[SSSD] SSSD + CYRUS/IMAP + LDAP + NSS caching = constantly growing sssd_be memory usage?
Dmitri Pal
dpal at redhat.com
Fri Oct 21 19:33:55 UTC 2011
On 10/21/2011 03:09 PM, Mark London wrote:
> Hi - I've compiled and installed the latest version of SSSD (1.6.1),
> with caching enabled, for a Redhat 6 computer running CYRUS IMAP mail
> server software (with SASL). Users are authenticated via LDAP, and
> the LDAP server is running as part of a Windows domain server. Mail
> is sent using sendmail, with SMTP authentication. We have
> appropriately 200 users (who read their mail using various
> applications, including the server's Squirrelmail webmail interface).
>
> Using both the version of SSSD that came with Redhat 6 and the newly
> compiled, the sssd_be process will constantly increase it's memory
> usage over time. Within a day, the process is now using up 2G:
>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+
> COMMAND
> 22900 root 20 0 2002m 1.7g 5628 S 0.0 14.8 9:41.42 sssd_be
>
> Why is there a constant need for extra memory, and is the amount of
> memory being used, "normal" for a mail server, that only 200 users?
> Here is my sssd.conf file. Thanks for any suggestions or help that
> anyone can provide. - Mark
Seems like a time to run Valgrind. Looks like a leak to me ...
>
> ----------------------------- sssd.conf --------------------------------
> [sssd]
> config_file_version = 2
> # Number of times services should attempt to reconnect in the
> # event of a crash or restart before they give up
> reconnection_retries = 3
>
> # If a back end is particularly slow you can raise this timeout here
> sbus_timeout = 30
> services = nss, pam
>
> # SSSD will not start if you do not configure any domains.
> # Add new domain configurations as [domain/<NAME>] sections, and
> # then add the list of domains (in the order you want them to be
> # queried) to the "domains" attribute below and uncomment it.
> ; domains = LOCAL,LDAP
>
> domains = PSFC
>
> [nss]
> # The following prevents SSSD from searching for the root user/group in
> # all domains (you can add here a comma-separated list of system accounts that
> # are always going to be /etc/passwd users, or that you want to filter out).
> filter_groups = root
> filter_users = root
> reconnection_retries = 3
> debug_level = 0
>
> # The entry_cache_timeout indicates the number of seconds to retain an
> # entry in cache before it is considered stale and must block to refresh.
> # The entry_cache_nowait_timeout indicates the number of seconds to
> # wait before updating the cache out-of-band. (NSS requests will still
> # be returned from cache until the full entry_cache_timeout). Setting this
> # value to 0 turns this feature off (default).
> #entry_cache_timeout = 600
> #entry_cache_nowait_timeout = 300
>
> [pam]
> reconnection_retries = 3
> debug_level = 0
>
> # LDAP domain where the LDAP server is an Active Directory server.
>
> [domain/PSFC]
> description = LDAP domain with AD server
> enumerate = true
> min_id = 501
> cache_credentials = TRUE
>
> id_provider = ldap
> chpass_provider = none
> auth_provider = ldap
> ldap_uri = ldaps://xxxxxxxx
> ldap_tls_cacertdir = /etc/openldap/cacerts
> ldap_schema = rfc2307bis
> ldap_search_base = dc=psfc,dc=mit,dc=edu
> ldap_user_search_base = dc=psfc,dc=mit,dc=edu
> ldap_group_search_base = dc=psfc,dc=mit,dc=edu
> ldap_default_bind_dn = CN=ADldapreadonly,OU=Computer Group,OU=PSFC Users,DC=psfc,DC=mit,DC=edu
> ldap_default_authtok_type = password
> ldap_default_authtok = ldapread
> ldap_user_object_class = person
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = msSFU30UidNumber
> ldap_user_gid_number = msSFU30GidNumber
> ldap_user_home_directory = msSFU30HomeDirectory
> ldap_user_shell = msSFU30LoginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_member = msSFU30PosixMember
> ldap_user_member_of = msSFU30PosixMemberOf
> ldap_group_name = name
> ldap_group_gid_number = msSFU30GidNumber
> ldap_force_upper_case_realm = True
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111021/9edf8c2c/attachment.html>
More information about the sssd-devel
mailing list