From owner-freebsd-questions@freebsd.org Tue Oct 13 11:02:49 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6930AA127D9 for ; Tue, 13 Oct 2015 11:02:49 +0000 (UTC) (envelope-from joh.hendriks@gmail.com) Received: from mail-wi0-x22f.google.com (mail-wi0-x22f.google.com [IPv6:2a00:1450:400c:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 017BA144D for ; Tue, 13 Oct 2015 11:02:49 +0000 (UTC) (envelope-from joh.hendriks@gmail.com) Received: by wicgb1 with SMTP id gb1so84219696wic.1 for ; Tue, 13 Oct 2015 04:02:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-type:content-transfer-encoding; bh=Z7u1f5oGN/6BuH/PLtHTMxmvgrVw9vgFbm9n1su27Ww=; b=ruPq2+lAKyd9HRC0FugxB8TabcMsFxkTs88zEDmbzC8+v6NUwZrmY3a4WiDpyurwVs OviXZhV12qmG21uEP4xVlImUB41BzBbrOyRxmyvCWoawVJjBUqYvOPr5GyhxEUrkVIdT Dk65OQF/EWJ+RPPdco5H5JvDBifg5Kk8cwOcDI+utL1/u8UyYDEotu6vjsJAmenmFTGr fovddlTAg6+idagd8SybsDngK5pEA1gFw1itl5Nq5s1Yvs0Q+tZGPH99qkP0MkobGgQ2 /8y1c4AMuVbIqhkqOI3ne5hm265oqbCWrGP82RS4235bKfYDCilf1nzAIxoN+ZNNE2BK TxWA== X-Received: by 10.180.187.205 with SMTP id fu13mr21615241wic.81.1444734166981; Tue, 13 Oct 2015 04:02:46 -0700 (PDT) Received: from Johans-MacBook-Air.local (92-70-102-130.glasvezel.netexpo.nl. [92.70.102.130]) by smtp.googlemail.com with ESMTPSA id uq5sm2981224wjc.3.2015.10.13.04.02.45 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Oct 2015 04:02:46 -0700 (PDT) Subject: Re: Top takes long to start To: freebsd-questions@freebsd.org References: <561B6979.3090301@gmail.com> <561B7659.1090907@freebsd.org> From: Johan Hendriks X-Enigmail-Draft-Status: N1110 Message-ID: <561CE4D5.7010406@gmail.com> Date: Tue, 13 Oct 2015 13:02:45 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <561B7659.1090907@freebsd.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 11:02:49 -0000 Op 12/10/15 om 10:59 schreef Matthew Seaman: > On 10/12/15 09:04, Johan Hendriks wrote: >> We use a central LDAP server with about 10k of user accounts. >> This is all running on Ubuntu servers. When we use top on a linux >> client, top starts instant. >> Now we are in the process of adding some FreeBSD server in the mix. >> One thing we noticed is the fact that as soon as we enable ldap top >> takes about 3 to 5 seconds to start on the FreeBSD hosts. > Wht are you using for ldap pam/nss connectivity? Definitely recommend > net/nss-pam-ldapd or net/nss-pam-ldapd-sasl (if your LDAP requires SASL > auth). This has a built in nslcd cache daemon, which should help avoid > some of the delays involved in looking up userids over your lan. > > Cheers, > > Matthew > > I am using nss-pam-ldapd-sasl-0.8.14_3. This is my /usr/local/etc/nslcd.conf file # This is the configuration file for the LDAP nameservice # switch library's nslcd daemon. It configures the mapping # between NSS names (see /etc/nsswitch.conf) and LDAP # information in the directory. # See the manual page nslcd.conf(5) for more information. # The user and group nslcd should run as. uid nslcd gid nslcd uri ldap://ldap.mydomain.com ldap://ldap-replication.mydomain.com base dc=mydomain,dc=com binddn uid=nss_pam,ou=account,dc=mydomain,dc=com bindpw thisissecret ssl start_tls #tls_reqcert never tls_reqcert demand tls_cacertfile /etc/ssl/ca-certificates.crt pam_authz_search (&(objectClass=posixAccount)(uid=$username)(|(host=$hostname)(host=$fqdn)(host=\\*))(authorizedService=$service)) My /etc/nsswitch.conf looks like group: files ldap group_compat: nis hosts: files dns networks: files passwd: files ldap passwd_compat: nis shells: files services: compat services_compat: nis protocols: files rpc: files Do I need to enable the caching? Also lookups are running fine id user gives a instant reply btw.