tunectl 1.0.0

package/tune-manifest.json

@@ -0,0 +1,993 @@
+{
+  "version": "1.0",
+  "generated": "2026-03-13",
+  "target_os": "Ubuntu 24.04 LTS",
+  "kernel": "6.8.0-101-generic",
+  "tuning_entries": [
+    {
+      "id": "SWAP-001",
+      "category": "swap",
+      "parameter": "vm.swappiness",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "60",
+      "after_value": "180",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Set to 180 for zram; zram compresses in RAM so high swappiness is beneficial. Use 60 if no zram."
+    },
+    {
+      "id": "SWAP-002",
+      "category": "swap",
+      "parameter": "vm.page-cluster",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "3",
+      "after_value": "0",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Set to 0 for zram (no readahead needed for compressed RAM swap). Use 3 if no zram."
+    },
+    {
+      "id": "SWAP-003",
+      "category": "swap",
+      "parameter": "vm.watermark_boost_factor",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "15000",
+      "after_value": "0",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Disables watermark boosting to reduce unnecessary reclaim with zram."
+    },
+    {
+      "id": "SWAP-004",
+      "category": "swap",
+      "parameter": "vm.watermark_scale_factor",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "10",
+      "after_value": "125",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Higher scale factor with zram to wake kswapd earlier. Scale proportionally on high-RAM systems."
+    },
+    {
+      "id": "SWAP-005",
+      "category": "swap",
+      "parameter": "/dev/zram0 swap device",
+      "config_file": "/etc/fstab",
+      "before_value": "not present",
+      "after_value": "/dev/zram0 none swap defaults,discard,pri=100,x-systemd.makefs 0 0",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "zram disksize set to 12G via udev rule. Scale disksize to ~1.5-2x RAM."
+    },
+    {
+      "id": "SWAP-006",
+      "category": "swap",
+      "parameter": "zram0 comp_algorithm",
+      "config_file": "/etc/udev/rules.d/99-zram.rules",
+      "before_value": "not configured",
+      "after_value": "lz4",
+      "risk": "none",
+      "requires_reboot": true,
+      "scaling_note": "lz4 is fastest. Use zstd for better ratio on memory-constrained systems."
+    },
+    {
+      "id": "SWAP-007",
+      "category": "swap",
+      "parameter": "zram0 disksize",
+      "config_file": "/etc/udev/rules.d/99-zram.rules",
+      "before_value": "not configured",
+      "after_value": "12G",
+      "risk": "low",
+      "requires_reboot": true,
+      "scaling_note": "Set to 1.5x physical RAM. For 8GB RAM use 12G; for 16GB use 24G; for 32GB use 48G."
+    },
+    {
+      "id": "SWAP-008",
+      "category": "swap",
+      "parameter": "zram kernel module boot load",
+      "config_file": "/etc/modules-load.d/zram.conf",
+      "before_value": "not loaded at boot",
+      "after_value": "zram",
+      "risk": "none",
+      "requires_reboot": true,
+      "scaling_note": null
+    },
+    {
+      "id": "SWAP-009",
+      "category": "swap",
+      "parameter": "zswap.enabled (boot param)",
+      "config_file": "/etc/default/grub",
+      "before_value": "Y (enabled)",
+      "after_value": "0 (disabled)",
+      "risk": "none",
+      "requires_reboot": true,
+      "scaling_note": "Disable zswap when using zram to avoid double-compression overhead."
+    },
+    {
+      "id": "MEM-001",
+      "category": "memory",
+      "parameter": "vm.dirty_ratio",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "20",
+      "after_value": "15",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Percentage of RAM. Lower value forces more frequent writeback, reducing data-loss window."
+    },
+    {
+      "id": "MEM-002",
+      "category": "memory",
+      "parameter": "vm.dirty_background_ratio",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "10",
+      "after_value": "3",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Percentage of RAM. Background writeback starts earlier to smooth I/O."
+    },
+    {
+      "id": "MEM-003",
+      "category": "memory",
+      "parameter": "vm.dirty_expire_centisecs",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "3000",
+      "after_value": "1500",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "MEM-004",
+      "category": "memory",
+      "parameter": "vm.dirty_writeback_centisecs",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "500",
+      "after_value": "200",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "MEM-005",
+      "category": "memory",
+      "parameter": "vm.vfs_cache_pressure",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "100",
+      "after_value": "50",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Lower = retain dentries/inodes longer. Good for repeated file access patterns."
