Clustering parameters

Guidewire provides the following configuration parameters in the config.xml file that relate to the application clusters.

To improve performance and reliability, you can install multiple PolicyCenter servers in a configuration known as a cluster. A cluster distributes client connections among multiple PolicyCenter servers, reducing the load on any one server. If one server fails, the other servers transparently handle its traffic.

For information on editing config.xml and setting configuration parameters, see Working with configuration parameters.

See also

ClusteringEnabled

Whether to enable clustering on this application server.

Studio Read-only Mode

If you set the value of ClusteringEnabled to true in file config.xml on a particular application server and then restart the associated Studio, Studio becomes effectively read-only. In this context, read-only means:

  • It is not possible to modify a Studio-managed resource. This applies, for example, to files that you open in the Gosu or Rules editor.
  • If it is possible to modify a Studio-managed resource, it is not possible to save any modification you make to that resource. This applies, for example, to files that you open in the PCF editor.

To indicate the read-only status:

  • Studio displays a padlock icon on the status bar that is visible only if Studio is in read-only mode. If you click the icon, Studio displays a modal message box indicating the reason why it is in read-only mode.
  • Studio disables the Save button any time that Studio is in read-only mode.
  • Studio changes the Save button tooltip in read-only mode to display the reason that save is not active in this mode. This is the same message that Studio shows if you click the padlock icon on the status bar.

Setting the value of configuration parameter ResourcesMutable to false provides the same Studio read-only behavior.

Default: false

Set for server: Yes

See also

ClusterMemberPurgeDaysOld

The number of days to keep cluster member records before they can be deleted.

Default: 30

Minimum value: 1

Required: true

ClusteringProductModelUpdateMaxRetries

Note: This configuration parameter has no meaning unless configuration parameter ClusteringEnabled is set to true.

Sets the maximum number of retries for each cluster node to perform synchronized product model update operations. In a multi-node PolicyCenter cluster, you install product model changes on one server, then start that server to force the upgrade changes. After the first server completes the upgrade process, you can then start the other nodes in the server cluster simultaneously. Due to the number of concurrent server starts, it is possible for there to be contention for the shared update lock while updating the PolicyCenter product model on each node. This configuration parameter sets the maximum number of times that a server node attempts to acquire the update lock before failing.

This parameter works in conjunction with ClusteringProductModelUpdateRetryTimeout and ClusteringProductModelUpdateSleepTimeCeiling. See ClusteringProductModelUpdateSleepTimeCeiling for an explanation of how these parameters interact.

Default: 25 (retries)

ClusteringProductModelUpdateRetryTimeout

Note: This configuration parameter has no meaning unless configuration parameter ClusteringEnabled is set to true.

Sets the time between successive attempts (retries) by a server node to perform synchronized product model update operations. In a multi-node PolicyCenter cluster, you install product model changes on one server, then start that server to force the upgrade changes. After the first server completes the upgrade process, you can then start the other nodes in the server cluster simultaneously. Due to the number of concurrent server starts, it is possible for there to be contention for the shared update lock while updating the PolicyCenter product model on each node. This configuration parameter sets the time to wait between successive attempts to acquire the update lock.

Each node in the server cluster uses the following algorithm to calculate the timeout before the next retry attempt. In this equation, TIMEOUT is the value of ClusteringProductModelUpdateRetryTimeout and n is the value of ClusteringProductModelUpdateMaxRetries.
  • (TIMEOUT) + (2 * TIMEOUT) + ... + ((n-1) * TIMEOUT) + (n * TIMEOUT)

This parameter works in conjunction with ClusteringProductModelUpdateMaxRetries and ClusteringProductModelUpdateSleepTimeCeiling. See ClusteringProductModelUpdateSleepTimeCeiling for an explanation of how these parameters interact.

Default: 5000 (milliseconds)

ClusteringProductModelUpdateSleepTimeCeiling

Note: This configuration parameter has no meaning unless configuration parameter ClusteringEnabled is set to true.

Sets the maximum time between successive attempts (retries) by a server node to perform synchronized product model update operations. In a multi-node PolicyCenter cluster, you install product model changes on one server, then start that server to force the upgrade changes. After the first server completes the upgrade process, you can then start the other nodes in the server cluster simultaneously. Due to the number of concurrent server starts, it is possible for there to be contention for the shared update lock while updating the PolicyCenter product model on each node. Each cluster server uses a retry/back-off approach in which each retry causes an increasing sleep time delay on that node. This configuration parameter sets the maximum allowable sleep time between successive attempts to acquire the update lock. PolicyCenter uses the minimum of the calculated sleep time and this parameter value to calculate the sleep time for each cluster node for each retry.

This parameter works in conjunction with ClusteringProductModelUpdateMaxRetries and ClusteringProductModelUpdateRetryTimeout. The following table illustrates the connections between these three configuration parameters.
Parameter Default Value Effect
ClusteringProductModelUpdateMaxRetries 25 retries The server attempts to acquire the database lock and fails. It then tries another n-1 times to acquire the lock until it is either successful or reaches the maximum number of permitted retries (n), at which point the lock acquisition fails.
ClusteringProductModelUpdateRetryTimeout 5 seconds The first retry attempt to acquire the lock occurs 5000 ms or 5 seconds after the first attempt. The second retry occurs 10 seconds (2 * 5) after the second attempt. The third retry occurs after 15 seconds (3 * 5). This pattern repeats until the 9th retry, after which the time between successive retries increases to 50 seconds (10 * 5).
ClusteringProductModelUpdateSleepTimeCeiling 50 seconds After the calculated time between retries equals the value of the sleep time ceiling, PolicyCenter waits this amount of time between all succeeding retry attempts until the lock process either succeeds or fails.

Default: 50000 (milliseconds)

ConfigVerificationEnabled

Whether to check the configuration of this server against the other servers in the cluster. You must also set configuration parameter ClusteringEnabled to true for ConfigVerificationEnabled to be meaningful.
Warning: Guidewire does not support disabling the ConfigVerificationEnabled parameter in a production environment. Do not set this parameter to false unless specifically instructed to do so by Guidewire Support.

Default: true

Set for server: Yes

PDFMergeHandlerLicenseKey

Provides the BFO (Big Faceless Organization) license key needed for server-side PDF generation. If you do not provide a license key for a server, each generated PDF from that server contains a a large DEMO watermark on its face. The lack of a license key does not, however, prevent document creation entirely.

It is possible to set this value differently for each server node in the cluster.

Default: None

SerializationWhitelistEnabled

Whether PolicyCenter permits only those Java classes placed on a serialization whitelist to be deserialized. In some situations, it is possible for deserialized Java objects from untrusted sources to be used to perform remote code invocation attacks against a Guidewire application server.

For this configuration parameter:

  • If false, PolicyCenter permits any Java class sent over a cluster channel to be deserialized, except for those classes specifically placed on a black (forbidden) list.
  • If true, PolicyCenter permits only those Java classes placed on a white list to be deserialized if sent over a cluster channel. If enabled, it is not possible to place any class on the black list on the white list as well.

Define the permitted (whitelist) and forbidden (blacklist) Java classes in the following configuration files:

  • serialization-whitelist.lst
  • serialization-blacklist.lst

The Server Tools Serialization Info screen (under Info Pages) provides a means of monitoring the deserialization of Java classes.

Default: true

See also