Performance Tuning Recommendations

This section describes some recommended performance tuning configurations to optimize the WSO2 Identity Server.

OS-level settings

When it comes to performance, the OS that the server runs plays an important role.

Following are the configurations you can apply to optimize OS-level performance:

1. To optimize network and OS performance, configure the following settings in /etc/sysctl.conf file of Linux. These settings specify a larger port range, a more effective TCP connection timeout value, and a number of other important parameters at the OS-level.

   It is not recommended to use net.ipv4.tcp_tw_recycle = 1 when working with network address translation (NAT), such as if you are deploying products in EC2 or any other environment configured with NAT.

   net.ipv4.tcp_fin_timeout = 30
   fs.file-max = 2097152
   net.ipv4.tcp_tw_recycle = 1
   net.ipv4.tcp_tw_reuse = 1
   net.core.rmem_default = 524288
   net.core.wmem_default = 524288
   net.core.rmem_max = 67108864
   net.core.wmem_max = 67108864
   net.ipv4.tcp_rmem = 4096 87380 16777216
   net.ipv4.tcp_wmem = 4096 65536 16777216
   net.ipv4.ip_local_port_range = 1024 65535      

2. To alter the number of allowed open files for system users, configure the following settings in /etc/security/limits.conf file of Linux (be sure to include the leading * character).

   * soft nofile 4096
   * hard nofile 65535

   Optimal values for these parameters depend on the environment.

3. To alter the maximum number of processes your user is allowed to run at a given time, configure the following settings in  /etc/security/limits.conf file of Linux (be sure to include the leading * character). Each carbon server instance you run would require upto 1024 threads (with default thread pool configuration). Therefore, you need to increase the nproc value by 1024 per each carbon server (both hard and soft).

   * soft nproc 20000
   * hard nproc 20000

Setting the thread execution limit for multitenant mode

In multitenant mode, the Carbon runtime limits the thread execution time. That is, if a thread is stuck or taking a long time to process, Carbon detects such threads, interrupts and stops them. Note that Carbon prints the current stack trace before interrupting the thread. This mechanism is implemented as an Apache Tomcat valve. Therefore, it should be configured in the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file as shown below.

<Valve className="org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve" threshold="600"/>

• The className is the Java class name used for the implementation. This must be set to org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.
• The threshold gives the minimum duration in seconds after which a thread is considered stuck. Default value is 600 seconds.

JVM settings

• JVM setting (Xmx) depends on your load. Given below are the general settings but if you are on a production environment, this might not be sufficent. In such situtaions, you can increase the load & tenancy.

  -Xms2048m -Xmx2048m -XX:MaxPermSize=1024m

• When an XML element has a large number of sub-elements and the system tries to process all the sub-elements, the system can become unstable due to a memory overhead. This is a security risk.
  
  To avoid this issue, you can define a maximum level of entity substitutions that the XML parser allows in the system. You do this using the entity expansion limit attribute that is in the <PRODUCT_HOME>/bin/wso2server.bat file (for Windows) or the <PRODUCT_HOME>/bin/wso2server.sh file (for Linux/Solaris). The default entity expansion limit is 64000.

  -DentityExpansionLimit=100000

  In a clustered environment, the entity expansion limit has no dependency on the number of worker nodes.

Database level settings

Set up the following database indexes in the Identity Server database to improve performance:

• create index IDX_ITS_LMT on IDN_THRIFT_SESSION (LAST_MODIFIED_TIME);
• create index IDX_IOAT_AT on IDN_OAUTH2_ACCESS_TOKEN (ACCESS_TOKEN);