PAM - Can I increase the performance of the pam appliance by adding resources?

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We are not seeing performance issues right now but we occasionally are seeing some issues. We currently have the minimum set. How can we tell if we need to increase the ram and will there be any benefits?

 

Listed in the product Manual

we recommend the following parameters:
Memory: 64 GB
CPU: 8 cores (we support up to 512 CPU cores)
Storage: 80 GB
Disk Type: SSD

At a minimum, we require the following parameters:
Memory: 16 GB
CPU: 8 cores (we support up to 512 CPU cores)
Storage: 80 GB
Disk Type: SSD

Environment

Release : 4.0

Resolution

 

There is no hard-set rule or calculation to define how much ram your particular appliance should have nor any gauge to look at to let you know how much, if any, performance you can gain by adding CPU, RAM, HD or Network adapters to your appliance. You can be sure that if your appliance runs out of ram then some services will automatically restart themselves and the general useability will go down. If you hit high CPU utilization sporadic performance issue will occur and if you are on a VMware appliance not using SSD hardisk space you will occasionally see operations like an LDAP sync or a cluster start will be slow. Here are some general guidelines you can follow.

1. If you are seeing any performance issues ensure you absolutely have 8 CPUs defined. If your appliance does not have enough processor threads available there is no way to avoid performance issue. Adding cpu over 8 is possible on ESX servers but may have limited benefits in most common installations at this time but may change as new features are added to PAM.

2. As for the hard disk it is a requirement to use SSD harddisk as it is about 5 time quicker in both read and writes from standard harddisks. All running processes either read or write to the hard disk. Waiting on IO from the disk cannot be avoided especially when running on running on a shared harddisk with just configuration.

3. Adding network adapters or bonded network cards could possibly improve connection performance but little evidence has shown any material improvements in most environments, so this should only be done if the sheer number of connections proves to be an issue and you are already at the recommended hardware levels.

4. Ram can be a bit tricky to wevaluate but understanding the memory management may help you plan for the correct ram usage. We will pre-allocate or set maximum ram usages for several key applications running on the PAM appliance this is done to ensure some memory hungry applications do not use all the available ram and create an outage. This is broken into 3 segments including up to 16gig, 32gig and 64gig. If you have installed 16 gig of ram you might not see your ram usage go higher than 50-60% but that does not mean you will not see improvements by going to 32. Our Web application and database processes have a maximum set to ensure they do not use more than 50-60% to ensure other processes have ram available. If you are on the minimum requirements and you find you are seeing some performance problems, you should increase your ram and re-evaluate to test if this helps. Support cannot determine any performance issues with any appliance at the "minimum" required ram as performance issue at this level would be considered normal or acceptable based on the hardware provided.

 

Note: previous to PAM version 4.1.1 there were some issues related to NFS services causing performance issues when session recording was enabled. This was not related to the speed of the NFS mounts but rather the sheer number of files in a single directory. These were resolved in 4.1.1 by creating dated subdirectories. If you are seeing performance issues while running recorded access sessions, you may need to review the speed of the  hard disks where PAM is writing the data.