Advanced tuning parameters for the virtual appliance

Change the advanced tuning parameter values only under the supervision of IBM® software support.

Local management interface (LMI)

The following table lists the advanced tuning parameters that are available.
Table 1. Advanced tuning parameters
Parameter Description
lmi.security.ciphers Enables specific ciphers for the local management interface. Valid values are specified as a space-separated list. The virtual appliance supports all the cipher suites that are supported by Java 8. See https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/ciphersuites.html for a list of the supported cipher suites.
lmi.security.protocol
Enables specific protocols for the local management interface. Valid values are TLS, TLSv1, andTLSv1.2.
Attention: When you change the protocol version, you must switch to the same protocol version all your running external entities, if they are configured with SSL. This includes the external database server and the directory server.
igi.security.ciphers Enables specific ciphers for the Identity Governance and Intelligence application. The value must be a cipher that is supported by the TLSv1.2 protocol. Multiple values can be specified as a space-separated list.
vmtoolsd.enabled Set to true to enable the use of Open VM Tools. Set to false to disable. By default, Open VM Tools are disabled.
With Open VM Tools enabled, you can use the following services:
  • You can shutdown and restart the virtual appliance gracefully from the hypervisor console.
  • You have clock synchronization between the virtual appliance and the ESXi server.
  • You can use the vmware support command to get VMWare statistics.
vmtoolsd.timesynch.enable Set to true to enable clock synchronization between the virtual appliance and the ESXi server. Set to false to disable.

If your network uses a Network Time Protocol (NTP) server, this parameter is automatically set to false.
openid.security.ciphers Set this parameter with a security cipher value to run the openID Connect authentication server with the desired cipher.
kernel.disable.spectre Disables the Identity Governance and Intelligence fix for Spectre and Meltdown.

Set to true to disable the fix. Set to false to enable the fix. By default, the fix is in running mode and this parameter is set to false.
identity_net.if.mtu Sets the maximum size of the transmission packets that are sent by the network interface.

The default value is 1500 bytes. You can change this value to a value between 576 and 1500 bytes.