Article Number
000068119
Applies To
This is a known issue in the following versions.
- RSA Governance & Lifecycle 7.5.x
Issue
Customer reports a long runtime in Identity Data Unification specifically in the following step
Step 8/11: Post-Processing: Populate Role Metrics
An Oracle AWR report may show long running queries (with different SQLId) starting with this statement.
Example of a long running query in AWR report.
INSERT INTO GTT_IDS (ID)
Cause
Longer runtimes in this step may occur due to changes to a Role Membership Rule or an incorrect or inefficient Role Membership Rule.
Resolution
The time to complete this step is dependent on the complexity of UINC and UOOC Role Membership Rule associated with Roles. If this step is failing or running longer than expected check to see if there were any recent changes to the Membership Rule associated with a Role or check to see if any new Roles were defined.
- If the Role metrics calculation is running too long.
- Avoid complex joins in Role membership Rules.
- Avoid expensive string searches using the LIKE keyword, especially contains, starts with or ends with queries.
Identify the long running Role from the problem query in the AWR report or identify the failing role from the exception and either delete the Role or resolve the problem by modifying the Role Membership Rule.
Notes
The attached script Per_Role_Constraint_Time_ACM-118035.sql can be used to identify the execution time for all Role Membership Rules.
Role Membership Rules over a minute are candidates for optimization.
Note if unification is failing in this step see the following article.
Unification is failing at step 8 on "AVUSER.ROLE_MANAGEMENT_PKG", line 2469 in RSA Governance & Lifecycle
