<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EpostStil17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=NO-BOK link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span lang=EN-US>Hey,<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>We're in the process of replacing an old
Sun Directory Server 5.2 deployment. In our preliminary tests using FDS 1.1.0
(this was back in Q2 2008 or so), we saw lots of "aci cache
overflown" messages in the log for some users, and performance would
basically drop to unacceptable levels. I previously posted about the issue to
the user-list in early May 2008, though in retrospect the mail probably
should've gone here. It's archived at http://www.mailinglistarchive.com/fedora-directory-users@redhat.com/msg02612.html
if anyone's interested)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Anyway, searching the cvs tree for the log
message and bumping ACLPB_MAX_SELECTED_ACLS from 200 to 2000 just happened to solve
our problem. The change was made as a long-shot in the dark without any insight
into the code-base, i.e. we don't really have any broad understanding of how and
where it's used. It just seemingly works. During our testing, we have not seen
side-effects though we don't really have any experience with the unmodified
server. It just wasn't usable for us with the legacy ldap-structure we have.<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>I've attached a patch for the one-line
change we made, based on the source RPM for fds-base-1.1.3. What are your
thoughts on including this in future revisions? If the patch is unacceptable, would
you be more prepared to accept a contribution making this configurable from
dse.ldif? Assuming neither option is acceptable and the current value of 200 is
locked, I would very much like to hear the reasoning, as obviously, even if
things seem to work, the apparent shortage of other people bumping into this
problem is slightly worrying (our directory has upwards of 1500 aci attrs - count
made with a quick grep -c "aci:" on an ldif exported from the old Sun
ldap). <o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
<p class=MsoNormal><span lang=EN-US>--<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>Audun Rĝe<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US>mail: audun.roe@kantega.no<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p>
</div>
</body>
</html>