This topic has 3 replies, 2 voices, and was last updated 9 months ago by gp2000.

  • Author
  • #26973

    We have roughly 35,000 users in our Directory.

    There is an application that uses the following query to output all users for reporting: “(&(givenName=*)(objectClass=inetorgperson))” . While “givenName” attribute is indexed, it hit a limit of index-entry-limit, which is 4,000 by default.

    It takes about 300 seconds to finish. While the query runs, LDAP becomes very slow, and it causes problems to the other clients doing simple searches that normally come back within few milliseconds, but at that time take 30-40 second to finish.

    Here is the output of the debugsearchindex:

    debugsearchindex: filter=(&(givenName=*)[INDEX:givenName.presence][NOT-INDEXED][INDEX:givenName.presence][LIMIT-EXCEEDED](objectClass=inetorgperson)[INDEX:objectClass.equality][LIMIT-EXCEEDED])[NOT-INDEXED] scope=sub[NOT-INDEXED] final=[NOT-INDEXED]

    What can be done to improve this query, but most importantly avoid having any performance hit on the other clients?

    All articles suggest not to increase index-entry-limit.




    Out of the 35000 users, how many entries have a givenName ? Most likely all of the users.
    So that search is slow not because it’s unindexed, but because it returns all 35000 users.
    Indexing the givenName attribute, will not make the query faster. But increasing the index-entry-limit could impact performance of updates and possibly other queries.


    Yes, that’s correct – all of the users.
    So, what would be recommended options for this case?

    Thank you.


    Does anyone have any suggestions on what to do in our case?

    Thank you.

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

©2020 ForgeRock - we provide an identity and access platform to secure every online relationship for the enterprise market, educational sector and even entire countries. Click to view our privacy policy and terms of use.

Log in with your credentials

Forgot your details?