Home / Databases / Redis

DatabasesHow-toIntermediate

Redis standalone in production: persistence (RDB and AOF), memory policy, security and backups

Run a single Redis or Valkey node safely. Covers when standalone is enough, RDB vs AOF persistence, maxmemory and eviction policies, kernel settings, ACLs and TLS, backups, and the signs that you need replication.

Deepak Bhardwaj2 min read

Applies toRedis 7.x/8.x Open Source, Valkey 8.x on Linux

1. When standalone is enough

  • Caches where losing the data only means a cold start.
  • Dev, test and small internal tools.
  • Not enough for: sessions or queues that must survive a node loss. Use Sentinel, Redis Cluster or a managed service with replicas for those.

2. Persistence options

Mode Data loss on crash Restart time Notes
None Everything Instant Pure cache
RDB snapshots Since the last snapshot (minutes) Fast Compact files; fork() needs memory headroom
AOF everysec About 1 second Slower (replays the log) Rewritten in the background
RDB + AOF About 1 second AOF with an RDB preamble loads quickly Recommended when data matters 
# redis.conf
save 3600 1 300 100 60 10000
appendonly yes
appendfsync everysec
aof-use-rdb-preamble yes
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 1gb
dir /var/lib/redis

3. Memory

maxmemory 12gb                 # leave room for fork copy-on-write and the OS
maxmemory-policy allkeys-lru   # cache: evict any key
# maxmemory-policy noeviction  # data store: return errors instead of losing keys

Keep maxmemory at about 60–75% of RAM on hosts that persist data. A fork() for RDB or an AOF rewrite can briefly need extra memory for pages that change.

4. Kernel settings

sysctl -w vm.overcommit_memory=1
echo never > /sys/kernel/mm/transparent_hugepage/enabled
sysctl -w net.core.somaxconn=1024

Make them permanent in /etc/sysctl.d/ and a systemd unit for the THP setting.

5. Security

bind 10.20.3.15
protected-mode yes
port 0
tls-port 6380
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt
aclfile /etc/redis/users.acl
rename-command FLUSHALL ""
rename-command CONFIG ""

# users.acl
user default off
user app on >strong-password ~app:* +@read +@write -@dangerous
user ops on >another-password ~* +@all

Never expose Redis to the internet. Unprotected instances are scanned for and attacked within minutes.

6. Backups

  • Copy the RDB file (BGSAVE, wait until LASTSAVE changes, then copy dump.rdb) to object storage every few hours.
  • Test a restore: stop Redis, put dump.rdb in dir, start, and check DBSIZE.

7. Monitoring

redis-cli --tls -a ... INFO memory | grep -E 'used_memory_human|maxmemory_human|mem_fragmentation_ratio'
redis-cli --tls -a ... INFO persistence | grep -E 'rdb_last_bgsave_status|aof_last_write_status'
redis-cli --tls -a ... INFO stats | grep -E 'evicted_keys|rejected_connections'

Alert on failed persistence, memory > 90% of maxmemory, evictions on a noeviction workload, and latency spikes (LATENCY DOCTOR).

Tip

If you find yourself adding "restart Redis" to runbooks or worrying about losing sessions, you've outgrown standalone. Move to a primary with replicas plus Sentinel, or a managed service with Multi-AZ.

Related fixes