ldapsearch is slow to launch (not slow to search, slow to launch)

user_2817542 0
Viewed 62

On one host ldapsearch was taking 20 seconds to launch.

Even if I just asked it what its version number is, it still took 20 seconds:

time ldapsearch -VV
ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.44 (Sep 30 2020 17:16:36) $
        mockbuild@x86-02.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/clients/tools
        (LDAP library: OpenLDAP 20444)

real    0m20.034s
user    0m0.006s
sys     0m0.008s

This isn't a question about time to search - if I asked it to search, it would spend 20 seconds before it even starts searching.

Once it starts, the search succeeds and takes about the same time as it does when invoked from other hosts.

I tried adding various command line parameters.

The only thing that returned a different result was ldapsearch --help which returns basically instantly, suggesting that the problem wasn't in loading libraries or any such.

openldap
1 Answers

Running strace showed that the delay was in network traffic, specifically port 53 (DNS):

socket(AF_INET6, SOCK_DGRAM|SOCK_NONBLOCK, IPPROTO_IP) = 3 <0.000038> 
connect(3, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "... poll([{fd=3, events=POLLOUT}], 1, 0)    = 1 ([{fd=3, revents=POLLOUT}]) <0.000011>
sendto(3, "..."..., 34, MSG_NOSIGNAL, NULL, 0) = 34 <0.000033>
poll([{fd=3, events=POLLIN}], 1, 5000)  = 0 (Timeout) <5.005182>

The destination for the connect call turned out to be an IP address that was being set in /etc/resolv.conf.

The IP address was unreachable.

Removing the unreachable IP address from /etc/resolv.conf made the delay go away.

user_28175420
Related