| Tested on | Red Hat Enterprise Linux 10.2 (lab VM) |
|---|---|
| Package | sysctl from procps-ng 4.0.4 |
| Applies to | RHEL, Rocky Linux, AlmaLinux, CentOS Stream, Fedora, Ubuntu, Debian, and other GNU/Linux systems with procps-ng sysctl |
| Privilege | Normal user to read most keys; sudo to write values or load .conf files |
| Man page | sysctl(8) |
| Scope | Read and write kernel tunables under /proc/sys, script-friendly output flags, pattern filtering, and loading single sysctl files. Persistent drop-in layout and full reload workflows are covered in the companion reload guide. |
| Related guides | sysctl reload without reboot sysctl for high-performance servers systemctl command Linux commands cheat sheet |
sysctl — quick reference
Read values
Inspect what the running kernel is using before you change a tunable.
| When to use | Command |
|---|---|
| Read one parameter with name and value | sysctl net.ipv4.ip_forward |
| Print only the value (scripts) | sysctl -n net.ipv4.ip_forward |
| List every available tunable | sysctl -a |
Same as -a |
sysctl --all |
Read using a procfs-style path with / |
sysctl net/ipv4/ip_forward |
| Print parameter names without values | sysctl -N net.ipv4.ip_forward |
| Print value with no trailing newline | sysctl -b -n net.ipv4.ip_forward |
| Include deprecated keys in a full listing | sysctl --deprecated -a |
Write runtime values
Changes apply immediately but are lost on reboot unless saved in /etc/sysctl.d/.
| When to use | Command |
|---|---|
| Set a value until reboot | sudo sysctl -w net.ipv4.ip_forward=1 |
Set using variable=value without -w |
sudo sysctl net.ipv4.ip_forward=1 |
| Suppress the confirmation line | sudo sysctl -q -w net.ipv4.ip_forward=1 |
| Equivalent write through procfs | echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward |
Load from files
| When to use | Command |
|---|---|
| Apply one sysctl drop-in file | sudo sysctl -p /etc/sysctl.d/99-custom.conf |
Load /etc/sysctl.conf only (no path) |
sudo sysctl -p |
Long form of -p |
sudo sysctl --load=/etc/sysctl.d/99-custom.conf |
| Apply full configured sysctl stack | sudo sysctl --system |
| Preview a file without writing tunables | sysctl --dry-run -p /path/file.conf |
| Ignore unknown keys while loading (containers) | sudo sysctl -e -p /path/file.conf |
Search and filter
| When to use | Command |
|---|---|
| Filter the full list with extended regex | sysctl -ar 'net\.ipv4\.tcp_fin' |
| Pipe a long list to grep | sysctl -a | grep somaxconn |
Help and version
| When to use | Command |
|---|---|
| Built-in usage summary | sysctl --help |
| Print procps-ng version | sysctl --version |
sysctl — command syntax
Synopsis from sysctl --help on RHEL 10.2 (procps-ng 4.0.4):
sysctl [options] [variable[=value] ...]
Options:
-a, --all display all variables
-n, --values print only values of the given variable(s)
-p, --load[=<file>] read values from file
--system read values from all system directories
-w, --write enable writing a value to variable
-r, --pattern <expression>
select setting that match expression
-e, --ignore ignore unknown variables errors
--dry-run Print the key and values but do not writeKernel parameters live as files under /proc/sys/. Dotted names map to paths (net.ipv4.ip_forward → /proc/sys/net/ipv4/ip_forward). Persistent values belong in numbered files under /etc/sysctl.d/; vendor defaults ship in /usr/lib/sysctl.d/.
sysctl --system loads the configured sysctl.d directories according to procps-ng precedence rules and then reads /etc/sysctl.conf last. Plain sysctl -p with no filename loads only /etc/sysctl.conf — it does not walk /etc/sysctl.d/ on its own.
sysctl — command examples
Essential Read one kernel parameter
Capture the current value before you tune networking, VM, or filesystem behaviour.
