Performance Tuning Guide

Transcription

1 IBM Tivoli Access Manager Performance Tuning Guide Version 3.9 GC

2

3 IBM Tivoli Access Manager Performance Tuning Guide Version 3.9 GC

4 Note: Before using this information and the product it supports, read the information in Appendix B, Notices on page 85. Second Edition (April 2002) This edition replaces GC Copyright International Business Machines Corporation 2001,2002. All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents Preface v Who should read this book v What this book contains v Publications vi IBM Tivoli Access Manager vi Related publications viii Accessing publications online x Ordering publications x Providing feedback about publications xi Accessibility xi Contacting customer support xi Conventions used in this book xi Typeface conventions xi Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager Initial steps for setting up an IBM SecureWay Directory Server Resetting an already populated database Planning disk and memory requirements UNIX operating system tuning for the IBM SecureWay Directory server General IBM SecureWay Directory tuning Access-Manager-Specific SecureWay Directory set up Preparing to expand to a large registry Adding users and groups Do the load of users or groups Add Access Manager ACLs not created by the bulkload utility Do the tunings in the next section titled Tuning after a Large Number of Updates Do a DB2 Backup Tuning after a large number of updates Redo the DB2 tuning parameters Recheck for missing and extra indexes Do a DB2 reorgchk Do a DB2 runstats on the objectclass table Do DB2 statistics tuning Start the IBM SecureWay Directory server Test the performance of the registry Chapter 2. Special case IBM LDAP directory tunings Using LDAP cache Setting the LDAP cache parameters Choosing the LDAP cache values for Access Manager Chapter 3. Tuning IBM Tivoli Access Manager WebSEAL Recommended Access Manager WebSEAL tunings auth-using-compare user-and-group-in-same-suffix default-policy-override-support Chapter 4. Special case IBM Tivoli Access Manager WebSEAL tunings LDAP admin account (cn=root) Load balancing between LDAP replicas SSL between IBM Tivoli Access Manager and LDAP Automatic migration of IBM SecureWay Policy Directory 3.7 users during authentication SSL session cache, user credential cache, and memory use Copyright IBM Corp. 2001,2002 iii

6 Chapter 5. Tuning the AIX operating system for IBM Tivoli Access Manager and LDAP 29 Chapter 6. Access Manager s Use of LDAP Directory Chapter 7. Utilities, scripts, and hints for managing IBM LDAP Directory servers IBM LDAP Directory s use of DB Distributing the database across multiple physical disks Background information on LDAP Directory tablespaces Create file systems and directories on the target disks Backing up the existing database Perform a redirected restore of the database DB2 backup and restore Monitoring LDAP performance Update performance and SMP systems Creating large numbers of users The LDAP bulkload utility Disk space requirements Bulk loading and ACLs Using the Access Manager scripts Adding a large number of members to a group Adding groups and the DB2 LOGFILSIZ parameter Using the group scripts together Chapter 8. Process memory size limits Increasing the operating system process memory size limits AIX-specific process size limits Setting the maximum number of AIX data segments that a process can use (LDR_CNTRL) AIX data segments and LDAP process DB2 connections Verifying process data segment usage Chapter 9. Troubleshooting Appendix A. Scripts do_tunings_322.sh and do_tunings_321.sh check_indexes.sh check_ldap_acls.sh fixacls.sh, fixacls2.sh, and fixacls3.sh sysstat_tune.sh test_registry_perf.sh mk_test_users.sh addpd_to_testusers_ldif.sh incremental_bulkload.sh mk_test_group_ldif.sh addpd_to_groups_ldif.sh incremental_group.sh Appendix B. Notices Trademarks iv IBM Tivoli Access Manager: Performance Tuning Guide

7 Preface Who should read this book What this book contains IBM Tivoli Access Manager (Access Manager) is the base software that is required to run applications in the Access Manager product suite. It enables the integration of Access Manager applications that provide a wide range of authorization and management solutions. Sold as an integrated solution, these products provide an access control management solution that centralizes network and application security policy for e-business applications. Note: IBM Tivoli Access Manager is the new name of the previously released software entitled Tivoli SecureWay Policy Director. Also, for users familiar with the Tivoli SecureWay Policy Director software and documentation, the term management server is now referred to as policy server. The IBM Tivoli Access Manager Performance Tuning Guide provides performance tuning information for an environment consisting of IBM Tivoli Access Manager, Version 3.9, with IBM SecureWay Directory defined as the user registry. This guide is regularly updated with the latest performance information regarding Access Manager. This guide supplements the performance tuning sample scripts, located at the following Web address: policy_dir/downloads.html This Web page requires a registered user name and password. This guide is for system administrators responsible for setting up, maintaining, and tuning large and small registries of users. Readers should be familiar with the following: v UNIX operating systems v Database architecture and concepts v Security management v Internet protocols, including HTTP, TCP/IP, File Transfer Protocol (FTP), and Telnet v Lightweight Directory Access Protocol (LDAP) and directory services v A supported user registry v Authentication and authorization This guide contains the following sections: v Chapter 1, Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager v Chapter 2, Special case IBM LDAP directory tunings v Chapter 3, Tuning IBM Tivoli Access Manager WebSEAL v Chapter 4, Special case IBM Tivoli Access Manager WebSEAL tunings Copyright IBM Corp. 2001,2002 v

