Bug #7469
closedlocal_sync_accounts() slowness can trigger GUI/XMLRPC failures with many accounts
100%
Description
When a firewall has many local accounts, the time it takes for local_sync_accounts() to finish grows large enough to trigger timeouts and other problems for XMLRPC.
Notably, in an HA cluster this becomes a burden because that function is called for each filter sync.
On stand-alone firewalls the function is only called during bootup, so it does not have quite the same impact in that scenario, though it still delays the boot process.
To illustrate the issue I made a playback script that calls local_sync_accounts() and nothing else:
: grep -c '<user>' /conf/config.xml 44 : time pfSsh.php playback localsyncusers 1.379u 5.649s 1:17.53 9.0% 633+216k 0+16190io 0pf+0w
For 44 accounts this particular test firewall needed 1 min 17 seconds to complete the sync process. This could easily overrun PHP/XMLRPC timeouts depending on the speed of the firewall cpu/disks/etc.
We have at least one customer hitting the issue ( 16693 ), plus at least one user report ( https://forum.pfsense.org/index.php?topic=127546.0 )
Updated by Renato Botelho over 7 years ago
- Target version changed from 2.4.0 to 2.4.1
Pushing to 2.4.1 because the whole function should be changed to be optimized
Updated by Jim Pingle almost 7 years ago
- Target version changed from 2.4.1 to 2.4.2
Moving target to 2.4.2 as we need 2.4.1 sooner than anticipated.
Updated by Renato Botelho almost 7 years ago
- Target version changed from 2.4.2 to 2.4.3
Updated by Renato Botelho over 6 years ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
Applied in changeset 79f7bc7f61a9026cca8770d60d27cde15dd6f26a.
Updated by Jim Pingle over 6 years ago
- Status changed from Feedback to Assigned
Current code is better but is not putting the users back into matching order on both units. Renato is working on an improvement to preserve the order on all nodes.
Updated by Renato Botelho over 6 years ago
- Status changed from Assigned to Feedback
Applied in changeset dc3bc1f8c9f5040762953b38df499ea5f86d13d5.
Updated by Paighton Bisconer over 6 years ago
Tested on Current Base System 2.4.3.a.20180216.1415
Syncing 106 users and adding a 107th took maybe two seconds, new user was there when secondary users page was reloaded immediately after saving new user.
Updated by Renato Botelho over 6 years ago
- Status changed from Feedback to Resolved