freeipa

#9091 unindexed searches in git master
Opened by abbra. Modified

Open
Close Issue

I was looking at various unindexed searches in nightly tests and noticed we don't have indexes for various certificate and DNA attributes. This may potentially be a slowdown on busy systems.

Below is logconv.pl output for http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/bf40e94a-7b21-11ec-bd36-fa163e7c9f91/test_integration-test_subids.py-TestSubordinateId-test_subid_stats/master.ipa.test/var/log/dirsrv/slapd-IPA-TEST/access.gz, from nightly test for subordinate IDs.

Access Log Analyzer 8.2
Command: logconv.pl access.gz
Processing 1 Access Log(s)...
[001] access.gz                         size (bytes):       273546
Found a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restartsFound a restart - resetting stats that depend on restarts
Total Log Lines Analysed:  12100
----------- Access Log Output ------------
Start of Logs:    22/Jan/2022:01:26:11.929982379
End of Logs:      22/Jan/2022:01:35:05.188416361
Processed Log Time:  0 Hours, 8 Minutes, 53.258436608 Seconds
Restarts:                      10
Secure Protocol Versions:
  - TLS1.3 client bound as uid=pkidbuser,ou=people,o=ipaca (14 connections)
  - TLS1.3 128-bit AES-GCM; client CN=CA Subsystem,O=IPA.TEST; issuer CN=Certificate Authority,O=IPA.TEST (14 connections)
  - TLS1.3 128-bit AES-GCM (7 connections)
Peak Concurrent Connections:   15
Total Operations:              5573
Total Results:                 5435
Overall Performance:           97.5%
Total Connections:             378           (0.71/sec)  (42.53/min)
 - LDAP Connections:           226           (0.42/sec)  (25.43/min)
 - LDAPI Connections:          134           (0.25/sec)  (15.08/min)
 - LDAPS Connections:          18            (0.03/sec)  (2.03/min)
 - StartTLS Extended Ops:      3             (0.01/sec)  (0.34/min)
Searches:                      3367          (6.31/sec)  (378.84/min)
Modifications:                 766           (1.44/sec)  (86.19/min)
Adds:                          936           (1.76/sec)  (105.31/min)
Deletes:                       15            (0.03/sec)  (1.69/min)
Mod RDNs:                      7             (0.01/sec)  (0.79/min)
Compares:                      0             (0.00/sec)  (0.00/min)
Binds:                         458           (0.86/sec)  (51.53/min)
Average wtime (wait time):     0.000871999
Average optime (op time):      0.011799130
Average etime (elapsed time):  0.012665199
Proxied Auth Operations:       0
Persistent Searches:           17
Internal Operations:           0
Entry Operations:              0
Extended Operations:           7
Abandoned Requests:            0
Smart Referrals Received:      0
VLV Operations:                17
VLV Unindexed Searches:        0
VLV Unindexed Components:      9
SORT Operations:               11
Entire Search Base Queries:    14
Paged Searches:                26
Unindexed Searches:            0
Unindexed Components:          14
  Unindexed Component #1 (notes=U)
  -  Date/Time:             22/Jan/2022:01:34:55
  -  Connection Number:     122
  -  Operation Number:      8
  -  Etime:                 0.000926775
  -  Nentries:              0
  -  IP Address:            192.168.122.120
  -  Search Base:           cn=otp,dc=ipa,dc=test
  -  Search Scope:          1 (one)
  -  Search Filter:         (&(ipatokenowner=uid=testuser_usermgr_user1,cn=users,cn=accounts,dc=ipa,dc=test)(objectclass=ipatoken))
  -  Bind DN:               uid=testuser_usermgr_mgr1,cn=users,cn=accounts,dc=ipa,dc=test
  Unindexed Component #2 (notes=U)
  -  Date/Time:             22/Jan/2022:01:34:12
  -  Connection Number:     80
  -  Operation Number:      3
  -  Etime:                 0.002117137
  -  Nentries:              10
  -  IP Address:            local
  -  Search Base:           cn=users,cn=accounts,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (&(objectclass=posixaccount)(!(memberof=*,cn=subids,cn=accounts,dc=ipa,dc=test))(memberof=cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=test)(!(nsaccountlock=true)))
  -  Bind DN:               cn=directory manager
  Unindexed Component #3 (notes=U)
  -  Date/Time:             22/Jan/2022:01:29:09
  -  Connection Number:     118
  -  Operation Number:      11
  -  Etime:                 0.002320895
  -  Nentries:              0
  -  IP Address:            192.168.122.120
  -  Search Base:           ou=ca,ou=requests,o=ipaca
  -  Search Scope:          1 (one)
  -  Search Filter:         (&(requeststate=approved)(requestid=*))
  -  Bind DN:               cn=directory manager
  Unindexed Component #4 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:19
  -  Connection Number:     17
  -  Operation Number:      3
  -  Etime:                 0.001097981
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #5 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:22
  -  Connection Number:     18
  -  Operation Number:      4
  -  Etime:                 0.003882136
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=cacert,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #6 (notes=U)
  -  Date/Time:             22/Jan/2022:01:29:42
  -  Connection Number:     154
  -  Operation Number:      3
  -  Etime:                 0.001134805
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #7 (notes=U)
  -  Date/Time:             22/Jan/2022:01:30:36
  -  Connection Number:     10
  -  Operation Number:      1
  -  Etime:                 0.002787192
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (ipacertsubject=cn=certificate authority,o=ipa.test)
