[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.

Mark London mrl at psfc.mit.edu
Tue Aug 14 02:16:49 UTC 2012


Mark London wrote:
> Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, or is 
> incredibly slow.  I've traced it to the fact that several of the LDAP 
> timeout values are 6 seconds.  This is not long enough, because the 
> default DNS timeout failover is 5 seconds.  Incoming SSH connections 
> are impossible without increasing the LDAP timeout value.  I'm not 
> sure yet which is the critical setting, but I've increased the 
> following from 6 seconds to 30:

Hi - First, I had a typo in the above paragraph of my previous email.  I 
mean to say "impossible without increasing".  Instead I said "impossible 
with increasing".

Secondly, I discovered that SSSD has an internal resolver, and found the 
dns_resolver_timeout variable.  I changed it from 5 seconds 1 second, 
but that didn't help.  I still see 5 second delays when 
sdap_ldap_connect_callback_add is called.   It would be nice if  the 
internal resolver had a cache!  Any other suggestions?  I'll be happy to 
hack the code, if someone could give me any idea of what needs to be 
fixed.  This situation has occurred several times over the past few 
months, causing major problems.  Thanks.

- Mark




More information about the sssd-devel mailing list