SlideShare a Scribd company logo

BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS

Nico Meisenzahl, profile picture
Nico Meisenzahl

This document is a presentation from a conference on best and worst practices for deploying IBM Connections, detailing the experience of presenters Christoph Stoettner and Nico Meisenzahl. It covers various aspects of installation, system requirements, performance tuning, and security settings for IBM Connections, alongside recommendations for optimizing deployments. Specific technical insights include configuration guidelines, server setup, LDAP considerations, and log management strategies to enhance system efficiency and user experience.

Technology
1 of 65
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
Toronto, June 6-7 2016 Best and Worst Practices Deploying IBM Connections Christoph Stoettner Nico Meisenzahl
PLATINUM & SPOTLIGHT SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
Christoph Stoettner • Senior Consultant – panagenda • IBM Notes / Domino since 1999 • IBM Connections since version 2.5 / 2009 • Many years of experience in: • Migrations • Administration und installs • Performance analysis • Joined panagenda in 2015 focusing in: • IBM Connections deployment und optimization • IBM Connections monitoring • Husband of one & father of two, Bavarian 3  @stoeps  linkedin.com/in/christophstoettner  www.stoeps.de  christophstoettner  +49 173 8588719 christoph.stoettner@panagenda.com
Nico Meisenzahl • Consultant at panagenda • IBM Notes / Domino since 2008 • IBM Connections since version 3.0 / 2010 • Many years of experience in: • Consulting • Migrations & Administration • Joined panagenda in 2016 focusing in: • IBM Connections Consulting • ICS deployment & optimization 4  @nmeisenzahl  linkedin.com/in/nicomeisenzahl  meisenzahl.org  nico.meisenzahl  +49 170 7355081 nico.meisenzahl@panagenda.com
IBM Connections Request Flow 5 Databases WebSphere Application Server IBM HTTP ServerWebSphere Plugins Application DBsPEOPLEDB LDAP Server TDI Forward to Application Server and Port (Load balancing and Failover) Redirect unknown URL Upload and Download of Files, Attachments Common: Access Customization, Webressources Read and Write Authentication Users / Groups Reads Userdata for Profiles Create, Update, Delete and Inactivate Profiles Shared Directory Link to Attachments Profile changes synchronize to Membertables through JMS Queue Optional: Direct Access to Attachments
Toronto, June 6-7 2016 Installation & Requirements
System Requirements • Regularly check requirement documents • All versions • http://short.stoeps.de/vwzrv • IBM Connections 5 • http://short.stoeps.de/mspdi • IBM Connections 5.5 • http://short.stoeps.de/cnx55sysreq • Check all notes, Download PDF Connections 5.0 CR3 Connections 5.5 Connections 5.5 CR1 7
System Requirements 8 • Be careful with installation documents • Sometimes wrong dependencies mentioned • Supported statement does not mean it’s licensed • http://www-01.ibm.com/support/docview.wss?uid=swg21683118 • Supported: DB2 10.5 FP4 -> but Connections 5.0 License Agreement: • You will not find a DB2 10.5 license in your PA Account
Sizing • Be prepared for future growth • Do not overact • A few hundred users doesn’t mean you need a large deployment • Not fans of multi-instance database machines • If I run in database performance issues I split the databases to different machines • Performance tuning guide • Multi-instance is best practice, if you have enough resources Performance Tuning Guide 5CR1 – page 10 9
Sizing • A word on requirements • 4 | 8 GB memory minimum is often too less, better to start with 10 or 12 GB • Memory swapping kills all tuning efforts • CPU cores • 2 cores minimum only on small deployments • Thumb rule: calculate one core for each jvm (expensive with PVU license) • Disk • Using network storage or virtualized servers • Easier to extend Connections 5.0Connections 5.5 10
Prepare for your Installation • Download all software packages • Check System Requirements! • Paths shouldn't contain spaces • No spaces in source and destination folders • Use a dedicated administration user • Especially on Windows avoid users with applied group policies • If possible disable User Account Control (UAC) • Run all Installer and Scripts with option “Run As Administrator” 11
Security Settings • During installation you should disable all "Security" Software • SELinux • AppArmor • Antivirus • Firewalls • Self developed scripts and extensions • It's not fun, when a script deletes databases, because you forgot to add the directory to the script exclusions 12
Operating System specific settings - Linux 13 • Different operating systems need special settings • Always use the operating system where you have the best skills • Linux • /etc/security/limits.conf • Increase nofile and nproc (see tuning guides) • Example from tuning guide • Default nproc (max number of processes) for user root 2047 • You can extend the nproc with ulimit –p up to 16384 (e.g. within .bashrc or .profile) • Or set soft and hard limit to equal sizes, avoids additional changes with profile root soft nproc 2047 root hardnproc 16384
Operating System specific settings - Windows 14 • Always use UNC path as Shared Directory • Easier to add additional WebSphere Nodes for failover or load balancing • WebSphere services • Technical user account • Enable “Password never expires” • Disable “Must change password on next login” • Default: LocalSystem has no network access • Check access rights on Shared Directory
Network • Name lookup / DNS • All servers must be resolvable (hosts is not a suitable workaround) • Knowing the protocol • Avoid Round Robin • No Authentication failover in WebSphere with Round Robin! • Network storage (file locking is important) • NFS v4 / SMB|CIFS • No DFS • Reverse Proxies / Proxies • Always test your deployment without proxies • Activate after successful testing 15
Register WAS as a service • Register WAS as a service • Services for Deployment Manager and NodeAgent(s) • wasservice.bat|sh • Map service to a technical user • any Active Directory User is possible • allowed to read / write network share with Shared Content • Service can parse commands to nodeagent • -stopArgs "<NA commands>" • Configure monitoring policy (if required) 16
WasService.bat|sh – Register service 17 cd D:IBMCNXWebSphereAppServerbin WASService.exe -add CnxNode01 -serverNamenodeagent -profilePathd:ibmcnxwebsphereappserverprofilesCNXNode01 -stopArgs "-username wasadmin-passwordpassword-stopservers" -userid cnxtec -passwordpassword -encodeParams -restart true -startType automatic parsed to nodeAgent stops AppServer
Monitoring Policy • Each Application Server • Change Node restart state to "RUNNING" • Large deployment on Windows • Default timeout for service shutdown = 20 seconds • Increase Value at: HKEY_Local_Machine: SYSTEMCurrentControlSetControl WaitToKillServiceTimeout • Must set this to STOPPED before performing updates • Or use syncNode.bat|shafter applying the update 18
Directories & Synching • Prepare your LDAP • Better data within LDAP → better Profiles • Switching Authentication directories is possible • Need some planning • Dependencies • Quality of LDAP data • Plans to activate SPNEGO • Domino Mail Integration 19
Federated Repositories Best Practice • Leave the file based wasadmin with WebSphere Application Server • Fallback if LDAP Bind Credentials changed • Solving problems with Federated Repositories • Default does not allow this (you have to disable security to change configuration) Check this box 20
