On Wed, 2012-06-27 at 13:18 -0400, Mark London wrote:
Hi - We are running SSSD with LDAP at our site, where we have several
hundred users. LDAP is being served by our Windows domain server.
With entry_cache_timeout set to a short value, when someone does an
operation that requires information for multiple users, i.e. listing the
owners of all of the user's home directories via the command "ls -l
/home", this will take many many minutes to complete. Of course, this
happens, because an LDAP request has to be issued for each user, and
then stored in the database. Further similar operations will complete
quickly, during the entry_cache_timeout period. But such operations do
not occur that frequent enough for the data to be kept in the cache.
The only solution seems to be sto imply increase entry_cache_timeout to
a very large value. Of course, this is not ideal, because changes to
the ldap entries will not be seen for a long time. A kludge workaround,
would be to keep a low timeout, and have a cron job that runs the
command "ls -l /home" every 5 minutes, on each workstation.
Is there a more elegant way to solve this problem? Thanks. - Mark
If this action is a very common one (listing all of /home), then in your
particular environment you will probably want to set 'enumerate = True'
in the [domain/DOMAINNAME] section of sssd.conf.
What this does is instruct SSSD to poll for cache updates on a regular
basis and store cached information about all users and groups at all
times.