Study Notes

Performance testing on LDAP
Wrote by Phillip Huang

Index
 Target
 Environment
 Preparing Work
 Testing Process
 Data Analysis

1. Target
Performance testing on getting returned entries from LDAP server

2. Environment
There are total two computers. One acts as LDAP server, another is client requests to query on LDAP server.
2.1 Hardware Info
LDAP server – CPU C2.0GHz/Memory 512MB/250G IDE/Realtek 8139(10/100Mbps)
Client machine- CPU P4 1.7GHz/Memory 512MB/80G IDE/Network device Intel PRO 1000(10/100/1000Mbps)
2.2 Software Info
LDAP server – Microsoft Windows 2000 Server / iPlanet Directory Server 5.1
Client – CentOS 4.3(2.6.9-34.EL) / LAT (1.0.7 stable version)
2.3 Network setting/info:
LDAP server IP – 192.168.123.21
LDAP service port – 390
Client IP – 192.168.123.32
Local Area Network – 10Mbps

3. Preparing work

3.1 iPlanet Directory Server Installation/Basic configuration
In the machine “192.168.123.21”, log on as administrator. Before install iPlanet Directory Server, be sure Internet Information Service (IIS) is not installed, specify only TCP/IP as network protocol and any other network services would not be installed. If IIS are installed, remove it and restart operating system. If other protocols (e.g. IPX/NetBIOS) and network services are installed, remove them and restart operating system.

Then, unzip the product binaries, and run the iPlanet Directory Server setup program. In this testing case, choose the type of installation as “typical installation”.

According to DNS host name “plasmon.sit”, select the directory suffix as “dc=plasmon, dc=sit” for the trees that contains the data. Here we set “390” as Directory Server port. The Directory Manager DN is the special directory entry to which access control does not apply. In this testing, we just keep the default Directory Manager DN is “cn=Directory Manager”, and set its password as “hello123”

3.2 Configure client setting
In the machine “192.168.123.32”, modify the “/etc/openldap/ldap.conf” file as the following:
# LDAP Defaults
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example, dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/openldap/cacerts
uri ldap://192.168.123.21:390
BASE dc=plasmon,dc=sit

3.3 connection testing
In the machine “192.168.123.32”, issue the “ldapsearch -x” command. If it is able to return the entries information from LDAP server, it means the configurations are right and connection between LDAP server and client runs well.

3.4 Create large number of general users
In the machine “192.168.123.32”, create a general user “rooney” and export its ldif to file name “1”.
# cat 1
dn: cn=rooney,ou=People, dc=plasmon,dc=sit
sn: wen
objectClass: top
objectClass: person
objectClass: inetOrgPerson
objectClass: organizationalPerson
displayName: rooney
Initials: rw
givenName: rooney
cn: rooney

I wrote a Shell script “stest” in order to replicate the above text with somewhere changes.
# !/bin/bash
# script name: stest
# replicate the “rooney” entry with some where changes
# create 10000 copies
for ((i=1;i<=10000;i++)) do cp 1 t1 # change "rooney" to "claudio_$i" sed "s/rooney/claudio_$i/g" t1 > t2
# change “wen” to “lopez_$i”
sed “s/wen/lopez_$i/g” t2 > rt$i

# remove temporary files
rm -rf t1 t2
done
# the following steps are to concatenate all the rt_$i files
# create B1 file
touch B1
for((i=1;i<=10000;i++)) do j=`expr $i + 1` cat B$i rt$i > B$j
# remove temporary files
rm -rf rt$i B$i
done
# end of script

As the result, I got a file named “B10001” contains 10000 different entries, and then imported this “B10001” to LDAP database by LAT. The successful import operating could be proved by showing these 10000 users in LAT window.
Issue “ldapsearch -x” only returned 5000 entries with “Administrative limit exceeded” messages. This issue will be described in detail later in this report