+    },
+    {
+      "id": "MEM-006",
+      "category": "memory",
+      "parameter": "vm.min_free_kbytes",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "67584",
+      "after_value": "131072",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "128MB reserved. Scale: 128MB for 8GB RAM, 256MB for 16GB, 512MB for 64GB+."
+    },
+    {
+      "id": "MEM-007",
+      "category": "memory",
+      "parameter": "vm.overcommit_memory",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "0",
+      "after_value": "1",
+      "risk": "med",
+      "requires_reboot": false,
+      "scaling_note": "Always overcommit. Good for build workloads. Risk: OOM killer fires if physical memory exhausted."
+    },
+    {
+      "id": "MEM-008",
+      "category": "memory",
+      "parameter": "vm.max_map_count",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "65530",
+      "after_value": "2097152",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Required for large JVM heaps, Elasticsearch, and many-mmap workloads."
+    },
+    {
+      "id": "MEM-009",
+      "category": "memory",
+      "parameter": "vm.compaction_proactiveness",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "20",
+      "after_value": "30",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Slightly more proactive compaction to reduce THP allocation stalls."
+    },
+    {
+      "id": "MEM-010",
+      "category": "memory",
+      "parameter": "vm.numa_stat",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1",
+      "after_value": "0",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Disables per-NUMA zone stats. Reduces overhead on single-NUMA machines."
+    },
+    {
+      "id": "MEM-011",
+      "category": "memory",
+      "parameter": "vm.stat_interval",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1",
+      "after_value": "10",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Reduces vmstat update frequency. Monitoring tools may see staler data."
+    },
+    {
+      "id": "MEM-012",
+      "category": "memory",
+      "parameter": "transparent_hugepage/enabled",
+      "config_file": "/etc/tmpfiles.d/thp.conf",
+      "before_value": "madvise",
+      "after_value": "always",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Also set via boot param transparent_hugepage=always for earliest activation."
+    },
+    {
+      "id": "MEM-013",
+      "category": "memory",
+      "parameter": "transparent_hugepage/defrag",
+      "config_file": "/etc/tmpfiles.d/thp.conf",
+      "before_value": "madvise",
+      "after_value": "defer+madvise",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Defers defrag to khugepaged to avoid allocation stalls."
+    },
+    {
+      "id": "MEM-014",
+      "category": "memory",
+      "parameter": "transparent_hugepage/khugepaged/scan_sleep_millisecs",
+      "config_file": "/etc/tmpfiles.d/thp.conf",
+      "before_value": "10000",
+      "after_value": "10000",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Default value retained. Reduce to 1000 for more aggressive THP promotion."
+    },
+    {
+      "id": "MEM-015",
+      "category": "memory",
+      "parameter": "ksm/run",
+      "config_file": "/etc/tmpfiles.d/ksm.conf",
+      "before_value": "0",
+      "after_value": "1",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Enables KSM page merging. Uses some CPU for memory deduplication."
+    },
+    {
+      "id": "MEM-016",
+      "category": "memory",
+      "parameter": "ksm/pages_to_scan",
+      "config_file": "/etc/tmpfiles.d/ksm.conf",
+      "before_value": "100",
+      "after_value": "300",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "More pages scanned per sleep cycle. Increase on high-RAM systems with many duplicate pages."
+    },
+    {
+      "id": "MEM-017",
+      "category": "memory",
+      "parameter": "ksm/sleep_millisecs",
+      "config_file": "/etc/tmpfiles.d/ksm.conf",
+      "before_value": "200",
+      "after_value": "20",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Faster scan cycle. Uses more CPU. Increase to 100+ on CPU-constrained systems."
+    },
+    {
+      "id": "MEM-018",
+      "category": "memory",
+      "parameter": "ksm/use_zero_pages",
+      "config_file": "/etc/tmpfiles.d/ksm.conf",
+      "before_value": "0",
+      "after_value": "1",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Allows KSM to merge zero-filled pages. Saves RAM with no downside."
