I was wrong stating that I reproduced locally similar issue. I was not using 2.0.17 and was reproducing an issue related to nsslapd-idlistscanlimit that is much larger in recent 2.x versions
I tried to mimic "Our environment has about 100k entries, about 15k users and about 10k groups. Also big groups with thousand of users, also users with thousand of group membership. So I would call it a small instance".
I made a given user an uniquemember of 1000 groups. Each group having 1000 users. Then the search retrieves the 1000 groups DN.
Could you share your dse.ldif (send me directly) ? Also could you confirm you see the same perf hit with regular connection bound as "cn=directory manager" ?
Hallo Thierry,got newest version from https://github.com/389ds/389-ds-base dc565fd (389-Directory/2.3.2 B2023.073.0958 )I can confirm, manageDSAit makes no difference any more in query time,got etimes with 0,9 sec after import and reindexing (with and without option)but a little difference to 1.4.x ist still present :) ( 0.0x sec vs 0.9 sec)thanks and best regardsClaas
_______________________________________________ 389-users mailing list -- firstname.lastname@example.org To unsubscribe send an email to email@example.com Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://firstname.lastname@example.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue