Loading...
Loading...
Impacted clusters may observe the following, though the scope and intensify of the symptoms may vary with individual workflows and configuration: During SMB session setup, NTLM or Kerberos authentication may take 10-30 seconds to complete, sometimes longer. NFS workflows may observe file access hangs or stalls for extended periods of time during authentication. Due to timeouts induced by the authentication delays, applications may report connection timeouts or "server not responding" errors. Under busy workflows, the compounding authentication latencies can exhaust LSASS threads. This in turn results in other operations relying on LSASS to become latent as they wait for LSASS to process their requests. Viewing a mapping token for a user demonstrates an abnormal degree of latency. The following log messages may also be present, though they are not exclusively indicative of the issue present. When present with the above latency, they may become suspect. These messages are present in /var/log/lsassd.log on a node. Unknown SID <SID> in file provider, trying to resolve as name Unknown SID <SID> in NIS provider, trying to resolve as name Unknown SID in LDAP provider, trying to resolve as name Administrators may also observe higher than usual outbound LDAP queries to Active Directory domain controllers.
Code enhancements in 9.12+ introduced additional unnecessary lookups for non-local group membership of users that unintentionally added 5-15 seconds of latency per lookup. This is more pronounced in instances where looking at the group membership of a user that has a large number of memberships, including those from SID History. A cluster may be at risk of the issue if the following conditions are true: The cluster is on OneFS 9.12 or later. There are multiple authentication providers present. There are an excessive number of messages in /var/log/lsassd.log on impacted nodes trying to resolve external SIDs as names. Viewing a user's mapping token takes five seconds or longer. There is no way to definitely know if a cluster will be at risk for hitting the issue, as this is subjective to each individual external authentication environment. That said, being on the impacted code level will significantly put a cluster at risk of the issue in addition to the other items listed above.
The fix is projected for release in: OneFS 9.15 - Release mid/late August 2026 OneFS 9.13.1.1 - Release August 2026 OneFS 9.14.0.1 - Currently Available A means to reduce but not completely remove latency would be to reduce the negative cache TTL and hit count. Memcache caches the failed lookups for the group SID as a user, but that does not get listed as a negative entry until five attempts. Note that <Zone> must be defined for the applicable access zone you want to apply these changes to with the relevant commands. NOTE : Always make sure you collect the default values for any system or global configurations you plan to modify prior to changing them, as they may vary between clusters . To modify the number of failed lookups necessary to write an entry to negative cache to one for a specified access zone: # isi_gconfig registry.Services.lsass.Parameters.Zones.<zone>.NegCacheHitsThreshold=1 If the parameter above doesn't exist for individual access zones, the same value may also be changed globally. isi_gconfig registry.Services.lsass.Parameters.NegCacheHitsThreshold=1 To extend the TTL/lifespan of the negative cache entry to four hours, thus reducing the frequency of queries: # isi zone zones modify <Zone> --negative-cache-entry-expiry=4H While not removing the issue fully, the above values the configuration is changed to reduces the frequency of potential latency to once every four hours. After installing the patch with the fix for the appropriate code-level, cluster administrators may revert the values for the above settings back to what were previously set.
Click on a version to see all relevant bugs
Dell Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.