Announcement

Collapse
No announcement yet.

DFS ACL Saving speed

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • DFS ACL Saving speed

    Good morning everyone (and afternoon for those in other timezones..)

    I have an issue with DFS..basically, users are finding it too slow to apply ACLs when there are a lot of subfolders.

    I did some tests on folders that have quite a few sub-folders inheriting, and it takes an average of 0,215181058 seconds per folder to save the ACL, on an XP sp2 machine. I'm testing on another machine right now and it seems to be about 4-5 times worse - but they are on different network locations so this is probably a non-issue.

    Now, 0,2 seconds per folder might not seem so bad but when they add someone at the top of a 10 000folder structure, that is 30 minutes with an unresponsive window on your screen..! nevermind those who have even slower performances.

    What I also noticed is that when I apply the ACL directly on the target instead of using the DFS Path, I improve performance by a lotl. A 30 minute operation becomes a ~10minute operation.

    There is only one target in the DFS (replication is handled in the background by the SAN appliance), so why is it so much faster to apply the ACL on the direct path? I guess it would be because you're skipping the DFS host and going straight to the share..

    Does anybody have any tips on improving that kind of performance problems ?
    What kind of performance do you get on your networks?

    Thanks



    Edit: I just tested from another machine that is directly in the data center, same subnet as DFS and File servers (all 1gig yada yada..)

    Applying ACL on 718 folders using the direct path to the file server took THREE seconds.
    Doing it using the DFS path took 11:20minutes . Jesus !! There's got to be a problem with the DFS server I guess.

    Is there a difference in the process on DFS versus standard share? Such as let's say in a normal share, the server will apply the SIDs, while in DFS, your workstation has to resolve them to names or something such as that? If that was the case for example it could mean that when your Domain controller is slow, you'd have more of an impact on DFS than a standard share...this is just an example though.
    Last edited by gepeto; 23rd May 2008, 14:24. Reason: Benchmark
    VCP on vSphere (4), MCITP:EA/DBA, MCTS:Blahblah

  • #2
    Re: DFS ACL Saving speed

    Is this 2003, or R2 DFS? Are you using replication?

    In 2003 if you change the ACL it will replicate the entire file, in R2 only the ACL gets replicated.

    Comment


    • #3
      Re: DFS ACL Saving speed

      There is no DFSR or FRS involved. Replication is invisible to Windows, as it happens between devices in the background.

      I'm doing some wireshark dumps, I guess there is some kind of networking issue.

      I was wondering if anyone could let me know how much slower it was on their DFS versus using the direct path..
      VCP on vSphere (4), MCITP:EA/DBA, MCTS:Blahblah

      Comment


      • #4
        Re: DFS ACL Saving speed

        http://technet2.microsoft.com/window....mspx?mfr=true

        When setting NTFS permissions, always use the path of the physical folder (\\servername\sharename) instead of navigating through the DFS namespace to set permissions. This is especially important when you have multiple link targets for a given link. Setting permissions on a folder by using its DFS path can cause the folder to inherit permissions from its parent folder in the namespace. In addition, if there are multiple link targets, only one of them gets its permissions updated when you use the DFS path.

        Comment


        • #5
          Re: DFS ACL Saving speed

          Wow thanks....pretty clear.

          It sucks though, am I going to tell users to right click, go to properties, check the DFS Tab, then browse to that path, and THEN set the permissions.. Ouch.

          Good article thanks !
          VCP on vSphere (4), MCITP:EA/DBA, MCTS:Blahblah

          Comment


          • #6
            Re: DFS ACL Saving speed

            Why do you have users setting permissions anyway?

            Comment


            • #7
              Re: DFS ACL Saving speed

              That client has 1 superuser per work folder responsible for ACLs.
              Downside is that they will often edit ACLs instead of just asking someone for a group membership modification..
              VCP on vSphere (4), MCITP:EA/DBA, MCTS:Blahblah

              Comment

              Working...
              X