Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

Important Security Fix for IMAP

Daniel Nashed  22 April 2017 11:13:16
In case you are running IMAP on a server that is reachable over the internet you should look into this fix ASAP.

It might not be that critical for internal services.

See details about this vulnerability here --> http://www.ibm.com/support/docview.wss?uid=swg22002280

All versions of Domino are affected!


NIFNSF Supported Maximum Size above 64 GB!

Daniel Nashed  21 April 2017 19:02:31
After getting that question offline and having a discussion on my blog, I checked with IBM if they plan support NIFNSF sizes above 64 GB.
Since it is kind of a database container and needs a database handle someone could think that the maximum limit is also 64 GB.
That would give us at least 64 GB room for the NIF index -- which would be already a big improvement.

But from what I recall from some comments at Connect some years ago the maximum limit was not around 64 GB when they designed it.

On the other side it is difficult to test and such large view / folder index sizes. And you will not run into many situations where you need such a large size.

From what I heard, IBM is about to publish a supported official size for the NIFNSF indexs that is far beyond 64 GB.
Stay tuned for the official statement. For now I can tell you that it will work above the 64 GB limit!

On the other side a databases with that index size will reach other limits like application responsiveness issues because of the nature of complex views with many documents.

But it is good to know that it was designed to support larger sizes and also the counters in the database will continue to work as I have tested earlier for DAOS.

Once we get an official statement I will update my post and share the link.


-- Daniel

Disclaimer Attachment Issue not yet fixed in IF1

Daniel Nashed  14 April 2017 20:28:40
As Rob Kirkland commented in one of my last blog posted, the fix in IF1 does not solve the iusse.

We both checked with IBM and got the reply that the SPR just changes back the default and disables the change introduced in FP8 for Google calender integration.

IBM is working on a fix hopefully makes it into FP9.

So for now you should keep the notes.ini Parameter MIMEDisclaimersNoEncode=0 disabled.

Thanks to Rob to bring this up!

-- Daniel

TPONAKFJLP

After upgrade to FP8, with disclaimers enabled, .pdf attachments have content-transfer-encoding of binary  



Get Notes FP Version in @Formulas

Daniel Nashed  12 April 2017 08:19:07
In C-API and Lotus Script, Java developers the version information already shown for each FP.
For example Lotus Script returns the full version string with session.NotesVersion.

But if you want to check the version information in @Formulas @Version will still return 405.

There is a new optional parameter which returns the Feature Pack version.
So you use @Version to check the version and if it is 405 you check @Version(1) which will return 8 for Feature Pack 8.
It is used in the new mail-template and will be updated for every new FP.

@Version(1) returns 0 for older versions (I checked with a Notes 7 client to verify).

-- Daniel




Notes/Domino 9.0.1 FP8 IF1 released

Daniel Nashed  11 April 2017 07:06:32
Notes and Domino 9.0.1 FP8 IF1 has been shipped and there is also a separate fix for iNotes.

All those IFs have the same version number but contain different SPRs!

The most important IF is for the Domino Server. It fixes the disclaimer issue I reported before.
And also the performance fix for the new feature NIFNSF which was introduced in in FP8.

Be aware that NIFNSF is a server feature and not a client feature. It requires translog enabled on your server!
Translog is not officially available on Notes clients.




Domino

YJIAAJ4MXV
Add new JNI wrappers to jNotes        

NNUZAG78H3
the tag includes some illegal characters, will be output not commentted as before.        

TPONAKFJLP
After upgrade to FP8, with disclaimers enabled, .pdf attachments have content-transfer-encoding of binary        

SWASAKELQ8
Perf issue w/ nifnsf enabled.        

LHEYAKALAH
Form Validation not working on an XPage        


Notes

LHEYAKBJSQ
SSJS editor stops working in an NSF with a managed bean        

LHEYAKALAH
Form Validation not working on an XPage        

LHEYAKBJSQ
        SSJS editor stops working in an NSF with a managed bean        

MDOYAKFPE2
XPages iNotes calendar control icons do not display the correct hover help text


iNotes

JJCMAKV3DT
iNotes "Starts With" window does not show when pressing any letter or number key


    Current Information about NIFNSF

    Daniel Nashed  1 April 2017 00:42:31
    Domino 9.0.1 Feature Pack 8 introduced "NIFNSF" which allows to separate the view/folder index into a separate file.

    Let me try to summarized my current experience from my tests and from the field.


    There are multiple benefits moving the index to a separate file.

    1. Backup Storage Reduction

    First of all having the index in a separate file reduces the amount of data that you need to backup.
    For mail databases the index is around 10%. If you have DAOS enabled from the remaining data it's about 30%.
    So the backup time and backup storage in total is reduced.

    2. Size Limit of the data above 64 GB

    The total size of a NSF is 64 GB. With DAOS enabled you can increase the logical size of a server based database by moving attachments to the DAOS store.
    For DAOS you can have external attachments up to 1 TB. Beyond that size the internal counters might overflow.

