Bug 1955572

Summary:	Adding hosts to a big host_group causes IPA to hang for long time
Product:	Red Hat Enterprise Linux 7	Reporter:	Aleksandr Sharov <asharov>
Component:	389-ds-base	Assignee:	LDAP Maintainers <ldap-maint>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	RHDS QE <ds-qe-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.8	CC:	cobrown, ldap-maint, mreynolds, pafleg, tbordaz
Target Milestone:	rc	Flags:	pm-rhel: mirror+
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-01 20:19:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Aleksandr Sharov 2021-04-30 12:19:19 UTC

Description of problem:
Client is trying to implement a HBAC rule for a big host_group - around 2500+ hosts.

After trying to add a bunch of new hosts to the group, IPA hangs for some time, possibly because it tries to iterate all memberof plugin tasks.

After some time - after adding 1000 hosts to a 1000 host group it was around 1 hour - the IPA becomes responsive back. The IPA's host systems are intact all the time.

We've tried to capture strace of dirserv, sosreport and atop from the system, you can find them in the case attached.

Version-Release number of selected component (if applicable):
389-ds-base-1.3.10.1-14.el7_8.x86_64                        Mon Aug 31 23:07:33 2020
ipa-server-4.6.6-11.el7.x86_64                              Mon Aug 31 23:08:07 2020
RHEL 7.8


How reproducible:
- not enough hosts in lab env to reproduce

Actual results:
IPA is hung fro long time and can't serve clients at all

Expected results:
IPA remains responsive, or processing takes significantly less time

Additional info:
Sosreports

sosreport-m1-freeipa01p-02903063-2021-04-29-foxtelk.tar.xz
sosreport-ds-freeipa01p-02903063-2021-04-29-ojefijs.tar.xz

strace
m1-freeipa01p_strace_dirsrv_32320.txt.gz

atop
m1-freeipa01p_atop_20210429
ds-freeipa01p_atop_20210429

Comment 2 Corey Brown 2021-05-06 14:43:35 UTC

Hi,

The case owner asked for the following in the case and the customer has provided a response:

Can we take a look at the current HBAC rule - 

# ipa hbacrule-find <rule name>

-------------------
1 HBAC rule matched
-------------------
  Rule name: unix-admins_hbac
  Host category: all
  Service category: all
  Enabled: TRUE

Corey Brown