On Mon, Feb 03, 2014 at 12:17:10PM -0700, Erinn Looney-Triggs wrote:
I have a RHEL 5.10 system running sssd version sssd-1.5.1-70.el5,
SSSD
is configured as a client of two IPA servers, config will be at the bottom.
This thing has been chugging along for years at this point without
issue, but performance hit the wall this morning and SSSD appears to be
the issue.
logins using kerberos are taking an extremely long time, I expect
because of user data enumeration, sudo passwords are taking an extremely
long time, su passwords etc.
Cranking up debugging is not revealing anything glaring to my untrained
eye.
Running an anonymous ldapsearch against the IPA servers (suggested in
debug documentation) is not possible as anonymous binds are disabled on
the server end. Though the connection does go through enough to indicate
that such is the case.
As well restarting SSSD takes a very long time, ~1-2 minutes when
compared with other systems on the same platform/hardware (seconds).
Any folks have ideas?
Please CC me as I am subscribed to the digest.
Thanks,
-Erinn
What Dmitri said would by my suggestion as well. Try to disable
enumeration for a test and see if the startup and general performance
improves. Or check the sssd.log for any signs of sssd restarting the
backends.
How many users and groups are there in the directory?