8 v v v v v Chapter 5, Tuning the AIX operating system for IBM Tivoli Access Manager and LDAP Chapter 6, Access Manager s Use of LDAP Directory Chapter 7 Utilities, scripts, and hints for managing IBM LDAP Directory servers Chapter 8, Process memory size limits Chapter 9, Troubleshooting Appendixes This guide contains the following appendix: v Appendix A, Scripts This appendix provides sample scripts that users can customize. The scripts are also available at: policy_dir/downloads.html Publications This section lists publications in the Access Manager library and any other related documents. It also describes how to access Tivoli publications online, how to order Tivoli publications, and how to make comments on Tivoli publications. IBM Tivoli Access Manager The Access Manager library is organized into the following categories: v v v v v v Release information Base information on page vii WebSEAL information on page vii Web security information on page vii Developer references on page viii Technical supplements on page viii Publications in the product library are included in Portable Document Format (PDF) on the product CD. To access these publications using a Web browser, open the infocenter.html file located in the /doc directory on the product CD. For additional sources of information about Access Manager and related topics, see the following Web sites: Release information v IBM Tivoli Access Manager for e-business Read Me First GI (am39_readme.pdf) Provides information for installing and getting started using Access Manager. v IBM Tivoli Access Manager for e-business Release Notes GI (am39_relnotes.pdf) Provides late-breaking information, such as software limitations, workarounds, and documentation updates. vi IBM Tivoli Access Manager: Performance Tuning Guide

9 Base information v IBM Tivoli Access Manager Base Installation Guide GC <(am39_install.pdf) Explains how to install, configure, and upgrade Access Manager software, including the Web portal manager interface. v IBM Tivoli Access Manager Base Administrator s Guide GC (am39_admin.pdf) Describes the concepts and procedures for using Access Manager services. Provides instructions for performing tasks from the Web portal manager interface and by using the pdadmin command. v IBM Tivoli Access Manager Base for Linux on zseries Installation Guide GC (am39_zinstall.pdf) Explains how to install and configure Access Manager Base for Linux on the zseries platform. WebSEAL information v IBM Tivoli Access Manager WebSEAL Installation Guide GC <(amweb39_install.pdf) Provides installation, configuration, and removal instructions for the WebSEAL server and the WebSEAL application development kit. v IBM Tivoli Access Manager WebSEAL Administrator s Guide GC (amweb39_admin.pdf) Provides background material, administrative procedures, and technical reference information for using WebSEAL to manage the resources of your secure Web domain. v IBM Tivoli Access Manager WebSEAL Developer s Reference GC (amweb39_devref.pdf) Provides administration and programming information for the Cross-domain Authentication Service (CDAS), the Cross-domain Mapping Framework (CDMF), and the Password Strength Module. v IBM Tivoli Access Manager WebSEAL for Linux on zseries Installation Guide GC (amweb39_zinstall.pdf) Provides installation, configuration, and removal instructions for WebSEAL server and the WebSEAL application development kit for Linux on the zseries platform Web security information v IBM Tivoli Access Manager for WebSphere Application Server User s Guide GC (amwas39_user.pdf) Provides installation, removal, and administration instructions for Access Manager for IBM WebSphere Application Server. v IBM Tivoli Access Manager for WebLogic Server User s Guide GC (amwls39_user.pdf) Provides installation, removal, and administration instructions for Access Manager for BEA WebLogic Server. v IBM Tivoli Access Manager Plug-in for Edge Server User s Guide GC (amedge39_user.pdf) Describes how to install, configure, and administer the plug-in for IBM WebSphere Edge Server application. v IBM Tivoli Access Manager Plug-in for Web Servers User s Guide GC (amws39_user.pdf) Preface vii

10 Provides installation instructions, administration procedures, and technical reference information for securing your Web domain using the plug-in for Web servers. Developer references v IBM Tivoli Access Manager Authorization C API Developer s Reference GC (am39_authc_devref.pdf) Provides reference material that describes how to use the Access Manager authorization C API and the Access Manager service plug-in interface to add Access Manager security to applications. v IBM Tivoli Access Manager Authorization Java Classes Developer s Reference GC (am39_authj_devref.pdf) Provides reference information for using the Java language implementation of the authorization API to enable an application to use Access Manager security. v IBM Tivoli Access Manager Administration C API Developer s Reference GC (am39_adminc_devref.pdf) Provides reference information about using the administration API to enable an application to perform Access Manager administration tasks. This document describes the C implementation of the administration API. v IBM Tivoli Access Manager Administration Java Classes Developer s Reference SC (am39_adminj_devref.pdf) Provides reference information for using the Java language implementation of the administration API to enable an application to perform Access Manager administration tasks. v IBM Tivoli Access Manager WebSEAL Developer s Reference GC (amweb39_devref.pdf) Provides administration and programming information for the Cross-domain Authentication Service (CDAS), the Cross-domain Mapping Framework (CDMF), and the Password Strength Module. Technical supplements v IBM Tivoli Access Manager Performance Tuning Guide GC (am39_perftune.pdf) Provides performance tuning information for an environment consisting of Access Manager with IBM SecureWay Directory defined as the user registry. v IBM Tivoli Access Manager Capacity Planning Guide GC (am39_capplan.pdf) Assists planners in determining the number of WebSEAL, user registry, and backend Web servers needed to achieve a required workload. v IBM Tivoli Access Manager Error Message Reference SC (am39_error_ref.pdf) Provides explanations and recommended actions for the messages produced by Access Manager. The Tivoli Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Glossary is available, in English only, at the following Web site: Related publications This section lists publications related to the Access Manager library. viii IBM Tivoli Access Manager: Performance Tuning Guide

