On 9/21/19 9:39 AM, Дилян Палаузов wrote:
Does a mdb_equality_candidates log message mean, that adding indices will improve the search?
Not in every case. You have to analyze the filters actually used by your application.
Otherwise blindly indexing attributes without analysis can result in performance getting worse.
IMO in its current form the message is useless.
The particular use-case is the OpenLDAP backend of MIT Kerberos and the indices it needs for this query, as discussed at https://github.com/krb5/krb5/pull/974#issuecomment-531167854. The debug output of OpenLDAP, when there is no objectClass eq index, but a krbPrincipal eq index, is:
If the Kerberos LDAP DB is large and isn't shared with a lot of other LDAP data, almost every object in the database will match one of the objectClass equality tests, but only one will match the krbPrincipalName test. In that scenario, an objectClass index is useless, as it doesn't reduce the number of candidates significantly, while the krbPrincipalName index is useful.
Correct.
But IIRC attribute objectClass is a special case. It should have an eq-index for other stuff. Forgot the details though. Maybe Quanah or others could provide more info.
Ciao, Michael.