0

We have LDAP setup to provide information regarding sudo. The whole system works, but it takes a long time (~10 seconds) for any sudo command to return.

For instance if I run

 strace -f -r -o strace.sudo-l.wri sudo -l

We see this show up in the strace output - blank lines added to show looping code:

16737      0.000129 open("/etc/netgroup", O_RDONLY) = -1 ENOENT (No such file or directory)
16737      0.000131 socket(PF_FILE, SOCK_STREAM, 0) = 6
16737      0.000097 connect(6, {sa_family=AF_FILE, path="/var/run/nslcd/socket"}, 110) = 0
16737      0.000246 select(1024, NULL, [6], NULL, {9, 999999}) = 1 (out [6], left {9, 999995})
16737      0.000192 sendto(6, "\1\0\0\0\341.\0\0\17\0\0\0TestGroup1_users", 27, MSG_NOSIGNAL, NULL, 0) = 27
16737      0.000134 select(1024, [6], NULL, NULL, {59, 999999}) = 1 (in [6], left {59, 987006})
16737      0.013308 read(6, "\1\0\0\0\341.\0\0\3\0\0\0", 1024) = 12
16737      0.000153 close(6)            = 0

16737      0.000114 open("/etc/netgroup", O_RDONLY) = -1 ENOENT (No such file or directory)
16737      0.000112 socket(PF_FILE, SOCK_STREAM, 0) = 6
16737      0.000091 connect(6, {sa_family=AF_FILE, path="/var/run/nslcd/socket"}, 110) = 0
16737      0.000214 select(1024, NULL, [6], NULL, {9, 1000000}) = 1 (out [6], left {9, 999996})
16737      0.000215 sendto(6, "\1\0\0\0\341.\0\0\21\0\0\0TestGroup2_users", 29, MSG_NOSIGNAL, NULL, 0) = 29
16737      0.000129 select(1024, [6], NULL, NULL, {59, 1000000}) = 1 (in [6], left {59, 987427})
16737      0.012863 read(6, "\1\0\0\0\341.\0\0\0\0\0\0\310\1\0\0\1\0\0\0-\10\0\0\0username1"..., 1024) = 248
16737      0.000156 close(6)            = 0

16737      0.000112 open("/etc/netgroup", O_RDONLY) = -1 ENOENT (No such file or directory)
16737      0.000110 socket(PF_FILE, SOCK_STREAM, 0) = 6
16737      0.000092 connect(6, {sa_family=AF_FILE, path="/var/run/nslcd/socket"}, 110) = 0
16737      0.000215 select(1024, NULL, [6], NULL, {9, 999999}) = 1 (out [6], left {9, 999995})
16737      0.000208 sendto(6, "\1\0\0\0\341.\0\0\17\0\0\0TestGroup3_users", 27, MSG_NOSIGNAL, NULL, 0) = 27
16737      0.000152 select(1024, [6], NULL, NULL, {59, 999999}) = 1 (in [6], left {59, 987404})
16737      0.012881 read(6, "\1\0\0\0\341.\0\0\3\0\0\0", 1024) = 12
16737      0.000121 close(6)            = 0

Note the relatively long times for the "read(6," calls to return. There are over 800 read calls, and 800 * 0.0128 seconds == 10.37 seconds.

I get that the call takes some amount of time over the wire, but the strace output shows that it's doing a lot of the same work over and over and over:

  • open("/etc/netgroup", O_RDONLY) = -1 ENOENT (No such file or directory)
  • connect(6, {sa_family=AF_FILE, path="/var/run/nslcd/socket"}, 110) = 0
  • read(6, "\1\0\0\0\341.\0\0\3\0\0\0", 1024) = 12
  • close(6) = 0

Is there a flag in sudo-ldap.conf or pam_ldap.conf (or elsewhere) that I mis-configured that's causing this, or is this a performance bug in the sudo code? (Or something else?)

  • Huge config files? ldap.conf, etc? Is name resolution working properly between hosts? Have you changed the hostname since installation? – Kevin_Kinsey Feb 6 '15 at 22:00
  • And, what is your hostname? – Kevin_Kinsey Feb 6 '15 at 22:01
  • - Huge config files? Not really, /etc/openldap/ldap.conf is 399 bytes, /etc/pam_ldap.conf is 8,937 bytes. - Is name resolution working properly between hosts? Yes, client running "time dig $LDAPSERVERNAME" returns in less than 0.01 seconds, as does the "time dig -x $SERVERIPADDR". From the server, doing the same to the client name/IP is equally as fast and accurate. - Have you changed the hostname since installation? No the client has been named "redhat357" since birth. - And, what is your hostname? The problem is across numerous machines, but in this case it is named "redhat357". – dan_linder Feb 6 '15 at 22:50
  • Try running nslcd in the foreground in debug mode to see what's taking so long – Andy Feb 14 '15 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.