Audun Røe wrote:
Hey,
We're in the process of replacing an old Sun Directory Server 5.2
deployment. In our preliminary tests using FDS 1.1.0 (this was back in
Q2 2008 or so), we saw lots of "aci cache overflown" messages in the
log for some users, and performance would basically drop to
unacceptable levels. I previously posted about the issue to the
user-list in early May 2008, though in retrospect the mail probably
should've gone here. It's archived at
http://www.mailinglistarchive.com/fedora-directory-users@redhat.com/msg02...
if anyone's interested)
Anyway, searching the cvs tree for the log message and bumping
ACLPB_MAX_SELECTED_ACLS from 200 to 2000 just happened to solve our
problem. The change was made as a long-shot in the dark without any
insight into the code-base, i.e. we don't really have any broad
understanding of how and where it's used. It just seemingly works.
During our testing, we have not seen side-effects though we don't
really have any experience with the unmodified server. It just wasn't
usable for us with the legacy ldap-structure we have.
I've attached a patch for the one-line change we made, based on the
source RPM for fds-base-1.1.3. What are your thoughts on including
this in future revisions? If the patch is unacceptable, would you be
more prepared to accept a contribution making this configurable from
dse.ldif?
Yes. This seems like something that should be configurable. We would
welcome your contribution.
Step 1) Please review
http://directory.fedoraproject.org/wiki/Contributing
Step 2) Please open a bug in
bugzilla.redhat.com for Fedora Directory
Server - you can attach patches, tests, etc. to the bug (after we
receive confirmation that you have signed and submitted the CLA)
Assuming neither option is acceptable and the current value of 200 is
locked, I would very much like to hear the reasoning, as obviously,
even if things seem to work, the apparent shortage of other people
bumping into this problem is slightly worrying (our directory has
upwards of 1500 aci attrs - count made with a quick grep -c "aci:" on
an ldif exported from the old Sun ldap).
--
Audun Røe
mail: audun.roe(a)kantega.no
------------------------------------------------------------------------
--
Fedora-directory-devel mailing list
Fedora-directory-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-devel