11 IBM DB2 Universal Database IBM DB2 Universal Database is required when installing IBM SecureWay Directory, z/os, and OS/390 SecureWay LDAP servers. DB2 information is available at the following Web site: IBM Global Security Toolkit Access Manager provides data encryption through the use of the IBM Global Security Toolkit (GSKit). GSKit is shipped on the IBM Tivoli Access Manager Base CD for your particular platform. The GSKit package installs the ikeyman key management utility, gsk5ikm, which enables you to create key databases, public-private key paris, and certificate requests. The following document is available in the /doc/gskit directory on the IBM Tivoli Access Manager Base CD for your particular platform: v Secure Sockets Layer Introduction and ikeyman User s Guide (gskikm5c.pdf) Provides information for network or system security administrators who plan to enable SSL communication in their Access Manager secure domain. IBM SecureWay Directory IBM SecureWay Directory, Version 3.2.2, is shipped on the IBM Tivoli Access Manager Base CD for your particular platform. If you plan to install the IBM SecureWay Directory server as your user registry, the following documents are available in the /doc/directory path on the IBM Tivoli Access Manager Base CD for your particular platform: v v v v v v IBM SecureWay Directory Installation and Configuration Guide, SC (aparent.pdf, lparent.pdf, sparent.pdf, wparent.pdf) Provides installation, configuration, and migration information for IBM SecureWay Directory components on AIX, Linux, Solaris Operating Environment, and Microsoft Windows operating systems. IBM SecureWay Directory Release Notes (relnote.pdf) Supplements IBM SecureWay Directory, Version 3.2.2, product documentation and describes features and functions made available to you in this release. IBM SecureWay Directory Readme Addendum (addendum322.pdf) Provides information about changes and fixes that occurred after the IBM SecureWay Directory documentation had been translated. This book is provided in English only. IBM SecureWay Directory Server Readme (server.pdf) Provides a description of the IBM SecureWay Directory Server, Version IBM SecureWay Directory Client Readme (client.pdf) Provides a description of the IBM SecureWay Directory Client SDK, Version This software development kit (SDK) provides LDAP application development support. IBM SecureWay Directory Configuration Schema (scparent.pdf) Preface ix

12 v Describes the directory information tree (DIT) and the attributes that are used to configure the slapd32.conf file. In IBM SecureWay Directory Version 3.2, the directory settings are stored using the LDAP Directory Interchange Format (LDIF) format in the slapd32.conf file. IBM SecureWay Directory Tuning Guide (tuning.pdf) Provides performance tuning information for IBM SecureWay Directory. Tuning considerations for directory sizes ranging from a few thousand entries to millions of entries are given where applicable. For more information about IBM SecureWay Directory, see the following Web site: IBM WebSphere Application Server IBM WebSphere Application Server, Advanced Single Server Edition 4.0.2, is installed with the Web portal manager interface. For information about IBM WebSphere Application Server, see the following Web site: Accessing publications online Publications in the product libraries are included in Portable Document Format (PDF) on the product CD. To access these publications using a Web browser, open the infocenter.html file, which is located in the /doc directory on the product CD. When IBM publishes an updated version of one or more online or hardcopy publications, they are posted to the Tivoli Information Center. The Tivoli Information Center contains the most recent version of the publications in the product library in PDF or HTML format, or both. Translated documents are also available for some products. You can access the Tivoli Information Center and other sources of technical information from the following Web site: Information is organized by product, including release notes, installation guides, user s guides, administrator s guides, and developer s references. Note: If you print PDF documents on other than letter-sized paper, select the Fit to page check box in the Adobe Acrobat Print dialog (which is available when you click File Print) to ensure that the full dimensions of a letter-sized page are printed on the paper that you are using. Ordering publications You can order many Tivoli publications online at the following Web site: publications/cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: v In the United States: v In Canada: x IBM Tivoli Access Manager: Performance Tuning Guide