Logs – adjust language WebSphere • Change log language to English (IBM will love you for this) • WebSphere Add "-Duser.language=en –Duser.region=US" to Generic JVM arguments of • Each application server (Process definition – Java Virtual Machine) • dmgr (System Administration – Deployment Manager – Process Definition ...) • nodeagents (System Administration – Node agents – nodeagent – Process Def ...) 21
Logs – adjust language TDI 22 • TDI • edit ibmdisrv.bat|sh • add -Duser.language=en –Duser.region=US to LOG_4J variable • Linux: • Windows:
Rotate Logs • WebSphere Logs too small for Troubleshooting • Default: 5 Logs 1 MB each (SystemOut and SystemErr) • Better 5-10 Logs 20 MB each • Setting for each Application Server • remember Nodeagents and Dmgr • Change this as soon as your servers have been created 23
Rotate Logs • IBM Connections 5.5 – SET BY DEFAULT!! • Install.log • Result: • So your logs are stored 30 days, independent of size 24
Rotate IBM HTTP Server Logs • Default: no max size for access_log and error_log • Often some GB of Log files • Open with an Editor? • Disk size • Search for this lines in httpd.conf: • Comment out: CustomLog log/access_log common ErrorLog logs/error_log # CustomLog log/access_log common # ErrorLog logs/error_log 25
Rotate IBM HTTP Server Logs • Add: • Delete Log Files older than x days • Linux • Windows (Batch through Task Scheduler or Powershell) Linux: CustomLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/error_log.%Y%m%d 86400“ Windows: CustomLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/error_log.%Y%m%d 86400" crontab -e # Delete logfiles older than 3 days in logs 10 0 * * * find /opt/IBM/HTTPServer/logs/*_log.* -mtime +3 -exec rm -rf {} ; forfiles -p "D:IBMHTTPServerlogs" -s -m *_log.* -d -3 -c "cmd /c echo @file" 26
Rotate Logs DB2 • db2diag.log • Default: no maximum size • Default: %PROGRAMDATA%IBMDB2instancenameDB2 • Full C-Partition in Windows still hard to solve [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 0 [db2inst1@cnx-db2 ~]$ db2 update dbm cfg using DIAGSIZE 1024 DB20000I The UPDATE DATABASE MANAGER CONFIGURATION command completed successfully. [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 1024 27
HTTP Server Keystore 28 • Several Reviews showed • Keystore of WebSphere Plugin used for IHS SSL Key • Why is this worse? • What would you do when you get SSL Errors within Connections? • This overwrites plugin-key.kdb on your Webserver • SSL Key deleted • Backup?
HTTP Server Key store 29 • When you want to reuse Plugin Key store • Import SSL Key into CMSKeyStore • But never seen this in the wild
HTTP Server Keystore • Best Practice - Create a separate key store for IHS • Ikeyman will help you • Possible to use a wildcard • Then you can just copy it to use on dev / test machines • Backup the keystore before changes • Don’t activate “Expiration time” • “Stash password to a file” • Creates a cnx-key.sth file • Used by IHS to open keystore 30
Toronto, June 6-7 2016 Security
J2EE Roles • Some Applications are public readable after installation • Profiles • Communities • Blogs • Wikis • Check after Updates • Google: “Site:myconnections-host” • Should only show a login page • Use the Community Scripts to do this or change in the ISC 32
Harden HTTP • Disable SSLv2 / v3 • Automatically disabled with 8.5.5.4 • SSLProtocolDisableSSlv2 SSLv3 • Check with hydra, nmap or ssllabs.com/ssltest/ • Default httpd.conf uses: TLS_RSA_WITH_3DES_EDE_CBC_SHA # Ciphers TLS1.0, 1.1 SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA # Additional Ciphers TLS1.2 SSLCipherSpec TLS_RSA_WITH_AES_128_GCM_SHA256 SSLCipherSpec TLS_RSA_WITH_AES_256_GCM_SHA384 SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA256 SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA256 33
Harden HTTP • If you use SSL Keys longer than 2048 bit, you must replace Java policy • Download and replace Java (unrestricted) policy files • https://www-01.ibm.com/marketing/iwm/iwm/web/reg/pick.do?source=jcesdk • Also needed if Domino (Mail Integration) or Sametime Proxy use longer keys • Remove Server Information (HTTP Header, Error pages) • ServerSignature Off • ServerTokens Prod (DEFAULT) • AddServerHeader Off Default 34
Remove Index • Remove all Files except index.html from <IHS_ROOT>/htdocs • Rename index.html (e.g. 0815.html) • echo 1 > 0815.html • For testing you can access the file • Add robots.txt 35
Toronto, June 6-7 2016 Tuning
Performance Tuning Guides • 4.0 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tunin g_Guide • 4.5 Addendum • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tunin g_Guide_Addendum • 5.0 CR1 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide • Read everything carefully • check and understand dependencies 37
Worst Practise Example - Tuning • Customer showed me a system with following infrastructure • WebSphere • Large deployment • 16 GB RAM • 4 Cores • DB2 • 12 instances • 8 GB RAM • 4 Cores • Connections restart 22 minutes Web Server ihs.example.local WebSphere was1.example.local Db2 / TDI db2.example.local Freigabe LDAP domino1.example.local User SynchronisationAuthentication 38
Solving the problem • Large deployment means about 15 JVM on the machine • Restart shows 15 min 100% CPU usage • Adding 4 cores and restart time get down to 7 minutes • Other option would be midsize deployment, but then you have to reinstall Connections • Java Heap Sizes set to default (256 MB and 768 MB) -> increase to 1.5 – 2.5 GB • Perf Guide mentions that multiple instances on DB2 only increase performance with enough resources • But that was not the real problem • DataSource connectionPool Sizes are set to Default 1/10 • Increase this values to the proposals in the guide and ... • Restart time comes down under 3 minutes • Key point: read the complete guide 39
Java Heap • Default Java Heap Sizes on Midsize Deployment: 2506 MB / application server • Large Deployment depends on application: 0.5 to 2.5 GB • Main point in memory tuning • Never exceed the system memory • Swapping kills all your tuning efforts • Counting the JVM Heap sizes is not enough • Maximum heap is not the maximum amount of memory the jvm uses! • Libraries, jars and so on count additional to memory usage • JVM memory usage may be 3 * JVM maximum Heap • Initial and maximum Heap Size should be equalized • mentioned in IBM Connections 5.0 tuning guide 40
IBM HTTP Server • Enable compression • Important !!!!! • See Slides from BP307 - IBM Connect 2014 • Save up to 70% network traffic • Minimal increase of CPU load • Enable file download through IHS • Depend on your deployment • Often security forbids storage access from DMZ • If you have no access to file share from IHS -> Files should be installed in a separate Cluster 41
Midsize Deployment Files • Often IHS positioned in the red zone (DMZ) • Mostly No Access to SHARED DIRECTORY • Create a Cluster for Files • No Problem with Large Deployments • With Midsize you can add an additional Cluster during Setup (Looks different on Connections 5.5!) http://www-01.ibm.com/support/docview.wss?uid=swg21317658 42
Activate Synchronous File transfer • Servers -> Application Servers -> serverName -> Web Container Settings -> Web Container -> Custom Properties • com.ibm.ws.webcontainer.channelwritetype=sync 43
Toronto, June 6-7 2016 Enhance User experience Happy admins with happy users
