An ioblocktimeout of 1 second is too aggressive. This topic has been debated before in https://pagure.io/389-ds-base/issue/49194. The current timeout is 5 minutes, and personally I feel that is too long, but 1 second is too short. I think something between 10 and 30 seconds might be more appropriate.

10 seconds then? I think that would be a large improvement here. This timeout is only for how long we block, not how long we can maxium time to send.

Updated to 10 seconds

Freeipa is setting it to 10s as well so it is probably a good tuning. I would prefer 30s default value to be smart with slow clients.
ioblocktimeout is a way to support reasonably slow clients and protecting the server from attack. If clients are slow, it could be fine for a worker to wait for several minutes as long as it does not hang the server. On the other side, if all workers get busy with slow clients, the admin would like to protect the server with small timeout.

Freeipa is setting it to 10s as well so it is probably a good tuning. I would prefer 30s default value to be smart with slow clients.
ioblocktimeout is a way to support reasonably slow clients and protecting the server from attack. If clients are slow, it could be fine for a worker to wait for several minutes as long as it does not hang the server. On the other side, if all workers get busy with slow clients, the admin would like to protect the server with small timeout.

I'm going to reach out to support to see if they have had problems with customers who set the ioblocktimeout too low...

If there are no known complaints then I think it's safe to set it to 10 seconds as that would address the more common problems. Having to increase it from 10 seconds would probably be the corner case. I'd rather have one 1 out of 100 customers that have to increase it, rather than have 40 out of 100 customers that need to lower it.

I think if IPA is doing 10s, and they have lots of "demanding" clients already, then this is a good baseline. I'll wait to hear what @mreynolds contact with GSS is like, but I think this sounds pretty well like everyone is in agreement here. :)

I think if IPA is doing 10s, and they have lots of "demanding" clients already, then this is a good baseline. I'll wait to hear what @mreynolds contact with GSS is like, but I think this sounds pretty well like everyone is in agreement here. :)

GSS said they typically tell customers to use between 5 and 10 seconds. So 10 seconds works for me.

Great, so I'm assuming that's an ack from you then?

Great, so I'm assuming that's an ack from you then?

Yessir!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3389

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.