group file query

[sparky_2]

We have a number of HP-UX servers that have in excess of 1500 users. The majority of these users have secondary membership to an additional two groups. This is causing difficulties with our /etc/group files because each member is listed within this under each secondary group. We are experiencing "large entry" and "large multi-line" group warnings. Is there any way that that the maximum size allowed can be increased and if so, would this have any negative implications if implemented?

[G. Vrijhoeven]

Hi,

It is related to:
/usr/include/limits.h

LINE_MAX

Gideon

[G. Vrijhoeven]

Hi,

I can not help you with a solution, since i do not know it.

Gideon

[Robert-Jan Goossens · Accepted solution]

Hi,

Check this doc,

http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000065680326

Document id: KBRC00011210

The maximum line length that is valid for a group entry (or script) is 2048 characters as defined in the /usr/include/limits.h for LINE_MAX as input from text files. This translates to the practical limit again defined in the limits.h file: 2048 -50 /9 = 222.

There is a workaround but is does have restrictions: Create multiple entries of the exact same group but with different users in each occurrence of the group entry. (In this case, they might want to use the yearly expiration date as a group identifier). For example:

users::20:root, ..., hundreds more users.

users::20:rooty, ..., hundreds more users.

users::20:rooter, ..., hundreds more users. .

Regards,
Robert-Jan.

[sparky_2]

Hi Robert-Jan,
Thanks, splitting users across multiple entries of each group will probably be my best way forward. When new users are added into these groups, however, what determines the line that the uid is appended to? Is it simply the first encountered and this should therefore be left with space to grow?

[Robert-Jan Goossens]

Keelin,

Yes to your question.

As described in the doc, this is a workaround not a fix. To administer these groups will be a bit of pain.

Kind regards and a good weekend.

Robert-Jan.

[Scott G. Gallup]

Another drawback to the multiple line approach is if SAM is used to remove an account. SAM converts the multiple lines back into a single line entry in the /etc/group file. Found this one out the hard way.