• RSA Governance & Lifecycle 8.0.0
• SecurID Governance & Lifecycle 7.5.x

Customer reports a long runtime in Identity Data Unification specifically in the following step
   Step 8/11: Post-Processing: Populate Role Metrics

An Oracle AWR report may show long running queries (with different SQLID) starting with a statement like the following:

INSERT INTO GTT_IDS (ID)

Longer runtimes in this step may occur due to changes to a Role Membership Rule or an incorrect or inefficient Role Membership Rule.

The time to complete this step is dependent on the complexity of UINC and UOOC Role Membership Rule associated with Roles.   If this step is failing or running longer than expected, check to see if there were any recent changes to the Membership Rule associated with a Role or check to see if any new Roles were defined. 

1. If the Role metrics calculation is running too long,
   • Avoid complex joins in Role membership Rules.
   • Avoid expensive string searches using the LIKE keyword, especially contains, starts with or ends with queries. 

Identify the long running Role from the problem query in the AWR report or identify the failing role from the exception and either delete the Role or resolve the problem by modifying the Role Membership Rule. 

If the unification step is taking longer, a script Per_Role_Constraint_Time_ACM-118035.sql is available to identify the execution time for all Role Membership Rules. Role Membership Rules over a minute are candidates for optimization. You may then try to simplify them or remove them in order to check the improvement in performance. Contact RSA Customer Support to obtain the script and the instructions on how to run the script.

Note:  If unification is failing in Step 8/11, refer to the following article:
Unification is failing at step 8 on "AVUSER.ROLE_MANAGEMENT_PKG", line 2469 in RSA Governance & Lifecycle