Large DNS zone

[Sigbjorn Lie]

Hi list,

I have recently imported a DNS zone into IPA, having just over 14 000 records in the DNS
zone. When trying to list the records in the webui, there an error message is displayed
"Search result has been truncated: Configured administrative server limit exceeded”.
I expected this with such a large DNS zone, and the "Search time limit” and
"Search size limit” set to default. 

What I didn’t expect, was when trying to search for a subset of records, the same erors
are displayed. The same error appear in both the webui and the CLI using “ipa
dnsrecord-find”. Some records show, other records doesn’t show.

When I know the exact name of the record, I may display it using “ipa dnsrecord-show”
without any timeout errors.

I have tried increasing the time limit to 20 seconds and the size limit to 20 000 using
"ipa config-mod", which I know is well excessive, however I still receive the
same error message.

I do find the record using ldapsearch and searching for "idnsName=dnsreco*”, so ldap
itself it working when searching for a dns record using a wildcard, however the IPA
framework does not seem to work.

Is there any setting I may tweak beside the "Search time limit” and "Search size
limit” to make the IPA framework successfully find the DNS records?

BIND + dyndb-ldap is working just fine. All DNS records is served from the large DNS
zone.


Regards.
Siggi

[Alexander Bokovoy]

On ke, 28 helmi 2018, Sigbjorn Lie via FreeIPA-users wrote:
> Hi list,
>
> I have recently imported a DNS zone into IPA, having just over 14 000
> records in the DNS zone. When trying to list the records in the webui,
> there an error message is displayed "Search result has been truncated:
> Configured administrative server limit exceeded”. I expected this with
> such a large DNS zone, and the "Search time limit” and "Search size
> limit” set to default.
>
> What I didn’t expect, was when trying to search for a subset of
> records, the same erors are displayed. The same error appear in both
> the webui and the CLI using “ipa dnsrecord-find”. Some records show,
> other records doesn’t show.
>
> When I know the exact name of the record, I may display it using “ipa
> dnsrecord-show” without any timeout errors.
>
> I have tried increasing the time limit to 20 seconds and the size limit
> to 20 000 using "ipa config-mod", which I know is well excessive,
> however I still receive the same error message.
>
> I do find the record using ldapsearch and searching for
> "idnsName=dnsreco*”, so ldap itself it working when searching for a dns
> record using a wildcard, however the IPA framework does not seem to
> work.
>
> Is there any setting I may tweak beside the "Search time limit” and
> "Search size limit” to make the IPA framework successfully find the DNS
> records?
>
> BIND + dyndb-ldap is working just fine. All DNS records is served from
> the large DNS zone. 
Recently there was a bug fixed in 389-ds where anonymous bind
limits
were leaking occasionally into authenticated bind access. It affected
GSS-SPNEGO SASL binds used by IPA framework. The fix for this is not
released yet:
https://pagure.io/389-ds-base/issue/49296
https://bugzilla.redhat.com/show_bug.cgi?id=1515190


-- 
/ Alexander Bokovoy

[Sigbjorn Lie]

>  On 28 Feb 2018, at 10:48, Alexander Bokovoy
> <abokovoy(a)redhat.com&gt; wrote:
>  
>  On ke, 28 helmi 2018, Sigbjorn Lie via FreeIPA-users wrote:
> > Hi list,
> > 
> > I have recently imported a DNS zone into IPA, having just over 14 000
> > records in the DNS zone. When trying to list the records in the webui,
> > there an error message is displayed "Search result has been truncated:
> > Configured administrative server limit exceeded”. I expected this with
> > such a large DNS zone, and the "Search time limit” and "Search size
> > limit” set to default.
> > 
> > What I didn’t expect, was when trying to search for a subset of
> > records, the same erors are displayed. The same error appear in both
> > the webui and the CLI using “ipa dnsrecord-find”. Some records show,
> > other records doesn’t show.
> > 
> > When I know the exact name of the record, I may display it using “ipa
> > dnsrecord-show” without any timeout errors.
> > 
> > I have tried increasing the time limit to 20 seconds and the size limit
> > to 20 000 using "ipa config-mod", which I know is well excessive,
> > however I still receive the same error message.
> > 
> > I do find the record using ldapsearch and searching for
> > "idnsName=dnsreco*”, so ldap itself it working when searching for a dns
> > record using a wildcard, however the IPA framework does not seem to
> > work.
> > 
> > Is there any setting I may tweak beside the "Search time limit” and
> > "Search size limit” to make the IPA framework successfully find the DNS
> > records?
> > 
> > BIND + dyndb-ldap is working just fine. All DNS records is served from
> > the large DNS zone.
>  Recently there was a bug fixed in 389-ds where anonymous bind limits
>  were leaking occasionally into authenticated bind access. It affected
>  GSS-SPNEGO SASL binds used by IPA framework. The fix for this is not
>  released yet:
>  https://pagure.io/389-ds-base/issue/49296
> <https://pagure.io/389-ds-base/issue/49296>
>  https://bugzilla.redhat.com/show_bug.cgi?id=1515190
> <https://bugzilla.redhat.com/show_bug.cgi?id=1515190>
>  
>  
>  -- 
>  / Alexander Bokovoy 
Ok, thank you for a rapid reply. :)


Regards,
Siggi