3.5 Create large number of POSIX users
As same as creating general users, used LAT to create a POSIX user
“luisfigo” and exported the entry to file named “2”.
# cat 2
dn: cn=luisfigo,ou=People, dc=plasmon,dc=sit
objectClass: top
objectClass: posixaccount
objectClass: shadowaccount
objectClass: inetorgperson
objectClass: person
objectClass: organizationalPerson
displayName: luisfigo
uidNumber: 1002
cn: luisfigo
Initials: lf
sn: figo
uid: luisfigo
gecos: luisfigo
homeDirectory: /home/lfigo
gidNumber: 1001
givenName: luis
userPassword: {SSHA}muFo383UsaJsjZpKqAF4MZUk+VxjYo9p8Zs3ow==

I wrote a Shell script “stest1” in order to replicate the above text with somewhere changes.
#! /bin/bash
# script name: stest1
# usage: ./stest1 $1 $2 $3 $4
# $1: the basic first name
# $2: the basic second name
# $3: the begin uidNumber
# $4: the end uidNumber
# create entry
for ((i=$3;i<=$4;i++)) do cp 2 t1 sed "s/luis/$1_$i/g" t1 > t2
sed “s/figo/$2_$i/g” t2 > t3
# reset the uidNumber
sed “s/1002/$i/g” t3 > rt$i
# remove temporary files
rm -rf t1 t2 t3
done
# the following steps are to concatenate all the rt_$i files
# create C$3 file
touch C$3
for((i=$3;i<=$4;i++)) do k=`expr $i + 1` cat C$i rt$i > C$k
# remove temporary files
rm -rf rt$i C$i
done
# rename the output file with meaningful name
mv C$i report$1_$2_$3_$4
# end of script

Then, I decided to create users in the following steps:
First, issued “./stest1 phillip huang 1003 4000” in command line, it created users whose uidNumber from 1003 to 4000.
Second, issued “./stest1 bruce gan 8000 11003” in command line, it created users whose uidNumber from 8000 to 11003.
Third, issued “./stest1 ashely cole 4001 7999” in command line, it created users whose uidNumber from 4001 to 7999.

Now, there are three files: reportphillip_huang_1003_4000, reportbruce_gan_8000_11003, reportashely_cole_4001_7999. Concatenate these three files in this identified order:
# cat reportphillip_huang_1003_4000 reportbruce_gan_8000_11003 reportashely_cole_4001_7999 > Shevchenko

Import the file “Shevchenko” to LDAP database by LAT. The successful import operating could be proved by showing these added POSIX users in LAT window. Note, here, issue “ldapsearch -x” also returned 5000 entries with “Administrative limit exceeded” messages.

3.6 Look – through Limitation on iPlanet Directory Server
The conditions that trigger the problem include using a user registry containing more entries than the registry’s “look-through” search limit on iPlanet. When the look-through limit defined in the iPlanet Directory Server is exceeded, the directory server returns a status of LDAP_ADMINLIMIT_EXCEEDED. The look-through limit is a performance related parameter that can be customized by the iPlanet LDAP administrator.

In the iPlanet Console, select the Configuration tab and expand the Data entry. Then select the Database Settings item and select the LDBM Plug-in Settings tab. In the Look-through Limit field, enter the maximum number of entries you want the server to check in response to a search request. The default look-through limit value is 5000. If you do not wish to set a limit, enter -1 in this field.

If bind to the directory as the Directory Manager, the look-through limit is unlimited by default, and overrides any settings you specify in this field.

So I would use “cn=Directory Manager” to return all entries without modify the iPlanet default setting in the following testing:
# ldapsearch -x -D “cn=Directory Manager” -w hello123

4. Testing Process
By default, iPlanet Directory Server has created index on “sn”,”cn” and “objectclass”. No Index is build for “uidNumber”. In this case, we focus on the responding on returned entries when request to query, sort and research.

