[SSSD] [PATCH 1/2] Set default DNS resolution timeout to 15 seconds.

Michal Židek mzidek at redhat.com
Thu Jul 4 14:23:37 UTC 2013


https://fedorahosted.org/sssd/ticket/1966 (SSSD failover doesn't work if 
the first DNS server in resolv.conf is unavailable).

The problem here is, that if first nameserver in resolv.conf is down, 
the resolution is too slow and SSSD will not wait for the result of 
ares_search and go offline. In my case the resolution was sometimes more 
than a minute, because all search domains in resolv.conf were searched 
inside ares_search() call using the first (not working) nameserver in 
the first place and then with the working nameserver (and before that, 
SSSD tried to figure out the domain name from my incorrectly set 
hostname, which added more unnecessary DNS lookups).

To avoid this problem, the option dns_discovery_domain must be set 
properly, so that only the correct domain is searched, but even that is 
not enough, because the default timeout for dns resolver operation in 
sssd is too low. This patch rises the default value to 15 seconds 
(instead of 5 seconds).

Another option might be to lower the amount of time ares waits for a 
nameserver to respond (currently it is 5 seconds, that is why 5 second 
for the entire dns resolution is not sufficient), but I do not want to 
do this.

These patches also change man pages, so probably master only (string 
freeze)? Even if this is a really small change.

I was also thinking, would it make sense to write a warning to the logs 
if the dns_discovery_domain option is not set? It seem to be important 
to set it properly for cases like this one.

Thanks
Michal
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Set-default-DNS-resolution-timeout-to-15-seconds.patch
Type: text/x-patch
Size: 1345 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130704/1ee3ae77/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-MAN-Changed-default-for-dns_resolver_timeout.patch
Type: text/x-patch
Size: 873 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130704/1ee3ae77/attachment-0001.bin>


More information about the sssd-devel mailing list