Running indexer in the background, as a different user

[Nate Vack]

Hi all,

In our app, we're running searchd as a different user than our unicorn workers. Clever boy that I am, I decided set up my sudoers file so my app could sudo, password-free, to our sphinxsearch user, and patched thinking_sphinx to take a run_as config option.

Then, I realized that updating our delta index after every insert was adding 20-100ms to our requests. No fun. I start thinking about delayed_job or one of its friends...

...and then realize another solution to both of these problems.

1: Create a directory for "sphinx_wrappers"

2: Create "indexer" in that directory. It's a bash script, with simply:

3: (optional for us) link searchd to the real searchd

#!/bin/bash

sudo -u sphinxsearch /path/to/indexer $* > /dev/null 2>&1 &

Now, indexer returns instantly, and there's no more patching sudo support on to thinking_sphinx!

So! My question for y'all: Is there something bad about this solution I haven't thought of yet?

Thanks!

-Nate

[Pat Allan]

If it works for you, wonderful :)

Though I'm not a fan of the sudo access… granted, it would be nice to have Sphinx running as its own user, though that's certainly a complication that TS doesn't allow for.

--
Pat

> --
> You received this message because you are subscribed to the Google Groups "Thinking Sphinx" group.
> To view this discussion on the web visit https://groups.google.com/d/msg/thinking-sphinx/-/eXSOPlfyk9wJ.
> To post to this group, send email to thinkin...@googlegroups.com.
> To unsubscribe from this group, send email to thinking-sphi...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/thinking-sphinx?hl=en.

[Nate Vack]

On Thursday, June 7, 2012 3:49:10 AM UTC-5, Pat Allan wrote:

Though I'm not a fan of the sudo access… granted, it would be nice to have Sphinx running as its own user, though that's certainly a complication that TS doesn't allow for.

What about the sudo access do you dislike?

I'm not allowing my app user to sudo root; it's limited to the sphinxsearch user. With a little(!) more work, I could limit it further, so it only has access to run /usr/bin/indexer. Doesn't seem any worse than just running searchd as my web user.

-n

[Pat Allan]

Ah, well I guess that's not as bad as I feared. Didn't realise you could lock down sudo access to a specific account that isn't root.

I guess what I would have done is have a service of some sort (possibly hand-crafted in Ruby) running with the Sphinx user, and when it's informed (however that may be - perhaps a process signal, perhaps a socket connection, perhaps touching a given file), it'll run the indexing. Thus no need for sudo setup, and you have the clear avenue for communication from one user/process to the other. Granted, it's probably a little bit of work, and you've got something that functions fine, so stick with it :)

--
Pat

> --
> You received this message because you are subscribed to the Google Groups "Thinking Sphinx" group.

> To view this discussion on the web visit https://groups.google.com/d/msg/thinking-sphinx/-/sC-jd6nlyekJ.