A VPS with 65,535 ephemeral ports and high request churn runs out of four-tuples before it runs out of bandwidth, CPU or file descriptors. Every outbound connection from your nginx…
Read MoreAuditing SUID Binaries and File Capabilities on a VPS: Inventory, Removal and Drift Checks
A stock Debian 12 install has 13 files with the SUID bit set, and several are unneeded on a server: /usr/bin/su, /usr/bin/mount and /usr/bin/chsh are standard privilege-escalation footholds after a…
Read MoreMeasuring Page-Cache Hit Ratio on a VPS with vmtouch and cachestat
free -h showed 412 MB of 3.8 GB “available” on a web node also holding 610 MB of page cache for static assets — and could not say whether that…
Read Moreio_uring SQPOLL on a KVM Guest: When the Polling Thread Beats Interrupts, and When It Burns a Core
At 4 KiB random reads on a 4 vCPU KVM guest with 4 virtio-blk queues, io_uring without SQPOLL tops out near 92k IOPS while –sqthread_poll=1 reaches about 118k – a…
Read MoreEd25519 vs RSA on a Small VPS: Where SSH Handshake CPU Actually Goes
A TLS 1.3 handshake with an Ed25519 certificate costs about 11 µs of CPU on a modern server core. RSA-2048 signing costs roughly 90 µs, plus 35 µs for the…
Read Moresystemd Services That Die After a Reboot: journalctl and Ordering Diagnostics
A unit that starts fine when you type systemctl start and dies after a reboot has one of four causes, and each has a different fix. The efficient way to…
Read MoreInnoDB Buffer Pool vs Swap on a Small VPS: The Memory Arithmetic
The standard advice for MySQL on a small VPS is “set innodb_buffer_pool_size to 50–70% of RAM”. On a 1 GB instance that rule produces a 700 MB buffer pool, leaves roughly 60 MB…
Read MoreInstrumenting nginx Request Timing to Find Where p99 Latency Actually Comes From
A slow page is rarely one slow thing. It is a sum of intervals: time queued in the accept backlog, time waiting for a free PHP-FPM worker, time spent in…
Read Morejemalloc Arena and Decay Tuning for Redis and nginx on Memory-Constrained Instances
Long-running daemons on small instances accumulate memory that the allocator never returns to the kernel. The process RSS climbs for days while the application’s own live heap stays flat, and…
Read Morenftables Set Performance: Hash Sizing, Timeouts and the Cost of Linear Rules
nftables sets are the single biggest performance lever most firewall configurations never touch. A ruleset with 400 individual ip saddr matches evaluates linearly; the same 400 addresses placed in a…
Read More