    But in some cases you still need more that 64 GB for NSF data and the view/folder indexes. With NIFNSF the limit is the 64 GB data in the NSF without the view/folder index.

    3. Performance

    NIFNSF is intended to deliver better performance than having all data in a single NSF file.

    There is a current performance issue. For mail databases there should not be big difference.
    But for more complex views in applications the performance with NIFNSF might be not as good as without it.
    Tests have shown that it can take double the time.

    There is a pending fix that might be delivered with an IF for FP8 which should bring back the performance to almost the same as without NIFNSF.

    And for FP9 there is optimization planned to have better performance for concurrent operations. Those changes did not make it into FP8.


    So for now you might want to wait at least for an IF before enabling NIFNSF for complex applications.



    -- Storage Location for NIFNSF --


    There are multiple options to configure where to store the .NDX files which store the NIF data.
    What you choose depends on your environment,platform and your requirements.

    a.) Have NDX files stored next to your NSF files

    b.) Have NDX files stored in a separate folder in the data directory

    c.) Have NDX outside the data directory on the same disk

    d.) Have NDX stored on a separate disk

    There are no one size fits all recommendations. It really depends what storage situation and platform you are running on.

    If you can for example on Windows I would store NDX files at least outside the data directory.
    On Linux often without a new mount point you might not be able to move the NDX files outside the data directory, because often the data directory is a mount.

    If you need to increase your storage anyway because the NSF disk is full, having a separate disk (most of the times virtual disk) makes sense.,
    This is a good way for a clean new allocation and it will separate the I/O operations.



    -- Enabling NIFSNSF on your Server --


    Translog

    First requirement is that you are using transactions logging. Circular translog is perfectly OK for that.
    And translog is general recommendation for Domino anyway! For stability, fault recovery and also for performance!

    ODS 51 or higher

    You will need at least ODS 51 for NIFSNSF. But I would recommend using ODS 52 for all databases on your server.

    notes.ini Create_R9_Databases=1 will ensure the ODS is updated the next time you run a copy-style compact.

    Notes.ini Settings

    There are a couple notes.ini settings. The most important setting  NIFNSFEnable=1 enables NIFNSF on your server.

    To store the NDX files in different locations (see options above) you can leverage NIFBasePath=path depending on your preferences.

    In addition if you want all new databases to be NIFNSF enabled there is another notes.ini setting CREATE_NIFNSF_DATABASES=1 which will ensure that all new databases are automatically NIFNSF enabled.



    -- Enabling NIFSNSF on a Database --


    Once your server is NIFNSF enabled you can start enabling NIFNSF on your databases via compact.

    Please take care not to run the compact operation on all databases. We have seen customers who enabled NIFSNSF also on the DAOS catalog -- even the special database has no views.

    I would currently start with mail databases only! And you just specify the right mail directory.

    The normal recommendation is to use

    compact -c -NIFNSF ON mail/

    This will enable the feature and also move existing indexes out of the NSF.
    But if the database is in use, the copy-style compact will not be possible.

    Instead you could enable NIFNSF on databases without copy-style compact and have a copy-style compact later on with either compact -c or leveraging the DBMT tool which you might have configured anyway.

    Once the database is on ODS 51 or higher and NIFNSF is enabled new indexes are created in the NDX file.
    But only the copy-style compact will move the views to the NDX file.



    -- Checking NIFNSF --


    You can check which databases are already NIFNSF enabled and there is also a way to see the size of the NDX. But this command shows all databases.

    The most useful commands shows all NIFNSF enabled databases.

    show dir -nifnsfonly

    show only NIFNSF enabled databases

    show dir -nifnsf

    show all databases with NDX files also



    -- Maintaining Databases with NIFNSF enabled --


    I have done some tests. Only with copy style compact the NDX will be compacted.
    Many customers are still using compact -B for an inplace, space reduction compact.

    There are also other reasons to leverage DBMT which is using copy style compacts and does use space pre-allocation to ensure the NSF is not allocated fragmented.

    The copy style compact will also shrink the NDX if needed. A compact -B did not free any space from the NDX file in my tests.

    However the free space in a NDX file should be still be reused if released from a purged view/folder index during normal runtime.



    -- Tuning for NIFNSF --

    A NDX file is a NSF file. The index data needs a container. Therefore if you are running a large server you have to make sure you have sufficient dbcache entries, because the NDX file will also need a cache entry.

    By default the dbcache handles depend on the size of the NSF Buffer Pool (which is 1024 MB for 64bit). The number of cache entries is around 3 times the buffer pool size in MB.

    3000 DbCache entries should be OK for most servers. But if your server is already on the limit you have to increase the limit.

