[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.
Jakub Hrozek
jhrozek at redhat.com
Tue Aug 14 08:33:12 UTC 2012
On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote:
> Mark London wrote:
> >Hi - When our primary DNS is unreachable, SSSD with LDAP breaks,
> >or is incredibly slow. I've traced it to the fact that several of
> >the LDAP timeout values are 6 seconds. This is not long enough,
> >because the default DNS timeout failover is 5 seconds. Incoming
> >SSH connections are impossible without increasing the LDAP timeout
> >value. I'm not sure yet which is the critical setting, but I've
> >increased the following from 6 seconds to 30:
>
> Hi - First, I had a typo in the above paragraph of my previous
> email. I mean to say "impossible without increasing". Instead I
> said "impossible with increasing".
>
> Secondly, I discovered that SSSD has an internal resolver, and found
> the dns_resolver_timeout variable. I changed it from 5 seconds 1
> second, but that didn't help. I still see 5 second delays when
> sdap_ldap_connect_callback_add is called. It would be nice if the
> internal resolver had a cache! Any other suggestions? I'll be
> happy to hack the code, if someone could give me any idea of what
> needs to be fixed. This situation has occurred several times over
> the past few months, causing major problems. Thanks.
>
I would recommend turning off the referral support:
ldap_referrals = false
That should get rid of many reconnection attempts. We don't control name
resolution for referred servers and I suspect the resolution is done
internally in libldap.
More information about the sssd-devel
mailing list