[openstack-dev] Expired tokens in Keystone

Clint Byrum clint at fewbar.com
Wed Jun 12 18:08:05 UTC 2013


Excerpts from Craig E. Ward's message of 2013-06-12 09:54:21 -0700:
> I am working with a Folsom installation of OpenStack. The Keystone database 
> (mysql) gets very large. The token table has millions of rows of expired 
> tokens. Is there a reason not to delete these from the table?
> 

As Dolph mentions, Havana has a command for flushing tokens. However, if
you use it on your million row table, you risk affecting token creation:

https://bugs.launchpad.net/keystone/+bug/1188378

Basically to maintain transaction isolation, InnoDB must lock the gaps
between rows it has marked for deletion while it does a delete. Also
delete will end up reading pages into the buffer pool, so if you are
tight on the size of that you will waste cache pages.

http://www.mysqlperformanceblog.com/2012/03/27/innodbs-gap-locks/

I'm working on a solution now, though it will likely have to have a
mysql specific method, and then a more naive method for other SQL engines.

Another thing you can do is use percona toolkit's pt-archiver command:

pt-archiver --source h=dbhost,D=keystone,t=token --purge --where "expires < NOW()" --primary-key-only --sleep-coef 1.0 --txn-size 500

This will delete the rows in a more friendly way. Read more here:

http://www.percona.com/doc/percona-toolkit/2.1/pt-archiver.html

I have been using this to keep a live table under control while I work
on the fix for the flush command.



More information about the OpenStack-dev mailing list