Friday 1 August 2014

GRC 10 Background Jobs Scheduling



1. The auth sync, user/role/profile (object) sync, and the usage sync jobs are scheduled like below:
GRAC_ACTION_USAGE_SYNC Daily Action Usage Job
GRAC_PFCG_AUTHORIZATION_SYNC Weekly Profile Generator (PFCG) roles authorization      synchronization
GRAC_ROLE_USAGE_SYNC  Daily Role usage synchronization
GRAC_ROLEREP_PROFILE_SYNC Daily Role repository profile synchronization
GRAC_ROLEREP_ROLE_SYNC Daily Role repository role synchronization
GRAC_ROLEREP_USER_SYNC Daily Role repository user synchronization
GRAC_SPM_AUDIT_LOG_SYNC Weekly Emergency Access Management (EAM) audit      log synchronization
GRAC_SPM_LOG_SYNC_UPDATE Weekly Emergency Access Management (EAM) log      synchronization
GRAC_SPM_WORKFLOW_SYNC Weekly Emergency Access Management (EAM)      workflow synchronization
Batch Risk Analysis Job  Daily Risk Analysis Job
Schedule the jobs so they are running at separate times.  Be sure the database is sized sufficiently.
Run the jobs for one connector at a time, create variants to run the jobs, use incremental when possible.
2. The Batch risk analysis job is the most intensive job.  I run this using parallel processes and make sure the rule set is cleaned up for only the needed risks, and the filter for the roles and profiles is properly setup.  Monitoring of this job is necessary.
3. Action Usage Sync:
This job will take a long time to finish when the job is scheduled for the first time or it has been a while since the last job was run.
Sometimes it may take up to a few hours to complete.
This job may be doing a full scan of table GRACACTUSAGE and get a large amount of data, which may take a very long time to complete.
The best practice for scheduling this job is after the very first job is completed -- immediately schedule a next period job that runs  ;every 4 hours, so that each job will select a much smaller amount of data and complete much quicker.

No comments:

Post a Comment