Re: [ovirt-users] slow kerberos authentication
On 05/12/2017 10:04 AM, Yaniv Kaul wrote:
On May 11, 2017 8:25 PM, "Fabrice Bacchella"
<fabrice.bacchella(a)orange.fr <mailto:fabrice.bacchella@orange.fr>> wrote:
I'm using kerberos authentication in ovirt for the URL
/sso/oauth/token-http-auth, but kerberos is done in Apache using
auth_gssapi_module and it's quite slow, about 6s for a request.
I'm trying to understand if it's apache or ovirt-engine that are
slow. Is there a way to get response time metered for http requests
inside ovirt instead of seen from apache ?
In 4.1, look under /var/log/httpd, there should be an ovirt specific log
file for exactly this - end to end latency of requests.
Y.
The name of that file is 'ovirt-requests-log', and it contains messages
like this:
[12/May/2017:11:09:30 +0200] 192.168.122.1 "Correlation-Id:
9e259b75-ee9e-4501-9737-b38d2c318123" "Duration: 393514us" "GET
/ovirt-engine/api/vms HTTP/1.1" 2322
Note however that it is generated by the web server, so the reported
time will include all the web server activities required to complete the
request.
If you need to get the same measurement from the point of view of the
application server you can edit the
/usr/share/ovirt-engine/services/ovirt-engine/ovirt-engine.xml.in file
and do the following modifications:
1. Modify the AJP connector (the one that Apache talks to) so that it
records the start time of the request:
<ajp-listener
name="ajp"
socket-binding="ajp"
redirect-socket="redirect"
record-request-start-time="true" <-- This is new
/>
2. Enable the access log:
<host name="default-host" alias="localhost">
<filter-ref .../>
<access-log pattern="%U %Dms"
directory="/var/log/ovirt-engine"
prefix="my" suffix=".log"/> <-- This is new
</host>
Then restart the engine. It will start to write to
/var/log/ovirt-engine/my.log lines like this:
/ovirt-engine/api/vms 801ms
The format of the pattern is described here:
http://undertow.io/javadoc/1.4.x/index.html
Remember that the ovirt-engine.xml.in file isn't considered a
configuration file, so your changes will be lost next time you update
the engine RPMs.