Chapter 5. Improving search performance through resource limits Searching through every entry in a database can have a negative impact on a server performance for larger directories. In large databases, effective indexing might not sufficiently reduce the search scope to improve the performance. You can set limits on user and client accounts to reduce the total number of entries or the total amount of time spent in an individual search. This makes searches more responsive and improves overall server performance. 5.1. Search operation limits for large directories You can control server limits for search operations by using special operational attribute values on the client application binding to the directory. You can set the following search operation limits: The Look through limit specifies how many entries you can examine for a search operation. The Size limit specifies maximum number of entries the server returns to a client application in response to the search operation. The Time limit specifies maximum time the server can spend processing a search operation. The Idle timeout limit specifies the time when connection to the server can be idle before the connection is dropped. The Range timeout limit specifies a separate look-through limit specifically for searches by using a range. In the global server configuration, the resource limits set for the client application take precedence over the default resource limits set. Note The Directory Manager receives unlimited resources by default, with the exception of range searches. 5.2. Search performance improvement with index scan limits For large indexes, it is efficient to treat any search which matches the index as an unindexed search. The search operation has to look in the entire directory to process results rather than searching through an index that is nearly the size of a directory in addition to the directory itself. Additional resources Setting an index scan limit 5.3. Fine grained ID list size In large databases, some queries can consume a large number of CPU and RAM resources. To improve the performance, you can set a default ID scan limit that applies to all indexes in the database by using the nsslapd-idlistscanlimit attribute. However, it is useful to either define a limit for certain indexes or use the list with no IDs defined. You can set individual settings for ID list scan limits for different types of search filters by using the nsIndexIDListScanLimit attribute. Additional resources Setting an index scan limit to improve performance when loading long list of ids 5.4. Setting user and global resource limits by using the command line You can set user-level resource limits, global resource limits, and limits for specific types of searches, such as simple paged and range searches , by using the command line. You can set user-level attributes on the individual entries and global configuration attributes are set in the appropriate server configuration area. You can set the following mentioned operational attributes for each entry by using the ldapmodify command: look-through You can specify the number of entries to examine for a search operation by using the look-through limit attribute. Setting the attribute's value to -1 indicates that there is no limit. User-level attribute: nsLookThroughLimit Global configuration: Attribute: nsslapd-lookthroughlimit Entry: cn=config,cn=ldbm database,cn=plugins,cn=config paged look-through You can specify the number of entries to examine for simple paged search operations by using the paged look-through limit attribute. Setting the attribute's value to -1 indicates that there is no limit. User-level attribute: nsPagedLookThroughLimit Global configuration: Attribute: nsslapd-pagedlookthroughlimit Entry: cn=config,cn=ldbm database,cn=plugins,cn=config size You can specify the maximum number of entries the server returns to a client application in response to a search operation by using the size limit attribute. Setting the attribute's value to -1 indicates that there is no limit. User-level attribute: nsSizeLimit Global configuration: Attribute: nsslapd-sizelimit Entry: cn=config You can add the nsSizeLimit attribute to the user's entry and for example give it a search return size limit of 500 entries: paged size You can specify the maximum number of entries the server returns to a client application for simple paged search operations by using the paged size limit attribute. Setting the attribute's value to -1 indicates that there is no limit. User-level attribute: nsPagedSizeLimit Global configuration: Attribute: nsslapd-pagedsizelimit Entry: cn=config time You can specify the maximum time the server can spend processing a search operation by using the time limit attribute. Setting the attribute's value to -1 indicates that there is no time limit. User-level attribute: nsTimeLimit Global configuration: Attribute: nsslapd-timelimit Entry: cn=config idle timeout You can specify the time in seconds for which a connection to the server can be idle before the connection is dropped by using the idle timeout attribute. Setting the attribute's value to -1 indicates that there is no limit. User-level attribute: nsidletimeout Global configuration: Attribute: nsslapd-idletimeout Entry: cn=config ID list scan You can specify the maximum number of entry IDs loaded from an index file for search results. If the ID list size is greater than the maximum number of IDs, the search will not use the index list, but will treat the search as an unindexed search and look through the entire database. User-level attribute: nsIDListScanLimit Global configuration: Attribute: nsslapd-idlistscanlimit Entry: cn=config,cn=ldbm database,cn=plugins,cn=config paged ID list scan You can specify the maximum number of entry IDs loaded from an index file for search results particularly for paged search operations by using the paged ID list scan limit. User-level attribute: nsPagedIDListScanLimit Global configuration: Attribute: nsslapd-pagedidlistscanlimit Entry: cn=config,cn=ldbm database,cn=plugins,cn=config range look-through You can specify the numbers of entries to examine for a range search operation by using the range look-through limit. Setting the attribute's value to -1 indicates that there is no limit. Note A range search is a search by using the greater-than , equal-to-or-greater-than , less-than , or equal-to-less-than operators. User-level attribute: not available Global configuration: Attribute: nsslapd-rangelookthroughlimit Entry: cn=config,cn=ldbm database,cn=plugins,cn=config Note You can set an access control list to prevent users from changing the setting. Additional resources Managing access control 5.5. Setting resource limits on anonymous binds You can configure resource limits for anonymous binds by creating a template user entry that has resource limits, and then applying this template to anonymous binds, because resource limits are set on a user entry and anonymous bind does not have a user entry associated with it. Prerequisites A template entry has been created. Procedure Set resource limits you want to apply to anonymous binds: Note For performance reasons, the template must be in the normal back end, not in the cn=config suffix that does not use an entry cache. Add the nsslapd-anonlimitsdn parameter to the server configuration, pointing to the DN of the template entry on all suppliers in a replication topology: 5.6. Performance improvement for range searches A range search (all IDs search) uses operators to set a bracket to search and return an entire subset of the entries within a directory. The range search can evaluate every entry in the directory to check if the entry is within the provided range. For example, to search for every entry modified at or after midnight on January 1, run the following command: To prevent a range search from turning into an all IDs search, you can use the look-through limit. By using this limit, you can improve overall performance and speed up range search results. However, some clients or administrative users, such as Directory Manager, cannot have the look-through limit set. In this case, the range search can take several minutes to complete or can even continue indefinitely. However, you can set a separate range look-through limit. By setting this limit, clients and administrative users can have high look-through limits and can still be able to set a reasonable limit on potentially performance-impaired range searches. You can configure such setting by using the nsslapd-rangelookthroughlimit attribute. The default value is 5000. To set the separate range look-through limit to 7500, run the following command:

Commands:
dsconf instance backend config set --lookthroughlimit value
dsconf instance backend config set --pagedlookthroughlimit value
dsconf instance config replace nsslapd-sizelimit value
ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: uid=user_name,ou=People,dc=example,dc=com changetype: modify add: nsSizeLimit nsSizeLimit: 500
dsconf instance config replace nsslapd-pagedsizelimit value
dsconf instance config replace nsslapd-timelimit value
dsconf instance config replace nsslapd-idletimeout value
dsconf instance backend config set --idlistscanlimit value
dsconf instance backend config set --pagedidlistscanlimit value
dsconf instance backend config set ----rangelookthroughlimit value
ldapadd -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=anonymous_template,ou=people,dc=example,dc=com objectclass: nsContainer objectclass: top cn: anonymous_template nsSizeLimit: 250 nsLookThroughLimit: 1000 nsTimeLimit: 60
dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-anonlimitsdn="cn=anonymous_template,ou=people,dc=example,dc=com"
(modifyTimestamp>=20210101010101Z)
dsconf -D "cn=Directory Manager" ldap://server.example.com backend config set --rangelookthroughlimit 7500