[neutron] security group list regression

James Denton james.denton at rackspace.com
Sat Feb 29 01:41:35 UTC 2020


Hello all,

We recently upgraded an environment from Newton -> Rocky, and have noticed a pretty severe regression in the time it takes the API to return the list of security groups. This environment has roughly 8,000+ security groups, and it takes nearly 75 seconds for the ‘openstack security group list’ command to complete. I don’t have actual data from the same environment running Newton, but was able to replicate this behavior with the following lab environments running a mix of virtual and baremetal machines:

Newton (VM)
Rocky (BM)
Stein (VM)
Train (BM)
	
Number of sec grps vs time in seconds:
		
#	Newton Rocky Stein  Train
200	4.1	3.7	5.4	5.2
500	5.3	7	11	9.4
1000	7.2	12.4	19.2	16
2000	9.2	24.2	35.3	30.7
3000	12.1	36.5	52	44
4000	16.1	47.2	73	58.9
5000	18.4	55	90	69

As you can see (hopefully), the response time increased significantly between Newton and Rocky, and has grown slightly ever since. We don't know, yet, if this behavior can be seen with other 'list' commands or is limited to secgroups. We're currently verifying on some intermediate releases to see where things went wonky.

There are some similar recent reports out in the wild with little feedback:

https://bugzilla.redhat.com/show_bug.cgi?id=1788749
https://bugzilla.redhat.com/show_bug.cgi?id=1721273

I opened a bug here, too:

https://bugs.launchpad.net/neutron/+bug/1865223

Bottom line: Has anyone else experienced similar regressions in recent releases? If so, were you able to address them with any sort of tuning?

Thanks in advance,
James



More information about the openstack-discuss mailing list