Opensso Performance Tuning

OpenSSO comes with tuning tool "amtune"


Amtune :: Introduction

The OpenSSO amtune falicitate you to do performance tuning of following :
1. OpenSSO
2. Sun Directory Server,
3. Two web containers from Sun -
- Sun Web Server 7
- Sun Application Servr 9.1 (aka Glassfish v2).
4. Operating system kernel and TCP/IP parameters.

Limitation of Amtune

1. Amtune tunes the operating system parameters only on Solaris and Linux .
2. Amtune tunes only Sun Web Server 7 and Sun Application Server 9.1/Glassfish v2.

However, amtune enables tuning of OpenSSO parameters -
- session/SDK cache entries,
- logging buffer,
- notification thread pool/queue ,
- LDAP connection pool sizes for service management,
- global authentication service and user data store.

when OpenSSO is deployed on supported web containers and supported
operating systems.


For Sun Web Server 7 and Sun Application Server 9.1/Glassfish v2, amtune tunes
- JVM heap and JVM per-thread stack sizes,
- JVM garbage collection algorithms,
- container worker/acceptor threads and queue sizes.


Download and Setup Amtune 

     # Download openam_release9 package
     $ wget http://www.forgerock.org/downloads/openam_release9_20100207.zip

     # Extract zip file 
     $ unzip openam_release9_20100207.zip
   
     # Move to tools Directory
     $ cd ./opensso/tools
      
     # Extract sooAdminTools zip 
     $ unzip ssoAdminTools.zip  -d  ./ssoAdminTools

     # Move to ssoAdmin dir 
     $ cd ./ssoAdminTools


     $ ./setup
     Path to config files of OpenSSO server(example:/opensso):/root/openam
     Debug Directory:/openam_debug
     Log Directory:/openam_log
     The version of this tools.zip is: ForgeRock OpenAM Express Build 9
     The version of your server instance is: ForgeRock OpenAM Express Build 9

Edit password file and change mode 

     # move to amtune folder 
     # cd <ssoadmintools>/openam/bin/amtune
     $ cd /root/opensso/tools/ssoAdminTools/openam/bin/amtune       
     
     #edit password file for your environment   
       
     $ sudo nano  amtune-passwordfile

          SSOADM_PASSWORD=password
          WADM_PASSWORD=password
          ASADMIN_PASSWORD=password
          DIRMGR_PASSWORD=password
  
  
      # change the mode of file read only acces to current user 
      $ sudo chmod 400 amtune-passwordfile

Edit amtune configuration file 

Amtune can be fired in two mode detemind by AMTUNE_MODE parameter in the amtune-env.properties file.

* REVIEW mode (default).return tuning recommendations for parameters values.
* CHANGE mode. make all of the tuning modifications that are defined in amtune-env.properties file. Use CHANGE mode only after you have reviewed and understand the tuning changes that will be applied to your deployment.

here i pasted my environment based sample configuration .

$ sudo nano  amtune-env.properties

          AMTUNE_MODE=CHANGE
          AMTUNE_LOG_LEVEL=FILE
          AMTUNE_TUNE_OS=true
          AMTUNE_TUNE_DS=false
          AMTUNE_TUNE_WEB_CONTAINER=false
          AMTUNE_TUNE_OPENSSO=true

          WEB_CONTAINER=other
          CONTAINER_INSTANCE_DIR=/usr/share/glassfishv3/domains/domain1
          
          WSADMIN_DIR=
          WSADMIN_USER=
          WSADMIN_HOST=
          WSADMIN_PORT=
          WSADMIN_SECURE=
          WSADMIN_CONFIG=
          WSADMIN_HTTPLISTENER=
        
          ASADMIN_DIR=/usr/share/glassfishv3/bin
          ASADMIN_USER=admin
          ASADMIN_HOST=localhost
          ASADMIN_PORT=4848
          ASADMIN_SECURE=
          ASADMIN_TARGET=server
          ASADMIN_HTTPLISTENER=http-listener-1
          #DO NOT MODIFY THE VALUE BELOW!
          AMTUNE_WEB_CONTAINER_JAVA_POLICY=false

          SSOADM_LOCATION=/root/opensso/tools/ssoAdminTools/openam/bin
          OPENSSOADMIN_USER=amadmin
          OPENSSOSERVER_URL=http://mydomain.sso.com:8080/openam
          REALM_NAME=/

          DS_HOST=
          DS_PORT=
          ROOT_SUFFIX=
          DS_INSTANCE_DIR=
          DS_TOOLS_DIR=
          DS_VERSION=
          DIRMGR_BIND_DN=

          # DO NOT MODIFY THE RATIOS BELOW UNLESS TESTS SHOW SIGNIFICANT  .                #IMPROVEMENT IN PERFORMANCE!
          AMTUNE_PCT_MEMORY_TO_USE=75
          AMTUNE_MEM_MAX_HEAP_SIZE_RATIO=7/8
          AMTUNE_MEM_MIN_HEAP_SIZE_RATIO=1/2
          # DO NOT MODIFY THE VALUES BELOW!
          AMTUNE_PER_THREAD_STACK_SIZE_IN_KB=128
          AMTUNE_PER_THREAD_STACK_SIZE_IN_KB_64_BIT=512
          AMTUNE_MIN_MEMORY_TO_USE_IN_MB=512
          AMTUNE_MAX_MEMORY_TO_USE_IN_MB_SOLARIS=3584
          AMTUNE_MAX_MEMORY_TO_USE_IN_MB_X86=2341
          AMTUNE_MAX_MEMORY_TO_USE_IN_MB_DEFAULT=1536

In above sample configuration , two parameters AMTUNE_TUNE_DS , AMTUNE_TUNE_WEB_CONTAINER are set false. because In our enviroment , we configured OpenLDAP as Directory Serve and Glassfish v3 as web container.

Amtune support tuning for only
- Sun Directory Server 5.2 and 6.3
- Sun Web Server 7 and Sun Application Server 9.1/Glassfish v2.

Glassfish v3 not fully supported till date , you can manually tune your glassfish v3 , use following link : glassfish v3 tuning

I filed JIRA OPENAM-571, regarding problem in openam tuning with glassfish v3. Here is the link of that issue.
https://bugster.forgerock.org/jira/browse/OPENAM-571

Fire amtune

        $ cd /root/opensso/tools/ssoAdminTools/openam/bin/amtune
        $ sudo ./amtune amtune-passwordfile

After successfull message ,it's recommended to reboot machine to reflect the changes.