[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.
Mark London
mrl at psfc.mit.edu
Tue Aug 14 02:16:49 UTC 2012
Mark London wrote:
> Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, or is
> incredibly slow. I've traced it to the fact that several of the LDAP
> timeout values are 6 seconds. This is not long enough, because the
> default DNS timeout failover is 5 seconds. Incoming SSH connections
> are impossible without increasing the LDAP timeout value. I'm not
> sure yet which is the critical setting, but I've increased the
> following from 6 seconds to 30:
Hi - First, I had a typo in the above paragraph of my previous email. I
mean to say "impossible without increasing". Instead I said "impossible
with increasing".
Secondly, I discovered that SSSD has an internal resolver, and found the
dns_resolver_timeout variable. I changed it from 5 seconds 1 second,
but that didn't help. I still see 5 second delays when
sdap_ldap_connect_callback_add is called. It would be nice if the
internal resolver had a cache! Any other suggestions? I'll be happy to
hack the code, if someone could give me any idea of what needs to be
fixed. This situation has occurred several times over the past few
months, causing major problems. Thanks.
- Mark
More information about the sssd-devel
mailing list