{
  "version": "1.0",
  "generated": "2026-03-13",
  "target_os": "Ubuntu 24.04 LTS",
  "kernel": "6.8.0-101-generic",
  "tuning_entries": [
    {
      "id": "SWAP-001",
      "category": "swap",
      "parameter": "vm.swappiness",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "60",
      "after_value": "180",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Set to 180 for zram; zram compresses in RAM so high swappiness is beneficial. Use 60 if no zram."
    },
    {
      "id": "SWAP-002",
      "category": "swap",
      "parameter": "vm.page-cluster",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "3",
      "after_value": "0",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Set to 0 for zram (no readahead needed for compressed RAM swap). Use 3 if no zram."
    },
    {
      "id": "SWAP-003",
      "category": "swap",
      "parameter": "vm.watermark_boost_factor",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "15000",
      "after_value": "0",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Disables watermark boosting to reduce unnecessary reclaim with zram."
    },
    {
      "id": "SWAP-004",
      "category": "swap",
      "parameter": "vm.watermark_scale_factor",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "10",
      "after_value": "125",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Higher scale factor with zram to wake kswapd earlier. Scale proportionally on high-RAM systems."
    },
    {
      "id": "SWAP-005",
      "category": "swap",
      "parameter": "/dev/zram0 swap device",
      "config_file": "/etc/fstab",
      "before_value": "not present",
      "after_value": "/dev/zram0 none swap defaults,discard,pri=100,x-systemd.makefs 0 0",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "zram disksize set to 12G via udev rule. Scale disksize to ~1.5-2x RAM."
    },
    {
      "id": "SWAP-006",
      "category": "swap",
      "parameter": "zram0 comp_algorithm",
      "config_file": "/etc/udev/rules.d/99-zram.rules",
      "before_value": "not configured",
      "after_value": "lz4",
      "risk": "none",
      "requires_reboot": true,
      "scaling_note": "lz4 is fastest. Use zstd for better ratio on memory-constrained systems."
    },
    {
      "id": "SWAP-007",
      "category": "swap",
      "parameter": "zram0 disksize",
      "config_file": "/etc/udev/rules.d/99-zram.rules",
      "before_value": "not configured",
      "after_value": "12G",
      "risk": "low",
      "requires_reboot": true,
      "scaling_note": "Set to 1.5x physical RAM. For 8GB RAM use 12G; for 16GB use 24G; for 32GB use 48G."
    },
    {
      "id": "SWAP-008",
      "category": "swap",
      "parameter": "zram kernel module boot load",
      "config_file": "/etc/modules-load.d/zram.conf",
      "before_value": "not loaded at boot",
      "after_value": "zram",
      "risk": "none",
      "requires_reboot": true,
      "scaling_note": null
    },
    {
      "id": "SWAP-009",
      "category": "swap",
      "parameter": "zswap.enabled (boot param)",
      "config_file": "/etc/default/grub",
      "before_value": "Y (enabled)",
      "after_value": "0 (disabled)",
      "risk": "none",
      "requires_reboot": true,
      "scaling_note": "Disable zswap when using zram to avoid double-compression overhead."
    },
    {
      "id": "MEM-001",
      "category": "memory",
      "parameter": "vm.dirty_ratio",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "20",
      "after_value": "15",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Percentage of RAM. Lower value forces more frequent writeback, reducing data-loss window."
    },
    {
      "id": "MEM-002",
      "category": "memory",
      "parameter": "vm.dirty_background_ratio",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "10",
      "after_value": "3",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Percentage of RAM. Background writeback starts earlier to smooth I/O."
    },
    {
      "id": "MEM-003",
      "category": "memory",
      "parameter": "vm.dirty_expire_centisecs",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "3000",
      "after_value": "1500",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "MEM-004",
      "category": "memory",
      "parameter": "vm.dirty_writeback_centisecs",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "500",
      "after_value": "200",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "MEM-005",
      "category": "memory",
      "parameter": "vm.vfs_cache_pressure",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "100",
      "after_value": "50",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Lower = retain dentries/inodes longer. Good for repeated file access patterns."
