cassandra 3.11.9 system_auth need to be SimpleStrategy or NetworkTopologyStrategy on production env?

user_5539664 0
Viewed 82

What is the recommended for cassandra (apache) 3.11.9 system_auth? need to be SimpleStrategy or NetworkTopologyStrategy? And with how much RF?

We have cassandra with 1 dc (2-3 AWS racks with EC2_snitch + dynamic_snitch disabled). Most queries running on consistency level local_one). Today our system_auth keyspace configured SimpleStrategy with RF 3. In a lot of queries, we are wasting time on (tracing):

Executing single-partition query on roles [ReadStage-X]

As part of an attempt to solve our problems we also increased the parameters:

roles_validity_in_ms, permissions_validity_in_ms, credentials_validity_in_ms, permissions_cache_max_entries.

Can queries latency problems be connected to system_auth keyspace configuration?

cassandra-3.0 cassandra
1 Answers

I answered this question a while ago, which is similar: Replication Factor to use for system_auth

Due to issues that can happen with larger clusters which fluctuate in size, we now treat system_auth like we do any other keyspace. That is, we set system_auth's RF to 3 in each DC.

tl;dr;, if you're using NetworkTopologyStrategy on your non-system keyspaces, then you should also be using it for system_auth. Same with your RF; I'd always match the RF of system_auth with that of my "normal" keyspaces, as well.

No, the replication strategy and RF used on system_auth does not typically cause query latency. That is of course, unless any of the Security cache settings have been altered. 10 years of working with Cassandra, I've never had to change those: https://docs.datastax.com/en/security/5.1/security/secAuthCacheSettings.html

queries wasting time on (tracing): "Executing single-partition query on roles [ReadStage-X]"

This statement got me thinking: Are you tracing queries in cqlsh while logged in as the default cassandra user? That user does trigger some cqlsh operations to execute at QUORUM. Could also be that maybe the query consistency and connection consistency are set differently. Just a thought.

user_10545580
Related