Summary for the Tivoli WebSEAL performance tests

Edit online

After performing performance tests on a Tivoli WebSEAL environment on Linux for IBM System z, we compiled a summary of our results and recommendations.

Test results and recommendations are specific to the test environment. Findings useful in the test environment might not apply in other environments with other workloads. For our detailed test results information, see Results for the Tivoli WebSEAL performance tests.

The following are our summary results:
  • The most critical resource was the CPU at the WebSEAL server. Just increasing the number of CPUs from one to two increased the throughput by nearly a factor of two without increasing the number of workload generators.
  • The CPU load of the other servers needed for WebSEAL was very low, making this is an ideal environment to host on z/VM® because z/VM offers the capability of running with more virtual CPUs than physical CPUs available, which allows the sharing of unused CPU capacity among the guests.
  • The log file is a resource where the access is serialized. This is a bottleneck whose impact increases with the number of workload generators. This shows that the I/O bandwidth for the log file is another constraint besides CPU capacity. To ensure the maximum I/O bandwidth, it is recommended to place the log file at least on a separate disk to avoid the sequential I/O flow being interrupted by other I/O requests or use a logical volume striped over disks from several ranks, which is the better option. Be aware that all our measurements were logging to a file.
  • As expected, SSL encryption has a negative impact on throughput because the encryption/decryption is a significant effort. Using CP Assist for Cryptographic Function (CPACF) hardware support reduces that impact significantly. By using large pages, throughput is improved by a factor of 2.4.
  • When the WebSEAL server runs CPU constrained it is a bottleneck limiting throughput. The cryptographic hardware support gives the CPU some relief, which enables the possibility to increase the workload beyond what could be driven without the hardware support.
  • Using an SSL junction from WebSEAL to the back end WebSphere® application server leads to a significant degradation of the throughput. The WebSEAL server has much more work to do in this scenario. The encrypted packages have to be decrypted, analyzed, and encrypted again. The degradation could be reduced by using hardware support for encryption. Be aware that the alternative to this overhead, like an isolated network using a HiperSockets™ connection or a z/VM guest LAN, can be easily implemented on System z™ and produces the same grade of security without this overhead.
  • Using the CPACF from the CPU for decryption and encryption of the requests and the CEX2C cryptographic adapter feature for the authentication results in an improvement by the hardware cryptographic support up to a factor of three.

    See Enable and run WebSEAL with cryptographic hardware support for a description on how to setup the cryptographic hardware support.