4.1 Research with filter based on “objectclass”
4.1.1 ldapsearch result redirect
Testing script: 4_1_1
# !/bin/bash
# script name: 4_1_1
# ldapsearch result redirect
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" > ldapsearch_4_1_$i
echo “End: `date`”
echo ” ”
sleep 60
done
# end of script
The result:
15:43:21 – 15:43:30 9s
15:44:30 – 15:44:38 8s
15:45:38 – 15:45:47 9s
4.1.2 ldapsearch result standard output(screen)
Testing script: 4_1_2
# !/bin/bash
# script name:4_1_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" echo "End: `date`" echo " " sleep 60 done # end of script The result: 16:29:28 - 16:31:02 94s 16:31:22 - 16:32:54 92s 16:33:14 - 16:34:42 88s 4.2 Research with filter based on "objectclass" and sort by uid 4.2.1 ldapsearch result redirect Testing script: 4_2_1 # !/bin/bash # script name: 4_2_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" –S uid > ldapsearch_4_2_$i
echo “End: `date`”
echo ” ”
sleep 60
done
# end of script
The result:
15:48:31 – 15:49:40 69s
15:50:40 – 15:51:50 70s
15:52:50 – 15:53:59 69s
4.2.2 ldapsearch result standard output(screen)
Testing script: 4_2_2
# !/bin/bash
# script name:4_2_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" –S uid echo "End: `date`" echo " " sleep 20 done # end of script The result: 16:37:48 - 16:40:26 162s 16:40:46 - 16:43:24 158s 16:43:44 - 16:46:21 157s 4.3 Research with filter based on "objectclass" and "cn" 4.3.1 ldapsearch result redirect Testing script: 4_3_1 # !/bin/bash # script name: 4_3_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 " (&(objectclass=*)(cn=*))" > ldapsearch_4_3_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
16:22:06 – 16:22:15 9s
15:22:45 – 16:22:53 8s
16:23:23 – 16:23:32 9s
4.3.2 ldapsearch result standard output(screen)
Testing script: 4_3_2
# !/bin/bash
# script name:4_3_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*))" echo "End: `date`" echo " " sleep 60 done # end of script The result: 16:48:22 - 16:49:56 94s 16:50:16 - 16:51:48 92s 16:52:08 - 16:53:40 92s 4.4 Research with filter based on "objectclass" "cn" and sort by uid 4.4.1 ldapsearch result redirect Testing script: 4_4_1 # !/bin/bash # script name: 4_4_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*))" -S uid > ldapsearch_4_4_$i
echo “End: `date`”
echo ” ”
sleep 60
done
# end of script
The result:
15:58:56 – 16:00:01 65s
16:01:01 – 16:02:06 65s
15:03:06 – 16:04:10 64s
4.4.2 ldapsearch result standard output(screen)
Testing script: 4_4_2
# !/bin/bash
# script name:4_4_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*))" -S uid echo "End: `date`" echo " " sleep 20 done # end of script The result: 16:55:56 - 16:58:35 159s 16:58:55 - 17:01:28 153s 17:01:48 - 17:04:22 154s 4.5 Research with filter based on "objectclass" "cn" "sn" 4.5.1 ldapsearch result redirect Testing script: 4_5_1 # !/bin/bash # script name: 4_5_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*)(sn=*))" > ldapsearch_4_5_$i
echo “End: `date`”
echo ” ”
sleep 60
done
# end of script
The result:
16:17:22 – 16:17:30 8s
16:18:30 – 16:18:38 8s
16:19:38 – 16:19:47 9s
4.5.2 ldapsearch result standard output(screen)
Testing script: 4_5_2
# !/bin/bash
# script name:4_5_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*)(sn=*))" echo "End: `date`" echo " " sleep 20 done # end of script The result: 17:06:24 - 17:07:55 91s 17:08:15 - 17:09:48 93s 17:10:08 - 17:11:33 95s 4.6 Research with filter based on "objectclass" "cn" "sn" and sort by uid 4.6.1 ldapsearch result redirect Testing script: 4_6_1 # !/bin/bash # script name: 4_6_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*)(sn=*))" -S uid > ldapsearch_4_6_$i
echo “End: `date`”
echo ” ”
sleep 60
done
# end of script
The result:
16:08:23 – 16:09:33 70s
16:10:33 – 16:11:41 68s
16:12:41 – 16:13:54 73s
4.6.2 ldapsearch result standard output(screen)
Testing script: 4_6_2
# !/bin/bash
# script name:4_6_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(objectclass=*)(cn=*)(sn=*))" -S uid echo "End: `date`" echo " " sleep 20 done # end of script The result: 17:13:17 - 17:16:13 176s 17:16:33 - 17:19:15 162s 17:19:35 - 17:22:30 175s Now, in iPlanet console, add "uidNumber" index. Restart LDAP service. 4.7 Research with filter based on "uidnumber" 4.7.1 ldapsearch result redirect Testing script: 4_7_1 # !/bin/bash # script name: 4_7_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(uidnumber=*)" > ldapsearch_4_7_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
18:17:32 – 18:17:38 6s
18:18:08 – 18:18:14 6s
18:18:44 – 18:18:51 7s
4.7.2 ldapsearch result standard output(screen)
Testing script: 4_7_2
# !/bin/bash
# script name:4_7_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(uidnumber=*)" echo "End: `date`" echo " " sleep 30 done # end of script The result: 18:19:21 - 18:21:08 107s 18:21:38 - 18:23:36 118s 18:24:06 - 18:26:02 116s 4.8 Research with filter based on "uidnumber" and sort by uid 4.8.1 ldapsearch result redirect Testing script: 4_8_1 # !/bin/bash # script name: 4_8_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(uidnumber=*)" –S uid > ldapsearch_4_8_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
18:26:32 – 18:26:52 20s
18:27:22 – 18:27:43 21s
18:28:13 – 18:28:33 20s

