[SSSD] No negative cache with sssd_nss

Jan Engelhardt jengelh at inai.de
Tue Jun 26 14:28:42 UTC 2012


Hi,


it seems that sssd does not cache negative responses from the shadow/NSS 
backend. This is particularly observable when repeatedly querying for 
groups that do not exist in /etc/group, but do exist in LDAP. sssd is 
configured to search local db, plus another server's LDAP tree.

If the group "clients" is in LDAP, the following testcase below runs in 
about ~8.5 sec on the reference machine. However, if I add the "clients" 
group to the end of /etc/group, it completes in like 1.3 sec.

When only in LDAP, tcpdump shows no activity on port 389, so at least 
the positive caching does work. However, the negative response from NSS 
increases the execution time significantly, which leads me to believe 
that part is not cached.

---8<---
#include <stdio.h>
#include <stdlib.h>
#include <pwd.h>
#include <grp.h>

int main(void)
{
        unsigned int i;
        struct group *g;

        for (i = 0; i < 50000; ++i) {
                g = getgrnam("clients");
        }
        return EXIT_SUCCESS;
}



More information about the sssd-devel mailing list