Chapter 7. Adjusting IdM Directory Server performance

Procedure

1. Disable automatic cache tuning.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0

2. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

3. Set the entry cache size for the database. This example sets the entry cache for the userroot database to 2 gigabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --cache-memsize=2147483648 userroot

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

5. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust cache-memsize to a different value, or re-enable cache auto-sizing.

Procedure

1. Disable automatic cache tuning, and set the database cache size. This example sets the database cache to 256 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --cache-autosize=0 --dbcachesize=268435456

2. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

3. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dbcachesize to a different value, or re-enable cache auto-sizing.

Procedure

1. Stop the Directory Server.

   [root@server ~]# systemctl stop dirsrv.target

2. Backup the /etc/dirsrv/slapd-instance_name/dse.ldif file before making any further modifications.

   [root@server ~]# *cp /etc/dirsrv/slapd-instance_name/dse.ldif \
        /etc/dirsrv/slapd-instance_name/dse.ldif.bak.$(date "+%F_%H-%M-%S")

3. Edit the /etc/dirsrv/slapd-instance_name/dse.ldif file:

   1. Set the percentage of free system RAM to use for the database and entry caches back to the default of 10% of free RAM.

      nsslapd-cache-autosize: 10

   2. Set the percentage used from the free system RAM for the database cache to the default of 25%:

      nsslapd-cache-autosize-split: 25

4. Save your changes to the /etc/dirsrv/slapd-instance_name/dse.ldif file.

5. Start the Directory Server.

   [root@server ~]# systemctl start dirsrv.target

Procedure

1. Optional: Display the database suffixes and their corresponding database names.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   dc=example,dc=com (userroot)

   This command displays the name of the back end database next to each suffix. Use the suffix’s database name in the next step.

2. Set the DN cache size for the database. This example sets the DN cache to 20 megabytes.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix set --dncache-memsize=20971520 userroot

3. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust dncache-memsize to a different value, or back to the default of 10 MB.

Procedure

1. Ensure the NDN cache is enabled.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-enabled
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-enabled: on

   If the cache is off, enable it with the following command.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-enabled=on
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ndn-cache-enabled"

2. Retrieve the current value of the nsslapd-ndn-cache-max-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ndn-cache-max-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ndn-cache-max-size: 20971520

3. Modify the value of the nsslapd-ndn-cache-max-size attribute. This example increases the value to 41943040 (40 MB).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ndn-cache-max-size=41943040

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ndn-cache-max-size to a different value, or re-enable cache auto-sizing.

Procedure

1. Retrieve the current value of the nsslapd-maxbersize parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxbersize
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxbersize: 2097152

2. Modify the value of the nsslapd-maxbersize attribute. This example increases the value to 4194304, 4 MB.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxbersize=4194304

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxbersize"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxbersize to a different value, or back to the default of 2097152.

Procedure

1. Retrieve the current value of the nsslapd-maxdescriptors parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-maxdescriptors
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-maxdescriptors: 4096

2. Modify the value of the nsslapd-maxdescriptors attribute. This example increases the value to 8192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-maxdescriptors=8192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-maxdescriptors"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-maxdescriptors to a different value, or back to the default of 4096.

Procedure

1. Retrieve the current value of the nsslapd-listen-backlog-size parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-listen-backlog-size
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-listen-backlog-size: 128

2. Modify the value of the nsslapd-listen-backlog-size attribute. This example increases the value to 192.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-listen-backlog-size=192

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-listen-backlog-size"

Procedure

1. Retrieve the current value of the nsslapd-db-locks parameter and make a note of it before making any adjustments, in case it needs to be restored.

   [root@server ~]# ldapsearch -D "cn=directory manager" -w DirectoryManagerPassword -b "cn=bdb,cn=config,cn=ldbm database,cn=plugins,cn=config" | grep nsslapd-db-locks
   nsslapd-db-locks: 50000

2. Modify the value of the locks attribute. This example doubles the value to 100000 locks.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --locks=100000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully updated database configuration

4. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

Procedure

1. Retrieve the current value of the nsslapd-ioblocktimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-ioblocktimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-ioblocktimeout: 10000

2. Modify the value of the nsslapd-ioblocktimeout attribute. This example lowers the value to 8000.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-ioblocktimeout=8000

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-ioblocktimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-ioblocktimeout to a different value, or back to the default of 10000.

Procedure

1. Retrieve the current value of the nsslapd-idletimeout parameter and make a note of it before making any adjustments, in case it needs to be restored. Enter the Directory Manager password when prompted.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config get nsslapd-idletimeout
   Enter password for cn=Directory Manager on ldap://server.example.com:
   nsslapd-idletimeout: 3600

2. Modify the value of the nsslapd-idletimeout attribute. This example lowers the value to 1800 (30 minutes).

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-idletimeout=1800

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "nsslapd-idletimeout"

4. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust nsslapd-idletimeout to a different value, or back to the default of 3600.

Procedure

1. Display the database suffixes and their corresponding back ends.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com backend suffix list
   cn=changelog (changelog)
   dc=example,dc=com (userroot)
   o=ipaca (ipaca)

   This command displays the names of the back end databases next to their suffix. Use the suffix name in the next step.

2. Modify the value of the repl-release-timeout attribute for the main userroot database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="dc=example,dc=com" --repl-release-timeout=90

3. Authenticate as the Directory Manager to make the configuration change.

   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

4. Optional: If your IdM environment uses the IdM Certificate Authority (CA), you can modify the value of the repl-release-timeout attribute for the CA database. This example increases the value to 90 seconds.

   [root@server ~]# dsconf -D "cn=Directory Manager" ldap://server.example.com replication set --suffix="o=ipaca" --repl-release-timeout=90
   Enter password for cn=Directory Manager on ldap://server.example.com:
   Successfully replaced "repl-release-timeout"

5. Restart the Directory Server.

   [root@server ~]# systemctl restart dirsrv.target

6. Monitor the IdM directory server’s performance. If it does not change in a desirable way, repeat this procedure and adjust repl-release-timeout to a different value, or back to the default of 60 seconds.

Procedure

1. Create a text file in LDIF format with your custom database settings. Separate LDAP attribute modifications with a dash (-). This example sets non-default values for the idle timeout and maximum file descriptors.

   dn: cn=config
   changetype: modify
   replace: nsslapd-idletimeout
   nsslapd-idletimeout=1800
   -
   replace: nsslapd-maxdescriptors
   nsslapd-maxdescriptors=8192

2. Use the --dirsrv-config-file parameter to pass the LDIF file to the installation script.

   1. To install an IdM server:

      # ipa-server-install --dirsrv-config-file filename.ldif

   2. To install an IdM replica:

      # ipa-replica-install --dirsrv-config-file filename.ldif