[SSSD] SSSD netgroup issue

Stephen Gallagher sgallagh at redhat.com
Fri Sep 23 19:07:08 UTC 2011


On Fri, 2011-09-23 at 12:42 -0600, Francisco Javier MarĂ­n Murillo wrote:
> Hello,
>  
> I do not see Stephen's answers that you mentioned about. Can he send
> email again ?
>  


Please subscribe to the sssd-devel mailing list to see all replies. We
usually don't reply directly to the original email address because the
responses may be of interest to others on the list as well. You can
subscribe at https://fedorahosted.org/mailman/listinfo/sssd-devel



From my earlier mail to this list:

The issue here is almost certainly cache expiration. Once you have
requested a netgroup, it will be available for entry_cache_timeout
seconds (defaults to 90 minutes). So changing the value on the server
won't have an effect on the client until up to 90 minutes later.

You can change this timeout by setting the following in the
[domain/DOMAINNAME] section of sssd.conf:
entry_cache_timeout = 90
(to set it to 90 seconds)

You can also purge your cache immediately by stopping SSSD and removing
the file /var/lib/sss/db/cache_DOMAINNAME.ldb.

In SSSD 1.6.0 and later, you can also use the sss_cache command like Jan
described above to immediately expire all cache entries (without
deleting the cache).



As an addendum, I strongly recommend against setting the cache timeout
shorter than about five or ten seconds, as you don't want to hammer your
LDAP server if someone does an 'ls -l' on a directory with a lot of
files.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110923/781f4fd3/attachment.sig>


More information about the sssd-devel mailing list