On Mon, Apr 15, 2013 at 01:20:37PM +0100, John Hodrien wrote:
On Mon, 15 Apr 2013, Jakub Hrozek wrote:
>From past conversations I know that your environment is rather big, so I
>suspect you are hitting either ldap_enumeration_search_timeout (the
>actual ldapsearch takes more than 60 seconds) or then saving the results
>takes so long that the monitor kills the back end.
That sounds plausible.
>>sssd-1.9.2-82.4.el6_4.x86_64
>>
>>That said, I'm fairly sure I'd never want to use enumerate = true
>
>I agree, but the reality is that users turn on enumeration quite
>frequently so longish-term (1.11 maybe, but probably 1.12) we should
>improve the enumeration task to be able to handle even very large
>directories.
I guess I'm not clear *why* people feel they need enumeration.
It's not completely clear to me either, the most frequent answer I heard
was "convenience".
>Currently, as you see from your experience, it's not great
when it comes
>to handling large number of users and groups..
But is it *ever* going to be possible to get to a state where full enumeration
with large trees is sane?
jh
I haven't really done any experiments or design, but we would have to
split the current single huge request into several smaller ones in order
to avoid starving the sssd_be event queue. I'm not exactly sure how,
though.