openstack/openstack-manuals
Code Issues Proposed changes

Merge "Add cron job to periodically flush expired tokens"

Browse Source
This commit is contained in:
Jenkins 2014-03-10 20:34:38 +00:00 committed by Gerrit Code Review
commit 6eefa66cc0
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
doc/install-guide/section_keystone-install.xml
View File

@ -207,5 +207,28 @@ admin_token = ADMIN_TOKEN
<screen os="rhel;fedora;centos;sles;opensuse"><prompt>#</prompt> <userinput>service openstack-keystone start</userinput>
<prompt>#</prompt> <userinput>chkconfig openstack-keystone on</userinput></screen>
</step>
<step>
<para>By default, the Identity Service stores expired tokens in
the database indefinitely. While potentially useful for auditing
in production environments, the accumulation of expired tokens
will considerably increase database size and may decrease
service performance, particularly in test environments with
limited resources. We recommend configuring a periodic task using
<systemitem class="service">cron</systemitem> to purge expired
tokens hourly.</para>
<substeps>
<step>
<para>Edit the crontab for the root user:</para>
<screen><prompt>#</prompt> <userinput>crontab -e</userinput></screen>
</step>
<step>
<para>Add the following line to purge expired tokens every
hour and log the output to
<filename>/var/log/keystone/keystone-tokenflush.log</filename>:
</para>
<programlisting>@hourly /usr/bin/keystone-manage token_flush >/var/log/keystone/keystone-tokenflush.log 2>&amp;1</programlisting>
</step>
</substeps>
</step>
</procedure>
</section>