Optimizing Symantec PAM Appliance Performance and Sizing Guidelines

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

This article provides hardware sizing recommendations and performance optimization guidelines for Symantec Privileged Access Manager (PAM) appliances deployed on VMware, KVM, or Cloud environments.

Environment

Symantec Privileged Access Manager 4.x

VMware ESXi / KVM Physical Hardware

AWS / Azure / Google Cloud

Resolution

Hardware Sizing Recommendations

While Symantec PAM supports a range of configurations, performance is heavily dependent on allocated resources.

Production Recommended Parameters

• Memory: 64 GB
• CPU: 8 cores (Scalable up to 512 cores)
• Storage: 80 GB
• Disk Type: Solid State Drive (SSD) - Mandatory for Production

Minimum Requirements (Evaluation/Small Labs)

• Memory: 32 GB
• CPU: 8 cores
• Storage: 80 GB
• Disk Type: SSD

Note: Broadcom Support cannot troubleshoot performance issues on appliances running at "Minimum" levels if utilization metrics indicate resource exhaustion.

Performance Optimization Guidelines

1. CPU Allocation

Ensure the appliance has at least 8 CPUs defined. Without sufficient processor threads, sporadic performance issues are unavoidable. While adding more than 8 CPUs is possible on ESX/KVM, benefits may vary based on the specific feature set in use (e.g., intensive session recording).

2. Disk I/O (SSD Requirement)

SSD storage is a strict requirement. SSDs provide approximately 5x faster read/write speeds compared to standard HDDs. Slow disk I/O will directly impact operations such as LDAP synchronization and cluster startups.

3. Memory Management

PAM uses tiered memory allocation (32GB, 64GB, 128GB  segments) to ensure high-demand services like the Web application and Database do not cause system-wide outages.

• If your appliance is at 16GB and experiences latency, upgrading to 32GB or 64GB allows PAM to automatically re-allocate larger memory pools to core services.

4. KVM and Physical Hardware Considerations

When migrating from VMware to KVM (as seen in recent migration cases), ensure the physical host provides dedicated resources to the PAM instance. Over-provisioning the physical host can lead to 'noisy neighbor' effects that degrade PAM performance even if the VM settings meet recommendations.