Single Sign On - LtpaToken 45 • Single Sign On within IBM portfolio • Domino only supports one domain per Web SSO Document • You can copy & paste Web SSO Documents and change Domain names (see e.g. Paul Mooney - AdminBlast 2012 – Tip #4 • DNS Domain is multi value (works until Domino 8.5.x, but not with Domino 9.x) • Servers with mixed Internet Site and Non-Internet Site usage: copy & paste too! • Often internal servers use local domains, when Connections is external accessible SSO needs workaround • adding additional hostnames to domino • You can use IHS (IBM HTTP Server) as a reverse proxy to access iNotes
Single Sign On - LtpaToken 46 • It’s possible but not recommended to change the cookie name • Default one are • LtpaToken • LtpaToken2 • Name dependencies • Web-SSO document name for Domino • Web SSO within WebSphere • sametime.ini • ST_TOKEN_TYPE=CustomLtpaName • Connections scheduler
Single Sign On - SPNEGO 47 • Requirements • Windows 2003 / 2008 / 2012 Active Directory • Configure use documentation and http://de.slideshare.net/david_hay/dave-hay-desktop-single-signon- in-an-active-directory-world?related=1 • Real additional value for users • Easy to deploy, when you have the rights and clue what to do • Do not test Browser Single Sign On with Chrome, because process does not end when you close the last window • Tip: SPNEGO is not working with a SPN which is a CNAME DNS alias
Mail integration 48 • Use IBM HTTP Server as reverse proxy to access iNotes LoadModule rewrite_module modules/mod_rewrite.so <IfModule mod_ibm_ssl.c> Listen 0.0.0.0:1443 <VirtualHost *:1443> ServerName connections.example.com SSLEnable RewriteEngine on ProxyRequests Off ProxyPass / http://inotes.example.local/ ProxyPassReverse / http://inotes.example.local/ </VirtualHost> </IfModule>
iNotes Web Mail Redirect 49 https://connections.example.com:1443
Socialmail-config.xml 50 • When you use reverse proxy to access iNotes • Mail integration works only when you use http or https • Add UseConfiguredProtocolto your configuration • Problem when you need to access multiple iNotes Servers <ServerConfig name="domino-redirect"> <ConfigType>REDIRECT</ConfigType> <RedirectURL>https://connections.example.com:1443/iwaredir.nsf</RedirectURL> <MailPattern type="example.com" /> </ServerConfig> <GadgetConfig> <GadgetPreference id="UseConfiguredProtocol">true</GadgetPreference> </GadgetConfig>
Mail integration and SPNEGO 51 • LtpaToken contains AD $DN • Lookup in Domino Directory with this DN -> user is not allowed to open mail • Solution • Add AD $DN to ACL • Or add AD $DN to Domino Fullname (AD DN contains , as delimiter between ou) • Or: • http://tdiblog.anderls.com/2015/02/adding-user-active-directory.html • Thanks Andreas Artner
Toronto, June 6-7 2016 Backup
What to Backup • Using an example Connections installation guide rarely explains backups • These guides normally do not mention backup, or what to back up • Disk crash means data loss • Database backups through file backup are not supported and mostly not restorable • Important!!! • Database Backup through Online Backups can be taken when Connections is up • Offline backups are also possible • Ensure the file system & DB backup are run at the same time of day • DB and Filesystem data will stay in sync – if you take your DB backup at midnight and the file system at midday they will be out of sync 53
Backup • Most important (minimum daily) • Databases (offline or online) • Shared content • Important • Configuration • WebSphere Application Server • Connections • IBM HTTP Server • TDI Solution • Test if restore is possible!!!! • Several issues with WebSphere restores, where binaries weren't on the tape 54
Toronto, June 6-7 2016 Checklists
Checklist Do • Document your installation steps • The official documentation is sometimes confusing, because all OS within one document • Use a LDAP user for connectionsAdmin • Be prepared for scaling • Shared directory on UNC path • No small deployment installations • Tune your environment • READ THE DOCUMENTATION!!!! Don’t • Use multiple instances DB2 with small resources • Install on a single machine (unless the environment is very small or for test) • Copy customizations to newer versions • jsp, ftl copy will break something • Use unstable file shares • Test deployment with server IE • Test with only one language 56
Install Checklist • WebSphere Application Server • Configure Federated Repository • LtpaToken, enable security • WebSphere Application Server Supplements (IHS, Plugins) • DB2 (or other DBM) • TDI • Add Webserver to Dmgr (use configurewebserver.bat) • Enable SSL on IHS • Import IHS Root Key within WebSphere cell trust keystore (retrieve from port) • Configure CCM • Install optional Addonslike Forms Experience Builder, IBM Docs, Cognos 57
Documentation Document EVERYTHING !!! because you can remember everything you did …. 58
Documentation • Everyone hates writing documentation • BUT – make notes as you go, it doesn’t need to be a full step by step guide with screenshots • Document all customizataions • Any additional changes made • Anything of note that deviates from the guides • Lessons learnt or how you solved issues • Use the scripts to output some of it 59
Toronto, June 6-7 2016 Resources
Useful Tools • Editor with syntax highlighting • vim, geany • notepad++, pspad, UltraEdit • Tail • baretail • multitail • mtail • Proxy • Fiddler (often asked for by IBM Support) • Burpsuite (intercept proxy) • Browser • Firefox (portable) / Firefox ESR • Chrome • IE (download vm with different versions) • https://www.modern.ie • Network analyzer • Wireshark • tcpdump • Unzip / Unarchiver • 7-zip • WinRar 61
Links and References • IBM Connections System Requirements • http://www-01.ibm.com/support/docview.wss?uid=swg27012786 • IBM Connections Family Documentation • http://www.ibm.com/support/knowledgecenter/SSYGQH/welcome • IBM Connections 4 Performance Tuning Guide • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tuning_Guide • IBM Connections 4.5 Performance Tuning Guide Addendum • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tuning_Guide_Addendum • IBM Connections 5 CR1 Performance Tuning Guide • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide 62
Useful Blogs • http://ibmconnections.com • http://turtleblog.info • http://portal2portal.blogspot.de • https://www.urspringer.de • http://socialconnections.info • http://blog.robertfarstad.com • http://www.curiousmitch.com • http://www.ramsit.com/category/blog • http://techblog.gis-ag.info • https://milanmatejic.wordpress.com • http://ibmdocs.com • http://domino.elfworld.org • https://dontforgetthe0.com • http://dilf.me.uk/socialshazza • http://www.stoeps.de • http://scripting101.org • http://meisenzahl.org • http://martin.leyrer.priv.at • http://kbild.ch • http://www.notesgoddess.net • http://www.dominodiva.com • http://notesbusters.com • https://rob59blog.wordpress.com • http://connections101.info • http://brandlrainer.blogspot.de • https://collaborationben.com 63
Thank you very much for your attention! panagenda GmbH – Make Your Data Work for You Lahnstr. 17 ● 64646 Heppenheim (Germany) Skype: christophstoettner ● Cell: +49 173 8588719 E-Mail: christoph.stoettner@panagenda.com Christoph Stoettner Senior Consultant panagenda GmbH – Make Your Data Work for You Lahnstr. 17 ● 64646 Heppenheim (Germany) Skype: nico.meisenzahl ● Cell: +49 170 7355081 E-Mail: nico.meisenzahl@panagenda.com Nico Meisenzahl Consultant 64
PLATINUM & SPOTLIGHT SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS

