[SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down. (Mark London)
Mark London
mrl at psfc.mit.edu
Tue Aug 14 14:35:56 UTC 2012
Jakub Hrozek <jhrozek at redhat.com> wrote
> On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote:
>
>> Mark London wrote:
>>
>>> Hi - When our primary DNS is unreachable, SSSD with LDAP breaks,
>>> or is incredibly slow. I've traced it to the fact that several of
>>> the LDAP timeout values are 6 seconds. This is not long enough,
>>> because the default DNS timeout failover is 5 seconds. Incoming
>>> SSH connections are impossible without increasing the LDAP timeout
>>> value. I'm not sure yet which is the critical setting, but I've
>>> increased the following from 6 seconds to 30:
>>>
>> I found the dns_resolver_timeout variable and changed it from 5 seconds 1
>> second, but that didn't help. I still see 5 second delays when
>> sdap_ldap_connect_callback_add is called. It would be nice if the
>> internal resolver had a cache! Any other suggestions? I'll be
>> happy to hack the code, if someone could give me any idea of what
>> needs to be fixed. This situation has occurred several times over
>> the past few months, causing major problems. Thanks.
>>
>
> I would recommend turning off the referral support:
> ldap_referrals = false
>
> That should get rid of many reconnection attempts. We don't control name
> resolution for referred servers and I suspect the resolution is done
> internally in libldap.
>
>
Thanks for the info! That reduces the time to login to 50 seconds.
Much better! Perhaps the default for that setting should be false?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120814/7f2d6dfb/attachment.html>
More information about the sssd-devel
mailing list