Post-Install: System

Optimize journald

Rewrites /etc/systemd/journald.conf with sane defaults so the systemd journal can't slowly eat your root partition, then restarts systemd-journald and vacuums existing logs.

Key values

• Storage=persistent — keep logs on disk across reboots.
• SystemMaxUse=64M / RuntimeMaxUse=60M — hard caps on journal disk/memory usage.
• Compress=yes, Seal=no — compress logs, skip forward-secure sealing (saves CPU).
• MaxLevelStore=info — store info and above (required for ProxMenux Monitor's log viewer and for Fail2Ban to detect SSH/Proxmox auth failures from the journal).
• Rate-limits: 1000 events / 30 s to prevent log flooding.
• ForwardToSyslog=no, ForwardToWall=no — don't duplicate messages to syslog or broadcast to consoles.

Optimize logrotate

Rewrites /etc/logrotate.conf with a tighter policy suitable for a host that's also part of an SSD-protecting Log2RAM setup: daily rotation, 7-day retention, 10 MB size trigger, compression, and copytruncate so active services keep writing without reopening their log files. Original logrotate.conf is backed up to .bak on first apply.

# /etc/logrotate.conf — ProxMenux-optimized
daily
su root adm
rotate 7
create
compress
size 10M
delaycompress
copytruncate

include /etc/logrotate.d

Increase various system limits

Raises a bunch of kernel, systemd and PAM limits that default to values too low for a host running many VMs, containers and networked services.

Optimize memory settings

Writes a balanced sysctl profile to /etc/sysctl.d/99-memory.conf. Designed for a hypervisor host — prefers keeping VM working sets in RAM and frees pages proactively so allocation bursts don't stall.

# /etc/sysctl.d/99-memory.conf
vm.swappiness = 10               # Avoid swapping unless truly necessary
vm.dirty_ratio = 15              # Start writeback sooner (default 20)
vm.dirty_background_ratio = 5    # Start async writeback earlier (default 10)
vm.overcommit_memory = 1         # Allow overcommit (needed by many applications)
vm.max_map_count = 262144        # Enough for modern apps (ES, Docker, some games)
vm.compaction_proactiveness = 20 # Only on kernels that support it

Enable fast reboots (kexec)

Installs kexec-tools and wires it up so you can reboot the host straight into a new kernel without going through BIOS/UEFI firmware. On big servers where POST takes 45 – 90 seconds, this turns a reboot from a coffee break into a few seconds of downtime.

What ProxMenux installs

• Package kexec-tools (with debconf pre-answered so apt doesn't prompt during install).
• Systemd unit /etc/systemd/system/kexec-pve.service — loads the Proxmox kernel and initrd into memory at boot, reusing the current cmdline.
• An alias in /root/.bash_profile: reboot-quick → systemctl kexec.

Usage after the next reboot (or manual systemctl start kexec-pve):

reboot-quick           # kexec into the already-loaded kernel
# Equivalent:
systemctl kexec

Enable restart on kernel panic

Makes the kernel auto-reboot instead of sitting forever on a panic screen. Critical on headless/remote Proxmox hosts where a hung kernel means all your VMs are down until you can power-cycle the box.

# /etc/sysctl.d/99-kernelpanic.conf
kernel.core_pattern = /var/crash/core.%t.%p   # where to drop core dumps
kernel.panic = 10                             # reboot 10s after a panic
kernel.panic_on_oops = 1                      # oops → treated as panic
kernel.hardlockup_panic = 1                   # hard lockup → panic → reboot

Verification

After applying the System optimizations:

# journald: actual size in use and limit
journalctl --disk-usage

# logrotate: check config is active (no errors)
logrotate -d /etc/logrotate.conf 2>&1 | head -20

# System limits: check a few effective values
sysctl fs.inotify.max_user_watches fs.file-max vm.swappiness vm.dirty_ratio
ulimit -n     # inside a new root shell

# kexec: service enabled
systemctl is-enabled kexec-pve

# kernel panic config
sysctl kernel.panic kernel.panic_on_oops kernel.hardlockup_panic

Related

• Useful System Commands — verify the changes (free -h, journalctl, ulimit -a).
• Performance — additional system-level tuning (pigz).
• Uninstall Optimizations — revert any of these changes.
• Customizable Post-Install — back to the parent menu.