SiteMinder Policy Server : CleanServerCmds Error causing CPU Spike

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On
• SITEMINDER

Issue/Introduction

Observation : Policy Server is consuming high CPU. A restart of the Policy Server might be needed in order to solve the CPU spike.

From the Policy Server logs it can be noticed the following line :

[SmPolicyServer.cpp:1095][ERROR] Exception in JournalThread. Text: Policy store failed operation 'CleanServerCmds' for object type 'Policy store provider'. LDAP Error Doing ServerCommand_Search: 85: Timed out

Environment

Policy Server 12.8.x
component: SMPLC
OS: All 

Cause

The problem faced is that  Policy Server reaches timeout by searching object in class: "smservercommand4" because there are to Many of such objects in the Policy Store.

 

Resolution

Running the below command will give you the amount of stored objects:

# ldapsearch -D "cn=Directory Manager" -w <password> -h <policystorehost> -p <port> \ -b ou=PolicySvr4,ou=siteminder,ou=netegrity,o=netegrity \ objectclass=smservercommand4 | grep dn: | wc -l

Then, running the below command will give you the list of all of the DNs of
every Management Command object:

# ldapsearch -D "cn=Directory Manager" -w <password> -h <host> -p <port> \ -b ou=PolicySvr4,ou=siteminder,ou=netegrity,o=netegrity \ objectclass=smservercommand4 smServerCommandOID4 \ | awk '/^smServerCommandOID4/ { print \ "smServerCommandOID4="$2",ou=PolicySvr4,ou=siteminder,ou=netegrity,o=netegrity" }'

Finally, you will need to delete these with the following procedure:

  - Stop all of the Policy Servers except one;

  - Execute the delete command (on unix, by piping the above list
    command into "ldapdelete"; on windows, capture the list of DN's into
    a text file first);

  - Restart the one Policy Server;
    
  - Start all the remaining Policy Servers;