4.8.2 ldapsearch result standard output(screen)
Testing script: 4_8_2
# !/bin/bash
# script name:4_8_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(uidnumber=*)" –S uid echo "End: `date`" echo " " sleep 30 done # end of script The result: 18:29:03 - 18:31:16 133s 18:31:47 - 18:34:00 133s 18:34:30 - 18:36:44 134s 4.9 Research with filter based on "uidnumber" and "objectclass" 4.9.1 ldapsearch result redirect Testing script: 4_9_1 # !/bin/bash # script name: 4_9_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*))" > ldapsearch_4_9_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
18:37:14 – 18:37:21 7s
18:37:51 – 18:37:57 6s
18:38:27 – 18:38:34 7s
4.9.2 ldapsearch result standard output(screen)
Testing script: 4_9_2
# !/bin/bash
# script name:4_9_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*))" echo "End: `date`" echo " " sleep 30 done # end of script The result: 18:39:04 - 18:41:01 117s 18:41:31 - 18:43:27 116s 18:43:57 - 18:45:55 118s 4.10 Research with filter based on "uidnumber" "objectclass" and sort by uid 4.10.1 ldapsearch result redirect Testing script: 4_10_1 # !/bin/bash # script name: 4_10_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*))" -S uid > ldapsearch_4_10_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
18:46:25 – 18:46:45 20s
18:47:15 – 18:47:35 20s
18:48:05 – 18:48:25 20s
4.10.2 ldapsearch result standard output(screen)
Testing script: 4_10_2
# !/bin/bash
# script name:4_10_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*))" -S uid echo "End: `date`" echo " " sleep 30 done # end of script The result: 18:48:55 - 18:51:09 134s 18:51:39 - 18:53:51 132s 18:54:21 - 18:56:37 135s 4.11 Research with filter based on "uidnumber" "objectclass" "cn" 4.11.1 ldapsearch result redirect Testing script: 4_11_1 # !/bin/bash # script name: 4_11_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*)(cn=*))" > ldapsearch_4_11_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
18:57:07 – 18:57:13 6s
18:57:43 – 18:57:50 7s
18:58:20 – 18:58:27 7s

4.11.2 ldapsearch result standard output(screen)
Testing script: 4_11_2
# !/bin/bash
# script name:4_11_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*)(cn=*))" echo "End: `date`" echo " " sleep 30 done # end of script The result: 18:58:57 - 19:00:54 117s 19:01:24 - 19:03:21 117s 19:03:51 - 19:05:47 116s 4.12 Research with filter based on "uidnumber ""objectclass" "cn" and sort by uid 4.12.1 ldapsearch result redirect Testing script: 4_12_1 # !/bin/bash # script name: 4_12_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*)(cn=*))" -S uid > ldapsearch_4_12_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
19:06:17 – 19:06:38 19s
19:07:08 – 19:07:28 20s
19:07:58 – 19:08:18 20s

