[SSSD] Understanding entry_negative_timeout

Jakub Hrozek jhrozek at redhat.com
Wed Sep 18 09:16:55 UTC 2013


On Wed, Sep 18, 2013 at 10:39:42AM +0200, Jean-Baptiste Denis wrote:
> Hello everybody,
> 
> I've got an sssd configuration with two ldap domains. The nss part of
> the configuration is this one :
> 
> [nss]
> filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
> override_shell = /bin/bash
> entry_negative_timeout = 15
> debug_level = 0x02F0
> 
> I've got a program that crawl a filesystem. For some reason, a bunch of
> files have an uid which do not "resolve" to anything. My ldap backend
> are hammered with requests like this one :
> 
> slapd[31421]: conn=361745 op=1712 SRCH base="ou=users,dc=example,dc=com"
> scope=2 deref=0 filter="(&(uidNumber=1047)(objectClass=posixAccount))
> 
> In /var/log/sssd/sssd_nss.log, it correspond to a lot of :
> 
> ....
> [sssd[nss]] [nss_cmd_getpwuid_search] (0x0040): No matching domain found
> for [1047], fail!
> ...
> 
> I thought that the "entry_negative_timeout" in the nss part of the
> configuration would prevent this kind of behaviour, but I obviously
> didn't guess right.
> 
> Any advice ?
> 
> Jean-Baptiste

Hi Jean-Baptiste,

>From the snippets you sent it indeed seems the UID is searched for. But
after one such search, the entry should be cached in the negative cache
and no requests towards the backend should be issued. Is it not the
case?

btw for your case you might want to either increase the negative timeout
a bit or, if the list of unresolvable UIDs is not long, filter them out
directly:
filter_users = root, 1047

filter_users can be used in both the nss section and the domain section.



More information about the sssd-devel mailing list