yes do not have this setting. I have tested with "ignore_group_members=True" and it helps with it. But it breaks the interface for getgrnam/gid, where it does not return any member. We have lots of application using this interface to check group memberships. 
Thanks,

Sanjay Agrawal


On Monday, January 4, 2021, 10:08:38 AM EST, Alexey Tikhonov <atikhono@redhat.com> wrote:


Hi,

On Tue, Dec 22, 2020 at 9:51 PM Sanjay Agrawal <sanjayagrawal@yahoo.com> wrote:
We are noticing that sometimes sssd take very long to resolve some queries. They are happens when sssd_be is 100% during that interval. SO with debug_level 9 I tried to capture but I am see that no log update in sssd_be. Following is sample output from sssd_be log during this time interval. SO it is stuck in save_group ? The group in question here is very large group. 

(2020-12-21 13:33:37:929203): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 13:33:38:018075): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 13:33:38:018253): [be[mydomain]] [sdap_save_groups] (0x4000): Group 4 members processed!
--
(2020-12-21 14:18:13:015516): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [orig_member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 14:18:13:040536): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 14:18:13:040796): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 processed!
--
(2020-12-21 14:18:13:102591): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 14:18:18:782683): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.

what is the value of `ignore_group_members` option in sssd.conf for this domain?
Could you please try if using `ignore_group_members = True` improves the situation?


 
(2020-12-21 14:18:18:783006): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 members processed!
--
(2020-12-21 14:23:13:013189): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [orig_member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 14:23:13:037017): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 14:23:13:037266): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 processed!
--
(2020-12-21 14:23:13:098968): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 14:23:13:765062): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 14:23:13:765277): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 members processed!
--
(2020-12-21 15:16:01:151526): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 15:16:07:549879): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 15:16:07:550229): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 members processed!
--
(2020-12-21 16:06:04:098209): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 16:06:09:528503): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 16:06:09:528813): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 members processed!
--
(2020-12-21 16:38:13:017447): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [orig_member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 16:38:13:043604): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 16:38:13:043817): [be[mydomain]] [sdap_save_groups] (0x4000): Group 2 processed!
--
(2020-12-21 16:38:13:133200): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 16:38:16:725696): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 16:38:16:726140): [be[mydomain]] [sdap_save_groups] (0x4000): Group 2 members processed!
--
(2020-12-21 17:26:22:880163): [be[mydomain]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [member] of entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb]
(2020-12-21 17:26:29:093140): [be[mydomain]] [sysdb_set_entry_attr] (0x0200): Entry [name=group1187@mydomain,cn=groups,cn=mydomain,cn=sysdb] has set [cache, ts_cache] attrs.
(2020-12-21 17:26:29:093619): [be[mydomain]] [sdap_save_groups] (0x4000): Group 0 members processed!

Any help is really appreciated. 
Thanks,
Sanjay Agrawal
_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org

_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org