<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Hi - I've compiled and installed the latest version of SSSD
(1.6.1), with caching enabled, for a Redhat 6 computer running CYRUS
IMAP
mail server software (with SASL). Users are authenticated via LDAP,
and the
LDAP server is running as part of a Windows domain server. Mail is
sent using sendmail, with SMTP authentication. We have appropriately
200 users (who read their mail using various applications, including
the server's Squirrelmail webmail interface).<br>
<br>
Using both the version of SSSD that came with Redhat 6 and the newly
compiled, the sssd_be process will constantly increase it's memory
usage over time. </tt><tt>Within a day, the process is now using up
2G:<br>
<br>
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+
COMMAND <br>
22900 root 20 0 2002m 1.7g 5628 S 0.0 14.8 9:41.42 sssd_be <br>
<br>
</tt><tt>Why is there a constant need for extra memory, and is the
amount of memory being used, "normal" for a mail server, that only 200
users? Here is my sssd.conf file. Thanks for any suggestions or help
that anyone can provide. - Mark </tt><tt><br>
<br>
----------------------------- sssd.conf --------------------------------<br>
</tt>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 13px;" lang="x-western">
<pre wrap="">[sssd]
config_file_version = 2
# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3
# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
; domains = LOCAL,LDAP
domains = PSFC
[nss]
# The following prevents SSSD from searching for the root user/group in
# all domains (you can add here a comma-separated list of system accounts that
# are always going to be /etc/passwd users, or that you want to filter out).
filter_groups = root
filter_users = root
reconnection_retries = 3
debug_level = 0
# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
#entry_cache_timeout = 600
#entry_cache_nowait_timeout = 300
[pam]
reconnection_retries = 3
debug_level = 0
# LDAP domain where the LDAP server is an Active Directory server.
[domain/PSFC]
description = LDAP domain with AD server
enumerate = true
min_id = 501
cache_credentials = TRUE
id_provider = ldap
chpass_provider = none
auth_provider = ldap
ldap_uri = ldaps://xxxxxxxx
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_schema = rfc2307bis
ldap_search_base = dc=psfc,dc=mit,dc=edu
ldap_user_search_base = dc=psfc,dc=mit,dc=edu
ldap_group_search_base = dc=psfc,dc=mit,dc=edu
ldap_default_bind_dn = CN=ADldapreadonly,OU=Computer Group,OU=PSFC Users,DC=psfc,DC=mit,DC=edu
ldap_default_authtok_type = password
ldap_default_authtok = ldapread
ldap_user_object_class = person
ldap_user_name = sAMAccountName
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_group_member = msSFU30PosixMember
ldap_user_member_of = msSFU30PosixMemberOf
ldap_group_name = name
ldap_group_gid_number = msSFU30GidNumber
ldap_force_upper_case_realm = True
</pre>
</div>
<br>
</body>
</html>