RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.3.0, 8.4.0 up to and including AM 8.8

The primary RSA Authentication Manager Security Console is unreachable with a 503 (service unavailable) error. This error occurs because of stuck threads, internal errors that are attributed to group lookup failures that timed out, and other reasons.

In the /opt/rsa/am/server/logs/biztier.log, we see the following error:
 

To resolve this issue,

1. Increase both console and biztier heapsizes memory allocation in /opt/rsa/am/config/src/scripts/Config.groovy 
2. Reboot the RSA Authentication Manager server.

1. Increase both console and biztier heapsizes memory allocation in /opt/rsa/am/config/src/scripts/Config.groovy:

1. Log on to the Appliance Operating System with SSH.
2. Log in to the primary RSA Authentication Manager server as rsaadmin and enter the operating system password.

During Quick Setup, another username may have been selected. Use that username to log in.

3. Repeat the login process to each replica, one at a time.
4. Go to /opt/rsa/am/config/src/scripts/:

5. Back up the original Config.groovy file:

5. Edit the Config.groovy file.
   1. Under the heapsizes normal section, increase biztier as follows in the 8G, 16GB, and 32G sections

        "8G" {
            opsconsole = "512m"
            biztier = "3072m"
            console = "2048m"
            radiusoc = "100m"
            quicksetup = "512m"
        }
        "16G" {
            opsconsole = "512m"
            biztier = "4096m"
            console = "4096m"
            radiusoc = "100m"
            quicksetup = "512m"
        }
        "32G" {
            opsconsole = "1024m"
            biztier = "10240m"
            console = "5120m"
            radiusoc = "256m"
            quicksetup = "512m"
        }

2. Save changes.
3. Reboot the system.

There is no need to increase wrapper.java.additional numbers 35 and 36 in /opt/rsa/am/server/wrapper/BiztierServerWrapper.conf or ConsoleServerWrapper.conf as described in some older instructions. These files are updated by Config.groovy.after reboot. However, if you added the exact same changes to the two wrapper files that you did to the Config.groovy file, you could change settings with a restart of RSA Authentication Manager services in SSH Linux:

/opt/rsa/am/server/rsaserv restart all

ps -ef | grep biztier 
ps -ef | grep console

The output from running these commands should show 4096m for both the minimum and maximum values. For example,

ps -ef | grep biztier 
Dweblogic.management.server=https://dagsasrsa01.r1-core.r1.aig.net:7006 -Xms4096m -Xmx4096m -Dims.denial.of.service

• That you have adequate memory which can be allocated, and
• That your users are accessing resources that need more memory.

• You can allocate more memory, if you have it, 
• You can access less resources, or
• You can do both.

Avoid searching all sublevels for group information and do not use the memberOf group search attribute if you have already allocated as much RAM as is recommended and available and still experience the out of memory errors, especially if the out of memory is due to a group search.

1. Log in to the Operations Console.
2. Go to Deployment Configuration > Identity Sources > Manage Existing.
3. Click the context arrow next to the identity source and choose Edit.
4. Click the Map tab.
5. Scroll to Directory Configuration - User Groups.
6. As shown in the images below,
   1. For Search Scope, change from Search all sublevels to Search only single level.
   2. Under Use MemberOf Attribute, clear the option to Enable the use of the MemberOf attribute:

.

7. When done, click Save or Save and Finish.