-----BEGIN PGP SIGNED MESSAGE-----
On 11/01/2009 11:44 PM, David O'Brien wrote:
Greetings one and all. I have a couple of questions about sssd, from
1. "How long should nss_sss cache negative cache hits before asking the
back end again?" (from NSS config options in the sssd.conf man page)
This describes the negative cache. In order to avoid flooding the data
provider with requests for a user that does not exist, we will maintain
a temporary negative cache that will short-circuit the usual lookup.
Normally the process would be:
1) Is the user in cache? No.
2) Ask the data provider to update the cache.
3) Data provider asks the remote data store about the user. No such
user. (This is an expensive operation, time-wise)
4) Data provider returns without updating the cache.
5) Cache reports no such user.
With this setting, after the first time that the data provider returns
no such user, we add this to a special negative cache (for as long as
this option specifies). This adds an additional step 0 to the above,
which is to check whether the user is in the negative cache first. If it
is, it immediately reports no such user instead of checking the data
This is useful in cases where someone might mistype a name and then the
process they run attempts to use this name many, many times in a very
short period. Rather than go to the data provider every time (which we
know will always be negative), we use the negative cache.
I don't quite get how you query the cache for something and cache the
results, unless there are two caches.
2. Are the cache and other option's values specified in seconds? I've
seen values of 15, 120, and 600, but I'm green enough with this sort of
thing to ask to make sure.
With one exception, they're all specified in seconds. That exception is
the offline_credentials_expiration, which as the manpage states is
specified in days.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----