Bug 1290380 – RFE: Improve SSSD performance in large environments

Bug 1290380 - RFE: Improve SSSD performance in large environments

Summary:	RFE: Improve SSSD performance in large environments

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	sssd (Show other bugs)
Sub Component:
Version:	7.3
Hardware:	Unspecified Unspecified

Priority	high Severity medium
Target Milestone:	rc
Target Release:	---
Assigned To:	SSSD Maintainers
QA Contact:	Namita Soman
Docs Contact:	Marc Muehlfeld

URL:
Whiteboard:
Keywords:	FutureFeature

Depends On:
Blocks:	1292074 1296125 1313485
	Show dependency tree / graph

Reported:	2015-12-10 06:28 EST by Jakub Hrozek
Modified:	2016-11-04 03:13 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:	sssd-1.14.0-0.2.beta1.el7
Doc Type:	Enhancement
Doc Text:	SSSD cache update performance improvement Previously, the System Security Services Daemon (SSSD) always updated all cached entries after the cache validity timeout passed. This consumed unnecessarily resources on the client and the server, for entries that have not been changed. SSSD has been enhanced and now checks if the cached entry requires an update. The time stamp values are increased for unchanged entries and stored in the new SSSD database `/var/lib/sss/db/timestamps_$domain.ldb`. This enhancement improves the performance for entries that rarely change on the server side, such as groups.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-11-04 03:13:22 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jakub Hrozek 2015-12-10 06:28:25 EST

Description of problem:
At the moment, the SSSD performance, especially with the default settings is not great and users have to resort to workarounds like ignore_group_members or mounting the cache to tmpfs.

The purpose of this bugzilla is to track improvements we can do to make sure less data is transferred over network and the cache writes are handled better.

Other related bugzillas might be filed later for e.g. PAC responder improvements.

Version-Release number of selected component (if applicable):
1.13

How reproducible:
always

Steps to Reproduce:
1. run "id aduser" for an AD user who is a member of hundreds of large groups
2.
3.

Actual results:
id takes 10+ seconds

Expected results:
id should be faster

Additional info:

Comment 1 Jakub Hrozek 2015-12-10 06:29:20 EST

Upstream ticket:
https://fedorahosted.org/sssd/ticket/2602

Comment 3 Jakub Hrozek 2016-06-23 08:10:18 EDT

Patches pushed upstream:
    beec1ee5799570f34a51ea57674c7291c15f7022
    b8946a5dbde01a87465de707092716349a35248b
    d36f4db9bb5efc63b94190cca25adb08ee56971c
    3bd9da80f71a6794af0a6b3fbc11bc3a2da64638
    4016c7dd288d379118b47ecbe7d8f46cfcb0d400
    40de79d69860ec7f04bf7795bd88b641ec42fd23
    a257259b05d62ebe548b6c798a3aa03a97dbc0c2
    dd285415d7a8d8376207960cfa3e977524c3b98c
    13d7df10bf4d76c333a9169f9fcbeb891d870351
    f983b400bf4f6fb14a2174d6f58071e06e9ec832
    f21b3cce14055e77af8ccb98dd8e0fa1ec1f7944
    72dbcd0a3361f1c0f0c3e348aa2fbcabd926188b
    e732d23f3ec986a463d757781a334040e03d1f59
    6e9d7cbe43fdfc866b18f9ef0779bbfc10ad6f3a

Comment 5 Jakub Hrozek 2016-07-06 07:37:44 EDT

Hi Marc, I wonder if the upstream design page:
https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprovements
would give some idea?

Comment 8 Amith 2016-09-02 04:45:33 EDT

Verified the bug on SSSD Version: sssd-1.14.0-30.el7.x86_64

This feature has been tested thoroughly and a detailed Test plan sent to DEV for review. The main sysdb cache and timestamp cache features of this RFE are functional and working fine.

Comment 10 errata-xmlrpc 2016-11-04 03:13:22 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html

Note You need to log in before you can comment on or make changes to this bug.