I have a server with 20,000 account entries and one group that has 10,000 members. Deleting members from that group is very slow on OpenLDAP 2.4.10, though adding goes at a reasonable speed.

Here is the test operation:

----------------------------------------------------------------------- dn: uniqueIdentifier=tenK,ou=groups,uniqueIdentifier=o_000000,dc=orgs,dc=dir,dc=example,dc=com changetype: modify delete: member member: uniqueIdentifier=a_004996,ou=accounts,uniqueIdentifier=o_000006,dc=orgs,dc=dir,dc=example,dc=com - add: member member: uniqueIdentifier=a_999999,ou=accounts,uniqueIdentifier=o_000005,dc=orgs,dc=dir,dc=example,dc=com -----------------------------------------------------------------------

On 2.3.42 that takes about 1s with the caches warm, but on 2.4.10 it takes almost 9s, most of which is CPU time.

The test machine has 2GB of memory and the DB_CONFIG looks like this for BDB:

----------------------------------------------------------------------- # memory cache size # gigabytes bytes number-of-regions # set_cachesize 0 150000000 1

# Logbuffer size # bytes # set_lg_bsize 2097152

# Remove the roll-forward transaction logs automatically # This reduces the space used by the database but it also reduces # the disaster-recovery options.

set_flags DB_LOG_AUTOREMOVE -----------------------------------------------------------------------

There is no disk activity during most of the 9s, with a large burst of writes at the end.

There have been various discussions about *adding* members to large groups in the past, but the problems appeared to have been solved in recent versions.

The problem is certainly related to indexing, as if I remove indexing from the 'member' attribute I get times of about 0.3s on 2.4.10. (Note: overall times are measured by timing an ldapmodify script, so not very accurate below 0.5s)

Does anyone know why this operation should have got slower from 2.3.x to 2.4.x ?

Andrew