Re: MDB indices operations (MIT Kerberos with OpenLDAP backend)

[Michael Ströder <michael@stroeder.com>]

On 9/21/19 9:39 AM, Дилян Палаузов wrote:
> Does a mdb_equality_candidates log message mean, that adding indices
> will improve the search?
Not in every case. You have to analyze the filters actually used by your
application.

Otherwise blindly indexing attributes without analysis can result in
performance getting worse.

IMO in its current form the message is useless.

> The particular use-case is the OpenLDAP backend of MIT Kerberos and the indices it
> needs for this query, as discussed at
> https://github.com/krb5/krb5/pull/974#issuecomment-531167854.  The debug output
> of OpenLDAP, when there is no objectClass eq index, but a krbPrincipal eq index, is:
> 
> If the Kerberos LDAP DB is large and isn't shared with a lot of other
> LDAP data, almost every object in the database will match one of the
> objectClass equality tests, but only one will match the
> krbPrincipalName test.  In that scenario, an objectClass index is
> useless, as it doesn't reduce the number of candidates significantly,
> while the krbPrincipalName index is useful.

Correct.

But IIRC attribute objectClass is a special case. It should have an
eq-index for other stuff. Forgot the details though. Maybe Quanah or
others could provide more info.

Ciao, Michael.