[SSSD] No negative cache with sssd_nss
Jan Engelhardt
jengelh at inai.de
Tue Jun 26 14:28:42 UTC 2012
Hi,
it seems that sssd does not cache negative responses from the shadow/NSS
backend. This is particularly observable when repeatedly querying for
groups that do not exist in /etc/group, but do exist in LDAP. sssd is
configured to search local db, plus another server's LDAP tree.
If the group "clients" is in LDAP, the following testcase below runs in
about ~8.5 sec on the reference machine. However, if I add the "clients"
group to the end of /etc/group, it completes in like 1.3 sec.
When only in LDAP, tcpdump shows no activity on port 389, so at least
the positive caching does work. However, the negative response from NSS
increases the execution time significantly, which leads me to believe
that part is not cached.
---8<---
#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <grp.h>
int main(void)
{
unsigned int i;
struct group *g;
for (i = 0; i < 50000; ++i) {
g = getgrnam("clients");
}
return EXIT_SUCCESS;
}
More information about the sssd-devel
mailing list