[Samba] performance issue with large group and dbcheck / dc join

[Denis Cardon]

Hi everyone,

yesterday I had to debug a failing join on a large domain for a group of 
primary schools with 1000+ desktop and 10k accounts. The domain run 
mostly ok except for some replications issues, however joining a new DC 
just takes eons and so does dbcheck.

After some investigation into dbcheck (4.1.17) and some "human powered" 
valgrind like evalution using pudb, I came to the conclusion that it was 
the computation of the memberof attribute that was to blame. Disabling 
that attribute check in the dbcheck code did solve the issue.

Actually there was a "pupils" group where all new pupils were 
automaticaly added (and which had in fact no real usage). So that was a 
group with about 10k members. Deleting the group resolved the dbcheck 
performance issue and the join at the same time. The dbcheck went for a 
few hours of run to just 6 minutes. I think that thread was experiencing 
a similar issue: https://lists.samba.org/archive/samba/2014-July/182819.html

Doing such large group is probably not a good idea, be it on a samba4 AD 
or on a MS AD. But for people with linux scripting background, it is 
much easier to just add a line in their adduser script that screw up the 
whole thing.

Should I open a bug for that?

Cheers,

Denis
-- 
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr