Change the flush mode to auto

Describe the bug

After upgrade from Keycloak 15.1.1 WildFly to Keycloak 17.0.0 Quarkus we have noticed that response from /auth/admin/realms/<realm>/users is much slower. Also CPU on keycloak server spikes to 100% CPU.

I.e. /auth/admin/realms/<realm>/users?first=0&max=7045 takes: 15.1.1 - 34 seconds 17.0.0 - about 7 min

We do not observe slow queries on DB level.

keycloak conf:

db=mariadb
db-username=user
db-password=xxx
db-url=jdbc:mariadb:sequential://x.x.x.x:3306,x.x.x.x:3306,x.x.x.x:3306/keycloak

http-enabled=true
http-port=8180
kc.http.relative-path=auth
kc.https.relative-path=auth

quarkus-properties-enabled=true

# Metrics and healthcheck are disabled by default
kc.metrics-enabled=true

cache=ispn
cache.config.file=cache-ispn.xml

proxy=passthrough

hostname=xxx

cache_ispn:

<?xml version="1.0" encoding="UTF-8"?>
<!--
       ~ Copyright 2019 Red Hat, Inc. and/or its affiliates
  ~ and other contributors as indicated by the @author tags.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~ http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<infinispan
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:infinispan:config:11.0 http://www.infinispan.org/schemas/infinispan-config-11.0.xsd"
        xmlns="urn:infinispan:config:11.0">
    <jgroups>
        <!-- Add JGroups stacks for Infinispan clustering. -->
      <stack name="kc-tcp" extends="tcp">
                <TCP bind_port="7700" />
        <TCPPING initial_hosts="${jgroups.tcpping.initial_hosts:x.x.x.x[7700],x.x.x.x[7700]}"
                 port_range="0"
                 stack.combine="REPLACE"
                 stack.position="MPING"/>
    </stack>
    </jgroups>
    <cache-container name="keycloak">
        <transport lock-timeout="60000"
                   stack="kc-tcp"/>
        <local-cache name="realms">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
        <local-cache name="users">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
        <distributed-cache name="sessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="authenticationSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="offlineSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="clientSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="offlineClientSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="loginFailures" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <local-cache name="authorization">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
        <replicated-cache name="work">
            <expiration lifespan="-1"/>
        </replicated-cache>
        <local-cache name="keys">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <expiration max-idle="3600000"/>
            <memory max-count="1000"/>
        </local-cache>
        <distributed-cache name="actionTokens" owners="2">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
            <memory max-count="-1"/>
        </distributed-cache>
    </cache-container>
</infinispan>

Build command: ./kc.sh build --cache-config-file cache-ispn.xml --cache ispn --http-relative-path auth --metrics-enabled true -Dkc.db-tx-type=enabled -Dkc.db-driver=org.mariadb.jdbc.Driver

show-config:

Current Mode: none
Runtime Configuration:
        kc.cache =  ispn (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.cache-config-file =  cache-ispn.xml (PersistedConfigSource)
        kc.config.args =  show-config (SysPropConfigSource)
        kc.db =  mariadb (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.db-password =  ******* (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.db-url =  jdbc:mariadb:sequential://x.x.x.x:3306,x.x.x.x:3306,x.x.x.x:3306/keycloak (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.db-username =  user (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.home.dir =  /home/keycloak/keycloak-17.0.0/bin/../ (SysPropConfigSource)
        kc.hostname =  xxx (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.http-enabled =  true (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.http-port =  8180 (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.http-relative-path =  auth (PersistedConfigSource)
        kc.metrics-enabled =  true (PersistedConfigSource)
        kc.proxy =  passthrough (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.quarkus-properties-enabled =  true (PersistedConfigSource)
        kc.show.config =  none (SysPropConfigSource)
        kc.spi.theme.cache-templates =  false (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.spi.theme.cache-themes =  false (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.spi.theme.static-max-age =  -1 (PropertiesConfigSource[source=file:/home/keycloak/keycloak-17.0.0/bin/../conf/keycloak.conf])
        kc.version =  17.0.0 (SysPropConfigSource)

Version

17.0.0

Expected behavior

Get users from REST API is similar fast as on 15.1.1

Actual behavior

Get users from REST API is slow

How to Reproduce?

Try to get users from REST API: /auth/admin/realms/<realm>/users?first=0&max=7045

Anything else?

No response

[pedroigor]

PHEW 😃

And thanks for contributing this.

[emikolajczak]

Hi, On new VM looks good. Get all users takes 18 sec. It looks that your fix working. Thanks for your assistance 😃