4.12.2 ldapsearch result standard output(screen)
Testing script: 4_12_2
# !/bin/bash
# script name:4_12_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(&(uidnumber=*)(objectclass=*)(cn=*))" -S uid echo "End: `date`" echo " " sleep 30 done # end of script The result: 19:08:48 - 19:11:01 133s 19:11:31 - 19:13:45 134s 19:14:15 - 19:16:29 133s 4.13 Research with filter based on "objectclass" sort by "objectclass" 4.13.1 ldapsearch result redirect Testing script: 4_13_1 # !/bin/bash # script name: 4_13_1 # ldapsearch result redirect for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" –S objectclass > ldapsearch_4_13_$i
echo “End: `date`”
echo ” ”
sleep 30
done
# end of script
The result:
19:16:59 – 19:18:09 70s
19:18:39 – 19:19:50 71s
19:20:20 – 19:21:31 71s
4.13.2 ldapsearch result standard output(screen)
Testing script: 4_13_2
# !/bin/bash
# script name:4_13_2
# ldapsearch result standard output(screen)
for ((i=0;i<=2;i++)) do echo " i = $i" echo "Start: `date`" ldapsearch -x -D "cn=Directory Manager" -w hello123 "(objectclass=*)" –S objectclass echo "End: `date`" echo " " sleep 30 done # end of script The result: 19:22:01 - 19:25:59 238s 19:26:29 - 19:30:26 237s 19:30:56 - 19:34:53 237s 5. Data Analysis Table 5-1 ldapsearch –x Filter Filter (objectclass=*) (objectclass=*)(cn=*) (objectclass=*)(cn=*)(sn=*) -------------------------------------------------------------------------------------------- Time(Redirect)(s) 9 9 8 Time(stdio)(s) 90 92 92 Table 5-2 ldapsearch –x Filter –S uid Filter (objectclass=*) (objectclass=*)(cn=*) (objectclass=*)(cn=*)(sn=*) ---------------------------------------------------------------------------------------------- Time(Redirect)(s) 70 65 70 Time(stdio)(s) 162 154 170 Note, ldapsearch –x ”(objectclass=*)” –S objectclass testing times are: 70s and 238s Table 5-3 ldapsearch –x Filter Filter (uidnumber=*) (uidnumber=*)(objectclass=*) (uidnumber=*)(objectclass=*)(cn=*) -------------------------------------------------------------------------------------------------------- Time(Redirect)(s) 6 7 6 Time(stdio)(s) 110 117 117 Table 5-4 ldapsearch –x Filter –S uid Filter (uidnumber=*) (uidnumber=*)(objectclass=*) (uidnumber=*)(objectclass=*)(cn=*) --------------------------------------------------------------------------------------------------------- Time(Redirect)(s) 20 20 19 Time(stdio)(s) 133 133 133 From Table5-1 and Table5-2, although iPlanet has built index on “uid”, it still took longer time to return results than the situation without sort operation. We could find that the returned time (Redirect) comparing Table5-3 withTable5-4, 20 is 3 times of 6, then dig of the returned time(Redirect) comparing Table5-1 with Table5-2, 70 is almost 8 times based on 9. I think this different of times is caused by the number of returned entries. Testing according Table5-1 and Table5-2 returned about 20,000 entries, but the other testing based on Table5-3 and Table5-4 has only about 10,000 items because some general users have no uidnumber. So the result is able to accepted, From all the tables, we could find that the query rate is not increased obviously whenever have multiple filters. It’s necessary to take a look at returning time of “ldapsearch –x ”(objectclass=*)” –S objectclass” subjects, they are 70s and 238s. Comparing with the time of “ldapsearch –x ”(objectclass=*)” –S uid” listed in Table5-2, 70s and 162s. The time(Redirect) is same, but here 238 is much bigger than 162. How could this happen, now I have no reasonable explanations and I’m still going on research.