    },
    {
      "id": "MEM-006",
      "category": "memory",
      "parameter": "vm.min_free_kbytes",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "67584",
      "after_value": "131072",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "128MB reserved. Scale: 128MB for 8GB RAM, 256MB for 16GB, 512MB for 64GB+."
    },
    {
      "id": "MEM-007",
      "category": "memory",
      "parameter": "vm.overcommit_memory",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "0",
      "after_value": "1",
      "risk": "med",
      "requires_reboot": false,
      "scaling_note": "Always overcommit. Good for build workloads. Risk: OOM killer fires if physical memory exhausted."
    },
    {
      "id": "MEM-008",
      "category": "memory",
      "parameter": "vm.max_map_count",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "65530",
      "after_value": "2097152",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Required for large JVM heaps, Elasticsearch, and many-mmap workloads."
    },
    {
      "id": "MEM-009",
      "category": "memory",
      "parameter": "vm.compaction_proactiveness",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "20",
      "after_value": "30",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Slightly more proactive compaction to reduce THP allocation stalls."
    },
    {
      "id": "MEM-010",
      "category": "memory",
      "parameter": "vm.numa_stat",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1",
      "after_value": "0",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Disables per-NUMA zone stats. Reduces overhead on single-NUMA machines."
    },
    {
      "id": "MEM-011",
      "category": "memory",
      "parameter": "vm.stat_interval",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1",
      "after_value": "10",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Reduces vmstat update frequency. Monitoring tools may see staler data."
    },
    {
      "id": "MEM-012",
      "category": "memory",
      "parameter": "transparent_hugepage/enabled",
      "config_file": "/etc/tmpfiles.d/thp.conf",
      "before_value": "madvise",
      "after_value": "always",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Also set via boot param transparent_hugepage=always for earliest activation."
    },
    {
      "id": "MEM-013",
      "category": "memory",
      "parameter": "transparent_hugepage/defrag",
      "config_file": "/etc/tmpfiles.d/thp.conf",
      "before_value": "madvise",
      "after_value": "defer+madvise",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Defers defrag to khugepaged to avoid allocation stalls."
    },
    {
      "id": "MEM-014",
      "category": "memory",
      "parameter": "transparent_hugepage/khugepaged/scan_sleep_millisecs",
      "config_file": "/etc/tmpfiles.d/thp.conf",
      "before_value": "10000",
      "after_value": "10000",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Default value retained. Reduce to 1000 for more aggressive THP promotion."
    },
    {
      "id": "MEM-015",
      "category": "memory",
      "parameter": "ksm/run",
      "config_file": "/etc/tmpfiles.d/ksm.conf",
      "before_value": "0",
      "after_value": "1",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Enables KSM page merging. Uses some CPU for memory deduplication."
    },
    {
      "id": "MEM-016",
      "category": "memory",
      "parameter": "ksm/pages_to_scan",
      "config_file": "/etc/tmpfiles.d/ksm.conf",
      "before_value": "100",
      "after_value": "300",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "More pages scanned per sleep cycle. Increase on high-RAM systems with many duplicate pages."
    },
    {
      "id": "MEM-017",
      "category": "memory",
      "parameter": "ksm/sleep_millisecs",
      "config_file": "/etc/tmpfiles.d/ksm.conf",
      "before_value": "200",
      "after_value": "20",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Faster scan cycle. Uses more CPU. Increase to 100+ on CPU-constrained systems."
    },
    {
      "id": "MEM-018",
      "category": "memory",
      "parameter": "ksm/use_zero_pages",
      "config_file": "/etc/tmpfiles.d/ksm.conf",
      "before_value": "0",
      "after_value": "1",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Allows KSM to merge zero-filled pages. Saves RAM with no downside."
    },
    {
      "id": "MEM-019",
      "category": "memory",
      "parameter": "LD_PRELOAD (jemalloc)",
      "config_file": "/etc/environment",
      "before_value": "not set",
      "after_value": "/usr/lib/x86_64-linux-gnu/libjemalloc.so.2",
      "risk": "med",
      "requires_reboot": false,
      "scaling_note": "Global allocator override. Improves fragmentation and multi-thread alloc. Some programs may behave differently."