    Here are the relevant server statistics from a current customer example:

            Database.DbCache.CurrentEntries = 4498
            Database.DbCache.HighWaterMark = 4500
            Database.DbCache.MaxEntries = 3000
            Database.DbCache.OvercrowdingRejections = 15220

    Your CurrentEntries and HighWaterMark should be alwass below the MaxEntries.
    And the OvercrowdingRejections should be always zero!

    So in this case it would make sense to increase the number of cache entries to 6000 via:

    notes.ini NSF_DbCache_Maxentries=6000

     

    CREATE_R9_LOG is not a valid notes.ini parameter and does not exist!

    Daniel Nashed  24 March 2017 11:29:50
    After hearing this question twice a week I think it is time for a blog entry.

    There is a notes.ini parameter for the different ODS formats in different releases.
    The latest one you should use is Create_R9_Databases=1 to create databases with ODS 52.

    ODS 52 is needed for local databases which are encrypted (there was an underlying ODS issue that has been addressed in ODS 52).
    Also for hew new LargeSummary (16MB instead of 32KB per document) you need to be on ODS 52.

    But there is no new notes.ini parameter for the optimized aligned translog extends.

    The only parameter valid is still CREATE_R85_LOG=1.

    I have dumped the string resources from the current binaries in 9.0.1 FP8 to double-check.

    There is no change for translog notes.ini parameters in Domino 9.0.1!

    Sounds like someone posted on his blog or added it to his presentation and others copied from there.

    -- Daniel


    libnotes.so:Create_R9_Databases
    libnotes.so:Create_R85_Databases
    libnotes.so:Create_R8_Databases
    libnotes.so:CREATE_R85_LOG

    Traveler 9.0.1.17 Relased with important bug fixes

    Daniel Nashed  24 March 2017 09:12:07
    As posted before Traveler 9.0.1.16 had one issue that needed urgent attention.
    Push was not working when the mail-server had a short downtime.
    If you are on that release you should update asap.

    There are a couple of other fixes along with that ARPA included in 9.0.1.17.

    Just back from a couple of days of travel and installed it this morning. Looks good so far.

    APAR # Abstract
    LO90889 Invitee status not correct on mobile device if the invitee response is received in a non-syncing folder.
    LO91550 Multiple ghost entries possible if adding invite to event that has outstanding updates pending.
    LO91723 User may stop recieving updates to mobile device after mail server restarted and there is no backup mail server.
    LO91733 Subject of mail replied to/forwarded from Windows 8 device may display incorrectly.
    LO91762 IBM Traveler server may change case of Domino domain to all lower case when sending mail.
    LO91770 Subject of new mail sent from Windows 8 device may display incorrectly.
    LO91819 User may not be able to sync data to mobile device when the user's mail file name contains special characters.
    LO91870 Wipe data option may be greyed out for iOS Verse client.


      D9.0.1 FP8 Attachment Corruption Issue with Disclaimers

      Daniel Nashed  21 March 2017 15:27:55
      There is an issue that has been reported about FP8. When using disclaimers attachments might be corrupted.
      IBM released a technote with details and is working on a fix.

      Feature Pack 8 contains an enhancement/fix to correctly send Google Calendar files.
      The fix is enabled by default and causes this corruption.

      You can still deploy FP8 and disable the feature/fix temporary via Notes.ini MIMEDisclaimersNoEncode=0 on your SMTP outbound server.

      See this SPR #TPONAKFJLP / APAR  #LO91828 for details
      http://www.ibm.com/support/docview.wss?uid=swg22000468

      -- Daniel




      Traveler on Domino 9.0.1 FP8

      Daniel Nashed  7 March 2017 23:51:34
      Domino 9.0.1 Feature Pack 8 has just shipped.
      If you are intending to update your Traveler Server to Domino FP8 you should be aware that you need at least Traveler 9.0.1.16
      (which currently has an issue reconnecting to a mail-server if it wasn't reachable --> see previous blog posts).

      If you still intend to update your server there are some important requirements. FP8 comes with Java 1.8 and Traveler is using that JVM.
      So it some changes are needed in the Traveler code to support the new JVM version.

      In addition for Traveler HA there are additional JDBC Requirements

      - If using DB2 server: In order to support Java 8 you must use DB2 JDBC Driver V10.5 FP7 (4.19.49) or higher, see technote 1983724 for details.

      - If using MS SQL server: In order to support Java 8 you must use sqljdbc42.jar file from MS JDBC 4.1 or later release.

      There is a new technote which contains links to the detailed technotes and also to the download sites

      -->  http://www.ibm.com/support/docview.wss?uid=swg21999188


      I updated my server to Domino 9.0.1 FP8 and Traveler 9.0.1.16 but you should probably wait for the fixed Traveler version before upgrading your server to FP8.

      • [IBM Lotus Domino]
      • [Domino on Linux]
      • [Nash!Com]
      • [Daniel Nashed]