[SSSD] Understanding entry_negative_timeout

Jean-Baptiste Denis jbdenis at pasteur.fr
Wed Sep 18 08:39:42 UTC 2013


Hello everybody,

I've got an sssd configuration with two ldap domains. The nss part of
the configuration is this one :

[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
override_shell = /bin/bash
entry_negative_timeout = 15
debug_level = 0x02F0

I've got a program that crawl a filesystem. For some reason, a bunch of
files have an uid which do not "resolve" to anything. My ldap backend
are hammered with requests like this one :

slapd[31421]: conn=361745 op=1712 SRCH base="ou=users,dc=example,dc=com"
scope=2 deref=0 filter="(&(uidNumber=1047)(objectClass=posixAccount))

In /var/log/sssd/sssd_nss.log, it correspond to a lot of :

....
[sssd[nss]] [nss_cmd_getpwuid_search] (0x0040): No matching domain found
for [1047], fail!
...

I thought that the "entry_negative_timeout" in the nss part of the
configuration would prevent this kind of behaviour, but I obviously
didn't guess right.

Any advice ?

Jean-Baptiste








More information about the sssd-devel mailing list