    },
    {
      "id": "CPU-001",
      "category": "cpu",
      "parameter": "kernel.sched_autogroup_enabled",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1",
      "after_value": "0",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Disables autogroup scheduling for better server workload distribution. Re-enable for interactive desktop use."
    },
    {
      "id": "CPU-002",
      "category": "cpu",
      "parameter": "kernel.sched_cfs_bandwidth_slice_us",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "5000",
      "after_value": "10000",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Larger CFS bandwidth slice reduces scheduling overhead for cgroup-throttled tasks."
    },
    {
      "id": "CPU-003",
      "category": "cpu",
      "parameter": "irqbalance service",
      "config_file": "systemctl",
      "before_value": "active",
      "after_value": "active (kept)",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "IRQ balancing kept enabled for multi-core systems."
    },
    {
      "id": "NET-001",
      "category": "network",
      "parameter": "net.core.rmem_max",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "212992",
      "after_value": "16777216",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "16MB max receive buffer. Scale to 32MB+ for 10Gbps+ links."
    },
    {
      "id": "NET-002",
      "category": "network",
      "parameter": "net.core.wmem_max",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "212992",
      "after_value": "16777216",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "16MB max send buffer. Scale to 32MB+ for 10Gbps+ links."
    },
    {
      "id": "NET-003",
      "category": "network",
      "parameter": "net.core.rmem_default",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "212992",
      "after_value": "1048576",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "1MB default receive buffer."
    },
    {
      "id": "NET-004",
      "category": "network",
      "parameter": "net.core.wmem_default",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "212992",
      "after_value": "1048576",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "1MB default send buffer."
    },
    {
      "id": "NET-005",
      "category": "network",
      "parameter": "net.core.netdev_max_backlog",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1000",
      "after_value": "16384",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Increase for high-PPS workloads."
    },
    {
      "id": "NET-006",
      "category": "network",
      "parameter": "net.core.somaxconn",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "4096",
      "after_value": "65535",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Max listen queue. Important for high-connection-rate services."
    },
    {
      "id": "NET-007",
      "category": "network",
      "parameter": "net.core.default_qdisc",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "fq_codel",
      "after_value": "fq",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "fq (fair queue) pairs with BBR congestion control."
    },
    {
      "id": "NET-008",
      "category": "network",
      "parameter": "net.ipv4.tcp_max_syn_backlog",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "256",
      "after_value": "8192",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Handles more half-open connections during SYN floods or burst traffic."
    },
    {
      "id": "NET-009",
      "category": "network",
      "parameter": "net.ipv4.tcp_max_tw_buckets",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "65536",
      "after_value": "131072",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "More TIME_WAIT buckets for high-connection workloads."
    },
    {
      "id": "NET-010",
      "category": "network",
      "parameter": "net.ipv4.tcp_fin_timeout",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "60",
      "after_value": "10",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Faster socket cleanup. May affect slow peers."
    },
    {
      "id": "NET-011",
      "category": "network",
      "parameter": "net.ipv4.tcp_keepalive_time",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "7200",
      "after_value": "60",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Detect dead connections faster. 60s is aggressive but suitable for server workloads."
    },
    {
      "id": "NET-012",
      "category": "network",
      "parameter": "net.ipv4.tcp_keepalive_intvl",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "75",
      "after_value": "10",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "NET-013",
      "category": "network",
      "parameter": "net.ipv4.tcp_keepalive_probes",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "9",
      "after_value": "6",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "NET-014",
      "category": "network",
      "parameter": "net.ipv4.tcp_slow_start_after_idle",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1",
      "after_value": "0",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Prevents congestion window reset on idle connections."
    },
    {
      "id": "NET-015",
      "category": "network",
      "parameter": "net.ipv4.tcp_tw_reuse",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "2",
      "after_value": "1",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Reuse TIME_WAIT sockets for new outgoing connections."
