Find out sysctl default values? (without rebooting)

Question

I have modified the value of net.core.rmem_max with sysctl, and now I would like to set it back to its default value.

If I reboot, net.core.rmem_max will go back to its default value (because it is not overridden in /etc/sysctl.conf), but can I know this value without rebooting?

Ideally I should have run sysctl net.core.rmem_max to read the value before modifying it, but I forgot...

Answer 1

This is not possible in general: the kernel does not retain the original values (at least under Linux it doesn't, and this is probably true of other unix variants). The value of the setting is stored in a variable; when you change the setting, the memory containing the variable is irreversibly updated.

For most settings, the initial value of the variable is a constant that is determined at compile time and stored in the kernel binary. So you could, in principle, inspect your kernel binary to find the default value. You would have to locate the symbol corresponding to the setting you're interested in, and follow the address of that symbol in the kernel binary. Booting your kernel in a virtual machine would be less work.

For most settings, you can look in the kernel source — kernel/sysctl.c and other files. You'll see definitions like

    {
            .procname       = "rmem_max",
            .data           = &sysctl_rmem_max,
            …
    },

(in net/core/sysctl_net_core.c), from which you can trace the initialization of the sysctl_rmem_max variable. While this one is initialized from a constant, it takes quite a bit of reading C code to expand.

Answer 2

On my OpenBSD machine, /etc/sysctl.conf lists a bunch of default sysctl values, but this list is not exhaustive.

Probably the best way is to read the sysctl code or ask a friend who is running the same OS for his values :)