Looks like you are on a right direction. In Mender 2.2 was significant performance improvements and upgrading server version is really good idea. Inventory update and deployments check poll intervals are definitely important for decreasing server load.
The situation is really interesting and I can imagine only hacky ways to try to handle it somehow.
I think the only option for rate limiting in open source version is twicking nginx configuration for enabling rate limiting by IP or do the same on your firewall and sequentially update devices fleet with decreased poll intervals.
Another thing, which might help, is manually check and create indexes in the DB for most frequent and heavy requests. But this step will require attention and manual intervention, because it has to be taken in consideration during further update process. The difference in indices is significant:
1.7.1
> use deviceauth
switched to db deviceauth
> db.getCollectionNames().forEach(function(collection) {
... indexes = db[collection].getIndexes();
... print("Indexes for " + collection + ":");
... printjson(indexes);
... });
Indexes for auth_sets:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_",
"ns" : "deviceauth.auth_sets"
},
{
"v" : 2,
"unique" : true,
"key" : {
"device_id" : 1,
"id_data" : 1,
"pubkey" : 1
},
"name" : "auth_sets:DeviceId:IdData:PubKey",
"ns" : "deviceauth.auth_sets"
},
{
"v" : 2,
"unique" : true,
"key" : {
"device_id" : 1,
"id_data_sha256" : 1,
"pubkey" : 1
},
"name" : "auth_sets:IdDataSha256:PubKey",
"ns" : "deviceauth.auth_sets"
}
]
Indexes for devices:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_",
"ns" : "deviceauth.devices"
},
{
"v" : 2,
"unique" : true,
"key" : {
"id_data" : 1
},
"name" : "devices:IdentityData",
"ns" : "deviceauth.devices"
}
]
Indexes for migration_info:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_",
"ns" : "deviceauth.migration_info"
}
]
>
2.5.0
> use deviceauth
switched to db deviceauth
> db.getCollectionNames().forEach(function(collection) {
... indexes = db[collection].getIndexes();
... print("Indexes for " + collection + ":");
... printjson(indexes);
... });
Indexes for auth_sets:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_"
},
{
"v" : 2,
"unique" : true,
"key" : {
"device_id" : 1,
"id_data_sha256" : 1,
"pubkey" : 1
},
"name" : "auth_sets:IdDataSha256:PubKey",
"background" : false
},
{
"v" : 2,
"unique" : true,
"key" : {
"id_data_sha256" : 1,
"pubkey" : 1
},
"name" : "auth_sets:NoDeviceId:IdDataSha256:PubKey",
"background" : false
}
]
Indexes for devices:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_"
},
{
"v" : 2,
"unique" : true,
"key" : {
"id_data_sha256" : 1
},
"name" : "devices:IdentityDataSha256",
"background" : false
}
]
Indexes for migration_info:
[ { "v" : 2, "key" : { "_id" : 1 }, "name" : "_id_" } ]
Indexes for tokens:
[
{
"v" : 2,
"key" : {
"_id" : 1
},
"name" : "_id_"
},
{
"v" : 2,
"key" : {
"exp.time" : 1
},
"name" : "TokenExpiration",
"background" : false,
"expireAfterSeconds" : 0
}
]
>
tokens collection might contain quite a lot of not indexed expired tokens, which might be safely deleted.