Increase Jamf capacity to handle school start period

[hphan]

We have 3000 Mac devices and 7000 iOS devices in JAMF. We will have 3500 more iOS devices this summer. Our JAMF database couldn't handle all the requests (DEP enrollment and apps download) at the beginning of the school year and max out at 100% for weeks. We post this to solicit advice from other JAMF users. What did you do that make a difference for your on-premise hosted JAMF setup? I hope this is helpful for all who are looking to manage their JAMF load.

We tried: convert to InnoDB, reduce device check-in frequency & collected info, change Tomcat pref, cluster our JSS Tomcat servers, and many other things.

At this time, we're thinking about procedural to reduce the load on our JAMF. We're thinking of disabling the authentication piece during the DEP enrollment process for the 3500 iOS devices in the summer so the devices will enroll and download all the settings and default apps during the summer time.

[lehmanp00]

Curious how you know that it is all the DEP and app requests that is causing the issue? We have similar numbers and our server (ubuntu) will spike a load value or 20+ and if it doesn't go down by 30min I bounce the Tomcat instance. JAMF has looked at this 4x in the past 2 years and it always ended up being a code bug that required a patch to fix. It has gotten better but has never really gone away. We have just resigned ourselves to the fact that this is how it is...

[cbrewer]

Something that helped us a lot is not having devices communicate with our master JSS. Our master JSS exists only for the purpose of being a master - clients don't check into it and our techs don't login to it. Along with that, InnoDB makes a big difference but it sounds like you've already done that one. Make sure you have lots of CPU and RAM for Tomcat. We're using roughly 16 cores and 32GB RAM currently.

[gbyers]

Ditto what cbrewer said. We have multiple JSS instances and the Master stands alone just being the Master. We have about 30,000 devices in all. 25k iOS and 5k macOS.

[TJ_Edgerly]

@hphan Just curious, how do you have your infrastructure set up?

1. Only single instance or cluster (sounds like you tried cluster...but wanted to be sure on your topology)?
2. How much hardware do you have dedicated?
3. What flavor are you hosting on the JSS (Mac, Linux, Windows)?
4. What is your thread pool count?

[lehmanp00]

This is very interesting!

We have a non-clustered setup of 2 servers. Our devices point to the Master and our Techs login to the child server. JAMF specifically told us to use this setup.
I have never heard of not having at least the devices point to the Master. I'm guessing that that Master does all the talking with Apple VPP/MDM cloud and having your devices point to a different server for MDM/Device communication help reduce the load on the Master even more?

As for clustering, we have heard nothing but horror stories about clustering a JAMF setup. So we have avoided that.

[cbrewer]

No issues with clustering here. In fact, I wasn't aware that running multiple JSS's without clustering was even a supported configuration.

[hphan]

Thank you for all the responses so far!
@lehmanp00 You are correct that there are more than DEP and app requests that brought down the JAMF servers. @cbrewer We have three JSS Tomcat servers - master, external and an internal. All our devices contact the Master. We use the internal for management. Will connect with JAMF about clustering the JSS servers as well as setting up so Master won't be the one get contacted by devices.
@TJ.Edgerly Only single instance or cluster (sounds like you tried cluster...but wanted to be sure on your topology)?
Technically, multiple JSS servers but they are not clustered with a load balancer in front.

How much hardware do you have dedicated?
JAMF DB - 8 cores, 8GB RAM
JSS servers - 4 cores, 8GB RAM

What flavor are you hosting on the JSS (Mac, Linux, Windows)?
Windows 2012 R2 server

What is your thread pool count?
It keeps changing as we contact JAMF engineers. I believe it is 45 right now.

[Sandy]

Hi,
I am confused about how you would set your master so that devices do not check into it. The limited access choices are:
Full access
Computers only
Mobile Devices only
Computers & Mobile Devices

How do you have your Master set?

[cbrewer]

@Sandy With DNS. The DNS name on my master isn't something that my client devices are even aware of.