  -  Bind DN:               cn=directory manager
  Unindexed Component #8 (notes=U)
  -  Date/Time:             22/Jan/2022:01:30:36
  -  Connection Number:     7
  -  Operation Number:      3
  -  Etime:                 0.001191106
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #9 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:19
  -  Connection Number:     17
  -  Operation Number:      4
  -  Etime:                 0.001806255
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=cacert,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #10 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:22
  -  Connection Number:     18
  -  Operation Number:      3
  -  Etime:                 0.001299984
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (cacertificate;binary=*)
  -  Bind DN:               fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
  Unindexed Component #11 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:54
  -  Connection Number:     4
  -  Operation Number:      1701
  -  Etime:                 0.001233946
  -  Nentries:              2
  -  IP Address:            local
  -  Search Base:           cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          1 (one)
  -  Search Filter:         (dnahostname=master.ipa.test)
  -  Bind DN:               cn=directory manager
  Unindexed Component #12 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:54
  -  Connection Number:     4
  -  Operation Number:      1705
  -  Etime:                 0.001762775
  -  Nentries:              2
  -  IP Address:            local
  -  Search Base:           cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          1 (one)
  -  Search Filter:         (dnahostname=master.ipa.test)
  -  Bind DN:               cn=directory manager
  Unindexed Component #13 (notes=U)
  -  Date/Time:             22/Jan/2022:01:31:47
  -  Connection Number:     4
  -  Operation Number:      654
  -  Etime:                 0.002515956
  -  Nentries:              0
  -  IP Address:            local
  -  Search Base:           cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (&(ipacertsubject=cn=certificate authority,o=ipa.test)(!(cn=ipa.test ipa ca)))
  -  Bind DN:               cn=directory manager
  Unindexed Component #14 (notes=U)
  -  Date/Time:             22/Jan/2022:01:32:01
  -  Connection Number:     2
  -  Operation Number:      60
  -  Etime:                 0.029712904
  -  Nentries:              1
  -  IP Address:            local
  -  Search Base:           cn=masters,cn=ipa,cn=etc,dc=ipa,dc=test
  -  Search Scope:          1 (one)
  -  Search Filter:         (objectclass=*)
  -  Bind DN:               cn=directory manager
Invalid Attribute Filters:     0
FDs Taken:                     378
FDs Returned:                  368
Highest FD Taken:              122
Broken Pipes:                  0
Connections Reset By Peer:     0
Resource Unavailable:          0
Max BER Size Exceeded:         0
Binds:                         458
Unbinds:                       287
----------------------------------
 - LDAP v2 Binds:              58
 - LDAP v3 Binds:              286
 - AUTOBINDs(LDAPI):           114
 - SSL Client Binds:           0
 - Failed SSL Client Binds:    0
 - SASL Binds:                 230
   - EXTERNAL: 128
   - GSS-SPNEGO: 94
   - GSSAPI: 8
 - Directory Manager Binds:    11
 - Anonymous Binds:            1
----- Connection Latency Details -----
 (in seconds)       <=1 2   3   4-5 6-10    11-15   >15
 --------------------------------------------------------------------------
 (# of connections) 283 1   7   4   47  
----- Current Open Connection IDs ----- 
Conn Number:  34 (local)
Conn Number:  6 (192.168.122.120)
Conn Number:  30 (local)
Conn Number:  35 (local)
Conn Number:  9 (local)
Conn Number:  31 (192.168.122.120)
Conn Number:  38 (192.168.122.239)
Conn Number:  5 (192.168.122.120)
Conn Number:  41 (local)
Conn Number:  10 (192.168.122.120)
----- Errors -----
err=0                  4601    Successful Operations   
err=32                  804    No Such Object          
err=14                   16    SASL Bind in Progress   
err=49                    6    Invalid Credentials (Bad Password)
err=68                    5    Already Exists          
err=50                    2    Insufficent (write) Privledges
err=19                    1    Constraint Violation    
----- Top 20 Failed Logins ------
6           cn=replication manager masteragreement1-master.ipa.test-pki-tomcat,cn=config
From the IP address(s) :
6           192.168.122.120 
----- Total Connection Codes -----
U1      287   Cleanly Closed Connections              
B1       44   Bad Ber Tag Encountered                 
A1       37   Client Aborted Connections              
----- Top 20 Clients -----
Number of Clients:  5
[1] Client: 192.168.122.120
       235 - Connections
       173 - U1 (Cleanly Closed Connections)
        30 - B1 (Bad Ber Tag Encountered)
        28 - A1 (Client Aborted Connections)
[2] Client: local
       134 - Connections
       114 - U1 (Cleanly Closed Connections)
         9 - A1 (Client Aborted Connections)
         6 - B1 (Bad Ber Tag Encountered)
[3] Client: 127.0.0.1
         4 - Connections
         4 - B1 (Bad Ber Tag Encountered)
[4] Client: ::1
         4 - Connections
         4 - B1 (Bad Ber Tag Encountered)
[5] Client: 192.168.122.239
         1 - Connections
----- Top 20 Bind DN's -----
Number of Unique Bind DN's: 11
433             cn=directory manager                    
73              uid=admin,cn=users,cn=accounts,dc=ipa,dc=test
