Although I had noticed that the /etc/sysctl.conf file has not been read for awhile now in openSUSE, I did not consider the problem beyond the optional customizations I’ve been implementing. I now understand this to be a major issue with far reaching consequences.
This configuration file which was commonly used prior to systemd changes no longer is usable at all. There is a bugzilla thread discussing how to handle this problem, but for many Users, they cannot wait… They need a solution now (see below).
Scope of issue:**
For Upgraders, this file almost certainly contains entries. Apparently upgrading does <not> properly parse this file and convert entries so these entries remain but are invalid after upgrade.
For Everyone, this file ordinarily should be avoided for any customizations. There is a very large body of support documents on the Internet which describes making entries into this file, but those “Help” documents should now be considered invalid without modification.
Important Note: There is <something> that is currently being run whenever I run “zypper up” which likely is relying on settings in sysctl.conf, my current most likely candidate is libvirt (vm manager, vm install, etc). And, if this can happen in this specific situation of course it can happen in any other install/configure routine that might be calling sysctl.conf
Issue which led me to discover this is a significant problem:
Troubleshooting erratic virtual network bridge devices and the virtual networks they support, they would work for only about a day and then become useless.
- Verified bridge devices exist
- Verified bridge devices were placed in SUSE FW internal zone
- Verified bridge-nf scripts were set to disable
- Verified no other FW software was running despite a generic warning that popped up whenever running SUSE FW from YAST.
- verified IPTABLES rule enabling IP_FORWARDING is set correctly
The following set to zero
And, further discovery the following lines in my sysctl.conf
kernel.sysrq = 0
net.ipv4.ip_forward = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.forwarding = 0
Whenever a new bridge device is created by libvirt or YAST, typically it will work initially. But, sometimes with the next “zypper up” and almost certainly with the next boot, the bridge device will no longer forward packets. The possibilities are myriad on my machine what might be happening so it’s very difficult to pinpoint exactly all possible causes although the current strong candidate is something related to libvirt(but notice that the consequences affects everything, not just libvirt).
Regardless of the possible causes, there seems to be a reliable solution!
For the past 3 days now, the fix I’ve implemented seems to be holding, am still testing the scope of the fix.
**1. Go “old school” **- Sysctl read and wrote to other files, it was simply a centralized management tool which preserved original settings while implementing custom and provided some fault tolerance(mistakes simply defaulted to original settings). With this method, although the original, default settings are lost, you can write into the original files. An example follows for the above settings which will likely be found in many if not all openSUSE:
The follwing script copies the original files to another location (you can modify) for backup
cp /proc/sys/kernel/sysrq /backup_original_before_sysctl/
cp /proc/sys/net/ipv4/ip_forward /backup_original_before_sysctl/
cp /proc/sys/net/ipv4/tcp_syncookies /backup_original_before_sysctl
cp /proc/sys/net/ipv6/conf/all/forwarding /backup_original_before_sysctl
The following script writes the sysctl.conf values into the original config files
echo 0 > /proc/sys/kernel/sysrq
echo 1 > /proc/sys/ipv4/ip_forward
echo 1 > /proc/sys/ipv4/tcp_syncookies
echo 0 > /proc/sys/ipv6/conf/all/forwarding
- The likely preferred method going forward is to use the systemd Unit systemd-sysctl.service
Unfortunately at this time I can’t find any existing templates or documentation how to properly write the dependency Units and the documented locations are empty. If anyone knows where this documentaiton can be found, pls post to this thread.
Will be submitting bugzilla(s) on this, but still considering how to frame this problem(s) because it involves many different components, and although the basic issue is the sysctl.conf file, the consequences are varied and far.