More Related Content

PDF
IBM Connections administration – keep your systems running the right way
LetsConnect
 
PPTX
Best And Worst Practices Deploying IBM Connections
LetsConnect
 
PPTX
AdminCamp 2017 - IBM Connections Adminblast
Nico Meisenzahl
 
PPTX
IBM Connections Adminblast - Connect17 (DEV 1268)
Nico Meisenzahl
 
PDF
Your App deserves more – The Art of App Modernization
Christian Güdemann
 
PDF
Best and worst practices deploying IBM Connections
LetsConnect
 
PDF
IBM Connections Troubleshooting or “Get the Cow off the Ice”
LetsConnect
 
PPTX
Webinar: IBM Connections Adminblast
Nico Meisenzahl
 
IBM Connections administration – keep your systems running the right way
LetsConnect
 
Best And Worst Practices Deploying IBM Connections
LetsConnect
 
AdminCamp 2017 - IBM Connections Adminblast
Nico Meisenzahl
 
IBM Connections Adminblast - Connect17 (DEV 1268)
Nico Meisenzahl
 
Your App deserves more – The Art of App Modernization
Christian Güdemann
 
Best and worst practices deploying IBM Connections
LetsConnect
 
IBM Connections Troubleshooting or “Get the Cow off the Ice”
LetsConnect
 
Webinar: IBM Connections Adminblast
Nico Meisenzahl
 

What's hot (19)

PPTX
Social Connections 12 - IBM Connections Adminblast
Nico Meisenzahl
 
PPTX
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
PDF
Victor Toal - IBM Connections: So you have it installed – now what?
LetsConnect
 
PPTX
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Nico Meisenzahl
 
PPTX
Soccnx10: IBM Connections Troubleshooting or “Get the Cow off the Ice”
panagenda
 
PDF
IBM Think 2018 - IBM Connections Troubleshooting
Nico Meisenzahl
 
PDF
Sutol How To Be A Lion Tamer
Sharon James
 
PPTX
SUTOL 2016: IBM Connections Deployment Best and Worst Practices
panagenda
 
PDF
Sutol - A Hitchhiker’s Guide to troubleshooting IBM Connections
Sharon James
 
PDF
Connections Migrations the easy way Soccnx10
Sharon James
 
PDF
be the captain of your connections deployment
Sharon James
 
PDF
Webinar: IBM Connections Adminblast
panagenda
 
PDF
1050: TDI Solutions Best Practises with IBM Connections Deployments - IBM Con...
panagenda
 
PDF
What We Wish We Had Known: Becoming an IBM Connections Administrator
Gabriella Davis
 
PDF
Planning & Completing An IBM Connections Upgrade
Gabriella Davis
 
PDF
June OpenNTF Webinar - Domino V12 Certification Manager
Howard Greenberg
 
PDF
IBM Connect 2016 - 60+ in 60 - Admin Tips Power Hour
Chris Miller
 
PDF
Web Performance First Aid
Alan Seiden
 
PDF
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
Social Connections 12 - IBM Connections Adminblast
Nico Meisenzahl
 