27              krbprincipalname=dns/master.ipa.test@ipa.test,cn=services,cn=accounts,dc=ipa,dc=test
14              uid=pkidbuser,ou=people,o=ipaca         
12              fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
6               uid=testuser_usermgr_mgr1,cn=users,cn=accounts,dc=ipa,dc=test
6               cn=replication manager masteragreement1-master.ipa.test-pki-tomcat,cn=config
6               uid=testuser_selfservice1,cn=users,cn=accounts,dc=ipa,dc=test
3               uid=testuser_selfservice2,cn=users,cn=accounts,dc=ipa,dc=test
2               krbprincipalname=ipa-dnskeysyncd/master.ipa.test@ipa.test,cn=services,cn=accounts,dc=ipa,dc=test
1               Anonymous Binds                         
----- Top 20 Search Bases -----
Number of Unique Search Bases: 816
636             dc=ipa,dc=test                          
415             cn=ipa.test,cn=kerberos,dc=ipa,dc=test  
150             cn=dns,dc=ipa,dc=test                   
113             cn=ipaconfig,cn=etc,dc=ipa,dc=test      
79              idnsname=ipa.test,cn=dns,dc=ipa,dc=test 
64              cn=global_policy,cn=ipa.test,cn=kerberos,dc=ipa,dc=test
52              idnsname=ipa.test.,cn=dns,dc=ipa,dc=test
36              cn=subids,cn=accounts,dc=ipa,dc=test    
29              uid=ipara,ou=people,o=ipaca             
28              cn=masters,cn=ipa,cn=etc,dc=ipa,dc=test 
27              cn=schema                               
25              cn=users,cn=accounts,dc=ipa,dc=test     
24              ou=certificaterepository,ou=ca,o=ipaca  
23              cn=accounts,dc=ipa,dc=test              
20              cn=config                               
20              fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test
18              cn=upg definition,cn=definitions,cn=managed entries,cn=etc,dc=ipa,dc=test
18              cn=master.ipa.test,cn=masters,cn=ipa,cn=etc,dc=ipa,dc=test
17              ou=groups,o=ipaca                       
16              ou=people,o=ipaca                       
----- Top 20 Search Filters -----
Number of Unique Search Filters: 161
2080            (objectclass=*)                         
344             (objectclass=krbticketpolicyaux)        
126             (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=krbtgt/ipa.test@ipa.test)(krbprincipalname:caseignoreia5match:=krbtgt/ipa.test@ipa.test)))
101             (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=admin@ipa.test)(krbprincipalname:caseignoreia5match:=admin@ipa.test)))
65              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=http/master.ipa.test@ipa.test)(krbprincipalname:caseignoreia5match:=http/master.ipa.test@ipa.test)))
58              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=ldap/master.ipa.test@ipa.test)(krbprincipalname:caseignoreia5match:=ldap/master.ipa.test@ipa.test)))
39              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=k/m@ipa.test)(krbprincipalname:caseignoreia5match:=k/m@ipa.test)))
32              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=host/master.ipa.test@ipa.test)(krbprincipalname:caseignoreia5match:=host/master.ipa.test@ipa.test)))
29              (objectclass=ipantdomainattrs)          
23              (&(objectclass=ipakrb5delegationacl)(memberprincipal=http/master.ipa.test@ipa.test))
22              (krbmkey=*)                             
21              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=testuser_selfservice1@ipa.test)(krbprincipalname:caseignoreia5match:=testuser_selfservice1@ipa.test)))
18              (krbprincipalkey=*)                     
18              (uniquemember=uid=ipara,ou=people,o=ipaca)
18              (userpassword=*)                        
17              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=testuser_usermgr_mgr1@ipa.test)(krbprincipalname:caseignoreia5match:=testuser_usermgr_mgr1@ipa.test)))
15              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=kadmin/changepw@ipa.test)(krbprincipalname:caseignoreia5match:=kadmin/changepw@ipa.test)))
14              (&(|(objectclass=krbprincipalaux)(objectclass=krbprincipal)(objectclass=ipakrbprincipal))(|(ipakrbprincipalalias=testuser_selfservice2@ipa.test)(krbprincipalname:caseignoreia5match:=testuser_selfservice2@ipa.test)))
14              (objectclass=*)" attrs="* entryusn nsuniqueid numsubordinates aci
13              (description=2;7;cn=certificate authority,o=ipa.test;cn=ipa ra,o=ipa.test)
----- Top 20 Most Frequent etimes (elapsed times) -----
etime=0.001028597    2         
etime=0.000819404    1         
etime=0.000850708    1         
etime=0.000880684    1         
etime=0.000895066    1         
etime=0.000904625    1         
etime=0.000919843    1         
etime=0.000920887    1         
etime=0.000939650    1         
etime=0.000968542    1         
etime=0.000972361    1         
etime=0.000998376    1         
etime=0.001037805    1         
etime=0.001048964    1         
etime=0.001092376    1         
etime=0.001110658    1         
etime=0.001114953    1         
etime=0.001117105    1         
etime=0.001119631    1         
etime=0.001132175    1         
----- Top 20 Longest etimes (elapsed times) -----
etime=6.030936826    1         
etime=0.712117792    1         
etime=0.697991441    1         
etime=0.689377510    1         
etime=0.659113175    1         
etime=0.653023258    1         
etime=0.645341607    1         
etime=0.633942539    1         
etime=0.625980799    1         
etime=0.616278779    1         
etime=0.559959591    1         
