• Why is my shibboleth IDP so slow to accept the first connection?

    Date: 2009.11.03 | Category: idp, productionalize, shibboleth

    When I create my first connection to my shibboleth IDP it takes 30 / 40 seconds for tomcat to serve the login page.

    At first I expected that my tomcat memory allocation / heap space value wasn’t being applied but my ps aux | grep java showed:
    /usr/lib/jvm/java-6-sun/bin/java -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/opt/tomcat/conf/logging.properties -Xmx512m -Djava.endorsed.dirs=/opt/tomcat/common/endorsed -classpath :/opt/tomcat/bin/bootstrap.jar:/opt/tomcat/bin/commons-logging-api.jar -Dcatalina.base=/opt/tomcat -Dcatalina.home=/opt/tomcat -Djava.io.tmpdir=/opt/tomcat/temp org.apache.catalina.startup.Bootstrap start
    I could see above it wasn’t using enough memory so I edited /usr/share/tomcat5.5/bin/catalina.sh and under JAVA_OPTS I added: -Xms256m -Xmx1024m -server -XX:+AggressiveOpts -XX:MaxPermSize=512m
    It now reads:
    JAVA_OPTS=”$JAVA_OPTS “-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager” “-Djava.util.logging.config.file=”$CATALINA_BASE/conf/logging.properties -Xms256m -Xmx2048m -server -XX:+AggressiveOpts -XX:MaxPermSize=1024m”
    I used the ./shutdown.sh script provided with tomcat to shutdown tomcat and then the ./startup.sh script to restart. Tested and performance was massively improved after a 5 minute start up wait.
    Use tailf /var/log/shibboleth/idp-process.log to watch the log file to check for startup completion.

    Related Posts

    1. Etherpad with Shibboleth Authentication (Technical document)
    2. Success: optimizing the Etherpad Java VM
    3. Testing Shibboleth SP 2 on CentOS to the ukfederation w/ Godaddy certs
    4. Shibboleth IDP configuration for multiple organizations & Google apps
    5. Android – Can’t establish a reliable data connection to the server.