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
Victor Toal - IBM Connections: So you have it installed – now what?
LetsConnect
 
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Nico Meisenzahl
 
Soccnx10: IBM Connections Troubleshooting or “Get the Cow off the Ice”
panagenda
 
IBM Think 2018 - IBM Connections Troubleshooting
Nico Meisenzahl
 
Sutol How To Be A Lion Tamer
Sharon James
 
SUTOL 2016: IBM Connections Deployment Best and Worst Practices
panagenda
 
Sutol - A Hitchhiker’s Guide to troubleshooting IBM Connections
Sharon James
 
Connections Migrations the easy way Soccnx10
Sharon James
 
be the captain of your connections deployment
Sharon James
 
Webinar: IBM Connections Adminblast
panagenda
 
1050: TDI Solutions Best Practises with IBM Connections Deployments - IBM Con...
panagenda
 
What We Wish We Had Known: Becoming an IBM Connections Administrator
Gabriella Davis
 
Planning & Completing An IBM Connections Upgrade
Gabriella Davis
 
June OpenNTF Webinar - Domino V12 Certification Manager
Howard Greenberg
 
IBM Connect 2016 - 60+ in 60 - Admin Tips Power Hour
Chris Miller
 
Web Performance First Aid
Alan Seiden
 
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
Ad

Viewers also liked (18)

PDF
IBM CONNECTIONS TROUBLESHOOTING OR “GET THE COW OFF THE ICE"
Nico Meisenzahl
 
PPTX
IBM Connect 2016: 1402 - Getting Technically Cozy with IBM Connections Cloud ...
David Simpson
 
PDF
IBM Chat/Sametime Migration (CCTY 2016 Munich)
Novakenstein
 
PDF
No, I’m not retired!
LetsConnect
 
PPTX
Herding Presidents (and others) to the Promised Land
LetsConnect
 
PDF
Soccnx10 Man versus Machine – A Story About Embracing Innovation
Femke Goedhart
 
PPTX
IBM Connections Antipatterns
LetsConnect
 
PPTX
Confessions of a Connections Addict
LetsConnect
 
PDF
Connections Upgrades and Migrations the Easy Way
LetsConnect
 
PPTX
OpenNTF: Past, Present, and Future
LetsConnect
 
PDF
How Designing IBM Verse Led Us to a New Way to Work
LetsConnect
 
PDF
10 insights to foster enterprise social networking, that you already know
LetsConnect
 
PPTX
Verisure Securitas Direct: On our fourth year in the Cloud! What has it been ...
LetsConnect
 
PDF
Change behavior, one Tiny Habit at a time
Sasja Beerendonk
 
PPTX
Lowe’s Journey with Becoming a Collaborative Company
LetsConnect
 
PDF
Are You Ready for an Alternative in Application Development?
LetsConnect
 
PPTX
Humanising Cognitive Systems
LetsConnect
 
PPTX
From Social What to Social WOW! How to design social user experiences that ma...
LetsConnect
 
IBM CONNECTIONS TROUBLESHOOTING OR “GET THE COW OFF THE ICE"
Nico Meisenzahl
 
IBM Connect 2016: 1402 - Getting Technically Cozy with IBM Connections Cloud ...
David Simpson
 
IBM Chat/Sametime Migration (CCTY 2016 Munich)
Novakenstein
 
No, I’m not retired!
LetsConnect
 
Herding Presidents (and others) to the Promised Land
LetsConnect
 
Soccnx10 Man versus Machine – A Story About Embracing Innovation
Femke Goedhart
 
IBM Connections Antipatterns
LetsConnect
 
Confessions of a Connections Addict
LetsConnect
 
Connections Upgrades and Migrations the Easy Way
LetsConnect
 
OpenNTF: Past, Present, and Future
LetsConnect
 
How Designing IBM Verse Led Us to a New Way to Work
LetsConnect
 
10 insights to foster enterprise social networking, that you already know
LetsConnect
 
Verisure Securitas Direct: On our fourth year in the Cloud! What has it been ...
LetsConnect
 
Change behavior, one Tiny Habit at a time
Sasja Beerendonk
 
Lowe’s Journey with Becoming a Collaborative Company
LetsConnect
 
Are You Ready for an Alternative in Application Development?
LetsConnect
 
Humanising Cognitive Systems
LetsConnect
 
From Social What to Social WOW! How to design social user experiences that ma...
LetsConnect
 
Ad

Similar to BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS (20)

PDF
Bp307 Practical Solutions for Connections Administrators, tips and scrips for...
Sharon James
 
PDF
Connections install in 45 mins
Sharon James
 
PDF
Tip from ConnectED 2015: Best and Worst Practices Deploying IBM Connections
SocialBiz UserGroup
 
PDF
Sa106 – practical solutions for connections administrators
Sharon James
 
PDF
Practical solutions for connections administrators
Sharon James
 
PDF
Practical solutions for connections administrators lite
Sharon James
 
PDF
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
PDF
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
PDF
IBM Connections Adminblast - Soccnx 12 Edition
panagenda
 
PDF
IBM Connections Adminblast
LetsConnect
 
PDF
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
PDF
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
PPTX
DEV-1269: Best and Worst Practices for Deploying IBM Connections – IBM Conne...
panagenda
 
PDF
Adm02. IBM Connections Adminblast
panagenda
 
PDF
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
siwbramy
 
PDF
A Hitchhiker's Guide to troubleshooting IBM Connections
ICON UK EVENTS Limited
 
PDF
A hitchhiker’s guide to troubleshooting ibm connections
Sharon James
 
PPTX
The Dev-Admin Chimera: Customising Connections (with Gab Davis)
Mark Myers
 
ODP
Debugging IBM Connections for the Impatient Admin - Social Connections VII
Martin Leyrer
 
PDF
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
bzdgohgye641
 
Bp307 Practical Solutions for Connections Administrators, tips and scrips for...
Sharon James
 
Connections install in 45 mins
Sharon James
 
Tip from ConnectED 2015: Best and Worst Practices Deploying IBM Connections
SocialBiz UserGroup
 
Sa106 – practical solutions for connections administrators
Sharon James
 
Practical solutions for connections administrators
Sharon James
 
Practical solutions for connections administrators lite
Sharon James
 
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
IBM Connections Adminblast - Soccnx 12 Edition
panagenda
 