etime=0.559290194    1         
etime=0.525632702    1         
etime=0.488384806    1         
etime=0.449558349    1         
etime=0.409222711    1         
etime=0.221893664    1         
etime=0.219750291    1         
etime=0.215743977    1         
etime=0.211014910    1         
----- Top 20 Most Frequent wtimes (wait times) -----
wtime=0.000072988    3         
wtime=0.000063495    3         
wtime=0.000026973    3         
wtime=0.000073618    2         
wtime=0.000057122    2         
wtime=0.000077527    2         
wtime=0.000071294    2         
wtime=0.000065603    2         
wtime=0.000029096    2         
wtime=0.000061903    2         
wtime=0.000041591    2         
wtime=0.000053769    2         
wtime=0.000076222    2         
wtime=0.000075484    2         
wtime=0.000070096    2         
wtime=0.000027658    2         
wtime=0.000058052    2         
wtime=0.000049350    2         
wtime=0.000031875    2         
wtime=0.000072957    2         
----- Top 20 Longest wtimes (wait times) -----
wtime=0.639613899    1         
wtime=0.600210929    1         
wtime=0.454062197    1         
wtime=0.430743446    1         
wtime=0.204942506    1         
wtime=0.197274168    1         
wtime=0.179864859    1         
wtime=0.147318599    1         
wtime=0.107485379    1         
wtime=0.105428829    1         
wtime=0.103298952    1         
wtime=0.102202620    1         
wtime=0.101489696    1         
wtime=0.101301977    1         
wtime=0.088749363    1         
wtime=0.081712960    1         
wtime=0.067028496    1         
wtime=0.063564631    1         
wtime=0.049313068    1         
wtime=0.024325371    1         
----- Top 20 Most Frequent optimes (actual operation times) -----
optime=0.001051903    2         
optime=0.001514038    2         
optime=0.001525981    2         
optime=0.001165963    1         
optime=0.014497816    1         
optime=0.001733952    1         
optime=0.071220588    1         
optime=0.014962913    1         
optime=0.002842542    1         
optime=0.007661437    1         
optime=0.003098058    1         
optime=0.000860963    1         
optime=0.002163567    1         
optime=0.002998224    1         
optime=0.006441697    1         
optime=0.002772805    1         
optime=0.002244550    1         
optime=0.000955220    1         
optime=0.002036855    1         
optime=0.002204279    1         
----- Top 20 Longest optimes (actual operation times) -----
optime=6.030786086    1         
optime=0.711883003    1         
optime=0.697737943    1         
optime=0.689181246    1         
optime=0.658850841    1         
optime=0.645167111    1         
optime=0.633752299    1         
optime=0.625858994    1         
optime=0.559825111    1         
optime=0.559064655    1         
optime=0.525506557    1         
optime=0.409126464    1         
optime=0.221758844    1         
optime=0.219662302    1         
optime=0.215397733    1         
optime=0.210936893    1         
optime=0.208726494    1         
optime=0.207333404    1         
optime=0.205398542    1         
optime=0.202919302    1         
----- Top 20 Largest nentries -----
nentries=93                     1
nentries=15                     3
nentries=14                     4
nentries=10                     1
nentries=8                      2
nentries=6                      5
nentries=4                      1
nentries=3                     13
nentries=2                     14
nentries=1                   2403
nentries=0                    899
----- Top 20 Most returned nentries -----
2403            nentries=1    
899             nentries=0    
14              nentries=2    
13              nentries=3    
5               nentries=6    
4               nentries=14   
3               nentries=15   
2               nentries=8    
1               nentries=4    
1               nentries=93   
1               nentries=10   
----- Extended Operations -----
3           1.3.6.1.4.1.1466.20037      Start TLS                                                   
2           1.3.6.1.4.1.4203.1.11.3     Other                                                       
1           2.16.840.1.113730.3.8.10.5     Other                                                       
1           1.3.6.1.4.1.4203.1.11.1     Password Modify                                             
----- Top 20 Most Requested Attributes -----
893         krbTicketFlags     
861         krbMaxRenewableAge 
861         krbMaxTicketLife   
824         aci                
589         *                  
580         krbPrincipalName   
577         uid                
573         ipaUserAuthType    
570         krbCanonicalName   
564         krbPrincipalExpiration
559         krbLastPwdChange   
559         krbPasswordExpiration
551         ipaKrbAuthzData    
549         krbLastAdminUnlock 
549         krbLastFailedAuth  
549         krbLoginFailedCount
549         krbTicketPolicyReference
549         krbLastSuccessfulAuth
549         krbPrincipalAliases
549         krbPrincipalType   
----- Recommendations -----
 1.  You have unindexed components, this can be caused from a search on an unindexed attribute, or your returned results exceeded the allidsthreshold.  Unindexed components are not recommended. To refuse unindexed searches, switch 'nsslapd-require-index' to 'on' under your database entry (e.g. cn=UserRoot,cn=ldbm database,cn=plugins,cn=config).
 2.  You have a significant difference between binds and unbinds.  You may want to investigate this difference.
Cleaning up temp files...
Done.

