[Samba] High cpu load on LDAP
Heinz Hölzl
heinz.hoelzl at gvcc.net
Wed Jan 22 06:54:32 UTC 2025
hi,
here is the number of member assignments:
regards,
Heinz
ldbsearch -H /usr/local/samba/private/sam.ldb | \
grep -o -C1 '^member\b' | uniq -c | grep member | sort -n
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
2 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
3 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
4 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
5 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
6 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
7 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
8 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
9 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
10 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
11 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
12 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
13 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
14 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
15 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
16 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
17 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
18 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
19 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
20 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
21 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
22 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
23 member
24 member
24 member
24 member
24 member
24 member
24 member
24 member
24 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
25 member
26 member
26 member
26 member
26 member
26 member
27 member
27 member
27 member
27 member
27 member
27 member
28 member
28 member
28 member
28 member
28 member
28 member
28 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
29 member
30 member
30 member
30 member
30 member
30 member
30 member
30 member
30 member
30 member
31 member
31 member
31 member
31 member
31 member
31 member
31 member
31 member
31 member
31 member
32 member
32 member
32 member
32 member
32 member
32 member
33 member
33 member
33 member
33 member
33 member
33 member
34 member
34 member
34 member
34 member
34 member
34 member
34 member
34 member
35 member
35 member
35 member
35 member
36 member
36 member
36 member
36 member
36 member
36 member
36 member
36 member
36 member
37 member
37 member
37 member
37 member
38 member
38 member
38 member
38 member
38 member
38 member
38 member
39 member
39 member
39 member
39 member
40 member
40 member
40 member
42 member
42 member
42 member
42 member
43 member
43 member
44 member
44 member
44 member
44 member
45 member
45 member
45 member
45 member
45 member
46 member
46 member
46 member
47 member
48 member
48 member
48 member
48 member
49 member
49 member
49 member
49 member
50 member
50 member
50 member
51 member
51 member
52 member
52 member
54 member
55 member
55 member
55 member
56 member
56 member
57 member
57 member
58 member
59 member
61 member
66 member
66 member
67 member
67 member
67 member
69 member
71 member
72 member
74 member
74 member
75 member
76 member
78 member
79 member
79 member
84 member
85 member
88 member
89 member
90 member
91 member
92 member
95 member
98 member
104 member
107 member
109 member
109 member
111 member
117 member
128 member
134 member
145 member
151 member
174 member
175 member
179 member
222 member
275 member
408 member
530 member
604 member
694 member
785 member
Am Mittwoch, dem 22.01.2025 um 15:04 +1300 schrieb Douglas Bagnall:
On 21/01/25 21: 30, Heinz Hölzl via samba wrote: > Hi Douglas, > >> Samba AD does not do this rephrasing, probably because in the distant >> past (a) it was not used at scale, (b) we didn't trust our backlinks, >> and
On 21/01/25 21:30, Heinz Hölzl via samba wrote:
> Hi Douglas,
>
>> Samba AD does not do this rephrasing, probably because in the distant
>> past (a) it was not used at scale, (b) we didn't trust our backlinks,
>> and (c) we didn't think of it. We could/should do it now, but it will
>> take a bit of work.
>
> I'm not sure if that's the problem in our AD, but it's a possibility.
>
> We still have massive performance problems every Monday, the ldap
> processes are often blocked for up to 10 seconds to 1-2 minutes and
> sometimes no longer respond at all.
>
> We have a total of 21500 assignments between users and groups:
> ldbsearch -b dc=xxxx,dc=xxx -H /usr/local/samba/private/sam.ldb member|
> grep ^member| wc -l
> 21539
>
> I ask you to think about whether this could be the cause of our
> problems.
It depends more on the size of the big groups, than on the overall
number of memberships.
This hack might help:
ldbsearch -H /usr/local/samba/private/sam.ldb | \
grep -o -C1 '^member\b' | uniq -c | grep member | sort -n
On a test environment, it tells me
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
1 member
2 member
3 member
3 member
8 member
which is saying the biggest group has 8 members, 2 others have 3
members, one has 2, and lots have 1.
If your 21k memberships are spread evenly across a few hundred groups,
that should be no problem. But they won't be. You will probably have one
or two groups with 10k users, and a long tail of tiny groups.
The Monday morning surge is clients for some reason searching for entire
membership of a 10k group. The intention is likely to confirm that
user X is indeed in the group, which could more easily be confirmed by
looking at the memberOf attribute on user X.
That's my suspicion.
Douglas
More information about the samba
mailing list