+    },
+    {
+      "id": "MEM-019",
+      "category": "memory",
+      "parameter": "LD_PRELOAD (jemalloc)",
+      "config_file": "/etc/environment",
+      "before_value": "not set",
+      "after_value": "/usr/lib/x86_64-linux-gnu/libjemalloc.so.2",
+      "risk": "med",
+      "requires_reboot": false,
+      "scaling_note": "Global allocator override. Improves fragmentation and multi-thread alloc. Some programs may behave differently."
+    },
+    {
+      "id": "CPU-001",
+      "category": "cpu",
+      "parameter": "kernel.sched_autogroup_enabled",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1",
+      "after_value": "0",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Disables autogroup scheduling for better server workload distribution. Re-enable for interactive desktop use."
+    },
+    {
+      "id": "CPU-002",
+      "category": "cpu",
+      "parameter": "kernel.sched_cfs_bandwidth_slice_us",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "5000",
+      "after_value": "10000",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Larger CFS bandwidth slice reduces scheduling overhead for cgroup-throttled tasks."
+    },
+    {
+      "id": "CPU-003",
+      "category": "cpu",
+      "parameter": "irqbalance service",
+      "config_file": "systemctl",
+      "before_value": "active",
+      "after_value": "active (kept)",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "IRQ balancing kept enabled for multi-core systems."
+    },
+    {
+      "id": "NET-001",
+      "category": "network",
+      "parameter": "net.core.rmem_max",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "212992",
+      "after_value": "16777216",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "16MB max receive buffer. Scale to 32MB+ for 10Gbps+ links."
+    },
+    {
+      "id": "NET-002",
+      "category": "network",
+      "parameter": "net.core.wmem_max",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "212992",
+      "after_value": "16777216",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "16MB max send buffer. Scale to 32MB+ for 10Gbps+ links."
+    },
+    {
+      "id": "NET-003",
+      "category": "network",
+      "parameter": "net.core.rmem_default",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "212992",
+      "after_value": "1048576",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "1MB default receive buffer."
+    },
+    {
+      "id": "NET-004",
+      "category": "network",
+      "parameter": "net.core.wmem_default",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "212992",
+      "after_value": "1048576",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "1MB default send buffer."
+    },
+    {
+      "id": "NET-005",
+      "category": "network",
+      "parameter": "net.core.netdev_max_backlog",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1000",
+      "after_value": "16384",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Increase for high-PPS workloads."
+    },
+    {
+      "id": "NET-006",
+      "category": "network",
+      "parameter": "net.core.somaxconn",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "4096",
+      "after_value": "65535",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Max listen queue. Important for high-connection-rate services."
+    },
+    {
+      "id": "NET-007",
+      "category": "network",
+      "parameter": "net.core.default_qdisc",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "fq_codel",
+      "after_value": "fq",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "fq (fair queue) pairs with BBR congestion control."
+    },
+    {
+      "id": "NET-008",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_max_syn_backlog",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "256",
+      "after_value": "8192",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Handles more half-open connections during SYN floods or burst traffic."
+    },
+    {
+      "id": "NET-009",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_max_tw_buckets",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "65536",
+      "after_value": "131072",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "More TIME_WAIT buckets for high-connection workloads."
+    },
+    {
+      "id": "NET-010",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_fin_timeout",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "60",
+      "after_value": "10",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Faster socket cleanup. May affect slow peers."
+    },
+    {
+      "id": "NET-011",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_keepalive_time",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "7200",
+      "after_value": "60",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Detect dead connections faster. 60s is aggressive but suitable for server workloads."
+    },
+    {
+      "id": "NET-012",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_keepalive_intvl",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "75",
+      "after_value": "10",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "NET-013",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_keepalive_probes",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "9",
+      "after_value": "6",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "NET-014",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_slow_start_after_idle",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1",
+      "after_value": "0",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Prevents congestion window reset on idle connections."
+    },
+    {
+      "id": "NET-015",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_tw_reuse",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "2",
+      "after_value": "1",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Reuse TIME_WAIT sockets for new outgoing connections."
+    },
+    {
+      "id": "NET-016",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_fastopen",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "1",
+      "after_value": "3",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Enable TFO for both client (1) and server (2) = 3. Requires application support."
