VR

Linux Syscall Reference


Common Syscalls in Backend Engineering

SyscallCostDescriptionWhen it appears
read()~100–500nsRead from fd (returns if data ready, blocks otherwise)Every network recv, file read
write()~100–500nsWrite to fdEvery network send, log write
accept()~500ns–1μsAccept new connection from listen socketNew connection per request (no pool)
connect()~500ns + RTTInitiate TCP connectionNew connection creation
epoll_wait()~500nsWait for events on registered fdsEvent loop at rest
epoll_ctl()~500nsAdd/modify/remove fd from interest listOn every new connection (async server)
socket()~1μsCreate new socket fdConnection creation
close()~500nsClose fd + optional TCP teardownConnection close
fork()~1–5msCreate new processPostgreSQL: per connection
mmap()~1μsMap file/anonymous memory into address spaceBuffer pool creation
brk()/sbrk()~500nsExtend heapmalloc() for large allocations
futex()~50–200nsFast user-space mutex (contended case)Any mutex contention

Syscall Overhead with Security Mitigations

Post-Spectre/Meltdown (2018), syscalls are more expensive due to KPTI (Kernel Page Table Isolation):

Pre-KPTI syscall:  ~100ns
Post-KPTI syscall: ~200-500ns (TLB flush on every syscall boundary)

At 1M syscalls/second: 200ms CPU overhead from syscalls alone
→ Batching and buffering reduce syscall count
→ io_uring (Linux 5.1+) enables async syscalls with reduced overhead

TCP Socket Tuning Parameters

# View current settings
sysctl net.ipv4.tcp_keepalive_time       # default: 7200 (2 hours)
sysctl net.ipv4.tcp_fin_timeout          # default: 60 seconds
sysctl net.core.somaxconn                # listen backlog (default: 128)
sysctl net.ipv4.ip_local_port_range      # ephemeral ports (default: 32768-60999)

# Tuning for high-connection-rate servers
sysctl -w net.ipv4.tcp_keepalive_time=300  # detect dead connections faster
sysctl -w net.core.somaxconn=65535         # larger accept queue
sysctl -w net.ipv4.ip_local_port_range="1024 65535"  # more ephemeral ports