samba - Sep 2005 - SAMBA 3.0.14a getpwent() usage with LDAP backend -- URGENT HELP!!!

Hi,

We're being hit by occasional very high load (up to 23 on a SUN Fire 
v440) on our LDAP server
coming from a query of (objectClass=posixAccount).  This currently
returns over 54,000 entries ...

This is coming from the getpwent() call in util_getent.c:getpwent_list()

This is coming from srv_samr_nt.c:get_memberuids()

But we're having trouble working out what triggers this call:  it
happens mostly during the morning startup period, but happens
occasionally thoughout the day.  It is not triggered by anything we
can think of with our clients MS/Win/XP, smbclient, Mac OS/X.  But
might be coming from clients we can't replicate: NT4, W2K, ???

Is there any alternative to getting the list of all users in
get_memberuids() ?

This causes a 2 hr slot in the morning when users have trouble loggin 
in, which is effecting about 6000 users!
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Daniel Wilson
Systems Administrator

IT & Communications Service - SLS
University of Sunderland
Unit 1a Technology Park
Chester Road
Sunderland
SR2 7PT

Tel: 0191 515 2695

This e-mail contains information which is confidential and may be 
privileged and is for the exclusive use of the recipient.
It is the responsibility of the recipient to ensure that this message 
and its attachments are virus free.
Any views or opinions presented are solely those of the author and do 
not necessarily represent those of the University, unless otherwise 
specifically
stated.

Do you have a good fragment of a log level 10 during the event and a
smb.conf file? Perhaps a sample of the LDAP record with the hashes X'd
out....I'm assuming you're using nss?


Cheers,

Bill


----- Original Message ----- 
From: "Daniel Wilson" <daniel.wilson@sunderland.ac.uk>
To: <samba@lists.samba.org>
Sent: Thursday, September 29, 2005 12:33 PM
Subject: [Samba] SAMBA 3.0.14a getpwent() usage with LDAP backend -- 
URGENTHELP!!!

> Hi,
>
> We're being hit by occasional very high load (up to 23 on a SUN Fire
> v440) on our LDAP server
> coming from a query of (objectClass=posixAccount).  This currently
> returns over 54,000 entries ...
>
> This is coming from the getpwent() call in util_getent.c:getpwent_list()
>
> This is coming from srv_samr_nt.c:get_memberuids()
>
> But we're having trouble working out what triggers this call:  it
> happens mostly during the morning startup period, but happens
> occasionally thoughout the day.  It is not triggered by anything we
> can think of with our clients MS/Win/XP, smbclient, Mac OS/X.  But
> might be coming from clients we can't replicate: NT4, W2K, ???
>
> Is there any alternative to getting the list of all users in
> get_memberuids() ?
>
> This causes a 2 hr slot in the morning when users have trouble loggin
> in, which is effecting about 6000 users!
> -- 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Daniel Wilson
> Systems Administrator
>
> IT & Communications Service - SLS
> University of Sunderland
> Unit 1a Technology Park
> Chester Road
> Sunderland
> SR2 7PT
>
> Tel: 0191 515 2695
>
> This e-mail contains information which is confidential and may be
> privileged and is for the exclusive use of the recipient.
> It is the responsibility of the recipient to ensure that this message
> and its attachments are virus free.
> Any views or opinions presented are solely those of the author and do
> not necessarily represent those of the University, unless otherwise
> specifically
> stated.
>
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba
>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel Wilson wrote:
> Hi,
> 
> We're being hit by occasional very high load (up to 23 on a SUN Fire
> v440) on our LDAP server
> coming from a query of (objectClass=posixAccount).  This currently
> returns over 54,000 entries ...
> 
> This is coming from the getpwent() call in util_getent.c:getpwent_list()
> 
> This is coming from srv_samr_nt.c:get_memberuids()

You might be interested in testing ldapsam:trusted=yes (see
the recent thread on this).  My first guess would be that
this is related to group membership.  You might also trying setting

	winbind enum users = no
	winbind enum groups = no





cheers, jerry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDPXtmIR7qMdg1EfYRAmpsAKCHO+H7+HTZet/NuNIYGMQMYe9bwQCfRvel
DE/k1NIx3IbI9fMQkImoQZI=3KHE
-----END PGP SIGNATURE-----