13 v In other countries, for a list of telephone numbers, see the following Web site: Accessibility Providing feedback about publications We are very interested in hearing about your experience with Tivoli products and documentation, and we welcome your suggestions for improvements. If you have comments or suggestions about our products and documentation, contact us in one of the following ways: v v Send an to pubs@tivoli.com. Contacting customer support Complete our customer feedback survey at the following Web site: Accessibility features help a user who has a physical disability, such as restricted mobility or limited vision, to use software products successfully. With this product, you can use assistive technologies to hear and navigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. If you have a problem with any Tivoli product, you can contact Tivoli Customer Support. See the Tivoli Customer Support Handbook at the following Web site: The handbook provides information about how to contact Tivoli Customer Support, depending on the severity of your problem, and the following information: v Registration and eligibility v v Conventions used in this book Telephone numbers and addresses, depending on the country in which you are located What information to gather before contacting support This guide uses several conventions for special terms and actions, operating system-dependent commands and paths, and margin graphics. Typeface conventions The following typeface conventions are used in this book: Bold Italic Monospace Command names and options, keywords, and other information that you must use literally appear in bold. Variables, command options, and values you must provide appear in italics. Titles of publications and special words or phrases that are emphasized also appear in italics. Code examples, command lines, screen output, file and directory names, and system messages appear in monospace font. Preface xi

14 xii IBM Tivoli Access Manager: Performance Tuning Guide

15 Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager The IBM SecureWay Directory is one of several directories supported by Access Manager. This section provides information on setting up, managing, and tuning a large registry of users on the IBM SecureWay Directory server. Because IBM SecureWay Directory uses DB2 for storing its information, much of this information is related to DB2 tuning. Performance problems can occur with small registries (more than several users), as well as with large registries (up to thousands of users). This document addresses tunings for any size registry. The information in this document is applicable to both master and replica servers. Notes are made where the steps may differ between the two types of servers. The information in this section is only for the IBM SecureWay Directory server, not the client; the client requires no tuning. It is assumed that the IBM SecureWay Directory Server has been installed and configured. The document does not cover how to initially configure the IBM SecureWay Directory server. Refer to IBM SecureWay Directory documentation for more information. See IBM SecureWay Directory. This document assumes a basic understanding of LDAP and of the design and deployment of a user name space on LDAP. This knowledge is prerequisite to understanding some of the steps in this document. Refer to the following IBM Redbooks for more information: v Understanding LDAP (SG ) v LDAP Implementation Cookbook (SG ) These documents can be found online at Initial steps for setting up an IBM SecureWay Directory Server This section describes how to set up a large registry of users with an empty database. The first part of the section describes how to reset an already populated registry to make it empty. Skip this section if the IBM SecureWay Directory server has been freshly installed and configured. In this case, the database is already empty. Resetting an already populated database If the IBM SecureWay Directory server is already configured and populated with data, it can be reset to an empty database using several methods, two of which are described here. One method is to unconfigure, uninstall, reinstall, and reconfigure the IBM SecureWay Directory server. Another method is to drop and recreate the IBM SecureWay Directory DB2 database. The first method also reset the DB2 database and LDAP configuration settings to their defaults. The second method does not. Even if the second method is used, it is a good idea to go through all of the subsequent tuning steps to ensure the database is properly tuned. Some of the files that are not changed as a result of dropping the database are listed below: Copyright IBM Corp. 2001,2002 1

16 /etc/slapd32.conf /etc/ldapschema/v3.modifiedschema You should save the original contents of these files, so that they can be restored to their defaults if necessary. To drop and create the database used by the IBM LDAP server, do the following: 1. Stop the Directory server. On UNIX systems, this can be done by first finding the process ID of the slapd process: ps ef grep slapd 2. Note the slapd process ID from the previous command, then stop the process using a command similar to the following: kill process_id where process_id is the process ID returned from the first command. On Windows systems, stop the IBM LDAP server service. 3. Switch to the ldapdb2 instance users. This is done on UNIX systems using the following command: su ldapdb2 On Windows systems, enter the following command at a command prompt: db2cmd set DB2INSTANCE=ldapdb2 4. Drop and create the database: db2 drop db ldapdb2 db2 create db ldapdb2 5. Exit from the ldapdb2 instance (UNIX systems) using the following command: exit After the database has been dropped and recreated, the IBM SecureWay Directory server must be started to finish the database configuration. Start the IBM SecureWay Directory server with the following command: slapd Planning disk and memory requirements The minimum memory size for an IBM SecureWay Directory server with more than a million users is 512 MB; the optimum memory size is 1 to 2 GB. For an IBM SecureWay Directory server with fewer than a million users, the optimum memory size is 256 MB. The disk space requirements for a server with over a million users depend upon whether the server machine is to be used to bulk-load the initial set of users and which version of the IBM SecureWay Directory server is used (Version or 3.2.2). Following is an explanation of the requirements: v v Bulkload: Reserve 7 to 9 GB of disk space for bulk-loading temporary files if millions of users are to be loaded. The bulkload utility is fastest when all users are loaded in one pass. Refer to the bulkload section for refinements on the disk requirements. See The LDAP bulkload utility on page 40. Accounting and temporary information: The ldapdb2 user s home directory initially holds the entire DB2 database. It also holds accounting and temporary information, like the DB2 transaction log. Reserve 100 MB to 1 GB of disk space for this accounting and temporary storage 2 IBM Tivoli Access Manager: Performance Tuning Guide

