Bug 979045
Summary: | sssd_be goes to 99% CPU and causes significant login delays when client is under load | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Dmitri Pal <dpal> | |
Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> | |
Status: | CLOSED CURRENTRELEASE | QA Contact: | Kaushik Banerjee <kbanerje> | |
Severity: | unspecified | Docs Contact: | ||
Priority: | medium | |||
Version: | 7.0 | CC: | grajaiya, jgalipea, jhrozek, nsoman, pbrezina | |
Target Milestone: | rc | |||
Target Release: | --- | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | sssd-1.10.0-18.el7 | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 979046 (view as bug list) | Environment: | ||
Last Closed: | 2014-06-13 10:28:38 UTC | Type: | --- | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 979046, 979047 |
Description
Dmitri Pal
2013-06-27 13:34:13 UTC
Please add steps to verify this (In reply to Namita Soman from comment #1) > Please add steps to verify this To reproduce, create a very large hostgroup. I used 2000 hosts for my testing, then the bug was visible. Then create an HBAC rule that references this hostgroup. Make sure to disable the allow_all rule for the test. Then log in to the client. With the unpatched SSSD, the CPU will spike for a couple of seconds. With the patch, the login should be quite faster and there should be no CPU spike. I would also advise to make sure the user is not a member of large groups to avoid the memberof plugin doing much work during login. That way the only CPU-intensive task is saving the large hostgroup. Alternatively (or in addition) you could check that the "member" attribute is not downloaded from the server at all. Fixed upstream. Temporarily moving bugs to MODIFIED to work around errata tool bug Tested using ipa-server-3.3.3-18.el7.x86_64, sssd-1.11.2-40.el7.x86_64, ipa-client-3.3.3-18.el7.x86_64 Added a host group - hostgroup1 Added 2000 hosts Added these hosts to the hostgroup Installed ipaclient, and added that host to same hostgroup Added hbac rule, allowing user (user one) to access hosts in the hostgroup (hostgroup1), and allowing access to a service (sshd). Disabled hbac rule allow_all Ran kdestroy ssh'd as user (one) from master server to the host where the rhel 7 client is installed. Was able to login fast. There was no cpu spikes or messages in sssd_testrelm.test.log This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |