Thursday, December 19, 2013

OIM ICF based connector filter error

Recently, I was helping a customer in an OIM project go live when we ran an “Active Directory User Target Recon Job” with an AD Connector ( and a regular expression filter to select just a subset of users.

To our surprise, every time we executed the job, we got a strange error:

(class: org/codehaus/groovy/runtime/ArrayUtil, method: createArray signature: ()[Ljava/lang/Object;) Illegal type in constant pool.

This message might be misleading at a first glance; it suggests errors with classloading or class compilation issues.

My customer was running OIM with a Hotspot JVM, so we started investigating issues related to JVM errors and looked for related messages in the logs.

We discovered that the actual root cause for this error was lack of space for the Code Cache generation.

The way the hotspot (and its JIT compiler) works, it uses non heap space to host a variety of objects that are considered as part of the JVM mechanics.

Those objects are not created on the heap space (defined by -Xms and -Xmx) but in separated spaces: Permanent Generation (or PermGem) and the Code Cache.

The Code Cache is used by the JIT compiler to store compiled pieces of byte code that are executed regularly and chosen by the JVM to be compiled into native code.

When the Code Cache space is full we see errors like java.lang.VirtualMachineError: out of space in CodeCache for adapters in the logs and that indicates that the JVM is having trouble to find space in the Code Cache.

In situations like these, the recommended solution is increase the Code Cache size, by bumping it up with the following JVM option -XX:ReservedCodeCacheSize.

Try setting this at 256m and increase it if you still see the issue happening, like -XX:ReservedCodeCacheSize=256m and so on.

Bounce the servers each time you make changes to the JVM parameters.

Although this issue was found during AD connector deployment, it might happen with other connectors that are also based on the ICF framework. All of them have the same capabilities around reconciliation filtering based on regular expressions.

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.