Parallel processing of GRC AC 5.3 SP13 Batch Risk Analysis

[Former Member]

Hello,

i have a question regarding the parallel processing of Batch Risk Analysis background jobs.

We have just implemented GRC AC 5.3 SP13 in one of our test-systems. The test-system currently has 6 Server-Nodes.

When running the initial Full Sync. Batch Risk Analysis the background job only gets executed by one of the Background Job Worker-Threads in one of the Server-Nodes. All the other ID0 Background Job Worker-Threads in the remaining Server-nodes remain idle.

Is there any special configuration in RAR needed in order to enable the parallel processing or is this dependent on the configuration of the Java-system itself ? If it's a system-configuration thing what configuration do I need to task the basis team to look into ?

Regards,

Benjamin

[Former Member]

Hi,

we had to manually INSERT the table entries into the DB of the Java system.

After a system reboot everything is working fine now and the Batch analysis jobs are now automatically picked up by all the nodes of the Java system.

By fixing this we were able improve the runtime of a full batch analysis from several days to several hours.

Regards,

Benjamin

[Former Member]

Hello Benjamin,

There should be no special configuration required for this, it should happen automatically.

I have just had a similar issue with my system, We found the issue was related to the JVM crashing occasionally, the background job would start in two processes and then after a few seconds change state to "error" and then continue processing very slowly in only one thread. The log files gave misleading information such as indicating a problem with jco connections etc.

I found SAP Note 1063596 - Background Jobs Crashing in Compliance Calibrator 5.x.

I found the log files mentioned in this note in my system which indicated a JVM problem, I implemented the correction, restarted the system and then started a new risk analysis job and it ran successfully in all three of my server nodes.

Perhaps you can copy and paste the error you see from the server* log files here?

Hope this helps.

Regards,

Chris

[s_pados]

In RAR config - optimizaiton you have to set webservice i/o and netweaver lock to NO. These are giving issues when set to yes. It resolved it at our system. don't forget to restart the server after changing these values.

Regards,

Stefan

[Former Member]

>

> In RAR config - optimizaiton you have to set webservice i/o and netweaver lock to NO. These are giving issues when set to yes. It resolved it at our system. don't forget to restart the server after changing these values.
> 
> Regards,
> Stefan

Hello Stefan,

we are currently on SAP GRC AC 5.3 SP13 (withouth the Patches). The changes we do in the webinterface for the two settings you have mentionened are not written to the database (execute select * from virsa_cc_config in the CC Debugger-Webinterface and look for IDs 250 and 251). This is a known bug.

For parameter "Store WebService Input/Output parameters objects in database Yes/No?" there seems to be a workaround by inserting the setting into the table directly (SNOTE 1508611). Can you confirm that the entry with CNFGPARAM-ID=251 exists in the table in your system (with value NO)?

For parameter "Use Net Weaver Logical Lock Yes/No?" there's the same issue. The workaround is described in SNOTE 1528592. Can you please confirm that theres an entry CNFGPARAM-ID=250 with value NO in your table ?

If you confirm the two settings I will have our IT guys insert those entries into the DB table.

P.S.: We are not planning to implement any Patches or SPs any time soon because we are doing the Ramp-up for SAP GRC 10.0. We want to check out the functionality in there first and not put too much effort into patching the "old" version right now.

@Chris Chapman:

I will have someone check the server logs for the errors that are described in the SNOTE you provided. Thanks for the help.

[s_pados]

Hi Benjamin,

Sorry for the late reply. Both parameters are in our virsa_cc_config table without having to put them there manually. I think that was fixed in one of the patches for SP13. We are on RAR SP 13 patch 3

[raghu_duggirala3]

Hi All,

You have to exclude the sap_all profile in the analysis (exclude all roles/profiles not related to risk analysis).

Please check the table indexes and other JVM tuning parameters.

Happy thanksgiving feasts..

[Former Member]

push

Hello Imanol,

any news on the OSS msg you opened against SAP ?

Our batch analysis has been running for over a week now on just one server node...

We will just let it go on for now as this is only our DEV/QAS GRC Installation

Regards,

Benjamin

[Former Member]

Hi,

Please post if you found solution or workaround...

Regards.

[Former Member]

Benjamin,

You are 100% right. We have noticed that also in SP13 and opened an OSS Message for it.

Kind regards,

Imanol

[Former Member]

Benjamin,

don't schedule user/role/profile sync jobs (may be incremental) as one job. schedule them as three separate jobs and make sure the sequence is user , role, profile with gap of at least 30 min.

similartly for batch job.

hope this help

regards,

Surpreet

[Former Member]

Hello Imanol,

I aldready read the document you are referring to before I opened this thread.

It says:

"Thread 0 on each server node is reserved for these two types of background jobs. A job of one of

these two types is decomposed into subtasks and executed in parallel in the threads with ID 0 of each

one of the available server nodes on the J2EE engine."

From what I understand based on the document the Batch Risk Analysis should be divided into subsets by RAR automatically and then be processed by the Worker Threads with ID = 0 on all of the available server nodes, right ?

When I scheduled the initial Full Sync. Batch Risk Analysis I noticed in .../sap/CCADStatus.jsp that just 1 of the availabe 6 Server-Nodes is processing the brackground job. Based on the document I expected all 6 Server-Nodes (and within the node the Thread with ID = 0) to be processing the analysis.

Regards,

Benjamin

[Former Member]

Hi all,

There is a very good documento call "How to Performance Optimize SAP GRC Access Control 5.3" (just google for it) where there is detailed information about this.

There is a section where describes about (4.7.3) Parallelization of Background Jobs.

Keep in mind that:

In GRC Access Control 5.3 the following two background jobs are executed in a parallelized fashion:

- User / Role / Profile Synchronization

- Batch Risk Analysis (scheduled in the Configuration 􀃆 Background Jobs 􀃆 Schedule Job)

Hope it helps. Best regards,

Imanol

[Former Member]

Benjamin,

You can schedule more backgorund jobs in RAR and the other nodes will pick them up. Once background job will not get divided between different server nodes.

Regards,

Alpesh