Run the command:
sysctl net.ipv4.ip_forwardSample output:
net.ipv4.ip_forward = 1The same number is visible directly under procfs:
cat /proc/sys/net/ipv4/ip_forwardSample output:
1A value of 1 means the host may route IPv4 packets between interfaces; 0 disables forwarding.
Essential Print only the value with -n
Scripts and one-liners often need the number without the parameter name.
Run the command:
sysctl -n net.ipv4.ip_forwardSample output:
1Use -n inside $(...) or if tests so you compare integers instead of parsing name = value lines.
Essential Set a runtime value with sysctl -w
Change a tunable on a running system for a test. The value resets at reboot unless you also add a drop-in file.
Read the current setting first:
sysctl -n net.ipv4.tcp_fin_timeoutWrite a new runtime value:
sudo sysctl -w net.ipv4.tcp_fin_timeout=31Sample output:
net.ipv4.tcp_fin_timeout = 31Confirm the kernel accepted it:
sysctl -n net.ipv4.tcp_fin_timeoutSample output:
31Restore your site's normal value when the test ends, or reload from disk with sudo sysctl --system.
Common Use slash paths instead of dots
sysctl accepts / separators that mirror the procfs directory layout.
Run the command:
sysctl net/ipv4/ip_forwardSample output:
net.ipv4.ip_forward = 1Both dotted and slash forms address the same file under /proc/sys/.
Essential Apply settings from a sysctl file
Bulk-apply key = value lines from a file the way boot scripts do.
Create a lab file under /tmp (on production hosts use /etc/sysctl.d/):
printf 'net.ipv4.tcp_fin_timeout = 30\n' > /tmp/sysctl-lab.confLoad that file:
sudo sysctl -p /tmp/sysctl-lab.confSample output:
net.ipv4.tcp_fin_timeout = 30Verify:
sysctl -n net.ipv4.tcp_fin_timeoutSample output:
30Remove the lab file when finished: rm /tmp/sysctl-lab.conf, then run sudo sysctl --system to reapply on-disk defaults.
Common Filter tunables with -a -r
sysctl -a prints thousands of lines. Combine --all with --pattern to narrow the list.
Run the command:
sysctl -ar 'net\.ipv4\.tcp_fin'Sample output:
net.ipv4.tcp_fin_timeout = 30The pattern uses extended regular expression syntax. Escape dots when you match literal dotted names.
Common Preview a file with --dry-run
See which keys a file would touch before you apply it on a shared host. --dry-run does not write tunables, so you only need permission to read the configuration file.
Run the command:
sysctl --dry-run -p /tmp/sysctl-lab.confSample output:
net.ipv4.tcp_fin_timeout = 30--dry-run prints keys and values but does not write to /proc/sys/.
Common Skip unknown keys with -e
Container images and minimal kernels may lack some tunables referenced in a shared config file.
Request a key that does not exist without -e:
sysctl -n nonexistent.key.testSample output:
sysctl: cannot stat /proc/sys/nonexistent/key/test: No such file or directoryThe command exits with a non-zero status. Repeat with --ignore:
sysctl -e -n nonexistent.key.testsysctl -e suppresses the error and exits successfully when the only problem is a missing key.
Common Print parameter names with -N
Shell completion and wrapper scripts sometimes need names without values.
Run the command:
sysctl -N net.ipv4.ip_forward net.ipv6.conf.all.forwardingSample output:
net.ipv4.ip_forward
net.ipv6.conf.all.forwardingPass multiple keys on one line; sysctl prints one name per line.
Advanced Omit the trailing newline with -b
Binary-friendly scripts use -b so the value is not followed by \n.