    },
    {
      "id": "NET-016",
      "category": "network",
      "parameter": "net.ipv4.tcp_fastopen",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "1",
      "after_value": "3",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Enable TFO for both client (1) and server (2) = 3. Requires application support."
    },
    {
      "id": "NET-017",
      "category": "network",
      "parameter": "net.ipv4.ip_local_port_range",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "32768 60999",
      "after_value": "1024 65535",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Expands ephemeral port range. Ensure no fixed services on ports 1024-32767."
    },
    {
      "id": "NET-018",
      "category": "network",
      "parameter": "net.ipv4.tcp_rmem",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "4096 131072 6291456",
      "after_value": "4096 1048576 16777216",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Per-socket TCP receive buffer: min 4KB, default 1MB, max 16MB."
    },
    {
      "id": "NET-019",
      "category": "network",
      "parameter": "net.ipv4.tcp_wmem",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "4096 16384 4194304",
      "after_value": "4096 1048576 16777216",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Per-socket TCP send buffer: min 4KB, default 1MB, max 16MB."
    },
    {
      "id": "NET-020",
      "category": "network",
      "parameter": "net.ipv4.tcp_congestion_control",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "cubic",
      "after_value": "bbr",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "BBR provides better throughput on lossy links. Requires tcp_bbr module."
    },
    {
      "id": "NET-021",
      "category": "network",
      "parameter": "net.ipv4.tcp_mtu_probing",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "0",
      "after_value": "1",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Enables PMTU discovery to handle ICMP black holes."
    },
    {
      "id": "NET-022",
      "category": "network",
      "parameter": "tcp_bbr kernel module boot load",
      "config_file": "/etc/modules-load.d/tcp_bbr.conf",
      "before_value": "not loaded at boot",
      "after_value": "tcp_bbr",
      "risk": "none",
      "requires_reboot": true,
      "scaling_note": null
    },
    {
      "id": "FS-001",
      "category": "filesystem",
      "parameter": "root mount: noatime",
      "config_file": "/etc/fstab",
      "before_value": "defaults (relatime)",
      "after_value": "noatime",
      "risk": "low",
      "requires_reboot": true,
      "scaling_note": "Eliminates atime updates on every read. Some mail servers need relatime."
    },
    {
      "id": "FS-002",
      "category": "filesystem",
      "parameter": "root mount: commit interval",
      "config_file": "/etc/fstab",
      "before_value": "5 (seconds)",
      "after_value": "60 (seconds)",
      "risk": "med",
      "requires_reboot": true,
      "scaling_note": "Delays journal commits to 60s. Risk: up to 60s of data loss on crash. Reduce to 30 for safer balance."
    },
    {
      "id": "FS-003",
      "category": "filesystem",
      "parameter": "/tmp as tmpfs",
      "config_file": "/etc/fstab",
      "before_value": "on-disk (part of root)",
      "after_value": "tmpfs /tmp tmpfs defaults,noatime,size=4G 0 0",
      "risk": "low",
      "requires_reboot": true,
      "scaling_note": "4GB tmpfs. Scale size to ~50% of RAM. May OOM if /tmp fills up."
    },
    {
      "id": "FS-004",
      "category": "filesystem",
      "parameter": "I/O scheduler for vda",
      "config_file": "/etc/udev/rules.d/60-io-tuning.rules",
      "before_value": "mq-deadline",
      "after_value": "none",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "No scheduler overhead for NVMe/virtio SSDs. Use mq-deadline for spinning disks."
    },
    {
      "id": "FS-005",
      "category": "filesystem",
      "parameter": "read_ahead_kb for vda",
      "config_file": "/etc/udev/rules.d/60-io-tuning.rules",
      "before_value": "128",
      "after_value": "1024",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "1024KB readahead for SSDs. Increase for sequential workloads; decrease for random I/O."
    },
    {
      "id": "FS-006",
      "category": "filesystem",
      "parameter": "fs.inotify.max_user_watches",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "65536",
      "after_value": "524288",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Each watch uses ~1KB kernel memory. 524288 watches \u2248 512MB. Scale with available RAM."
