Recommendations for Management Center GUI Performance Issues

Products

• Management Center
• Management Center - VA

Issue/Introduction

This document outlines best practices and recommendations to address GUI slowness and performance degradation in Management Center (MC).

Cause

Performance issues are often driven by a combination of a growing device count and complex Role-Based Access Control (RBAC) configurations. Specifically, the extensive use of `isMemberOf` permission filters across deep device group hierarchies can lead to significant delays during login and device navigation.

When significant GUI slowness is observed, it is typically caused by back-end API calls struggling with one or more of the following factors:

● Permission Check Overhead: The system performs $O(N \times M)$ permission checks (i.e., total devices $\times$ total filtered permissions). As the number of devices and the complexity of roles increase, this overhead grows exponentially.

● `isMemberOf` Filter Inefficiency: Deep device group hierarchies (multiple levels) and devices belonging to several groups simultaneously can cause `isMemberOf` filters to evaluate very slowly, as they often require individual database operations for each check.

● Recursive Calculations: The system may recursively calculate health nodes for all managed devices during the initial page load. Large device counts combined with complex permissions can cause this process to block or delay the UI.

Resolution

The recommendations below focus on immediate configuration optimizations to alleviate these issues and restore system responsiveness.

1. Replace `isMemberOf` Filters with Device Attributes (Highest Impact)

Using `isMemberOf` filters for device permissions can be highly inefficient in large-scale environments. Replacing them with device attributes often yields a massive performance improvement because attribute evaluation is performed in-memory rather than via repeated database queries.

a. Create an Attribute Definition: Go to *Settings → Attribute Definitions* and create a relevant attribute (e.g., `Region`, `Site`, `Department`).

b. Tag Each Device: On each device's metadata page, assign the appropriate attribute value (e.g., `Region = EMEA`).

c. Update Role Permissions: Change the role definition from using group membership to using the attribute.
○ Instead of: `VIEW DEVICE WHERE isMemberOf('groupUUID')`
○ Use: `VIEW DEVICE WHERE attributeIs('Region', 'EMEA')`

2. Clean Up "Garbage" and Unused Filters

● Regularly audit, identify, and remove `isMemberOf` filters that point to empty, deleted, or irrelevant groups.

● Eliminating these unused filters directly reduces the mathematical multiplier for permission checks without altering actual user access.

3. Consolidate Roles and Permissions

● Reduce Role Count: Audit existing roles and consolidate legacy, redundant, or overlapping roles.

● Simplify Filters: Any reduction in the total number of roles, permissions, or filters exponentially reduces the overall time complexity of access checks.

4. Flatten Device Group Hierarchies

● Reduce Depth: Consolidate group hierarchies to be as flat as possible. Deeply nested groups require more computational overhead to resolve.

● Limit Memberships: Avoid placing a single device into multiple categorical groups simultaneously unless strictly necessary.

● Root Group Management: Avoid placing an excessively large number of devices directly into the root group.

5. Optimize Dashboard Widgets

● Resource-intensive widgets, such as **Device Health** and **Top Problem Devices**, require heavy back-end polling. Removing or limiting these on the main dashboard can significantly reduce initial login delays.