14.5. Improving Search Performance through Resource Limits
With large directories, searching through every entry in the database can have a negative impact on the server performance. Effective indexing can improve the performance in certain scenarios. However, in large databases, this may still not reduce the search scope enough to improve the performance.
Reasonable limits can be set on user and client accounts to reduce the total number of entries or the total amount of time spent in an individual search, which both makes searches more responsive and improves overall server performance.
Server limits for search operations are controlled using special operational attribute values on the client application binding to the directory. You can set the following search operation limits:
- Look through limit. Specifies how many entries can be examined for a search operation.
- Size limit. Specifies the maximum number of entries the server returns to a client application in response to a search operation.
- Time limit. Specifies the maximum time the server spends processing a search operation.
- Idle timeout. Specifies the time a connection to the server can be idle before the connection is dropped.
- Range timeout. Specifies a separate look-through limit specifically for searches using a range.
The resource limits set for the client application take precedence over the default resource limits set for in the global server configuration.
Note
The Directory Manager receives unlimited resources by default, with the exception of range searches.
14.5.1. Search Performance and Resource Limits
For details, see the corresponding section in the Red Hat Directory Server Performance Tuning Guide.
14.5.2. Fine Grained ID List Size
For details, see the corresponding section in the Red Hat Directory Server Performance Tuning Guide.
14.5.3. Setting User and Global Resource Limits Using the Command Line
Through the command line, administrators can set user-level resource limits, global resource limits, and limits for specific kinds of searches, such as simple paged and range searches. Section 13.1.3, “Overview of the Searching Algorithm” has more information on how these resource limits affect Directory Server search performance.
Section 14.5.3, “Setting User and Global Resource Limits Using the Command Line” lists operational attributes which can be set for each entry using the command line. Use
ldapmodify to add the attributes to the entry.
User-level attributes are set on the individual entries, while global configuration attributes are set in the appropriate server configuration area.
- Look-through limit
- Specifies how many entries are examined for a search operation. Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute:
nsLookThroughLimit - Global configuration:
- Attribute:
nsslapd-lookthroughlimit - Entry:
cn=config,cn=ldbm database,cn=plugins,cn=config
- Page look-through limit
- As with the look-through limit, specifies how many entries are examined, but specifically for simple paged search operations. Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute:
nsPagedLookThroughLimit - Global configuration:
- Attribute:
nsslapd-pagedlookthroughlimit - Entry:
cn=config,cn=ldbm database,cn=plugins,cn=config
- Size limit
- Specifies the maximum number of entries the server returns to a client application in response to a search operation. Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute:
nsSizeLimit - Global configuration:
- Attribute:
nsslapd-sizelimit - Entry:
cn=config
- Paged size limit
- As with the size limit, specifies the maximum number of entries the server returns to a client application but only for simple paged search operations. Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute:
nsPagedSizeLimit - Global configuration:
- Attribute:
nsslapd-pagedsizelimit - Entry:
cn=config
- Time Limit
- Specifies the maximum time the server spends processing a search operation. Giving this attribute a value of
-1indicates that there is no time limit.- User-level attribute:
nsTimeLimit - Global configuration:
- Attribute:
nsslapd-timelimit - Entry:
cn=config
- Idle timeout
- Specifies the time a connection to the server can be idle before the connection is dropped. The value is given in seconds. Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute:
nsidletimeout - Global configuration:
- Attribute:
nsslapd-idletimeout - Entry:
cn=config
- ID list scan limit
- Specifies the maximum number of entry IDs loaded from an index file for search results. If the ID list size is greater than this value, the search will not use the index list but will treat the search as an unindexed search and look through the entire database.
- User-level attribute:
nsIDListScanLimit - Global configuration:
- Attribute:
nsslapd-idlistscanlimit - Entry:
cn=config,cn=ldbm database,cn=plugins,cn=config
- Paged ID list scan limit
- As with the ID list scan limit, specifies the maximum number of entry IDs loaded from an index file for search results, but specifically for paged search operations.
- User-level attribute:
nsPagedIDListScanLimit - Global configuration:
- Attribute:
nsslapd-pagedidlistscanlimit - Entry:
cn=config,cn=ldbm database,cn=plugins,cn=config
- Range look-through limit
- Specifies how many entries are examined for a range search operation (a search using greater-than, equal-to-or-greater-than, less-than, or equal-to-less-than operators). Giving this attribute a value of
-1indicates that there is no limit.- User-level attribute: not available
- Global configuration:
- Attribute:
nsslapd-rangelookthroughlimit - Entry:
cn=config,cn=ldbm database,cn=plugins,cn=config
For information about the parameters listed above, see their descriptions in the Red Hat Directory Server Configuration, Command, and File Reference.
For example, this sets the size limit for a user:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: uid=user_name,ou=People,dc=example,dc=com changetype: modify add: nsSizeLimit nsSizeLimit: 500
The
ldapmodify statement adds the nsSizeLimit attribute to the user's entry and gives it a search return size limit of 500 entries.
Note
Set an access control list (ACL) to prevent users changing the setting. For details about ACLs, see Chapter 18, Managing Access Control.
14.5.4. Setting Resource Limits on Anonymous Binds
Resource limits are set on a user entry. An anonymous bind, obviously, does not have a user entry associated with it. This means that the global resource limits usually apply to anonymous operations. However, it is possible to configure resource limits specifically for anonymous binds by creating a template user entry that has resource limits, and then applying that template to anonymous binds.
- Create a template entry and set whatever resource limits you want to apply to anonymous binds.
Note
For performance reasons, the template should be in the normal back end, not in thecn=configsuffix, which does not use an entry cache.For example:# ldapadd -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=anonymous_template,ou=people,dc=example,dc=com objectclass: nsContainer objectclass: top cn: anonymous_template nsSizeLimit: 250 nsLookThroughLimit: 1000 nsTimeLimit: 60
- On all suppliers in a replication topology, add the
nsslapd-anonlimitsdnparameter to the server configuration, pointing to the DN of the template entry. Any of the resource limits in Section 14.5.3, “Setting User and Global Resource Limits Using the Command Line” can be set. For example:# dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-anonlimitsdn="cn=anonymous_template,ou=people,dc=example,dc=com"
14.5.5. Improving Performance for Range Searches
Range searches use operators (Section 14.3.2, “Using Operators in Search Filters”) to set a bracket to search for and return an entire subset of entries within the directory. For example, this searches for every entry modified at or after midnight on January 1:
(modifyTimestamp>=20210101010101Z)
The nature of a range search is that it must evaluate every single entry within the directory to see if it is within the range given. Essentially, a range search is always an all IDs search.
For most users, the look-through limit kicks in and prevents range searches from turning into an all IDs search. This improves overall performance and speeds up range search results. However, some clients or administrative users like Directory Manager may not have a look-through limit set. In that case, a range search can take several minutes to complete or even continue indefinitely.
It is possible to set a separate range look-through limit. This allows clients and administrative users to have high look-through limits while still allowing a reasonable limit to be set on potentially performance-impaired range searches.
This is configured in the
nsslapd-rangelookthroughlimit attribute. The default value is 5000, the same as the default nsslapd-lookthroughlimit attribute value.
For example:
# ldapmodify -a -D "cn=Directory Manager" -W -p 389 -h server.example.com -x
dn: cn=config,cn=ldbm database,cn=plugins,cn=config
changetype: add
add: nsslapd-rangelookthroughlimit
nsslapd-rangelookthroughlimit: 7500