searchrate

searchrate — measure search throughput and response time

Synopsis

searchrate {options} [filter template string] [attributes …]

Description

This utility can be used to measure search throughput and response time of a directory service using user-defined searches.

Example:

searchrate -p 1636 -Z -X -D uid=admin -w password \

-F -c 4 -t 4 -b 'dc=example,dc=com' -g 'rand(0,2000)' '(uid=user.{})'

Before trying the example, import 2000 randomly generated users.

When you do not use the -f option to keep connections open and rebind on the connections, the tool can exhaust its available ports, causing the tool to crash. You can work around this problem on test systems by changing TCP settings on the system.

For example, on Linux systems, set the following parameters in the /etc/sysctl.conf file:

net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1

The parameter net.ipv4.tcp_fin_timeout sets the length of time in seconds to wait for a final FIN packet before forcing a close of the socket. The default is 60 (seconds).

The parameter net.ipv4.tcp_tw_recycle enables fast recycling of TIME_WAIT sockets. The default is 0 (false). Enabling this can cause Network Address Translation (NAT) issues.

The parameter net.ipv4.tcp_tw_reuse enables reuse of TIME_WAIT sockets for new connections. The default is 0 (false).

These settings are recommended only for testing, and not for production systems .

After making the changes to /etc/sysctl.conf , reload the configuration with the sysctl command:

# sysctl -p

Options

The searchrate command takes the following options:

Command options:

-a | --dereferencePolicy {dereferencePolicy}: Alias dereference policy ('never', 'always', 'search', or 'find'). Default: never
-b | --baseDn {baseDN}: Base DN template string.
-B | --warmUpDuration {warmUpDuration}: Warm up duration in seconds. Default: 0
-c | --numConnections {numConnections}: Number of connections. Default: 1
-d | --maxDuration {maxDuration}: Maximum duration in seconds, 0 for unlimited. Default: 0
-e | --percentile {percentile}: Calculate max response time for a percentile of operations.
-f | --keepConnectionsOpen: Keep connections open. Default: false
-F | --noRebind: Keep connections open and do not rebind. Default: false
-g | --argument {generator function or static string}: Argument used to evaluate the template strings in program parameters (ie. Base DN, Search Filter). The set of all arguments provided form the argument list in order. Besides static string arguments, they can be generated per iteration with the following functions:

"inc({filename})" Consecutive, incremental line from file

"inc({min},{max})" Consecutive, incremental number

"rand({filename})" Random line from file

"rand({min},{max})" Random number

"randstr({length},charSet)" Random string of specified length and optionally from characters in the charSet string. A range of character can be specified with [start-end] charSet notation. If no charSet is specified, the default charSet of [A-Z][a-z][0-9] will be used.

These functions do not support formatted integers with comma due to the ambiguity between a comma used to separate function arguments and a comma used to separate digits in a formatted integer.
-i | --statInterval {statInterval}: Display results each specified number of seconds. Default: 5
-m | --maxIterations {maxIterations}: Max iterations, 0 for unlimited. Default: 0
-M | --targetThroughput {targetThroughput}: Target average throughput to achieve. Default: 0
-s | --searchScope {searchScope}: Search scope ('base', 'one', 'sub', or 'subordinates'). Note: 'subordinates' is an LDAP extension that might not work with all LDAP servers. Default: sub
-S | --scriptFriendly: Use script-friendly mode. Default: false
-t | --numConcurrentRequests {numConcurrentRequests}: Number of concurrent requests per connection. Default: 1
-Y | --proxyAs {authzID}: Use the proxied authorization control with the given authorization ID.

LDAP connection options:

--connectTimeout {timeout}: Maximum length of time (in milliseconds) that can be taken to establish a connection. Use '0' to specify no time out. Default: 30000
-D | --bindDn {bindDN}: DN to use to bind to the server. Default:
-E | --reportAuthzId: Use the authorization identity control. Default: false
-h | --hostname {host}: Fully-qualified server host name or IP address. Default: localhost.localdomain
-N | --certNickname {nickname}: Nickname of the certificate that should be sent to the server for SSL client authentication.
-o | --saslOption {name=value}: SASL bind options.
-p | --port {port}: Directory server port number.
-q | --useStartTls: Use StartTLS to secure communication with the server. Default: false
-T | --trustStorePassword[:env|:file] {trustStorePassword}: Truststore password which will be used as the cleartext configuration value.
--useJavaKeyStore {keyStorePath}: JKS keystore containing the certificate which should be used for SSL client authentication.
--useJavaTrustStore {trustStorePath}: Use a JKS truststore file for validating server certificate.
--useJceKeyStore {keyStorePath}: JCEKS keystore containing the certificate which should be used for SSL client authentication.
--useJceTrustStore {trustStorePath}: Use a JCEKS truststore file for validating server certificate.
--useJvmTrustStore: Use the JVM truststore for validating server certificate. Default: false
--usePasswordPolicyControl: Use the password policy request control. Default: false
--usePkcs11KeyStore: PKCS#11 keystore containing the certificate which should be used for SSL client authentication. Default: false
--usePkcs12KeyStore {keyStorePath}: PKCS#12 keystore containing the certificate which should be used for SSL client authentication.
--usePkcs12TrustStore {trustStorePath}: Use a PKCS#12 truststore file for validating server certificate.
-w | --bindPassword[:env|:file] {bindPassword}: Password to use to bind to the server. Omit this option while providing the bind DN to ensure that the command prompts for the password, rather than entering the password as a command argument.
-W | --keyStorePassword[:env|:file] {keyStorePassword}: Keystore password which will be used as the cleartext configuration value.
-X | --trustAll: Trust all server SSL certificates. Default: false
-Z | --useSsl: Use SSL for secure communication with the server. Default: false