Compact unindexed search summary:

  Unindexed Component Summary - 14 total unindexed components
  -  Unindexed Filters:   Filter:   (cacertificate;binary=*) (occurrences 6)
                          - Bind DN:  fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test (binds  6)
  -  Unindexed Filters:   Filter:   (dnahostname=master.ipa.test) (occurrences 2)
                          - Bind DN:  cn=directory manager (binds  2)
  -  Unindexed Filters:   Filter:   (&(objectclass=posixaccount)(!(memberof=*,cn=subids,cn=accounts,dc=ipa,dc=test))(memberof=cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=test)(!(nsaccountlock=true))) (occurrences 1)
                          - Bind DN:  cn=directory manager (binds  1)
  -  Unindexed Filters:   Filter:   (objectclass=*) (occurrences 1)
                          - Bind DN:  cn=directory manager (binds  1)
  -  Unindexed Filters:   Filter:   (ipacertsubject=cn=certificate authority,o=ipa.test) (occurrences 1)
                          - Bind DN:  cn=directory manager (binds  1)
  -  Unindexed Filters:   Filter:   (&(requeststate=approved)(requestid=*)) (occurrences 1)
                          - Bind DN:  cn=directory manager (binds  1)
  -  Unindexed Filters:   Filter:   (&(ipacertsubject=cn=certificate authority,o=ipa.test)(!(cn=ipa.test ipa ca))) (occurrences 1)
                          - Bind DN:  cn=directory manager (binds  1)
  -  Unindexed Filters:   Filter:   (&(ipatokenowner=uid=testuser_usermgr_user1,cn=users,cn=accounts,dc=ipa,dc=test)(objectclass=ipatoken)) (occurrences 1)
                          - Bind DN:  uid=testuser_usermgr_mgr1,cn=users,cn=accounts,dc=ipa,dc=test (binds  1)
  -  Unindexed Bind DNs:  Bind DN:  cn=directory manager (binds 7)
                          - Unindexed Filter: (&(requeststate=approved)(requestid=*)) (occurrences 1)
                          - Unindexed Filter: (ipacertsubject=cn=certificate authority,o=ipa.test) (occurrences 1)
                          - Unindexed Filter: (&(ipacertsubject=cn=certificate authority,o=ipa.test)(!(cn=ipa.test ipa ca))) (occurrences 1)
                          - Unindexed Filter: (&(objectclass=posixaccount)(!(memberof=*,cn=subids,cn=accounts,dc=ipa,dc=test))(memberof=cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=test)(!(nsaccountlock=true))) (occurrences 1)
                          - Unindexed Filter: (objectclass=*) (occurrences 1)
                          - Unindexed Filter: (dnahostname=master.ipa.test) (occurrences 2)
  -  Unindexed Bind DNs:  Bind DN:  fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test (binds 6)
                          - Unindexed Filter: (cacertificate;binary=*) (occurrences 6)
  -  Unindexed Bind DNs:  Bind DN:  uid=testuser_usermgr_mgr1,cn=users,cn=accounts,dc=ipa,dc=test (binds 1)
                          - Unindexed Filter: (&(ipatokenowner=uid=testuser_usermgr_user1,cn=users,cn=accounts,dc=ipa,dc=test)(objectclass=ipatoken)) (occurrences 1)

