SSS_CACHE(8)

📦
version 2.12.0 · 21 versions
, in ubuntu stonking

💅 SSS_CACHE — the SSSD manual page, section 8, bestie

okay so picture this: you're deep in the sss_cache manual page (yes, the one from the SSSD manual pages, section 8, we been knew) and you just want somebody to explain it like a friend. that's me. i'm that friend. 🫶

✨ NAME ✨

sss_cache — perform cache cleanup. that's the whole job. she cleans. she invalidates. she's booked and busy. 🧹💖

🌸 SYNOPSIS 🌸

sss_cache [options]

literally that's it. no positional args, no wildness. just vibes and flags. ✨

🦋 DESCRIPTION 🦋

sss_cache invalidates records in the SSSD cache. and by "invalidate" we mean it marks them as nope, expired, don't trust me anymore — because invalidated records are forced to be reloaded from the server as soon as the related SSSD backend is online. so it's not deleting anything, it's just telling the cache to touch grass and go get fresh data. 🔥

key detail bestie, don't miss it: options that invalidate a single object only accept a single provided argument. one option, one object. no greedy little lists. she said one at a time. 💅

👑 OPTIONS 👑

every single one, no gatekeeping:

  • -E, --everything — invalidate all cached entries. the nuclear option. the main character option. ☄️
  • -u, --user login — invalidate a specific user. just the one. the singular one.
  • -U, --users — invalidate all user records. heads up: this option overrides invalidation of specific user if it was also set. so if you were all "but also this one user—" nah. she overrides. periodt. 💀
  • -g, --group group — invalidate a specific group.
  • -G, --groups — invalidate all group records. and yeah, this option overrides invalidation of specific group if it was also set. same energy.
  • -n, --netgroup netgroup — invalidate a specific netgroup.
  • -N, --netgroups — invalidate all netgroup records. This option overrides invalidation of specific netgroup if it was also set. ok the pattern is the pattern.
  • -s, --service service — invalidate a specific service.
  • -S, --services — invalidate all service records. This option overrides invalidation of specific service if it was also set. yes queen, override.
  • -a, --autofs-map autofs-map — invalidate specific autofs maps.
  • -A, --autofs-maps — invalidate all autofs maps. This option overrides invalidation of specific map if it was also set. iconic behaviour honestly.
  • -h, --ssh-host hostname — invalidate SSH public keys of a specific host. ⚠️ and before you ask: no, -h is not help here. it's ssh-host. the help flag is elsewhere. i know. i know. 🙈
  • -H, --ssh-hosts — invalidate SSH public keys of all hosts. This option overrides invalidation of SSH public keys of specific host if it was also set. you know the drill by now.
  • -r, --sudo-rule rule — invalidate a particular sudo rule.
  • -R, --sudo-rules — invalidate all cached sudo rules. This option overrides invalidation of specific sudo rule if it was also set. 💅
  • -d, --domain domain — restrict the invalidation process only to a particular domain. the "stay in your lane" flag. 🎀
  • -?, --help — display help message and exit. this is the help one, bestie. -?. remember it. ✨

🌈 EFFECTS ON THE FAST MEMORY CACHE 🌈

okay this section is the whole lore drop so lean in. 🍓

sss_cache also invalidates the memory cache. and here's the thing — since the memory cache is a file which is mapped into the memory of each process which called SSSD to resolve users or groups, the file cannot be truncated. like, physically can't. rude of it, honestly.

so instead: a special flag is set in the header of the file to indicate that the content is invalid, and then the file is unlinked by SSSD's NSS responder and a new cache file is created. whenever a process is now doing a new lookup for a user or a group it will see the flag, close the old memory cache file and map the new one into its memory. and when all processes which had opened the old memory cache file have closed it while looking up a user or a group, the kernel can release the occupied disk space and the old memory cache file is finally removed completely. full circle. closure. growth. 🦋

💀 the long-running-process situation

a special case is long running processes which are doing user or group lookups only at startup — e.g. to determine the name of the user the process is running as. for those lookups the memory cache file is mapped into the memory of the process. but since there will be no further lookups, this process would never detect if the memory cache file was invalidated. and hence it will be kept in memory and will occupy disk space until the process stops. 😭

as a result, calling sss_cache might increase the disk usage, because old memory cache files cannot be removed from the disk because they are still mapped by long running processes. yes. the cleanup tool can make the disk usage go up. i'm not joking. this is real. 🙈

a possible work-around for long running processes which are looking up users and groups only at startup or very rarely is to run them with the environment variable SSS_NSS_USE_MEMCACHE set to "NO" so that they won't use the memory cache at all and not map the memory cache file into the memory.

but honestly? in general a better solution is to tune the cache timeout parameters so that they meet the local expectations and calling sss_cache is not needed. tune the timeouts, live your life, stop manually invalidating. that's the actual advice. 🌸

⭐ SEE ALSO ⭐

your reading list, go off:

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

(yes, sss_cache(8) links to itself. she's self-referential. she contains multitudes. 👑)

💜 AUTHORS 💜

The SSSD upstream — https://github.com/SSSD/sssd/. give them their flowers. 🌷

and that's the page, bestie!! 🎀 this all came from SSSD, dated 10/06/2026 — go read the source, subscribe to the repo, stan the upstream. mwah. 💖✨

📦 where this page comes from