[Freeipa-users] In webgui, ID Views slow, to crashingly slow

[Martin Babinsky]

On 09/20/2016 12:17 AM, Simpson Lachlan wrote:
>> -----Original Message-----
>>
>> On 09/19/2016 03:12 AM, Lachlan Musicman wrote:
>>> Hi
>>>
>>> Sometimes when I visit the ID Views page in the webgui, it is
>>> crushingly slow, and often it times out.
>>>
>>> Centos 7, ipa --version
>>> VERSION: 4.2.0, API_VERSION: 2.156
>>>
>>> Is there a reason, can I do something to fix this?
>>>
>>
>> What kind of ID Views do you use? Do you use them to  override AD users?
>> Is there any useful info in '/var/log/httpd/error_log'?
>
> There is the single ID View Name, Default Trust View, and in that we have a number of users over riding the AD usernames and home dirs.
>
> The httpd error log is relatively large, tbh, but there's nothing in there that looks like an obvious reason. In fact, for an error log, there is a hell of a lot of "SUCCESS" messages? The most obvious culprit in the error log is jsonserver_session...
>
> Next time I see it (I only see it intermittently), I'll grab the logs and have a look.
>
> Cheers
> L.
>
>
>
> This email (including any attachments or links) may contain
> confidential and/or legally privileged information and is
> intended only to be read or used by the addressee.  If you
> are not the intended addressee, any use, distribution,
> disclosure or copying of this email is strictly
> prohibited.
> Confidentiality and legal privilege attached to this email
> (including any attachments) are not waived or lost by
> reason of its mistaken delivery to you.
> If you have received this email in error, please delete it
> and notify us immediately by telephone or email.  Peter
> MacCallum Cancer Centre provides no guarantee that this
> transmission is free of virus or that it has not been
> intercepted or altered and will not be liable for any delay
> in its receipt.
>

One thing that crossed my mind is to check the connectivity to the AD 
domain controllers. To resolve AD user overrides, FreeIPA uses SSSD to 
contact AD DCs to do the username -> SID translation. If there is some 
problem contacting them, then there may be hangs/timeouts when resolving 
override anchors.

Thus you may also want to to check SSSD logs (see
https://fedorahosted.org/sssd/wiki/Troubleshooting) to see whether this 
is not the case.

-- 
Martin^3 Babinsky