Run the command:
sysctl -b -n net.ipv4.ip_forwardSample output:
1Pair -b with -n when another program reads the raw bytes from a pipe.
sysctl — when to use / when not
| Use sysctl when | Use something else when |
|---|---|
You need kernel tunables under /proc/sys/ |
You change service units — use systemctl |
| You want dotted names, file loading, or pattern filters | You only need one static proc file — cat /proc/sys/... |
You script reads with -n or bulk loads with -p |
You tune application daemons — edit the app's own config first |
You reload numbered drop-ins after editing /etc/sysctl.d/ |
You need a full persistence and reboot walkthrough — use the sysctl reload guide in Related guides |
sysctl vs writing /proc/sys directly
| sysctl | echo / tee on /proc/sys/... |
|
|---|---|---|
| Read one key | sysctl name or sysctl -n name |
cat /proc/sys/... |
| Write one key | sudo sysctl -w name=value |
echo value | sudo tee /proc/sys/... |
Load .conf files |
sysctl -p FILE or sysctl --system |
Not available |
| Pattern filter | sysctl -ar 'regex' |
Manual find / grep |
| Script-friendly output | -n, -N, -b, -q |
Parse cat output yourself |
Both paths change the same kernel knobs. sysctl adds file loading, filtering, and flags that make automation safer.
sysctl — interview corner
What does the sysctl command do?
sysctl is the user-space front end for kernel parameters exposed as files under /proc/sys/. Each dotted name (net.ipv4.ip_forward) maps to a procfs path (/proc/sys/net/ipv4/ip_forward).
You can read values, write temporary runtime values, and load key = value lines from .conf files. There is no long-running sysctl daemon — each invocation talks to procfs directly.
A strong answer is:
"sysctl reads and writes kernel tunables in /proc/sys. I use -n in scripts, -w for runtime tests, -p FILE for one drop-in, and --system for the full configured stack."
When do you use sysctl -n?
-n (or --values) prints only the value, not name = value. That keeps shell scripts simple:
if [ "$(sysctl -n net.ipv4.ip_forward)" -eq 1 ]; then ...
Without -n you would strip the label with awk or cut.
A strong answer is:
"-n gives me just the number or string — I use it anywhere a script branches on a kernel setting."
What is the difference between sysctl -w and sysctl name=value?
Both write forms set a runtime value when you have permission. -w forces every argument to be treated as a write operation and errors if parsing fails.
sudo sysctl net.ipv4.ip_forward=1 and sudo sysctl -w net.ipv4.ip_forward=1 achieve the same result on procps-ng 4.0.4.
A strong answer is:
"-w is explicit write mode; name=value is shorthand. Neither survives reboot unless I also add a file in /etc/sysctl.d/."
What is the difference between sysctl -p and sysctl --system?
-p FILE loads one specified sysctl file. If you omit the filename, procps-ng sysctl -p loads /etc/sysctl.conf. Use -p /etc/sysctl.d/99-custom.conf when you want to apply one drop-in file explicitly.
--system loads the configured sysctl.d directories according to procps-ng precedence rules and then reads /etc/sysctl.conf last. Use it when you want the complete on-disk stack reapplied.
A strong answer is:
"-p FILE for one file I just edited; --system when I want the complete configured sysctl stack reapplied."
How do you search sysctl parameters by name?
sysctl -a alone is huge. Combine all with pattern:
sysctl -ar 'net\.ipv4\.tcp'
The pattern is an extended regex matched against parameter names. For ad hoc greps, sysctl -a | grep keyword still works.
A strong answer is:
"I use sysctl -ar with a regex when I know the prefix; otherwise sysctl -a piped to grep for quick exploration."
Troubleshooting
| Symptom | Likely cause | What to try |
|---|---|---|
Permission denied on write |
Not root | Prefix with sudo |
cannot stat /proc/sys/... |
Typo or kernel lacks that tunable | sysctl -a | grep keyword; check docs for your kernel |
sysctl: no variables specified with -r |
Pattern used without -a |
Use sysctl -ar 'pattern' not sysctl -r alone |
Value unchanged after sysctl -p |
Wrong file or later drop-in overrides | grep -r KEY /etc/sysctl.d/ /usr/lib/sysctl.d/ |
| Setting reverts after reboot | Only used sysctl -w |
Add /etc/sysctl.d/99-custom.conf, then run sudo sysctl -p /etc/sysctl.d/99-custom.conf or sudo sysctl --system |
| Unknown key errors in containers | Tunable missing in namespace | sysctl -e -p file.conf to ignore missing keys |
