Question

A developer asks:

Is there is a limit to the size of the requestor RuleSet list that Process Commander can comfortably support? How many RuleSets can/should be in the list without impact to performance?

Together with the standard built-in RuleSets, our core application RuleSets, and our supporting interface RuleSets the list can easily grow to number in the 20's.

Can our RuleSet list of length 20 to 30 be supported without noticeable performance impact?

Response

There is no fixed limit to the number of RuleSets that a requestor can have.  The performance impact of long RuleSet lists is marginal.  That's because the RuleSet associated with each rule and the RuleSet list of the requestor is hashed.  The hash value is stored and used to match the two RuleSet lists.  The hash for a RuleSet list is computed when the first requestor using that RuleSet list logs in.  Subsequent requestors with the same RuleSet list are reusing that hash.

What does have an impact on rule resolution performance is having too many distinct RuleSet lists.  Having many distinct RuleSet lists means more rule assembly, more cache entries for the same rule, and more hash computation (see above). 

To help administrators minimize the number of distinct RuleSet lists, Version 4.2 introduces the Rule-Application rule type. Using application-based access groups (instead of the older RuleSet-list-based approach) reduces the possibility of errors and makes security maintenance easier.  

The biggest impact on rule resolution performance occurs if and when there's a poor level of granularity.  Having thousands of rules with the same family name — the combination of the values of all the key properties — of a rule will affect the performance negatively. That's because during rule resolution, the system begins by reading all rules of the same family name from the database and putting them into a temporary list. 

For example, when rule resolution searches for an activity named Display, all Rule-Obj-Activity instances named Display are retrieved regardless of the class they apply to.  In a V4.2 SP2 or later system, you can see this in the Performance tool counters (in the Database section).   The Performance tool shows the count of database records that were accessed to resolve to a rule.

In summary, rule granularity and the variability of RuleSet lists is far more important to performance than the number of RuleSets in a RuleSet list.  There is only a marginal performance impact of longer RuleSet lists.

Of course, you should use as many RuleSets as needed to meet your requirements, but avoid unnecessary proliferation.