[openstack-dev] Expired tokens in Keystone
Clint Byrum
clint at fewbar.com
Wed Jun 12 18:08:05 UTC 2013
Excerpts from Craig E. Ward's message of 2013-06-12 09:54:21 -0700:
> I am working with a Folsom installation of OpenStack. The Keystone database
> (mysql) gets very large. The token table has millions of rows of expired
> tokens. Is there a reason not to delete these from the table?
>
As Dolph mentions, Havana has a command for flushing tokens. However, if
you use it on your million row table, you risk affecting token creation:
https://bugs.launchpad.net/keystone/+bug/1188378
Basically to maintain transaction isolation, InnoDB must lock the gaps
between rows it has marked for deletion while it does a delete. Also
delete will end up reading pages into the buffer pool, so if you are
tight on the size of that you will waste cache pages.
http://www.mysqlperformanceblog.com/2012/03/27/innodbs-gap-locks/
I'm working on a solution now, though it will likely have to have a
mysql specific method, and then a more naive method for other SQL engines.
Another thing you can do is use percona toolkit's pt-archiver command:
pt-archiver --source h=dbhost,D=keystone,t=token --purge --where "expires < NOW()" --primary-key-only --sleep-coef 1.0 --txn-size 500
This will delete the rows in a more friendly way. Read more here:
http://www.percona.com/doc/percona-toolkit/2.1/pt-archiver.html
I have been using this to keep a live table under control while I work
on the fix for the flush command.
More information about the OpenStack-dev
mailing list