On Tue, Nov 08, 2011 at 10:31:56AM +0000, John Hodrien wrote:
On Tue, 8 Nov 2011, GOLLSCHEWSKY, Tim wrote:
>I've re-run my tests, with and without the symlink to /dev/shm:
>
>No symlink:
> Time Size of cache.ldb
> With ldap_rfc2307bis_initgroup_filter 6.43s 7553024
> WithOUT ldap_rfc2307bis_initgroup_filter 43.95s 15974400
>
>With symlink:
> Time Size of cache.ldb
> With ldap_rfc2307bis_initgroup_filter 4.86s 7528448
> WithOUT ldap_rfc2307bis_initgroup_filter 26.82s 15962112
>
>So the symlink does provide some improvement. But 26 seconds is still not
>acceptable for an ssh login time.
Sure. Just for info, picking on a user I know to be in a lot of groups (92)
against AD with a reasonable amount of nested groups and no cache, id takes
5-10 seconds (varying with load on ldap servers I guess), and final cache.ldb
size is 13627392 so not far off yours. That was tested with 1.6.1.
jh
Just for the record, running plain "id" is not the best way to measure
how long does the initgroups() operation take, "id -G" is much better.
The difference is that without -G, id would also run getgrgid() on all
the returned GID numbers.