    },
    {
      "id": "FS-007",
      "category": "filesystem",
      "parameter": "fs.inotify.max_user_instances",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "128",
      "after_value": "1024",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "FS-008",
      "category": "filesystem",
      "parameter": "fs.aio-max-nr",
      "config_file": "/etc/sysctl.d/99-performance.conf",
      "before_value": "65536",
      "after_value": "1048576",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Max AIO requests system-wide. Required for databases and high-IOPS workloads."
    },
    {
      "id": "SVC-001",
      "category": "services",
      "parameter": "ModemManager.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "No modem hardware on servers."
    },
    {
      "id": "SVC-002",
      "category": "services",
      "parameter": "snapd.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Re-enable if snap packages are needed."
    },
    {
      "id": "SVC-003",
      "category": "services",
      "parameter": "snapd.socket",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Must be disabled alongside snapd.service."
    },
    {
      "id": "SVC-004",
      "category": "services",
      "parameter": "udisks2.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Disk management daemon. Not needed on headless servers."
    },
    {
      "id": "SVC-005",
      "category": "services",
      "parameter": "multipathd.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Re-enable for SAN/multipath storage configurations."
    },
    {
      "id": "SVC-006",
      "category": "services",
      "parameter": "open-iscsi.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Re-enable if iSCSI storage is used."
    },
    {
      "id": "SVC-007",
      "category": "services",
      "parameter": "open-vm-tools.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Re-enable on VMware virtual machines."
    },
    {
      "id": "SVC-008",
      "category": "services",
      "parameter": "lvm2-monitor.service",
      "config_file": "systemctl disable/mask",
      "before_value": "enabled",
      "after_value": "disabled/masked",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Re-enable if LVM volumes are used."
    },
    {
      "id": "CGRP-001",
      "category": "cgroup",
      "parameter": "droid.slice CPUWeight",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "800",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "High-priority slice for droid workloads. Range: 1-10000."
    },
    {
      "id": "CGRP-002",
      "category": "cgroup",
      "parameter": "droid.slice MemoryHigh",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "5G",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Scale to ~60% of RAM. For 16GB use 10G, for 32GB use 20G."
    },
    {
      "id": "CGRP-003",
      "category": "cgroup",
      "parameter": "droid.slice IOWeight",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "500",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "CGRP-004",
      "category": "cgroup",
      "parameter": "droid.slice ManagedOOMSwap",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "kill",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "systemd-oomd kills processes in this slice when swap is exhausted."
    },
    {
      "id": "CGRP-005",
      "category": "cgroup",
      "parameter": "droid.slice ManagedOOMMemoryPressure",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "kill",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "CGRP-006",
      "category": "cgroup",
      "parameter": "droid.slice ManagedOOMMemoryPressureLimit",
      "config_file": "/etc/systemd/system/droid.slice",
      "before_value": "not present",
      "after_value": "80%",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "CGRP-007",
      "category": "cgroup",
      "parameter": "bulk.slice CPUWeight",
      "config_file": "/etc/systemd/system/bulk.slice",
      "before_value": "not present",
      "after_value": "100",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Low-priority slice for bulk/background work."
    },
    {
      "id": "CGRP-008",
      "category": "cgroup",
      "parameter": "bulk.slice MemoryHigh",
      "config_file": "/etc/systemd/system/bulk.slice",
      "before_value": "not present",
      "after_value": "3G",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Scale to ~35% of RAM. For 16GB use 6G, for 32GB use 12G."
    },
    {
      "id": "CGRP-009",
      "category": "cgroup",
      "parameter": "bulk.slice IOWeight",
      "config_file": "/etc/systemd/system/bulk.slice",
      "before_value": "not present",
      "after_value": "100",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": null
    },
    {
      "id": "CGRP-010",
      "category": "cgroup",
      "parameter": "run-in-droid OOMScoreAdjust",
      "config_file": "/usr/local/bin/run-in-droid",
      "before_value": "not present",
      "after_value": "-500",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Protects droid processes from OOM killer. Range: -1000 to 1000."
