Bug 41551

Summary: Reduce CPU load of dcesrv_samr_GetGroupsForUser
Product: UCS Reporter: Arvid Requate <requate>
Component: Samba4Assignee: Arvid Requate <requate>
Status: CLOSED FIXED QA Contact: Stefan Gohmann <gohmann>
Severity: normal    
Priority: P5 CC: gohmann
Version: UCS 4.1   
Target Milestone: UCS 4.1-2-errata   
Hardware: Other   
OS: Linux   
What kind of report is it?: Bug Report What type of bug is this?: 2: Improvement: Would be a product improvement
Who will be affected by this bug?: 2: Will only affect a few installed domains How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.069 Enterprise Customer affected?: Yes
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: 2015110921000315 Bug group (optional): Large environments, Troubleshooting, UCS Performance
Max CVSS v3 score:
Attachments: 0001-s4-samr-Rework-GetGroupsForUser-to-use-memberOf.patch

Description Arvid Requate univentionstaff 2016-06-13 20:00:43 CEST
Created attachment 7738 [details]
0001-s4-samr-Rework-GetGroupsForUser-to-use-memberOf.patch

In one customer environment (Ticket #2015110921000315) the rpc_server component of Samba drew 100% CPU pretty much 24x7. Perf flamegraphs indicated that the dcesrv_samr_GetGroupsForUser code took the largest CPU share.

The attached patch attempts to make this code more efficient.
Comment 1 Arvid Requate univentionstaff 2016-06-13 20:04:38 CEST
Please note that that environment proved to be special, as a bunch of non-UCS SMB-clients didn't run winbind. None the less, the patch should improve scalability and performance.
Comment 2 Arvid Requate univentionstaff 2016-06-27 13:25:59 CEST
*** Bug 41665 has been marked as a duplicate of this bug. ***
Comment 3 Arvid Requate univentionstaff 2016-06-27 21:05:43 CEST
Samba has been rebuilt with this patch and two additional upstream regression patches:

https://bugzilla.samba.org/show_bug.cgi?id=11948
https://bugzilla.samba.org/show_bug.cgi?id=11982

I did some basic performance tests before and after this update and could not verify any positive effect. I created a user account with samba-tool and 100 groups, added the user to them and then I've run "time net rpc user info" a 100 times and took the running average:

Without the patch: 0.27461 seconds average
With the patch: 0.31074 seconds average

I understand there might be other limiting factors which throttle the performance even though the patch in itself should reduce the CPU consumption.

Anyway, the approach of using memberOf obviously seems like the right thing to do.

Advisory: samba.yaml
Comment 4 Stefan Gohmann univentionstaff 2016-07-08 15:20:12 CEST
YAML: OK

Tests: OK

Build log: OK

Code review: OK
Comment 5 Janek Walkenhorst univentionstaff 2016-07-11 12:31:09 CEST
<http://errata.software-univention.de/ucs/4.1/210.html>