17 v DB2 database tables: The database tables can either stored in the ldapdb2 user s home directory or spread across multiple disk drives using a redirected restore. The disk requirement for the database tables depends upon the IBM LDAP server version and the number of users in the registry. Note that the following requirements are for IBM Tivoli Access Manager (formerly Tivoli SecureWay Policy Director) users. For regular LDAP users, the disk storage requirements may differ. IBM SecureWay Directory, Version 3.2.1: 20 KB of disk space per user IBM SecureWay Directory, Version 3.2.2: 11 KB of disk space per user The requirements on the number of and speed of the CPUs and disk drives on the SecureWay Directory server machine are not within the scope of this document. Many slow servers can perform as well as a single fast server. This type of planning is discussed more fully in the IBM Tivoli Access Manager Capacity Planning Guide. See Technical supplements. One guideline is that faster CPUs improve authentication and search times, while faster disk drives improve user creation and update time. UNIX operating system tuning for the IBM SecureWay Directory server This section describes how to make the operating system changes required to support large registries with the IBM SecureWay Directory server. Skip this section if the server is to be deployed on a Windows operating system. Solaris operating system Skip this section if you are not setting up tuning on the Solaris operating system. Increase the shared memory maximum (shmmax): The shared memory maximum must be increased to allow DB2 processes to allocate the buffer pool space. In a later step, the buffer pool settings may be changed to sizes that are too large for the default shared memory maximum. On a Solaris system, update the shared memory maximum in the /etc/system file by changing the following line: set shmsys:shminfo_shmmax = physical_memory where physical_memory is the size of the physical memory on the machine in bytes. After changing the shared memory maximum, reboot the system in order for it to take effect. Examining the contents of the /etc/system file is not a reliable way to determine the operating systems setting for the shared memory maximum. For that purpose, use the following command: sysdef grep i shmmax An indication that the shared memory maximum has not been set large enough for the DB2 cache is the following message: SQL1478W The database has been started but only one buffer pool has been activated. SQLSTATE=01626 An insufficient size for the shared memory maximum can also prevent DB2 from starting. In this case, the following message is displayed: SQL1220N The database manager shared memory set cannot be allocated. Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager 3

18 These messages also appear when executing the following DB2 command: db2 connect to ldapdb2 They also appear when starting the IBM SecureWay Directory server. Increase process memory size limit: ulimit -d unlimited ulimit -v unlimited On Solaris, issue the following commands: This sets the process memory size limits to unlimited. At a minimum, set these limits to 256 MB. If the LDAP cache is to be employed, 256 MB will not likely be enough, so set the memory size to unlimited. Refer to the IBM SecureWay Directory documentation for more information. See IBM SecureWay Directory. Increase file size limits: If the file size limits are not high enough, the following files may grow to exceed the limit: v DB2 table and index files v Temporary files used in the bulk-load process On Solaris, issue the following command: ulimit -f unlimited This sets the maximum file size to unlimited. AIX operating system Skip this section if you are not setting up tuning on the AIX operating system. Increase process memory size limit: /etc/security/limits file: default: data = -1 rss = -1 On AIX, modify the following lines in the This modification sets the process memory size limits to unlimited. At a minimum, set these limits to 256 MB. If the LDAP cache is to be employed, 256 MB will not likely be enough memory, so set it to unlimited. Refer to the IBM SecureWay Directory documentation for more information. See IBM SecureWay Directory. Refer to Chapter 8, Process memory size limits on page 47 for more information on this subject. It contains information about increasing the number of data segments that a process can use. The number of data segments that a process can use is another factor that limits memory usage on the AIX operating system. Increase file size limits: If the file size limits are not high enough, the following files may expand to exceed the limit: v DB2 table and index files v Temporary files used in the bulk-load process On AIX, modify the following lines in the /etc/security/limits file: default: fsize = -1 This modification sets the maximum file size to unlimited. 4 IBM Tivoli Access Manager: Performance Tuning Guide

