yahoo-eng-team team mailing list archive

[Paul Griffin <paul.griffin@xxxxxxxxxxx>]

Public bug reported:

The nova.objects.instance.InstanceList class's get_by_security_group_id
function calls the db.security_group_get function, which uses the
_security_group_get_query() function to generate a query object. That
query, by default, joins with the secgroup-rules table, and currently
the db.security_group_get function offers no option to avoid joining
with the rules. As a result:

If a security group exists with a large number of instances and a large
number of rules, the db query result will be very large and take
multiple seconds to complete, tying up conductor and making the system
unresponsive.

Since the InstanceList.get_by_security_group_id call only aims to build
a list of instances, there is no need in this case to join with the
rules, and so the db.security_group_get call should optionally avoid
joining with the rules table.

** Affects: nova
     Importance: Undecided
     Assignee: Paul Griffin (paul-griffin)
         Status: New

** Changed in: nova
     Assignee: (unassigned) => Paul Griffin (paul-griffin)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1552971

Title:
  InstanceList.get_by_security_group_id can run very slow

Status in OpenStack Compute (nova):
  New

Bug description:
  The nova.objects.instance.InstanceList class's
  get_by_security_group_id function calls the db.security_group_get
  function, which uses the _security_group_get_query() function to
  generate a query object. That query, by default, joins with the
  secgroup-rules table, and currently the db.security_group_get function
  offers no option to avoid joining with the rules. As a result:

  If a security group exists with a large number of instances and a
  large number of rules, the db query result will be very large and take
  multiple seconds to complete, tying up conductor and making the system
  unresponsive.

  Since the InstanceList.get_by_security_group_id call only aims to
  build a list of instances, there is no need in this case to join with
  the rules, and so the db.security_group_get call should optionally
  avoid joining with the rules table.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1552971/+subscriptions