[Samba] gencache.tdb size and cache flush

[Francesco Malvezzi]

Il 04/09/18 12:42, Volker Lendecke ha scritto:
> On Tue, Sep 04, 2018 at 11:59:04AM +0200, Francesco Malvezzi wrote:
>> Il 04/09/18 06:00, Volker Lendecke ha scritto:
>>> Hi!
>>>
>>> Technical description below, but the exec summary is: Yes, we have a
>>> performance problem with gencache.
>>>
>>> On Wed, Aug 29, 2018 at 10:28:05AM +0200, Francesco Malvezzi via samba wrote:
>>>> Hi all,
>>>>
>>>> I have a midsize AD domain with some 50k users but only 100 workstations
>>>> joined.
>>>>
>>>> Sometimes I find server CPU throttling at 100%. In order to let it drop
>>>
>>> Can you find out where *exactly* that 100% is spent? gstack on the
>>> spinning process with debug symbols would be very helpful here.
>>
>> not sure how to do it.
>>
>> can be like that
>> https://gist.github.com/francescm/8e396f5470da8df8451be13777e18810
>> ?
> 
> Yes, exactly. The relevant line is
> 
> #19 0x00007fe50c1c5a3c in dcesrv_samr_EnumDomainUsers

thank you for reading all that stuff.

> 
> which means that some client is listing all users in your domain. With
> 50.000 users this takes a while. If the client times out and
> reconnects, this can pretty quickly pile up.

If I simulate it by listing all user in Active Directory User and
Computer utility, I obtain a load raise at 100% cpu, very short because
client disconnects at around 1000 users.

A call to:
time sudo ./bin/ldbsearch -H private/sam.ldb "(objectClass=user)" >
/dev/null

real	0m22,410s
user	0m20,132s
sys	0m2,072s

describes better your scenario: one cpu is full load for about 20
seconds and then it drops.

> 
> Do you have Linux clients with winbind and "winbind enum users = yes"
> in your network? This would probably do that to your DC.

As far as I know, the winbindd clients in our milieu do not enumerate
users, unless misconfigured (but can't talk for MacOSX clients),

thank you,

franz