Ubuntu Server Kernel Tuning for High-Concurrency LEMP Web Servers (sysctl.conf & Limits)

Ubuntu Server Kernel Tuning for High-Concurrency LEMP Web Servers (`sysctl.conf` & Limits)

Author: Mir Alamin (Principal Web Architect) | Published: August 3, 2026 at 04:30 PM | Reading Time: 23 min read | Category: Performance | Tags: Ubuntu Server Tune, LEMP setup, Ubuntu Server Update, Web Server, Nginx Tune

Executive Summary

Default Linux kernel settings in Ubuntu 24.04 LTS are configured for general-purpose workloads, placing artificial bottlenecks on network socket allocation, TCP connection queues, and file descriptor limits. When a LEMP web server (Nginx, MariaDB, PHP-FPM) encounters traffic spikes exceeding 10,000 concurrent requests per second, un-tuned kernel parameters trigger packet drops, TCP: time wait bucket table overflow warnings, and server unresponsiveness.

This deep technical guide details tuning /etc/sysctl.conf, /etc/security/limits.conf, and systemd service descriptors to unlock maximum network throughput on Ubuntu enterprise web hosts.

1. Socket Queue & TCP Buffer Tuning in `/etc/sysctl.d/99-lemp-tuning.conf`

To handle high-volume TCP handshake establishment without dropping SYN packets:

# /etc/sysctl.d/99-lemp-tuning.conf

# Maximum socket receive/send queue buffers across all protocol layers
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144

# Increase max backlog connection queue length
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535

# TCP Memory Limits (min, default, max in memory pages)
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# Enable TCP Fast Open (TFO) & TCP Window Scaling
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_window_scaling = 1

# Reuse TIME_WAIT sockets for rapid connection recycling
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_max_tw_buckets = 2000000

# File Descriptors & System Limits
fs.file-max = 2097152

Apply parameters immediately:

sudo sysctl -p /etc/sysctl.d/99-lemp-tuning.conf

2. Hardening Open File Descriptor Limits (`/etc/security/limits.conf`)

By default, Ubuntu caps process open file descriptors at 1024. Nginx worker processes and MariaDB require significantly higher limits to maintain thousands of open socket files simultaneously.

# /etc/security/limits.conf
www-data soft nofile 65535
www-data hard nofile 65535
mysql    soft nofile 65535
mysql    hard nofile 65535
root     soft nofile 65535
root     hard nofile 65535

Systemd Service Override Limits:

Override limits explicitly for Nginx and PHP-FPM systemd daemons:

# /etc/systemd/system/nginx.service.d/override.conf
[Service]
LimitNOFILE=65535

# /etc/systemd/system/php8.3-fpm.service.d/override.conf
[Service]
LimitNOFILE=65535

Reload systemd and restart daemons:

sudo systemctl daemon-reload
sudo systemctl restart nginx php8.3-fpm

3. Kernel Performance Benchmarks

After applying kernel socket queue optimizations on a 32-core Ubuntu server under a 25,000 req/sec benchmark:

For professional kernel tuning and server infrastructure management:

🚀 Website Speed Optimization Services
⚙️ Managed Server Administration Plans
🔧 Website & Server Troubleshooting Services

4. Frequently Asked Questions (FAQ)

Q1: What does `net.core.somaxconn` do in Linux?

somaxconn sets the maximum socket listen backlog queue for incoming TCP connections before Nginx or PHP-FPM accept them. A higher value prevents dropped connection handshakes during rapid traffic surges.

Q2: Is setting `tcp_tw_reuse = 1` safe for HTTPS web traffic?

Yes, tcp_tw_reuse allows the kernel to safely reuse TIME_WAIT sockets for outbound or loopback TCP connections when financially and protocol-wise safe, drastically reducing socket exhaustion.

Mir Alamin