On Tuesday, March 19, 2013 12:34:23 PM UTC-5, Josh wrote: > > The majority of our servers are attached to large LDAP directories. > However, there are also cases when we need to define local service > accounts for whatever reason. We do this with the "user" resource-type. > If the host is attached to a LDAP directory, it takes Puppet a VERY long > time to process the "user" resource-type. In our case, it takes 60+ > seconds to process each user type. Running "puppet resource user username" > on the host takes over 2 minutes. During this time, the "puppet" process > on each hosts is pegged at 100% CPU usage. > > Is there any way around this? I have seen it brought up on the list, but > not anytime recently (2008, last I searched). > > This sounds like an issue associated more with your hosts' configuration than with Puppet itself. Try running your system's user management commands (for example, useradd / usermod / userdel) directly. I think you will see similar long runtimes. If so, then you cannot attribute your performance problem to Puppet.
It is possible that you could improve performance for existing local users by modifying the service priorities in your name service policy to give the local user and group files highest priority (but be aware that this makes local user and group entries supercede LDAP). On common Linuxes that typically means modifying /etc/nsswitch.conf. That's the best I can do without any details of your manifests or target node configurations. John -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/puppet-users?hl=en. For more options, visit https://groups.google.com/groups/opt_out.