+    },
+    {
+      "id": "NET-017",
+      "category": "network",
+      "parameter": "net.ipv4.ip_local_port_range",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "32768 60999",
+      "after_value": "1024 65535",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Expands ephemeral port range. Ensure no fixed services on ports 1024-32767."
+    },
+    {
+      "id": "NET-018",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_rmem",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "4096 131072 6291456",
+      "after_value": "4096 1048576 16777216",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Per-socket TCP receive buffer: min 4KB, default 1MB, max 16MB."
+    },
+    {
+      "id": "NET-019",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_wmem",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "4096 16384 4194304",
+      "after_value": "4096 1048576 16777216",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Per-socket TCP send buffer: min 4KB, default 1MB, max 16MB."
+    },
+    {
+      "id": "NET-020",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_congestion_control",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "cubic",
+      "after_value": "bbr",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "BBR provides better throughput on lossy links. Requires tcp_bbr module."
+    },
+    {
+      "id": "NET-021",
+      "category": "network",
+      "parameter": "net.ipv4.tcp_mtu_probing",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "0",
+      "after_value": "1",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Enables PMTU discovery to handle ICMP black holes."
+    },
+    {
+      "id": "NET-022",
+      "category": "network",
+      "parameter": "tcp_bbr kernel module boot load",
+      "config_file": "/etc/modules-load.d/tcp_bbr.conf",
+      "before_value": "not loaded at boot",
+      "after_value": "tcp_bbr",
+      "risk": "none",
+      "requires_reboot": true,
+      "scaling_note": null
+    },
+    {
+      "id": "FS-001",
+      "category": "filesystem",
+      "parameter": "root mount: noatime",
+      "config_file": "/etc/fstab",
+      "before_value": "defaults (relatime)",
+      "after_value": "noatime",
+      "risk": "low",
+      "requires_reboot": true,
+      "scaling_note": "Eliminates atime updates on every read. Some mail servers need relatime."
+    },
+    {
+      "id": "FS-002",
+      "category": "filesystem",
+      "parameter": "root mount: commit interval",
+      "config_file": "/etc/fstab",
+      "before_value": "5 (seconds)",
+      "after_value": "60 (seconds)",
+      "risk": "med",
+      "requires_reboot": true,
+      "scaling_note": "Delays journal commits to 60s. Risk: up to 60s of data loss on crash. Reduce to 30 for safer balance."
+    },
+    {
+      "id": "FS-003",
+      "category": "filesystem",
+      "parameter": "/tmp as tmpfs",
+      "config_file": "/etc/fstab",
+      "before_value": "on-disk (part of root)",
+      "after_value": "tmpfs /tmp tmpfs defaults,noatime,size=4G 0 0",
+      "risk": "low",
+      "requires_reboot": true,
+      "scaling_note": "4GB tmpfs. Scale size to ~50% of RAM. May OOM if /tmp fills up."
+    },
+    {
+      "id": "FS-004",
+      "category": "filesystem",
+      "parameter": "I/O scheduler for vda",
+      "config_file": "/etc/udev/rules.d/60-io-tuning.rules",
+      "before_value": "mq-deadline",
+      "after_value": "none",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "No scheduler overhead for NVMe/virtio SSDs. Use mq-deadline for spinning disks."
+    },
+    {
+      "id": "FS-005",
+      "category": "filesystem",
+      "parameter": "read_ahead_kb for vda",
+      "config_file": "/etc/udev/rules.d/60-io-tuning.rules",
+      "before_value": "128",
+      "after_value": "1024",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "1024KB readahead for SSDs. Increase for sequential workloads; decrease for random I/O."
+    },
+    {
+      "id": "FS-006",
+      "category": "filesystem",
+      "parameter": "fs.inotify.max_user_watches",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "65536",
+      "after_value": "524288",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Each watch uses ~1KB kernel memory. 524288 watches \u2248 512MB. Scale with available RAM."
+    },
+    {
+      "id": "FS-007",
+      "category": "filesystem",
+      "parameter": "fs.inotify.max_user_instances",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "128",
+      "after_value": "1024",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "FS-008",
+      "category": "filesystem",
+      "parameter": "fs.aio-max-nr",
+      "config_file": "/etc/sysctl.d/99-performance.conf",
+      "before_value": "65536",
+      "after_value": "1048576",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Max AIO requests system-wide. Required for databases and high-IOPS workloads."