There is an open (and stale) PR for dnahostname: https://github.com/freeipa/freeipa/pull/5955

My analysis of these:

Unindexed Filters: Filter: (cacertificate;binary=*) (occurrences 6)
- Bind DN: fqdn=master.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test (binds 6)

I honestly couldn't find where this is coming from. My guess is the installer. I tried an upgrade, ipa-certupdate and ipa-cacert-manage list and the number of searches didn't change.

  • Unindexed Filters: Filter: (&(objectclass=posixaccount)(!(memberof=*,cn=subids,cn=accounts,dc=ipa,dc=test))(memberof=cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=test)(!(nsaccountlock=true))) (occurrences 1)
    - Bind DN: cn=directory manager (binds 1)

This is from the ipa-subids. I suppose it could be expensive.

Note: there is no man page for this command (in libexec)

  • Unindexed Filters: Filter: (objectclass=*) (occurrences 1)
    - Bind DN: cn=directory manager (binds 1)

I'm pretty sure this is bogus.

  • Unindexed Filters: Filter: (ipacertsubject=cn=certificate authority,o=ipa.test) (occurrences 1)
    - Bind DN: cn=directory manager (binds 1)

ipalib/install/certstore.py::update_ca_cert(). This could get bad if a whole lot of clients run ipa-certupdate I guess. But in general probably not a huge problem.

  • Unindexed Filters: Filter: (&(requeststate=approved)(requestid=*)) (occurrences 1)
    - Bind DN: cn=directory manager (binds 1)

This is from the CA.

  • Unindexed Filters: Filter: (&(ipacertsubject=cn=certificate authority,o=ipa.test)(!(cn=ipa.test ipa ca))) (occurrences 1)
    - Bind DN: cn=directory manager (binds 1)

ipalib/install/certstore.py::get_ca_certs

I don't think this is a big problem.

  • Unindexed Filters: Filter: (&(ipatokenowner=uid=testuser_usermgr_user1,cn=users,cn=accounts,dc=ipa,dc=test)(objectclass=ipatoken)) (occurrences 1)
    - Bind DN: uid=testuser_usermgr_mgr1,cn=users,cn=accounts,dc=ipa,dc=test (binds 1)

An eq index on ipatokenowner may be needed.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.