Mac.getInstance() for HmacSHA1 taking ages to execute

Question

I've recently ran into a deployment issue with a call to Mac.getInstance("HmacSHA1").
It can take up to 10 minutes to execute that single call on this specific server, whilst on other machines its execution is instant.

CPU usage also spikes during the call.

Here's a bit of details on the server:

• OS: CentOS 5.6 Final (kernel 2.6.35.8-16, i686);
• JVM: Sun's JDK 1.6.0_25 (32bit);
• CPU: Intel Core2 Duo CPU ([email protected]);
• Mem: 2GB of RAM;
• Dedicated physical server.

Any clues on what might be the problem here?

Padget

Answer 1

I suspect you're low on system entropy for secure random numbers. See this page to check: Check available entropy in Linux. And this question has answers to consider: How to solve performance problem with Java SecureRandom? In particular this Java option should help you:

-Djava.security.egd=file:/dev/./urandom

It's much faster, but slightly less secure.

Hodgson

Doesn't seem to be related to entropy. I installed rng-utils and ran the the rngd, available entropy jumped from 150ish to 1500-2000. I kind of fixed the problem yesterday by switching to OpenJDK... Any ideas? Thanks! – Padget

Hmm, I see you did say that the CPU usage spikes. Have you tried profiling it on that server? One easy way to check is just watch jstack and see which threads are frequently in a RUNNABLE state. See this answer for the command I typically use, just replace BLOCKED with RUNNABLE since you're seeing CPU spikes instead of blocking issues: #5390817 – Hodgson

jstack hangs for as long as the call to Mac.getInstance() runs. I did try calling it with jstack -F <pid> and here's a couple of outputs I grabbed: d.pr/UVV6 and d.pr/o0dK. I'll have to wait a bit before investigating any further, since after a couple of executions it stops hanging and runs normally -- seems to have some caching effect. – Padget

Sun's (Oracle) JVM is acting really weird; other than taking ages on that getInstance() call, the process randomly dies and I can't even find the crash logs. I'm sticking with OpenJDK for now; thanks for the hints! – Padget