[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Slow search with cn=*, not with cn=abc*



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Thanks for downgrading to debug the problem!

BTW I was using 2.1.25 not 2.1.26, and certainly not yet 2.1.29, but the 
problem is still there.

I suspected it was in PHP, but ldapsearch has the same very long time to find 
1000 users with 'cn=*'  and considerably shorter with cn="abc*"

The first for rules in my ACL are:

# Allow read access of root DSE to ALL
access to dn=""
        by * read

# Allow read access of 'cn=Subschema' to ALL
access to dn="cn=Subschema"
        by * read

# Allow search access on attrs=objectclass,uid to ANONYMOUS
access to attrs=objectclass,uid
        by anonymous search stop
        by * none break

# Allow read access on attrs=entry,cn to ANONYMOUS
access to attrs=entry,cn,qwidostatus
        by anonymous read stop
        by * none break

Since I am doing 

	ldapsearch -x -h localhost -p 9389 -b "qwidoApp=qwido" 
	"(&(objectclass=qwidoQmailUser)(cn=*))"

which is an anonymous bind, it should evaluate only the first 4 rules...

Wait a minute... if I search specifically for attribute cn, as you suggested,
like this:

	ldapsearch -x -h localhost -p 9389 -b "qwidoApp=qwido" 
	"(&(objectclass=qwidoQmailUser)(cn=*))" cn

then the time for cn=* is considerably shorter... about a second or 2, instead 
of 12 - 20.

Conclusion: evaluation of my long list of ACL's slows things down!

Thanks for helping me find a possible solution. That is, IF I can make my 
ACL's more efficient :-(

Cheers,
ace






> søn, 11.04.2004 kl. 19.33 skrev Ace Suares:
> > I am encountering a slow search when I search for something like
> > 	(&(objectclass=qmailuser)(cn=*))
> > but not if I use something like
> > 	(&(objectclass=qmailuser)(cn=abc*))
> >
> > I use openLDAP 2.1.26, bdb 4.2.52 with the latest patches, on Debian
> > Woody.
>
> I dropped back to OL from 2.2.8 to 2.1.29 in the weekend and just tried
> this for you (but with max 100 entries):
>
> ldapsearch -x '(&(objectclass=CourierMailAccount)(cn=t*))' cn, etc (as
> you stated). All were more or less instantaneous (didn't take the time).
> Indices: cn pres,eq objectClass pres,eq.
>
> This was using ldapi, BDB 4.2.52/patches, RedHat RHEL3
>
> --Tonni

- -- 
Ace Suares' Internet Consultancy
NIEUW ADRES: Postbus 2599, 4800 CN Breda
telefoon: 06-244 33 608
fax en voicemail: 0848-707 705
website: http://www.suares.nl * http://www.qwikzite.nl
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQFAexXuy7boE8xtIjURAt0rAJ9pqy9RjOQ7vu3Kp+UmkVOPmIhT9gCeO1fK
AXf7iTUOwXzApmAgddf+VKs=
=qIvP
-----END PGP SIGNATURE-----