Utility input/output options:

-n | --no-prompt: Use non-interactive mode. If data in the command is missing, the user is not prompted and the tool will fail. Default: false
--noPropertiesFile: No properties file will be used to get default command line argument values. Default: false
--propertiesFilePath {propertiesFilePath}: Path to the file containing default property values used for command line arguments.
-v | --verbose: Use verbose mode. Default: false

General options:

-V | --version: Display Directory Server version information. Default: false
-H | --help: Display this usage information. Default: false

Exit codes

0: The command completed successfully.
89: An error occurred while parsing the command-line arguments.

Examples

The following example measures search performance:

$ searchrate \
 --hostname localhost \
 --port 1636 \
 --useSsl \
 --usePkcs12TrustStore /path/to/opendj/config/keystore \
 --trustStorePassword:file /path/to/opendj/config/keystore.pin \
 --baseDn dc=example,dc=com \
 --numConnections 4 \
 --noRebind \
 --numConcurrentRequests 4 \
 --maxDuration 30 \
 --argument "rand(0,2000)" "(uid=user.{})"
--------------------------------------------------------------------------------------------
|     Throughput    |                 Response Time                |       Additional      |
|    (ops/second)   |                (milliseconds)                |       Statistics      |
|   recent  average |   recent  average    99.9%   99.99%  99.999% |  err/sec Entries/Srch |
--------------------------------------------------------------------------------------------
|  15669.9  15669.9 |    0.992    0.992    17.04    29.62    33.42 |      0.0          1.0 |
|  28143.6  21896.8 |    0.562    0.717    12.39    25.30    33.42 |      0.0          1.0 |
|  26761.8  23518.5 |    0.592    0.669    10.49    22.02    32.11 |      0.0          1.0 |
|  27053.2  24402.2 |    0.585    0.646     9.18    19.79    30.67 |      0.0          1.0 |
|  27555.4  25032.8 |    0.575    0.630     8.22    18.35    30.02 |      0.0          1.0 |
|  27745.3  25484.1 |    0.570    0.619     7.67    17.83    29.62 |      0.0          1.0 |

This example uses the following options:

--hostname localhost , --port 1636 , --useSsl , --usePkcs12TrustStore /path/to/opendj/config/keystore , --trustStorePassword:file /path/to/opendj/config/keystore.pin: Access the server running on the local system over a secure LDAPS connection to port 1636.
--baseDn dc=example,dc=com: Search under the base DN dc=example,dc=com . This user is not subject to access control, so rates may be higher than what you observe with a regular user.
No --bindDn or --bindPassword options: Perform the search as an anonymous user.
--numConnections 4: Open 4 connections to the server.
--noRebind: Keep connections open and do not rebind.
--numConcurrentRequests 4: Perform up to 4 concurrent requests on each connection.
--maxDuration 30: Run for a maximum of 30 seconds.
--argument "rand(0,2000)" "(uid=user.{})": Search for an entry with UID equal to uid=user.number , where number is a random number between 0 and 2000, inclusive.

Notice the following characteristics of the output:

The first two columns show the throughput in operations completed per second. The recent column shows the average rate for operations reflected in this row of output. The average column shows the average rate since the beginning of the run.
The response time columns indicate characteristics of response latency in milliseconds. The recent column shows the average latency for operations reflected in this row of output. The average column shows the average latency since the beginning of the run. The "99.9%" column shows the latency after which 99.9% of operations have completed. Only 1 operation in 1000 took longer than this. The "99.99%" column shows the latency after which 99.99% of operations have completed. Only 1 operation in 10,000 took longer than this. The "99.999%" column shows the latency after which 99.999% of operations have completed. Only 1 operation in 100,000 took longer than this.
The additional statistics columns show information about what is happening during the run. The "err/sec" column shows the rate of error results per second for this row of output. Unless you have intentionally set up the command to generate errors, this column should indicate 0.0 . The "Entries/Srch" column shows the average number of entries returned for each search. If you expect one result entry per search, this column should indicate 1.0 . Check that these columns match your expectations before looking at any other columns.

Directory Services 7.3.5