Re: Access Security Config File (ACF) size?

[David Bracey via Tech-talk <tech-talk at aps.anl.gov>]

It seems to me that managing the ACF (or ACFs) is straightforward, since these can be centrally located (on some network share, where IOC’s can read them).

 

The hard part is the association of ASG to DB record, since these are declared with the record instances on the IOC.  Since these are scattered at your edge, they are more difficult to manage or audit.

 

I would think a strategy that required the ASG <-> record association to change as rarely as possible, and instead favored modifying the ACF(s) and telling IOC’s to reload would be desired.

 

From: Anders Lindh Olsson <anders.lindholsson at ess.eu>
Date: Wednesday, April 22, 2026 at 9:43 AM
To: tech-talk at aps.anl.gov <tech-talk at aps.anl.gov>, David Bracey <dbracey at fnal.gov>
Subject: Re: Access Security Config File (ACF) size?

[EXTERNAL] – This message is from an external sender

Hi Dave,

 

We use a singular ACF file at ESS, and we currently have around ~10 M records in production. It has not really been a problem thus far, but we also do not (yet?) have many conditionals in the file.

 

When we decided on the approach, we weighed between per-IOC and global and centralised. One of the main concerns for per-IOC was traceability - doing pvget MY-PV.ASG will not be very helpful.

 

 

Cheers

A

---

From: Tech-talk <tech-talk-bounces at aps.anl.gov> on behalf of David Bracey via Tech-talk <tech-talk at aps.anl.gov>
Sent: 22 April 2026 16:19
To: tech-talk at aps.anl.gov <tech-talk at aps.anl.gov>
Subject: Access Security Config File (ACF) size?

 

Does anyone have a feel for how large an ACF could be without becoming problematic?

 

Considering an extreme example, if one had ~100000 PVs, and one defined an ASG for each PV, would that be a problem?

 

How big do ACF’s get in the wild?

 

Are there strategies for using multiple ACF’s?

 

• Dave Bracey, Fermilab