[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.

Jakub Hrozek jhrozek at redhat.com
Tue Aug 14 08:33:12 UTC 2012


On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote:
> Mark London wrote:
> >Hi - When our primary DNS is unreachable, SSSD with LDAP breaks,
> >or is incredibly slow.  I've traced it to the fact that several of
> >the LDAP timeout values are 6 seconds.  This is not long enough,
> >because the default DNS timeout failover is 5 seconds.  Incoming
> >SSH connections are impossible without increasing the LDAP timeout
> >value.  I'm not sure yet which is the critical setting, but I've
> >increased the following from 6 seconds to 30:
> 
> Hi - First, I had a typo in the above paragraph of my previous
> email.  I mean to say "impossible without increasing".  Instead I
> said "impossible with increasing".
> 
> Secondly, I discovered that SSSD has an internal resolver, and found
> the dns_resolver_timeout variable.  I changed it from 5 seconds 1
> second, but that didn't help.  I still see 5 second delays when
> sdap_ldap_connect_callback_add is called.   It would be nice if  the
> internal resolver had a cache!  Any other suggestions?  I'll be
> happy to hack the code, if someone could give me any idea of what
> needs to be fixed.  This situation has occurred several times over
> the past few months, causing major problems.  Thanks.
> 

I would recommend turning off the referral support:
    ldap_referrals = false

That should get rid of many reconnection attempts. We don't control name
resolution for referred servers and I suspect the resolution is done
internally in libldap.



More information about the sssd-devel mailing list