[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.
Mark London
mrl at psfc.mit.edu
Mon Aug 13 20:16:06 UTC 2012
Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, or is
incredibly slow. I've traced it to the fact that several of the LDAP
timeout values are 6 seconds. This is not long enough, because the
default DNS timeout failover is 5 seconds. Incoming SSH connections are
impossible with increasing the LDAP timeout value. I'm not sure yet
which is the critical setting, but I've increased the following from 6
seconds to 30:
ldap_network_timeout = 30
ldap_opt_timeout = 30
ldap_search_timeout = 30
What I don't understand is, even with this increase, while it allows SSH
logins to work, it still takes about 1 1/2 minutes to login to the
computer. The logs show that every LDAP connection takes about 5
seconds to complete. That seems to imply to me that the code doing an
DNS Lookup to the primary DNS server, rather than using the local DNS
cache. See below. I've not traced the code, to see if in fact this is
the case. But whatever the reason, LDAP connections are taking a long
time, with the primary DNS server being down:
(Mon Aug 13 15:43:46 2012) [sssd[be[PSFC]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldaps://ForestDnsZones.psfc.mit.edu/DC=ForestDnsZones,DC=psfc,DC=mit,DC=edu]
with fd [32].
(Mon Aug 13 15:43:51 2012) [sssd[be[PSFC]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldaps://DomainDnsZones.psfc.mit.edu/DC=DomainDnsZones,DC=psfc,DC=mit,DC=edu]
with fd [33].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldaps://psfc.mit.edu/CN=Configuration,DC=psfc,DC=mit,DC=edu] with fd [34].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]] [sdap_rebind_proc] (0x1000):
Successfully bind to
[ldaps://DomainDnsZones.psfc.mit.edu/DC=DomainDnsZones,DC=psfc,DC=mit,DC=edu].
(Mon Aug 13 15:43:56 2012) [sssd[be[PSFC]]] [sdap_rebind_proc] (0x1000):
Successfully bind to
[ldaps://ForestDnsZones.psfc.mit.edu/DC=ForestDnsZones,DC=psfc,DC=mit,DC=edu].
This is true, even though I have enumeration turned on, with long cached
timeouts:
enum_cache_timeout = 86400
ldap_purge_cache_timeout = 0
ldap_enumeration_refresh_timeout = 300
I was under the impression that enumeration prevented blocking, and used
cache values, rather than waiting for LDAP requests to finish.
Any comments, or opinions on how to fix this problem? Thanks.
- Mark
More information about the sssd-devel
mailing list