JVM options

Edit online

The JVM (Java™ virtual machine) settings in AS4 Microservice control the available memory and other performance settings for each type of member (informational, operational, catalog, container).

Use the jvm.options file to change, add, or remove a JVM option and its value. The jvm.options file for each member is at install_dir\Members\member_type\usr\servers\member_type. The settings for each member control just that member.

The jvm.options file includes default properties and values. You can tune the JVM options by changing these default values or by adding other values.

After you change the jvm.options file, you must restart AS4 Microservice.

To monitor the JVM of a member, add the line -verbose:gc. Always monitor the JVM of the operational member, because it is the most active member. If you have more than one node, also monitor the container member. If a JVM fails and the Java core memory dump shows that the JVM is out of memory, increase the setting.

Default settings

You can change memory heap settings from the following default values:

Table 1. Default JVM memory heap settings
Member Type	Default Minimum Setting	Default Maximum Setting
Catalog	256 MB (`-Xms256m`)	512 MB (`-Xmx512m`)
Container	2048 MB (`-Xms2048m`)	2048 MB (`-Xmx2048m`)
Operational	1024 MB (`-Xms1024m`)	1024 MB (`-Xmx1024m`)
Informational	512 MB (`-Xms512m`)	512 MB (`-Xmx512m`)

If you want to restore the default values in the jvm.options file, use the contents of the jvm.options.factorySettings file that is in the same directory as the jvm.options file.

The following example shows a default jvm.options file for the operational member:

-Xms1024m
-Xmx1024m
-Djava.endorsed.dirs=../wxs/lib/endorsed
-Dorg.osgi.framework.bootdelegation=com.ibm.wsspi.runtime
-Dcom.ibm.msg.client.config.location=file:../../../../resources/jms.config
-Xjit:{java/util/UUID.*}(count=0),{java/security/SecureRandom.*}(count=0),{com/ibm/crypto/provider/SecureRandom.*}(count=0),{java/util/*Calendar*}(count=0),{sun/util/calendar/*}(count=0)
-Djavax.xml.parsers.DocumentBuilderFactory=com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl
-Djavax.xml.transform.TransformerFactory=com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl
-Djavax.xml.stream.XMLOutputFactory=com.ibm.xml.xlxp.api.stax.XMLOutputFactoryImpl
-Djavax.xml.stream.XMLInputFactory=com.ibm.xml.xlxp.api.stax.XMLInputFactoryImpl
-Djavax.xml.datatype.DatatypeFactory=org.apache.xerces.jaxp.datatype.DatatypeFactoryImpl
-Djavax.xml.validation.SchemaFactory:http://www.w3.org/2001/XMLSchema=org.apache.xerces.jaxp.validation.XMLSchemaFactory
-Djavax.xml.xpath.XPathFactory:http://java.sun.com/jaxp/xpath/dom=org.apache.xpath.jaxp.XPathFactoryImpl
-Dcom.ibm.jsse2.disableSSLv3=false

Security protocols

You can use the jvm.options file to control whether you use the Transport Layer Security (TLS) protocol or the Secure Sockets Layer (SSL) protocol.

Attention: Although you can use either the TLS or SSL protocol with AS4 Microservice, IBM recommends that you use SSL only for compatibility with earlier versions due to security vulnerabilities. For more information, see the IBM Product Security Incident Response Blog.

In the operational member, SSL v3 is enabled by default with the line -Dcom.ibm.jsse2.disableSSLv3=false that is included in the jvm.options file during the installation of AS4 Microservice.

Attention: SSL is required only if an SSL cipher is selected in a business exchange configuration. If SSL is not required, you can enhance security by setting -Dcom.ibm.jsse2.disableSSLv3 to true.

The -Dcom.ibm.jsse2.disableSSLv3=false setting overrides the default value of true in the IBM® SDK for Java. The default value of true disables SSL v3 in the IBMJSSE2 provider, even if SSL v3 is requested by the application code.

To enable support for the Secure Sockets Layer (SSL) protocol for the informational, catalog, or container member, add the following line to the jvm.options file:

-Dcom.ibm.jsse2.disableSSLv3=false

Attention: You would probably set -Dcom.ibm.jsse2.disableSSLv3 to false in an informational, catalog, or container member only when you are working with Customer Support to resolve a problem.