19 Create file systems large file enabled: Any file system that is to hold a large file must be created with large file support enabled. The large file support option is found in smitty on the Add a Journaled File System menu. General IBM SecureWay Directory tuning This section describes general IBM SecureWay Directory tuning. For the most part, this information is not specific to Access Manager; it is applicable to most uses of the IBM SecureWay Directory server. The information is applicable to the initial setup of an empty database as well as an existing database. Start the IBM SecureWay Directory server to finish configuration After the IBM SecureWay Directory server has been configured, it is necessary to complete the database configuration by starting the server. Database tables and indexes are not defined until the first time the server is started. On UNIX systems, start the IBM SecureWay Directory server with the following command: slapd On Windows systems, start the IBM LDAP server service. Stop the SecureWay Directory server On UNIX systems, use the following commands to stop the IBM SecureWay Directory Server: ps ef grep slapd # find the slapd process id kill slapd process id ps ef grep slapd # repeat this until slapd is gone On Windows systems, stop the IBM LDAP server service. Do DB2 parameter tuning Before executing the commands in this section, switch to the ldapdb2 user context. On UNIX systems, this can be done with the following command: su ldapdb2 On Windows systems, run the following command at a command prompt: db2cmd set DB2INSTANCE=ldapdb2 Examples of the commands in this section can be found in the do_tunings_322.sh and do_tunings_321.sh scripts. These scripts can be found at policy_dir/downloads.html and in Appendix A, Scripts on page 53 to this document. Execute the following commands to set up several of the DB2 tuning parameters: db2 update database configuration for ldapdb2 using SORTHEAP 2500 db2 update database configuration for ldapdb2 using MAXLOCKS 100 db2 update database configuration for ldapdb2 using MINCOMMIT 25 db2 update database configuration for ldapdb2 using UTIL_HEAP_SZ 5000 db2 update database configuration for ldapdb2 using LOGFILSIZ For IBM SecureWay Directory, Version 3.2.2, use the following commands: db2 connect to ldapdb2 db2 alter bufferpool ibmdefaultbp size defaultbp_sz db2 alter bufferpool ldapbp size ldapdb_sz db2 terminate Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager 5

20 db2 force applications all db2stop db2start where defaultbp_sz and ldapdb_sz are defined as follows: defaultbp_sz = (phys_mem*0.75)*(0.75)/4096 ldapdb_sz = (phys_mem*0.75)*(0.25)/32768 and phys_mem is the amount of physical memory in bytes For IBM SecureWay Directory, Version 3.2.1, use the following commands: db2 update database configuration for ldapdb2 using BUFFPAGE buffpage_sz db2 connect to ldapdb2 db2 "alter bufferpool ibmdefaultbp size -1" db2 terminate db2 force applications all db2stop db2start where buffpage_sz is (phys_mem*0.75/4096) and phys_mem is the amount of physical memory in bytes. Setting the ibmdefaultbp size to 1 indicates that the size is controlled by the BUFFPAGE configuration parameter. The ibmdefaultbp and ldapbp parameters control the size of DB2 buffer pools. DB2 buffer pools hold the DB2 cache of tables and indexes. DB2 uses indexes identify which table rows to retrieve during a search. In the examples, the size calculations are designed to allocate the recommended 75 percent of the IBM SecureWay Directory server s physical memory to the DB2 buffer pools. For IBM SecureWay Directory, Version 3.2.2, the calculations divide the 75 percent of physical memory between the ibmdefaultbp and ldapbp buffer pools in a 3 to 1 ratio. For more information, refer to the IBM Security Directory Tuning Guide (see IBM SecureWay Directory). CAUTION: As of the writing of this guide, IBM SecureWay Directory, Version 3.2.2, does not always perform optimally with large settings for the buffer pool parameters. It is recommended that the following minimum settings for the buffer pools be initially used and larger be tried later: db2 alter bufferpool ibmdefaultdp size db2 alter bufferpool ladbp size 400 Error messages: The following message may appear when setting the DB2 parameters. They are normal and do not mean there has been a failure. SQL1482W The BUFFPAGE parameter will only be used if one of the buffer pools is defined with a size of -1. DB20000I The UPDATE DATABASE CONFIGURATION command completed successfully. DB21026I For most configuration parameters, all applications must disconnect from this database before the changes become effective Displaying and verifying the current settings: For IBM SecureWay Directory, Version 3.2.2, the current setting of the DB2 tuning parameters can be displayed by using the following commands: 6 IBM Tivoli Access Manager: Performance Tuning Guide

21 db2 get database configuration for ldapdb2 \ egrep DBHEAP SORTHEAP MAXLOCKS MINCOMMIT UTIL_HEAP_SZ db2 connect to ldapdb2 db2 "select bpname,npages,pagesize from syscat.bufferpools" db2 terminate For IBM SecureWay Directory 3.2.1, the current setting of the DB2 tuning parameters can be displayed by using the following commands: db2 get database configuration for ldapdb2 \ egrep BUFFPAGE DBHEAP SORTHEAP MAXLOCKS MINCOMMIT UTIL_HEAP_SZ db2 connect to ldapdb2 db2 "select * from syscat.bufferpools" db2 terminate In this second case, verify that the NPAGES column is defined as -1. If not, redo the DB2 parameter tunings. Functional problems can occur if one of the heap configuration parameters is too low. To display the current heap parameter settings issue the following DB2 command: db2 get db cfg for ldapdb2 grep HEAP The following is an example output showing the minimum values for the various heap parameters: Database heap (4KB) (DBHEAP) = 1200 Utilities heap size (4KB) (UTIL_HEAP_SZ) = 5000 Max appl. control heap size (4KB) (APP_CTL_HEAP_SZ) = 128 Sort list heap (4KB) (SORTHEAP) = 2500 SQL statement heap (4KB) (STMTHEAP) = 2048 Default application heap (4KB) (APPLHEAPSZ) = 2048 Statistics heap size (4KB ) (STAT_HEAP_SZ) = 4384 If a heap parameter is less that the minimum, increase it to the minimum using a command similar to the following: db2 update db cfg for ldapdb2 using parm_name parm_value where parm_name is the name on the third to last column of the above output, without the parenthesis and the parm_value is the value for that parameter in given in the last column. If the heap parameters are set too low, the IBM SecureWay Directory will fail in various functional ways that may not indicate a problem with the heap parameter. The cli.error file (/var/slapd/cli.error on Solaris and /tmp/cli.error on AIX.) is useful in these situations. It contains DB2 error messages that often indicate which heap parameter is too low. db2look is a useful DB2 utility that for most cases is an alternative to the above commands. It provides considerable information about the database and its configuration in one command. Here is an example of its usage: db2look -d ldapdb2 -u ldapdb2 p o outpu_file where output_file is a file location for storing the results. Warning about tuning while slapd is running: Note that the DB2 parameter tuning commands make use of db2 terminate. If the IBM SecureWay Directory server process, slapd, is running when this command is issued, it renders the Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager 7

