very slow remove users process

[Adrian HY]

Hi folks, I have a freeipa group with 30000 users to delete. The process is
very very slow.  For example:

# time ipa -v user-del vvv

-------------------------
Deleted user "vvv"
-------------------------

real    0m16.913s
user    0m0.814s
sys     0m0.084s

The hardware parameters are normal. The hard drive is SSD.

Regards.

[thierry bordaz]

Hi Adrian,

deleting a user triggers several LDAP requests. In case the performance 
hit comes from slow DS requests, you would look in DS access log 
(/var/log/dirsrv/slapd-<inst>/access for the set of triggered requests. 
In each response, etime indicates the time spent by the each req. Can 
you isolate a/some specific req. that are very very long ?

regards
thierry

On 05/31/2017 12:52 AM, Adrian HY via FreeIPA-users wrote:
> Hi folks, I have a freeipa group with 30000 users to delete. The 
> process is very very slow.  For example:
>
> # time ipa -v user-del vvv
> Deleted user "vvv"
>
> real    0m16.913s
> user    0m0.814s
> sys     0m0.084s
>
> The hardware parameters are normal. The hard drive is SSD.
>
> Regards.
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[Rob Crittenden]

thierry bordaz via FreeIPA-users wrote:
> Hi Adrian,
>
> deleting a user triggers several LDAP requests. In case the performance
> hit comes from slow DS requests, you would look in DS access log
> (/var/log/dirsrv/slapd-<inst>/access for the set of triggered requests.
> In each response, etime indicates the time spent by the each req. Can
> you isolate a/some specific req. that are very very long ?

My guess would be it is slow in removing the user from ipausers. I'm not
sure how that shows in the logs as it is likely done by a plugin.

rob
> regards
> thierry
>
> On 05/31/2017 12:52 AM, Adrian HY via FreeIPA-users wrote:
> > Hi folks, I have a freeipa group with 30000 users to delete. The
> > process is very very slow.  For example:
> >
> > # time ipa -v user-del vvv
> > Deleted user "vvv"
> >
> > real    0m16.913s
> > user    0m0.814s
> > sys     0m0.084s
> >
> > The hardware parameters are normal. The hard drive is SSD.
> >
> > Regards.
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[thierry bordaz]

On 05/31/2017 03:30 PM, Rob Crittenden wrote:
> thierry bordaz via FreeIPA-users wrote:
> > Hi Adrian,
> >
> > deleting a user triggers several LDAP requests. In case the performance
> > hit comes from slow DS requests, you would look in DS access log
> > (/var/log/dirsrv/slapd-<inst>/access for the set of triggered requests.
> > In each response, etime indicates the time spent by the each req. Can
> > you isolate a/some specific req. that are very very long ?
>
> My guess would be it is slow in removing the user from ipausers. I'm not
> sure how that shows in the logs as it is likely done by a plugin.

I agree it is the most likely expensive req.
It may depends how many entries are referring to the deleted user but 
16sec is much higher than what expected.
> rob
> > regards
> > thierry
> >
> > On 05/31/2017 12:52 AM, Adrian HY via FreeIPA-users wrote:
> > > Hi folks, I have a freeipa group with 30000 users to delete. The
> > > process is very very slow.  For example:
> > >
> > > # time ipa -v user-del vvv
> > > Deleted user "vvv"
> > >
> > > real    0m16.913s
> > > user    0m0.814s
> > > sys     0m0.084s
> > >
> > > The hardware parameters are normal. The hard drive is SSD.
> > >
> > > Regards.
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]

[thierry bordaz]

Hi,

Just for recording, this issue of slow user-del will be track with 
https://pagure.io/389-ds-base/issue/49286

regards
thierry
On 05/31/2017 03:45 PM, thierry bordaz via FreeIPA-users wrote:
> On 05/31/2017 03:30 PM, Rob Crittenden wrote:
> > thierry bordaz via FreeIPA-users wrote:
> > > Hi Adrian,
> > >
> > > deleting a user triggers several LDAP requests. In case the performance
> > > hit comes from slow DS requests, you would look in DS access log
> > > (/var/log/dirsrv/slapd-<inst>/access for the set of triggered requests.
> > > In each response, etime indicates the time spent by the each req. Can
> > > you isolate a/some specific req. that are very very long ?
> >
> > My guess would be it is slow in removing the user from ipausers. I'm not
> > sure how that shows in the logs as it is likely done by a plugin.
>
> I agree it is the most likely expensive req.
> It may depends how many entries are referring to the deleted user but 
> 16sec is much higher than what expected.
> > rob
> > > regards
> > > thierry
> > >
> > > On 05/31/2017 12:52 AM, Adrian HY via FreeIPA-users wrote:
> > > > Hi folks, I have a freeipa group with 30000 users to delete. The
> > > > process is very very slow.  For example:
> > > >
> > > > # time ipa -v user-del vvv
> > > > Deleted user "vvv"
> > > >
> > > > real    0m16.913s
> > > > user    0m0.814s
> > > > sys     0m0.084s
> > > >
> > > > The hardware parameters are normal. The hard drive is SSD.
> > > >
> > > > Regards.
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to 
> > > > [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to 
> > > [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]