So Trellix did not accept this as a bug in their healthcheck script. We put in a RFE with tem to do this healthcheck invocation using setpriv or su -c. Which doesn't trigger the LDAP queries.
Now we have an open case with RH Tech Support on this. Basically, when sudo is invoked as root and we have early in the /etc/sudoers file:
and then later on in /etc/sudoers file we have:
## Read drop-in files from /etc/sudoers.
#includedir /etc/sudoers.d
then sudo should not be making group membership queries to enumerate all the various AD groups in /etc/sudoers.d/* files. which is triggering multiple LDAP queries on thousands of servers -- all on the hour and half-hour.
Spike