22 server partially functional. Any cached searches appear to respond correctly. Other searches may simply return with no results or error messages or the operations error message may appear. The recovery is to recycle the IBM SecureWay Directory server. It is best to stop the IBM SecureWay Directory server when changing the DB2 tuning parameters. Buffer pool memory usage warnings: If any of the buffer pools are set too high, DB2 can fail to start due to insufficient memory. If this occurs there may be a core dump file, but usually there is no error message. On AIX systems, the system error log may report a memory allocation failure. This log can be viewed by executing the following command: errpt a more Restoring a database that was backed up on a system with buffer pool sizes that are too large for the target machine may cause the restore to fail. Refer to Chapter 9, Troubleshooting for information on how to work around this problem. If the DB2 fails to start due to buffer pool sizes being too large, redo the DB2 tuning parameters. Check for missing and extra indexes Run the check_indexes.sh, which is found online at policy_dir/downloads.html (and in Appendix A, Scripts on page 53 of this guide) under the context of the ldapdb2 users. Enter this context on UNIX systems with the following command: su ldapdb2 On Windows systems, run the following command at a command prompt: db2cmd set DB2INSTANCE=ldapdb2 In rare cases, the IBM LDAP server can drop one or more of its DB2 table indexes. Since DB2 table indexes are critical to IBM LDAP server performance, they should be checked. The check_indexes.sh script checks for the existence of DB2 table indexes that are imported for IBM LDAP server and Access Manager performance. The script assumes that it is being used against an ldapdb2 database that Access Manager has been configured into it. If Access Manager has not been configured into the database, the script reports several missing indexes. The script prints out a suggested DB2 create command for any missing indexes. It prints out a colon-separated index definition when it finds indexes that are not expected. These unexpected indexes could come from other products using LDAP, so are more for informational purposes. The second field of the colon-separated list of extra indexes is the name of the index. If the unexpected indexes are not desired, they can be deleted using the following command: db2 drop index index_name db2look is a useful utility that also displays information about database indexes. Here is an example of its usage: db2look -d ldapdb2 -u ldapdb2 p o output_file 8 IBM Tivoli Access Manager: Performance Tuning Guide

23 where output_file is the location for file for storing the results. Do a DB2 reorgchk To perform a DB2 reorgchk on UNIX systems, use the following command: su ldapdb2 db2 connect to ldapdb2 db2 reorgchk update statistics on table all db2 terminate To perform a DB2 reorgchk on Windows systems, use the following command: db2cmd set DB2INSTANCE=ldapdb2 db2 reorgchk update statistics on table all db2 terminate Start the IBM SecureWay Directory server Start the IBM SecureWay Directory server to verify that the DB2 tuning parameters do not cause functional problems. On UNIX systems, run the following commands: slapd iostat 5# or vmstat, repeat this until CPU utilization goes idle On Windows systems, start the IBM LDAP service. Verify change log is not configured The IBM SecureWay Directory Change Log significantly slows down update performance. The change log causes all Directory updates to be recorded in a separate Change Log DB2 database, separate from the Directory server database. The change log database can be used by other applications to track updates. Access Manager does not use the change log functionality. The change log configuration can be determined by searching for the CN=CHANGELOG pseudo suffix as follows: ldapsearch -h ldap_host -D cn=root -w ldap_passwd -s base -b "objectclass=*" \ grep "CN=CHANGELOG" where ldap_passwd is the password for the directory administrator. To verify that the IBM SecureWay Directory Change Log option is not configured, attempt to unconfigure it as follows: ldapucfg -g The following message should appear: The Change Log is not currently enabled. Tuning slapd32.conf The following sections discuss changes to the /etc/slapd32.conf file. On Windows systems, the etc/slapd32.conf file is not located at the root of the disk drive. Search each disk to find it. Increase the number of SecureWay Directory connections to DB2: Edit the /etc/slapd32.conf file and increase the ibm-slapddbconnections parameter to 8 for AIX or 30 for all other operating systems. The number of DB2 connections determines the amount of processing concurrency between the IBM SecureWay Directory server and DB2. If the number of DB2 connections is increased beyond its maximum value, the maximum will be used. Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager 9

