On 09/14/2015 09:42 AM, ghiureai wrote:

Please keep replies on-list.

HI Rich, here is some details and Q from developers which designed the DS tree , has performance issues, any input from you much appreciate it:

The slow query problem seems to be related to the acis. Please send the following question to your redhat collaborator.

"We have the following LDAP structure:

A->B(one)->C(few thousand)

B has macro acis that refer to the C nodes.

By "node" do you mean a host/machine, or a subtree in the DIT?

The ldapsearch command to list the cn of all C nodes is more than an order of magnitude slower when B is used as the base compared to when A is used as the base node (1-2s vs 10-20s or more). This is counter intuitive as A has other children besides B. Performance is much better when the macro acis are removed. Are macro acis cached when A is used as the base? Is this normal or we are doing something wrong? Is there a solution to this?"

Don't know, but yes, it looks as though the performance is related to macro ACI handling.

Please file a bug/ticket with 389.

Thanks, Isabella

On 09/11/2015 08:35 AM, Rich Megginson wrote:

...

On 09/11/2015 08:50 AM, ghiureai wrote:

...

Fast query:

ldapsearch -x -h xxx -b "ou=ds,dc=cb,dc=net" -W -D "uid=axxx,ou=Users,ou=ds,dc=cb,dc=net" "(objectclass=groupofuniquenames)" "cn" | sort -u | wc

Slow query: ldapsearch -x -h xxx-b "ou=groups,ou=ds,dc=cb,dc=net" -W -D "uid=axxx,ou=Users,ou=ds,dc=cb,dc=net" "(objectclass=groupofuniquenames)" "cn" | sort -u | wc

What version of 389? rpm -q 389-ds-base

What is the time difference between the fast query and the slow query (e.g. time ldapsearch -x -h xxx ... for both queries)

What does the access log say? For example, provide the excerpts from the access log for both queries showing the connection through the unbind/disconnect.

Is there anything in the errors log during the time of the slow search?

...

On 09/10/2015 03:00 PM, ghiureai wrote:

...

Hi Gurus, we are seening some performance issues when running ldapsearch with tree ou=Groups, ou=ds , dc=abc, dc=net takes longer than when looking for same user but from one level up of tree up aka :ou=ds, dc=abc,dc=net, the difference in time very high , any idea why we seeing this ? Also we are seeing time exec diff when running from same levele of DS( under ou=ds) but different ou's ?

Isabella