Tip of the Month: Improving LDAP Performance
By Matt Ray on Sep 19, 2008 in Best Practices, Community, Systems Management, Tips, Zope
Community member Nathaniel McCallum’s provided instructions for making Zenoss use LDAP or ActiveDirectory for Authentication and Authorization recently had a very important update from Scott Haskell. Users were reporting very slow UI response times and Scott narrowed it down to those installations using LDAP. He tracked down the Zope RAM Cache Manager and updated the documentation on how to greatly improve performance:
Enabling Caching
LDAPMultiPlugins has the ability to cache expensive LDAP look-ups and other operations. This ability, however, is not enabled by default. To enable caching:
- Login to the ZMI (Zope Management Interface) at http://servername:8080/zport/manage
- Click on ‘acl_users(PAS)’ from the center pane or the top-level ‘acl_users’ from the left navigation pane
- From the drop-down list in the upper right, select ‘RAM Cache Manager’ and click add.
- Give the RAM Cache Object a name; e.g. - LDAP Cache
- Click on the newly created object to configure it
- Tweak the properties as needed
- Click on the ‘Associate’ tab
- Click ‘Locate’
- Your LDAPMultiPlugins object (whatever you named it) and userManager will appear as objects that you can associate with the RAM Cache.
- Check your LDAPMultiPlugin object and select ‘Save Changes’.
Caching is now enabled for LDAP.
Scott went even further and documented his debugging and troubleshooting of the problem. Thanks again to Scott for this great tip!
Sphere: Related Content
















Receive
Blog Updates via Email
Gavin Henry | Sep 19, 2008 | Reply
Maybe try using a decent LDAP Directory server…not AD. Try OpenLDAP.
Scott Haskell | Sep 20, 2008 | Reply
I don’t really think the LDAP implementation is the issue here. My issue was authenticating over a site-to-site VPN. Anything over 75ms RTT average was painfully slow, due to checking credentials on nearly every page (and action), in Zenoss. You don’t realize how many look-ups are done until you notice a slow down in the UI. You’re hitting your LDAP server constantly unless you’ve got the RAM Cache Manager enabled. You’re not going to notice this on the LAN, but definitely over a VPN.