000011556 - Access Manager Aserver threads blocked waiting on protected URL cache

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000011556
Applies ToRSA Access Manager 6.x Authorization Server (AServer)
IssueAccess Manager Aserver threads blocked waiting on protected URL cache
I thread dump of the aserver under load shows many threads wating in state BLOCKED for the protected URL cache.
"MuxWorker-19" - Thread t@55
   java.lang.Thread.State: BLOCKED
                at sirrus.authserver.ProtectedURLCache.getProtectedURI(ProtectedURLCache.java:1253)
                - waiting to lock <15673a7> (a java.util.HashSet) owned by "MuxWorker-11" t@47
CauseThe protected URL cache is the entry point for all authorization checks.  Normally it is very efficient and more efficient than going to the datastore directly. Still there is overhead in maintaining the cache.  If threads are BLOCKED waiting on cache updates then the aserver is at capacitly.  The efficiency of the cache decreases with the number of unique URL's for each web server.  With very large numbers of entitlemetns per web server (over 10,000) the cache may not perform to specifications.  Consider reducing the number of protected URL's per web server or using an alternate method of entitlement such as an aserver hook. 
ResolutionDelete unused webservers and applications from the entitlement manager.   Put the aserver in passive mode and reduce the number of entilements. 
Legacy Article IDa56982