Mailing-List: contact user-help@accumulo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@accumulo.apache.org
MIME-Version: 1.0
In-Reply-To: <CAKERyGSOdm7d+S20rkN9-vkZqGGt-8W1ws=PQS2Rcx5GqDVyvw@mail.gmail.com>
References: <CAKERyGSOdm7d+S20rkN9-vkZqGGt-8W1ws=PQS2Rcx5GqDVyvw@mail.gmail.com>
Date: Thu, 9 Jun 2016 15:18:41 -0400
Message-ID: <CAGUtCHrF7tj0Cr+WdGsFnDC220BgpdS5P6aPK4FWkLTt7jixOA@mail.gmail.com>
Subject: Re: visibility constraint performance
From: Keith Turner <keith@deenlo.com>
To: user@accumulo.apache.org
Content-Type: multipart/alternative; boundary=001a113e2df23eff6c0534dd4a13
archived-at: Thu, 09 Jun 2016 19:18:59 -0000

--001a113e2df23eff6c0534dd4a13
Content-Type: text/plain; charset=UTF-8

On Thu, Jun 9, 2016 at 2:49 PM, Jonathan Wonders <jwonders88@gmail.com>
wrote:

> Hi All,
>
> I've been tracking down some performance issues on a few 1.6.x
> environments and noticed some interesting and potentially undesirable
> behavior in the visibility constraint.  When the associated visibility
> evaluator checks a token to see if the user has a matching authorization,
> it uses the security operations from the tablet server's constraint
> environment which ends up authenticating the user's credentials on each
> call.  This will end up flooding logs with Audit messages corresponding to
> these authentications if the Audit logging is enabled.  It also consumes a
> non-negligible amount of CPU, produces a lot of garbage (maybe 50-60% of
> that generated under a heavy streaming ingest load), and can cause some
> contention between client pool threads when accessing the ZooCache.
>
> My initial measurements indicate a 25-30% decrease in ingest rate
> (entries/s and MB/s) for my environement and workload when this constraint
> is enabled.  This is with the Audit logging disabled.
>
> Is this intended behavior?  It seems like the authentication is redundant
> with the authentication that is performed at the beginning of the update
> session.
>

No. It would be best to avoid that behavior.


>
> Thanks,
> --Jonathan
>

--001a113e2df23eff6c0534dd4a13
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Thu, Jun 9, 2016 at 2:49 PM, Jonathan Wonders <span dir=3D"ltr">&lt;=
<a href=3D"mailto:jwonders88@gmail.com" target=3D"_blank">jwonders88@gmail.=
com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr=
">Hi All,<div><br></div><div>I&#39;ve been tracking down some performance i=
ssues on a few 1.6.x environments and noticed some interesting and potentia=
lly undesirable behavior in the visibility constraint.=C2=A0 When the assoc=
iated visibility evaluator checks a token to see if the user has a matching=
 authorization, it uses the security operations from the tablet server&#39;=
s constraint environment which ends up authenticating the user&#39;s creden=
tials on each call.=C2=A0 This will end up flooding logs with Audit message=
s corresponding to these authentications if the Audit logging is enabled.=
=C2=A0 It also consumes a non-negligible amount of CPU, produces a lot of g=
arbage (maybe 50-60% of that generated under a heavy streaming ingest load)=
, and can cause some contention between client pool threads when accessing =
the ZooCache.</div><div><br></div><div><div>My initial measurements indicat=
e a 25-30% decrease in ingest rate (entries/s and MB/s) for my environement=
 and workload when this constraint is enabled.=C2=A0 This is with the Audit=
 logging disabled.</div></div><div><br></div><div>Is this intended behavior=
?=C2=A0 It seems like the authentication is redundant with the authenticati=
on that is performed at the beginning of the update session.</div></div></b=
lockquote><div><br></div><div>No. It would be best to avoid that behavior.<=
/div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0=
 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div>=
<br></div><div>Thanks,</div><div>--Jonathan</div></div>
</blockquote></div><br></div></div>

--001a113e2df23eff6c0534dd4a13--