[SSSD] How to tune the failover mecanism ?

Jakub Hrozek jhrozek at redhat.com
Mon Dec 3 15:49:36 UTC 2012


On Mon, Dec 03, 2012 at 04:35:00PM +0100, Olivier wrote:
> Hello everyone,
> 
> I use sssd to authenticate users on redhat boxes,
> as a layer between pam and my ldap serverS.
> 
> User ldap accounts are announced but 3 replicated
> (open)ldap servers.
> 
> I have declared my 3 servers in sssd.conf:
> 
> ldap_uri: ldap://ldap1.example.fr,ldap://ldap2.example.fr,ldap://ldap3.example.fr
> 
> That works, but I would like now to better tune the
> sssd failover and cache function offered by sssd,
> and I'm a bit stuck.
> 
> Questions :
> 
> 1- about the failover mecanism, I read in sssd-ldap man page :
> 
> " If the resolution attempt succeeds, the back end tries to connect to
> a service on this machine.
>   If the service connection attempt fails, then only this particular
> service is considered offline and
>   the back end automatically switches over to the next service."
> 
> I there any way to tune the "timeout" after which the bakend considers
> that the attempt
> to connect to a server has failed and therefore that it's time to try
> the next one ?

It depends, there are several timeouts at play. There is the DNS
resolution timeout (dns_resolver_timeout) and there may be per-provider
timeouts such as ldap_network_timeout.

What particular problem you are seeing?

> 
> 2- I'm a bit stuck to configure the behaviour of the boxes with regard to
>     sssd cache (in anthother word, I have not perfectly understood under
>     which condition sssd returns cached information rather than querying
>     ldap and how to tune that).
> 
> Intuitively, I would something like the sssd cache for an entry to be returned
> rather than querying ldap if :
> 
> -> the cache was "recently" refreshed for that entry ( not sur what I
> should mean
>     by "recently" )
> -> no ldap server respond (I suspect that this would be tuned with
> "ldap_search_timeout" ?)

That's pretty how the cache mechanism works.

In general, the entries are returned from on-disk cache for the time
specified in entry_cache_timeout or per-object entry timeouts (for
example entry_cache_user_timeout for users, entry_cache_group_timeout
for groups etc.).

If the cached entry has been saved more than entry_cache_timeout seconds
ago, the NSS responder queries LDAP and saves the entry again.

If the entry was present in the cache and was supposed to be refreshed
BUT no LDAP server is reachable, then the SSSD falls back to the expired
cache entry.

Additionally, there is a new cache layer introduced in 1.9 that is
entirely kept in-memory and is pretty fast. That memory cache is
controlled by the memcache_timeout option.



More information about the sssd-devel mailing list