On Thu, 2012-01-05 at 15:07 +0100, Jakub Hrozek wrote:
On Thu, Jan 05, 2012 at 12:33:24PM +0800, Joe Jin wrote:
> On 01/05/12 11:43, Stephen Gallagher wrote:
> > On Thu, 2012-01-05 at 11:26 +0800, Joe Jin wrote:
> >> Hi,
> >>
> >> When I did sssd + openLDAP tests I found if remove nisNetgroupTriple or
> >> memberNisNetgroup attribute, sssd did not reflected the changed,
> >> "getent netgroup <group_name>" return unchanged result.
> >
> > Did you wait for the entry_cache_timeout period? Cached entries aren't
> > updated instantaneously.
>
> Yes I did, I set entry_cache_timeout to 120s, when I add new entry to
> nisNetgroupTriple or memberNisNetgroup, it updated in 120s, but if I
> removed any one of the attributes, getent still return former result,
> even after more than 120s.
>
Sorry I could not reproduce that behaviour - neither with master nor 6.2
One twist is that the cache expiry time is saved into the cache so if
you save an item, then change the entry_cache_timeout, the entry keeps
its original expiry timeout.
I would recommend to purge the cache altogether (or at least the netgroup
items) if you need to reflect a changed entry_cache_timeout value.
I wonder if we should think about changing how this work, and instead of
saving the expiration time save the update time instead and always
calculate expiration time at check time.
I am sure this can cause issues where we want to use the expire time to
set a non default value, but it is worth thinking if it makes sense to
change this behavior as it may confuse admins greatly when they are
testing stuff or need to change values to a shorter cache time.
Simo.
--
Simo Sorce * Red Hat, Inc * New York