Public bug reported: On list operations, every attribute for every item returned by the plugin is checked by the policy engine to see whether the user has rights to see it [*], assuming the attribute map specifies enforce_policy=True for that attribute
However, in most cases no policies are actually defined for those attributes; in this case the neutron server emits a log.debug statement for the specific attribute saying no policy was found. This statement is then repeated for every attribute without policy times the number of items in the response. Simple instrumenation shows list operations take in the API layer more than 500% the time they take in the plugin. The time is wasted after the plugin call completes and more precisely while doing policy checks. While other optimisations might be performed (such as not repeating checks already performed, and not triggering init() for each check), the biggest offender is the log statement. Some measurements are available here: http://paste.openstack.org/show/75069/ * I believe this is wrong as well, but that's another story ** Affects: neutron Importance: High Assignee: Salvatore Orlando (salvatore-orlando) Status: In Progress ** Tags: api icehouse-backport-potential -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1302467 Title: Logging on list operations slows down operation by about 500% Status in OpenStack Neutron (virtual network service): In Progress Bug description: On list operations, every attribute for every item returned by the plugin is checked by the policy engine to see whether the user has rights to see it [*], assuming the attribute map specifies enforce_policy=True for that attribute However, in most cases no policies are actually defined for those attributes; in this case the neutron server emits a log.debug statement for the specific attribute saying no policy was found. This statement is then repeated for every attribute without policy times the number of items in the response. Simple instrumenation shows list operations take in the API layer more than 500% the time they take in the plugin. The time is wasted after the plugin call completes and more precisely while doing policy checks. While other optimisations might be performed (such as not repeating checks already performed, and not triggering init() for each check), the biggest offender is the log statement. Some measurements are available here: http://paste.openstack.org/show/75069/ * I believe this is wrong as well, but that's another story To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1302467/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
