[SSSD] RFC - disable the cleanup task by default
Jakub Hrozek
jhrozek at redhat.com
Mon Apr 13 09:05:19 UTC 2015
On Wed, Apr 08, 2015 at 12:52:33PM +0200, Jakub Hrozek wrote:
> On Wed, Apr 08, 2015 at 12:11:06PM +0200, Lukas Slebodnik wrote:
> > On (08/04/15 11:59), Jakub Hrozek wrote:
> > >On Wed, Apr 08, 2015 at 11:56:59AM +0200, Pavel Březina wrote:
> > >> On 04/07/2015 05:08 PM, Jakub Hrozek wrote:
> > >> >On Tue, Apr 07, 2015 at 05:02:33PM +0200, Jakub Hrozek wrote:
> > >> >>On Tue, Apr 07, 2015 at 04:39:30PM +0200, Jakub Hrozek wrote:
> > >> >>>So unless account_cache_expiration is set to something sensible, only
> > >> >>>empty groups are removed and that's quite a corner case.
> > >> >>
> > >> >>Correction - also groups who have never logged in might be removed. This
> > >> > ~~~~~~
> > >> > users, sorry
> > >> >>could be useful for pruning info after "ls -l" on directory like /tmp
> > >> >>for example.
> > >> >>
> > >> >>But my opinion on the whole cleanup task still stands.
> > >>
> > >> Sure we can disable it, it don't oppose.
> > >>
> > >> Or we can also increase the default value for ldap_purge_cache_timeout to
> > >> days instead of hours.
> > >
> > >This wouldn't help the biggest problem though which is when the cache cleanup
> > >starts for a huge database on a busy server, the single transaction blocks
> > >any other transaction..
> >
> > Disabling clean-up task might help busy servers. There is hight probability
> > all users/groups in sssd cache are used and refreshed very often
> >
> > But could it cause problems in other use cases?
>
> So far I can think of one use case:
> The users never log in and are only used for identity lookups. At
> the same time, the users on the server tend to change (be
> added/deleted). And at the same time, the removed entries are never
> requested (ie files are removed before someone does getpwuid() of
> the owner).
>
> I can imagine ls -l on /tmp on a university server where students come
> and go might hit this problem.
>
> >
> > BTW we already have documented how to disable clean-up task.
> > man sssd-ldap -> ldap_purge_cache_timeout
>
> Noone reads documentation :-) We had two RHEL customer cases this week
> where sssd_be was spinning out of control during a cleanup task and users
> couldn't log in. For one customer (jb on #sssd), the sssd_be process was
> even killed and restated.
>
> >
> > maybe we should write wiki page with performance tuning.
>
> In my opinion it would be better the other way around, add a wiki page
> for cache size tuning. Disk space is cheap, but slow logins look bad.
Simo, what do you think?
More information about the sssd-devel
mailing list