URL:
https://github.com/SSSD/sssd/pull/5552
Title: #5552: files: split update into batches
alexey-tikhonov commented:
"""
I think the latest issues you've found are not strictly related
to the patches. The reason is that if there are many users and groups in the cache the
`sss_cache -UG` needs more time to invalidate all users and groups. With 5000 users and
the related primary groups it looks like `sss_cache` runs for more then 1s even if all
entries are already invalidated. But this means that the next `userdel` command is called
more than 1s after the last `userdel` which means that it is called while a refresh is
running. This is no issue for the `userdel` command itself, but `userdel` will call
`sss_cache` which will try to modify the cache which is locked by the transaction covering
the refresh. So `sss_cache` has to wait until the refresh is finished which might take
some time. For the next `userdel` call the same happens again.
...
It might also be possible to modify `sss_cache` so that it e.g. only
sends a command to SSSD and not tries to modify the caches on its own.
The thing is, IIRC, the real use of sss_cache here is to drop mem-cache. Invalidation of
sysdb cache (for all domains!) is undesirable side effect (that does only harm - for
"files" provider expiration time doesn't have any affect anyway).
Details are here:
https://bugzilla.redhat.com/show_bug.cgi?id=1693379#c6
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5552#issuecomment-876569077