    },
    {
      "id": "CGRP-011",
      "category": "cgroup",
      "parameter": "run-in-bulk OOMScoreAdjust",
      "config_file": "/usr/local/bin/run-in-bulk",
      "before_value": "not present",
      "after_value": "500",
      "risk": "low",
      "requires_reboot": false,
      "scaling_note": "Bulk processes are OOM-expendable (killed before droid processes)."
    },
    {
      "id": "BOOT-001",
      "category": "boot",
      "parameter": "mitigations (kernel cmdline)",
      "config_file": "/etc/default/grub",
      "before_value": "auto",
      "after_value": "auto,nosmt",
      "risk": "med",
      "requires_reboot": true,
      "scaling_note": "Disables SMT for security mitigations. Performance impact on multi-threaded workloads."
    },
    {
      "id": "BOOT-002",
      "category": "boot",
      "parameter": "l1tf (kernel cmdline)",
      "config_file": "/etc/default/grub",
      "before_value": "flush (default)",
      "after_value": "off",
      "risk": "med",
      "requires_reboot": true,
      "scaling_note": "Disables L1TF mitigation. Security tradeoff for performance on pre-Cascade Lake CPUs."
    },
    {
      "id": "BOOT-003",
      "category": "boot",
      "parameter": "tsx_async_abort (kernel cmdline)",
      "config_file": "/etc/default/grub",
      "before_value": "full (default)",
      "after_value": "off",
      "risk": "med",
      "requires_reboot": true,
      "scaling_note": "Disables TSX Async Abort mitigation. Security tradeoff for performance on Intel CPUs."
    },
    {
      "id": "BOOT-004",
      "category": "boot",
      "parameter": "preempt (kernel cmdline)",
      "config_file": "/etc/default/grub",
      "before_value": "voluntary",
      "after_value": "none",
      "risk": "low",
      "requires_reboot": true,
      "scaling_note": "No preemption for maximum throughput. May increase latency for interactive tasks."
    },
    {
      "id": "BOOT-005",
      "category": "boot",
      "parameter": "transparent_hugepage (kernel cmdline)",
      "config_file": "/etc/default/grub",
      "before_value": "madvise",
      "after_value": "always",
      "risk": "low",
      "requires_reboot": true,
      "scaling_note": "Enables THP at earliest boot stage. Complemented by tmpfiles.d/thp.conf."
    },
    {
      "id": "BUILD-001",
      "category": "memory",
      "parameter": "RUSTC_WRAPPER",
      "config_file": "/etc/environment",
      "before_value": "not set",
      "after_value": "sccache",
      "risk": "none",
      "requires_reboot": false,
      "scaling_note": "Enables sccache as Rust compile cache. Requires sccache binary in PATH."
    }
  ],
  "summary": {
    "total_entries": 86,
    "by_category": {
      "swap": 9,
      "memory": 20,
      "cpu": 3,
      "network": 22,
      "filesystem": 8,
      "services": 8,
      "cgroup": 11,
      "boot": 5
    },
    "by_risk": {
      "none": 51,
      "low": 29,
      "med": 6
    },
    "requires_reboot_count": 12,
    "config_files": [
      "/etc/sysctl.d/99-performance.conf",
      "/etc/fstab",
      "/etc/default/grub",
      "/etc/default/grub.d/50-cloudimg-settings.cfg",
      "/etc/default/grub.d/51-legacy-ifnames.cfg",
      "/etc/systemd/system/droid.slice",
      "/etc/systemd/system/bulk.slice",
      "/etc/modules-load.d/tcp_bbr.conf",
      "/etc/modules-load.d/zram.conf",
      "/etc/udev/rules.d/60-io-tuning.rules",
      "/etc/udev/rules.d/99-zram.rules",
      "/etc/tmpfiles.d/thp.conf",
      "/etc/tmpfiles.d/ksm.conf",
      "/etc/environment",
      "/usr/local/bin/run-in-droid",
      "/usr/local/bin/run-in-bulk",
      "/usr/local/bin/server-audit"
    ],
    "audit_checks_in_server_audit": 113
  }
}