24 Turn off object class alias checking: following line: ibm-slapdsetenv: OC_ALIAS=NO Edit the /etc/slapd32.conf file and add the Add the line under the cn=front End,cn=Configuration DN. Here is an example: dn: cn=front End,cn=Configuration objectclass: top objectclass: ibm-slapdfrontend ibm-slapdsetenv: OC_ALIAS=NO This option turns off object class aliasing, whereby the IBM SecureWay Directory server searches the Directory database for the numeric alias for object classes. This only occurs when object class is specified in the LDAP search filter. The object class alias search causes the DB2 optimizer to make poor choices regarding indexing and search performance degrades significantly. Search performance does not degrade if you turn off aliasing. This option is only available on IBM SecureWay Directory, Version 3.2.2, and above. Enable the IBM SecureWay Directory concurrent read/write capability: /etc/slapd32.conf file and add the following line: ibm-slapdsetenv: LDAP_CONCURRENTRW=ON Edit the Add the line under the cn=front End,cn=Configuration DN. Here is an example: dn: cn=front End,cn=Configuration objectclass: top objectclass: ibm-slapdfrontend ibm-slapdsetenv: LDAP_CONCURRENTRW=ON LDAP_CONCURRENTRW controls the concurrency of the read and write operations. Read operations are also called searches and write operations are called updates. Without LDAP_CONCURRENTRW, the IBM SecureWay Directory server serializes read operations with write operations. With LDAP_CONCURRENTRW, read operations occur concurrently with write operations. With LDAP_CONCURRENTRW, there is a slight chance of erroneous results when a read is performed on data that is being updated. From an Access Manager point of view, an example is a failed authentication for a user that is in the process of being created. The LDAP_CONCURRENTRW parameter can also be set as an environment variable in the process where the IBM SecureWay Directory server is started. For example, as follows: kill slapd process id export LDAP_CONCURRENTRW=ON slapd Add suffix information to slapd32.conf: If you have not already done so, for example, because the database already exists, add suffix-distinguished names (DNs) to the /etc/slapd32.conf file. Preferably, add only one suffix for all user directory objects. Add another suffix for the Access Manager secauthority=default object. This is required to configure Access Manager. Here are some example lines: ibm-slapdsuffix: secauthority=default ibm-slapdsuffix: user suffix where user suffix is the suffix to be used for user objects. Place these lines next to existing ibm-slapdsuffix lines in the file and order them as indicated in the next section. 10 IBM Tivoli Access Manager: Performance Tuning Guide

25 You should use only one suffix for user objects. The user name space can be broken up within the suffix by using multiple directory container objects. If more than one suffix is used, additional directory searches are necessary to find the user object, which slows down performance. For one or two additional suffixes, the performance slows down by approximately 10 percent. Refer to the IBM SecureWay Directory documentation for more information on suffixes. See IBM SecureWay Directory. Order the suffixes in slapd32.conf: After the set of suffixes to be added has been determined, order them in the /etc/slapd32.conf file for best performance. List the least commonly used suffixes first and the most commonly used suffixes last. For example, list the suffix with the most number of users last. Access Manager searches each suffix until it finds the user it is authenticating. It does this in the reverse order in which the suffixes are listed in the /etc/slapd32.conf file. Typically, users are not stored in the Access Manager secauthority=default suffix. In this case, list the secauthority=default suffix first. Recycle the IBM SecureWay Directory server: Recycle the IBM SecureWay Directory server to make it aware of any changes made so far, for example, any new suffixes added. The following is a summary of how this is done on UNIX systems: ps ef grep slapd # find the slapd process id kill slapd process id ps ef grep slapd # repeat this until slapd is gone slapd iostat 5# or vmstat, Repeat this until CPU utilization goes idle On Windows systems, stop and start the IBM LDAP service. Verify suffix order: Verify that the suffixes are ordered for performance by issuing the following command: ldapsearch -h ldap_host -D cn=root -w ldap_passwd \ -s base -b "" "objectclass=*" grep namingcontexts The suffixes will be listed in the reverse order in which they exist in the /etc/slapd32.conf file. Ignore the pseudo suffixes cn=schema and cn=localhost. Create the suffix objects Skip this step if the directory is to be restored from a backup. A replica server is typically loaded from a backup copy of the master Directory server. The IBM SecureWay Directory db2ldif and ldif2db utilities or DB2 backup and restore utilities can be used for these purposes. If you have not already done so, create the IBM SecureWay Directory objects for all suffixes, except the Access Manager secauthority=default suffix. The following is an example of creating a suffix object named o=ibm.com using the IBM SecureWay Directory ldapadd command and an LDIF-encoded definition of that suffix object. cat <EOF ldapadd -h ldap_host -D cn=root -w ldap_passwd dn: o=ibm.com objectclass: organization objectclass: top o: ibm.com EOF where ldap_host is the host name of the directory server and ldap_passwd is the IBM SecureWay Directory administrator s password. Chapter 1. Setting up, managing, and tuning the IBM SecureWay Directory server for Access Manager 11