Bug 1290380 - RFE: Improve SSSD performance in large environments
Summary: RFE: Improve SSSD performance in large environments
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.3
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: Namita Soman
Marc Muehlfeld
URL:
Whiteboard:
Depends On:
Blocks: 1292074 1296125 1313485
TreeView+ depends on / blocked
 
Reported: 2015-12-10 11:28 UTC by Jakub Hrozek
Modified: 2020-05-02 17:58 UTC (History)
11 users (show)

Fixed In Version: sssd-1.14.0-0.2.beta1.el7
Doc Type: Enhancement
Doc Text:
SSSD cache update performance improvement Previously, the System Security Services Daemon (SSSD) always updated all cached entries after the cache validity timeout passed. This consumed unnecessarily resources on the client and the server, for entries that have not been changed. SSSD has been enhanced and now checks if the cached entry requires an update. The time stamp values are increased for unchanged entries and stored in the new SSSD database `/var/lib/sss/db/timestamps_$domain.ldb`. This enhancement improves the performance for entries that rarely change on the server side, such as groups.
Clone Of:
Environment:
Last Closed: 2016-11-04 07:13:22 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3643 0 None closed Optimize cache writes to sysdb 2020-09-07 21:00:26 UTC
Red Hat Product Errata RHEA-2016:2476 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2016-11-03 14:08:11 UTC

Description Jakub Hrozek 2015-12-10 11:28:25 UTC 
Description of problem:
At the moment, the SSSD performance, especially with the default settings is not great and users have to resort to workarounds like ignore_group_members or mounting the cache to tmpfs.

The purpose of this bugzilla is to track improvements we can do to make sure less data is transferred over network and the cache writes are handled better.

Other related bugzillas might be filed later for e.g. PAC responder improvements.

Version-Release number of selected component (if applicable):
1.13

How reproducible:
always

Steps to Reproduce:
1. run "id aduser" for an AD user who is a member of hundreds of large groups
2.
3.

Actual results:
id takes 10+ seconds

Expected results:
id should be faster

Additional info:
Comment 1 Jakub Hrozek 2015-12-10 11:29:20 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2602
Comment 3 Jakub Hrozek 2016-06-23 12:10:18 UTC 
Patches pushed upstream:
    beec1ee5799570f34a51ea57674c7291c15f7022
    b8946a5dbde01a87465de707092716349a35248b
    d36f4db9bb5efc63b94190cca25adb08ee56971c
    3bd9da80f71a6794af0a6b3fbc11bc3a2da64638
    4016c7dd288d379118b47ecbe7d8f46cfcb0d400
    40de79d69860ec7f04bf7795bd88b641ec42fd23
    a257259b05d62ebe548b6c798a3aa03a97dbc0c2
    dd285415d7a8d8376207960cfa3e977524c3b98c
    13d7df10bf4d76c333a9169f9fcbeb891d870351
    f983b400bf4f6fb14a2174d6f58071e06e9ec832
    f21b3cce14055e77af8ccb98dd8e0fa1ec1f7944
    72dbcd0a3361f1c0f0c3e348aa2fbcabd926188b
    e732d23f3ec986a463d757781a334040e03d1f59
    6e9d7cbe43fdfc866b18f9ef0779bbfc10ad6f3a
Comment 5 Jakub Hrozek 2016-07-06 11:37:44 UTC 
Hi Marc, I wonder if the upstream design page:
https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprovements
would give some idea?
Comment 8 Amith 2016-09-02 08:45:33 UTC 
Verified the bug on SSSD Version: sssd-1.14.0-30.el7.x86_64

This feature has been tested thoroughly and a detailed Test plan sent to DEV for review. The main sysdb cache and timestamp cache features of this RFE are functional and working fine.
Comment 10 errata-xmlrpc 2016-11-04 07:13:22 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html
Note You need to log in before you can comment on or make changes to this bug.