+    },
+    {
+      "id": "SVC-001",
+      "category": "services",
+      "parameter": "ModemManager.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "No modem hardware on servers."
+    },
+    {
+      "id": "SVC-002",
+      "category": "services",
+      "parameter": "snapd.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Re-enable if snap packages are needed."
+    },
+    {
+      "id": "SVC-003",
+      "category": "services",
+      "parameter": "snapd.socket",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Must be disabled alongside snapd.service."
+    },
+    {
+      "id": "SVC-004",
+      "category": "services",
+      "parameter": "udisks2.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Disk management daemon. Not needed on headless servers."
+    },
+    {
+      "id": "SVC-005",
+      "category": "services",
+      "parameter": "multipathd.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Re-enable for SAN/multipath storage configurations."
+    },
+    {
+      "id": "SVC-006",
+      "category": "services",
+      "parameter": "open-iscsi.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Re-enable if iSCSI storage is used."
+    },
+    {
+      "id": "SVC-007",
+      "category": "services",
+      "parameter": "open-vm-tools.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Re-enable on VMware virtual machines."
+    },
+    {
+      "id": "SVC-008",
+      "category": "services",
+      "parameter": "lvm2-monitor.service",
+      "config_file": "systemctl disable/mask",
+      "before_value": "enabled",
+      "after_value": "disabled/masked",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Re-enable if LVM volumes are used."
+    },
+    {
+      "id": "CGRP-001",
+      "category": "cgroup",
+      "parameter": "droid.slice CPUWeight",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "800",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "High-priority slice for droid workloads. Range: 1-10000."
+    },
+    {
+      "id": "CGRP-002",
+      "category": "cgroup",
+      "parameter": "droid.slice MemoryHigh",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "5G",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Scale to ~60% of RAM. For 16GB use 10G, for 32GB use 20G."
+    },
+    {
+      "id": "CGRP-003",
+      "category": "cgroup",
+      "parameter": "droid.slice IOWeight",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "500",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "CGRP-004",
+      "category": "cgroup",
+      "parameter": "droid.slice ManagedOOMSwap",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "kill",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "systemd-oomd kills processes in this slice when swap is exhausted."
+    },
+    {
+      "id": "CGRP-005",
+      "category": "cgroup",
+      "parameter": "droid.slice ManagedOOMMemoryPressure",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "kill",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "CGRP-006",
+      "category": "cgroup",
+      "parameter": "droid.slice ManagedOOMMemoryPressureLimit",
+      "config_file": "/etc/systemd/system/droid.slice",
+      "before_value": "not present",
+      "after_value": "80%",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "CGRP-007",
+      "category": "cgroup",
+      "parameter": "bulk.slice CPUWeight",
+      "config_file": "/etc/systemd/system/bulk.slice",
+      "before_value": "not present",
+      "after_value": "100",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Low-priority slice for bulk/background work."
+    },
+    {
+      "id": "CGRP-008",
+      "category": "cgroup",
+      "parameter": "bulk.slice MemoryHigh",
+      "config_file": "/etc/systemd/system/bulk.slice",
+      "before_value": "not present",
+      "after_value": "3G",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Scale to ~35% of RAM. For 16GB use 6G, for 32GB use 12G."
+    },
+    {
+      "id": "CGRP-009",
+      "category": "cgroup",
+      "parameter": "bulk.slice IOWeight",
+      "config_file": "/etc/systemd/system/bulk.slice",
+      "before_value": "not present",
+      "after_value": "100",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": null
+    },
+    {
+      "id": "CGRP-010",
+      "category": "cgroup",
+      "parameter": "run-in-droid OOMScoreAdjust",
+      "config_file": "/usr/local/bin/run-in-droid",
+      "before_value": "not present",
+      "after_value": "-500",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Protects droid processes from OOM killer. Range: -1000 to 1000."
+    },
+    {
+      "id": "CGRP-011",
+      "category": "cgroup",
+      "parameter": "run-in-bulk OOMScoreAdjust",
+      "config_file": "/usr/local/bin/run-in-bulk",
+      "before_value": "not present",
+      "after_value": "500",
+      "risk": "low",
+      "requires_reboot": false,
+      "scaling_note": "Bulk processes are OOM-expendable (killed before droid processes)."
+    },
+    {
+      "id": "BOOT-001",
+      "category": "boot",
+      "parameter": "mitigations (kernel cmdline)",
+      "config_file": "/etc/default/grub",
+      "before_value": "auto",
+      "after_value": "auto,nosmt",
+      "risk": "med",
+      "requires_reboot": true,
+      "scaling_note": "Disables SMT for security mitigations. Performance impact on multi-threaded workloads."
+    },
+    {
+      "id": "BOOT-002",
+      "category": "boot",
+      "parameter": "l1tf (kernel cmdline)",
+      "config_file": "/etc/default/grub",
+      "before_value": "flush (default)",
+      "after_value": "off",
+      "risk": "med",
+      "requires_reboot": true,
+      "scaling_note": "Disables L1TF mitigation. Security tradeoff for performance on pre-Cascade Lake CPUs."
+    },
+    {
+      "id": "BOOT-003",
+      "category": "boot",
+      "parameter": "tsx_async_abort (kernel cmdline)",
+      "config_file": "/etc/default/grub",
+      "before_value": "full (default)",
+      "after_value": "off",
+      "risk": "med",
+      "requires_reboot": true,
+      "scaling_note": "Disables TSX Async Abort mitigation. Security tradeoff for performance on Intel CPUs."
+    },
+    {
+      "id": "BOOT-004",
+      "category": "boot",
+      "parameter": "preempt (kernel cmdline)",
+      "config_file": "/etc/default/grub",
+      "before_value": "voluntary",
+      "after_value": "none",
+      "risk": "low",
+      "requires_reboot": true,
+      "scaling_note": "No preemption for maximum throughput. May increase latency for interactive tasks."
+    },
+    {
+      "id": "BOOT-005",
+      "category": "boot",
+      "parameter": "transparent_hugepage (kernel cmdline)",
+      "config_file": "/etc/default/grub",
+      "before_value": "madvise",
+      "after_value": "always",
+      "risk": "low",
+      "requires_reboot": true,
+      "scaling_note": "Enables THP at earliest boot stage. Complemented by tmpfiles.d/thp.conf."
+    },
+    {
+      "id": "BUILD-001",
+      "category": "memory",
+      "parameter": "RUSTC_WRAPPER",
+      "config_file": "/etc/environment",
+      "before_value": "not set",
+      "after_value": "sccache",
+      "risk": "none",
+      "requires_reboot": false,
+      "scaling_note": "Enables sccache as Rust compile cache. Requires sccache binary in PATH."
+    }
+  ],
+  "summary": {
+    "total_entries": 86,
+    "by_category": {
+      "swap": 9,
+      "memory": 20,
+      "cpu": 3,
+      "network": 22,
+      "filesystem": 8,
+      "services": 8,
+      "cgroup": 11,
+      "boot": 5
+    },
+    "by_risk": {
+      "none": 51,
+      "low": 29,
+      "med": 6
+    },
+    "requires_reboot_count": 12,
+    "config_files": [
+      "/etc/sysctl.d/99-performance.conf",
+      "/etc/fstab",
+      "/etc/default/grub",
+      "/etc/default/grub.d/50-cloudimg-settings.cfg",
+      "/etc/default/grub.d/51-legacy-ifnames.cfg",
+      "/etc/systemd/system/droid.slice",
+      "/etc/systemd/system/bulk.slice",
+      "/etc/modules-load.d/tcp_bbr.conf",
+      "/etc/modules-load.d/zram.conf",
+      "/etc/udev/rules.d/60-io-tuning.rules",
+      "/etc/udev/rules.d/99-zram.rules",
+      "/etc/tmpfiles.d/thp.conf",
+      "/etc/tmpfiles.d/ksm.conf",
+      "/etc/environment",
+      "/usr/local/bin/run-in-droid",
+      "/usr/local/bin/run-in-bulk",
+      "/usr/local/bin/server-audit"
+    ],
+    "audit_checks_in_server_audit": 113
+  }
+}