On 2/4/2014 1:40 AM, Jakub Hrozek wrote:
On Mon, Feb 03, 2014 at 12:17:10PM -0700, Erinn Looney-Triggs wrote:
> I have a RHEL 5.10 system running sssd version sssd-1.5.1-70.el5, SSSD
> is configured as a client of two IPA servers, config will be at the bottom.
>
> This thing has been chugging along for years at this point without
> issue, but performance hit the wall this morning and SSSD appears to be
> the issue.
>
> logins using kerberos are taking an extremely long time, I expect
> because of user data enumeration, sudo passwords are taking an extremely
> long time, su passwords etc.
>
> Cranking up debugging is not revealing anything glaring to my untrained
> eye.
>
> Running an anonymous ldapsearch against the IPA servers (suggested in
> debug documentation) is not possible as anonymous binds are disabled on
> the server end. Though the connection does go through enough to indicate
> that such is the case.
>
> As well restarting SSSD takes a very long time, ~1-2 minutes when
> compared with other systems on the same platform/hardware (seconds).
>
> Any folks have ideas?
>
> Please CC me as I am subscribed to the digest.
>
> Thanks,
> -Erinn
What Dmitri said would by my suggestion as well. Try to disable
enumeration for a test and see if the startup and general performance
improves. Or check the sssd.log for any signs of sssd restarting the
backends.
How many users and groups are there in the directory?
Apologies on the delay. It is actually a very small setup < 50 users and
groups total.
However, the problem turned out not to be with SSSD but with rsyslog on
the system. The product that is deployed on there switched from logging
locally to sending logs via syslog. It was sending a large number of
logs and things began to stack up pretty badly pretty quickly. For
reasons that aren't exactly clear to me this ended up effecting SSSD's
performance as well. Nevertheless, switching back to logging locally in
our product, SSSD happy, sending via syslog SSSD very unhappy.
Thanks for the suggestions though, I tried both with enumeration and
without.
-Erinn