IBM Connections Adminblast
LetsConnect
 
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
DEV-1269: Best and Worst Practices for Deploying IBM Connections – IBM Conne...
panagenda
 
Adm02. IBM Connections Adminblast
panagenda
 
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
siwbramy
 
A Hitchhiker's Guide to troubleshooting IBM Connections
ICON UK EVENTS Limited
 
A hitchhiker’s guide to troubleshooting ibm connections
Sharon James
 
The Dev-Admin Chimera: Customising Connections (with Gab Davis)
Mark Myers
 
Debugging IBM Connections for the Impatient Admin - Social Connections VII
Martin Leyrer
 
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
bzdgohgye641
 

More from Nico Meisenzahl (20)

PDF
Cloud-Native & Sustainability: How and Why to Build Sustainable Workloads
Nico Meisenzahl
 
PDF
Container Day Security: How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
PDF
Festive Tech Calendar: Festive time with AKS networking
Nico Meisenzahl
 
PDF
ContainerConf 2022: Hijack Kubernetes
Nico Meisenzahl
 
PDF
ContainerConf 2022: Kubernetes is awesome - but...
Nico Meisenzahl
 
PDF
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
PDF
KCD Munich 2022: Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
PDF
Cloud Love Conference: Kubernetes is awesome, but...
Nico Meisenzahl
 
PDF
How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
PDF
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
PPTX
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
PDF
Azure Zürich User Group: Azure Kubernetes Service – more than just a managed ...
Nico Meisenzahl
 
PDF
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
PDF
azdevcom - Hijack a Kubernetes Cluster
Nico Meisenzahl
 
PDF
Continuous Lifecycle: Enhance Your Compliance and Governance With Policy-Base...
Nico Meisenzahl
 
PDF
Continuous Lifecycle: Hijack Kubernetes
Nico Meisenzahl
 
PDF
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
PDF
GitLab Commit: Enhance your Compliance with Policy-Based CI/CD
Nico Meisenzahl
 
PDF
Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure
Nico Meisenzahl
 
PDF
Microsoft DevOps Forum 2021 – DevOps & Security
Nico Meisenzahl
 
Cloud-Native & Sustainability: How and Why to Build Sustainable Workloads
Nico Meisenzahl
 
Container Day Security: How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
Festive Tech Calendar: Festive time with AKS networking
Nico Meisenzahl
 
ContainerConf 2022: Hijack Kubernetes
Nico Meisenzahl
 
ContainerConf 2022: Kubernetes is awesome - but...
Nico Meisenzahl
 
KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
KCD Munich 2022: Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
Cloud Love Conference: Kubernetes is awesome, but...
Nico Meisenzahl
 
How to Prevent Your Kubernetes Cluster From Being Hacked
Nico Meisenzahl
 
Container Days: Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
Azure Zürich User Group: Azure Kubernetes Service – more than just a managed ...
Nico Meisenzahl
 
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
azdevcom - Hijack a Kubernetes Cluster
Nico Meisenzahl
 
Continuous Lifecycle: Enhance Your Compliance and Governance With Policy-Base...
Nico Meisenzahl
 
Continuous Lifecycle: Hijack Kubernetes
Nico Meisenzahl
 
Hijack a Kubernetes Cluster - a Walkthrough
Nico Meisenzahl
 
GitLab Commit: Enhance your Compliance with Policy-Based CI/CD
Nico Meisenzahl
 
Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure
Nico Meisenzahl
 
Microsoft DevOps Forum 2021 – DevOps & Security
Nico Meisenzahl
 

Recently uploaded (20)

PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PPTX
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Approach and Philosophy of On baking technology
30anthuong17
 
Cloud computing and distributed systems.
kkkkkhan
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Teaching material agriculture food technology
LiaRayya
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 

BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS

  • 1. Toronto, June 6-7 2016 Best and Worst Practices Deploying IBM Connections Christoph Stoettner Nico Meisenzahl
  • 3. Christoph Stoettner • Senior Consultant – panagenda • IBM Notes / Domino since 1999 • IBM Connections since version 2.5 / 2009 • Many years of experience in: • Migrations • Administration und installs • Performance analysis • Joined panagenda in 2015 focusing in: • IBM Connections deployment und optimization • IBM Connections monitoring • Husband of one & father of two, Bavarian 3  @stoeps  linkedin.com/in/christophstoettner  www.stoeps.de  christophstoettner  +49 173 8588719 christoph.stoettner@panagenda.com
  • 4. Nico Meisenzahl • Consultant at panagenda • IBM Notes / Domino since 2008 • IBM Connections since version 3.0 / 2010 • Many years of experience in: • Consulting • Migrations & Administration • Joined panagenda in 2016 focusing in: • IBM Connections Consulting • ICS deployment & optimization 4  @nmeisenzahl  linkedin.com/in/nicomeisenzahl  meisenzahl.org  nico.meisenzahl  +49 170 7355081 nico.meisenzahl@panagenda.com
  • 5. IBM Connections Request Flow 5 Databases WebSphere Application Server IBM HTTP ServerWebSphere Plugins Application DBsPEOPLEDB LDAP Server TDI Forward to Application Server and Port (Load balancing and Failover) Redirect unknown URL Upload and Download of Files, Attachments Common: Access Customization, Webressources Read and Write Authentication Users / Groups Reads Userdata for Profiles Create, Update, Delete and Inactivate Profiles Shared Directory Link to Attachments Profile changes synchronize to Membertables through JMS Queue Optional: Direct Access to Attachments
  • 6. Toronto, June 6-7 2016 Installation & Requirements
  • 7. System Requirements • Regularly check requirement documents • All versions • http://short.stoeps.de/vwzrv • IBM Connections 5 • http://short.stoeps.de/mspdi • IBM Connections 5.5 • http://short.stoeps.de/cnx55sysreq • Check all notes, Download PDF Connections 5.0 CR3 Connections 5.5 Connections 5.5 CR1 7
  • 8. System Requirements 8 • Be careful with installation documents • Sometimes wrong dependencies mentioned • Supported statement does not mean it’s licensed • http://www-01.ibm.com/support/docview.wss?uid=swg21683118 • Supported: DB2 10.5 FP4 -> but Connections 5.0 License Agreement: • You will not find a DB2 10.5 license in your PA Account
  • 9. Sizing • Be prepared for future growth • Do not overact • A few hundred users doesn’t mean you need a large deployment • Not fans of multi-instance database machines • If I run in database performance issues I split the databases to different machines • Performance tuning guide • Multi-instance is best practice, if you have enough resources Performance Tuning Guide 5CR1 – page 10 9
  • 10. Sizing • A word on requirements • 4 | 8 GB memory minimum is often too less, better to start with 10 or 12 GB • Memory swapping kills all tuning efforts • CPU cores • 2 cores minimum only on small deployments • Thumb rule: calculate one core for each jvm (expensive with PVU license) • Disk • Using network storage or virtualized servers • Easier to extend Connections 5.0Connections 5.5 10
  • 11. Prepare for your Installation • Download all software packages • Check System Requirements! • Paths shouldn't contain spaces • No spaces in source and destination folders • Use a dedicated administration user • Especially on Windows avoid users with applied group policies • If possible disable User Account Control (UAC) • Run all Installer and Scripts with option “Run As Administrator” 11
  • 12. Security Settings • During installation you should disable all "Security" Software • SELinux • AppArmor • Antivirus • Firewalls • Self developed scripts and extensions • It's not fun, when a script deletes databases, because you forgot to add the directory to the script exclusions 12
  • 13. Operating System specific settings - Linux 13 • Different operating systems need special settings • Always use the operating system where you have the best skills • Linux • /etc/security/limits.conf • Increase nofile and nproc (see tuning guides) • Example from tuning guide • Default nproc (max number of processes) for user root 2047 • You can extend the nproc with ulimit –p up to 16384 (e.g. within .bashrc or .profile) • Or set soft and hard limit to equal sizes, avoids additional changes with profile root soft nproc 2047 root hardnproc 16384
  • 14. Operating System specific settings - Windows 14 • Always use UNC path as Shared Directory • Easier to add additional WebSphere Nodes for failover or load balancing • WebSphere services • Technical user account • Enable “Password never expires” • Disable “Must change password on next login” • Default: LocalSystem has no network access • Check access rights on Shared Directory
  • 15. Network • Name lookup / DNS • All servers must be resolvable (hosts is not a suitable workaround) • Knowing the protocol • Avoid Round Robin • No Authentication failover in WebSphere with Round Robin! • Network storage (file locking is important) • NFS v4 / SMB|CIFS • No DFS • Reverse Proxies / Proxies • Always test your deployment without proxies • Activate after successful testing 15
  • 16. Register WAS as a service • Register WAS as a service • Services for Deployment Manager and NodeAgent(s) • wasservice.bat|sh • Map service to a technical user • any Active Directory User is possible • allowed to read / write network share with Shared Content • Service can parse commands to nodeagent • -stopArgs "<NA commands>" • Configure monitoring policy (if required) 16
  • 17. WasService.bat|sh – Register service 17 cd D:IBMCNXWebSphereAppServerbin WASService.exe -add CnxNode01 -serverNamenodeagent -profilePathd:ibmcnxwebsphereappserverprofilesCNXNode01 -stopArgs "-username wasadmin-passwordpassword-stopservers" -userid cnxtec -passwordpassword -encodeParams -restart true -startType automatic parsed to nodeAgent stops AppServer
  • 18. Monitoring Policy • Each Application Server • Change Node restart state to "RUNNING" • Large deployment on Windows • Default timeout for service shutdown = 20 seconds • Increase Value at: HKEY_Local_Machine: SYSTEMCurrentControlSetControl WaitToKillServiceTimeout • Must set this to STOPPED before performing updates • Or use syncNode.bat|shafter applying the update 18
  • 19. Directories & Synching • Prepare your LDAP • Better data within LDAP → better Profiles • Switching Authentication directories is possible • Need some planning • Dependencies • Quality of LDAP data • Plans to activate SPNEGO • Domino Mail Integration 19
  • 20. Federated Repositories Best Practice • Leave the file based wasadmin with WebSphere Application Server • Fallback if LDAP Bind Credentials changed • Solving problems with Federated Repositories • Default does not allow this (you have to disable security to change configuration) Check this box 20
  • 21. Logs – adjust language WebSphere • Change log language to English (IBM will love you for this) • WebSphere Add "-Duser.language=en –Duser.region=US" to Generic JVM arguments of • Each application server (Process definition – Java Virtual Machine) • dmgr (System Administration – Deployment Manager – Process Definition ...) • nodeagents (System Administration – Node agents – nodeagent – Process Def ...) 21
  • 22. Logs – adjust language TDI 22 • TDI • edit ibmdisrv.bat|sh • add -Duser.language=en –Duser.region=US to LOG_4J variable • Linux: • Windows:
  • 23. Rotate Logs • WebSphere Logs too small for Troubleshooting • Default: 5 Logs 1 MB each (SystemOut and SystemErr) • Better 5-10 Logs 20 MB each • Setting for each Application Server • remember Nodeagents and Dmgr • Change this as soon as your servers have been created 23
  • 24. Rotate Logs • IBM Connections 5.5 – SET BY DEFAULT!! • Install.log • Result: • So your logs are stored 30 days, independent of size 24
  • 25. Rotate IBM HTTP Server Logs • Default: no max size for access_log and error_log • Often some GB of Log files • Open with an Editor? • Disk size • Search for this lines in httpd.conf: • Comment out: CustomLog log/access_log common ErrorLog logs/error_log # CustomLog log/access_log common # ErrorLog logs/error_log 25
  • 26. Rotate IBM HTTP Server Logs • Add: • Delete Log Files older than x days • Linux • Windows (Batch through Task Scheduler or Powershell) Linux: CustomLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/error_log.%Y%m%d 86400“ Windows: CustomLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/error_log.%Y%m%d 86400" crontab -e # Delete logfiles older than 3 days in logs 10 0 * * * find /opt/IBM/HTTPServer/logs/*_log.* -mtime +3 -exec rm -rf {} ; forfiles -p "D:IBMHTTPServerlogs" -s -m *_log.* -d -3 -c "cmd /c echo @file" 26
  • 27. Rotate Logs DB2 • db2diag.log • Default: no maximum size • Default: %PROGRAMDATA%IBMDB2instancenameDB2 • Full C-Partition in Windows still hard to solve [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 0 [db2inst1@cnx-db2 ~]$ db2 update dbm cfg using DIAGSIZE 1024 DB20000I The UPDATE DATABASE MANAGER CONFIGURATION command completed successfully. [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 1024 27
  • 28. HTTP Server Keystore 28 • Several Reviews showed • Keystore of WebSphere Plugin used for IHS SSL Key • Why is this worse? • What would you do when you get SSL Errors within Connections? • This overwrites plugin-key.kdb on your Webserver • SSL Key deleted • Backup?
  • 29. HTTP Server Key store 29 • When you want to reuse Plugin Key store • Import SSL Key into CMSKeyStore • But never seen this in the wild
  • 30. HTTP Server Keystore • Best Practice - Create a separate key store for IHS • Ikeyman will help you • Possible to use a wildcard • Then you can just copy it to use on dev / test machines • Backup the keystore before changes • Don’t activate “Expiration time” • “Stash password to a file” • Creates a cnx-key.sth file • Used by IHS to open keystore 30
  • 31. Toronto, June 6-7 2016 Security
  • 32. J2EE Roles • Some Applications are public readable after installation • Profiles • Communities • Blogs • Wikis • Check after Updates • Google: “Site:myconnections-host” • Should only show a login page • Use the Community Scripts to do this or change in the ISC 32
  • 33. Harden HTTP • Disable SSLv2 / v3 • Automatically disabled with 8.5.5.4 • SSLProtocolDisableSSlv2 SSLv3 • Check with hydra, nmap or ssllabs.com/ssltest/ • Default httpd.conf uses: TLS_RSA_WITH_3DES_EDE_CBC_SHA # Ciphers TLS1.0, 1.1 SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA # Additional Ciphers TLS1.2 SSLCipherSpec TLS_RSA_WITH_AES_128_GCM_SHA256 SSLCipherSpec TLS_RSA_WITH_AES_256_GCM_SHA384 SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA256 SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA256 33
  • 34. Harden HTTP • If you use SSL Keys longer than 2048 bit, you must replace Java policy • Download and replace Java (unrestricted) policy files • https://www-01.ibm.com/marketing/iwm/iwm/web/reg/pick.do?source=jcesdk • Also needed if Domino (Mail Integration) or Sametime Proxy use longer keys • Remove Server Information (HTTP Header, Error pages) • ServerSignature Off • ServerTokens Prod (DEFAULT) • AddServerHeader Off Default 34
  • 35. Remove Index • Remove all Files except index.html from <IHS_ROOT>/htdocs • Rename index.html (e.g. 0815.html) • echo 1 > 0815.html • For testing you can access the file • Add robots.txt 35
  • 36. Toronto, June 6-7 2016 Tuning
  • 37. Performance Tuning Guides • 4.0 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tunin g_Guide • 4.5 Addendum • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tunin g_Guide_Addendum • 5.0 CR1 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide • Read everything carefully • check and understand dependencies 37
  • 38. Worst Practise Example - Tuning • Customer showed me a system with following infrastructure • WebSphere • Large deployment • 16 GB RAM • 4 Cores • DB2 • 12 instances • 8 GB RAM • 4 Cores • Connections restart 22 minutes Web Server ihs.example.local WebSphere was1.example.local Db2 / TDI db2.example.local Freigabe LDAP domino1.example.local User SynchronisationAuthentication 38
  • 39. Solving the problem • Large deployment means about 15 JVM on the machine • Restart shows 15 min 100% CPU usage • Adding 4 cores and restart time get down to 7 minutes • Other option would be midsize deployment, but then you have to reinstall Connections • Java Heap Sizes set to default (256 MB and 768 MB) -> increase to 1.5 – 2.5 GB • Perf Guide mentions that multiple instances on DB2 only increase performance with enough resources • But that was not the real problem • DataSource connectionPool Sizes are set to Default 1/10 • Increase this values to the proposals in the guide and ... • Restart time comes down under 3 minutes • Key point: read the complete guide 39
  • 40. Java Heap • Default Java Heap Sizes on Midsize Deployment: 2506 MB / application server • Large Deployment depends on application: 0.5 to 2.5 GB • Main point in memory tuning • Never exceed the system memory • Swapping kills all your tuning efforts • Counting the JVM Heap sizes is not enough • Maximum heap is not the maximum amount of memory the jvm uses! • Libraries, jars and so on count additional to memory usage • JVM memory usage may be 3 * JVM maximum Heap • Initial and maximum Heap Size should be equalized • mentioned in IBM Connections 5.0 tuning guide 40
  • 41. IBM HTTP Server • Enable compression • Important !!!!! • See Slides from BP307 - IBM Connect 2014 • Save up to 70% network traffic • Minimal increase of CPU load • Enable file download through IHS • Depend on your deployment • Often security forbids storage access from DMZ • If you have no access to file share from IHS -> Files should be installed in a separate Cluster 41
  • 42. Midsize Deployment Files • Often IHS positioned in the red zone (DMZ) • Mostly No Access to SHARED DIRECTORY • Create a Cluster for Files • No Problem with Large Deployments • With Midsize you can add an additional Cluster during Setup (Looks different on Connections 5.5!) http://www-01.ibm.com/support/docview.wss?uid=swg21317658 42
  • 43. Activate Synchronous File transfer • Servers -> Application Servers -> serverName -> Web Container Settings -> Web Container -> Custom Properties • com.ibm.ws.webcontainer.channelwritetype=sync 43
  • 44. Toronto, June 6-7 2016 Enhance User experience Happy admins with happy users
  • 45. Single Sign On - LtpaToken 45 • Single Sign On within IBM portfolio • Domino only supports one domain per Web SSO Document • You can copy & paste Web SSO Documents and change Domain names (see e.g. Paul Mooney - AdminBlast 2012 – Tip #4 • DNS Domain is multi value (works until Domino 8.5.x, but not with Domino 9.x) • Servers with mixed Internet Site and Non-Internet Site usage: copy & paste too! • Often internal servers use local domains, when Connections is external accessible SSO needs workaround • adding additional hostnames to domino • You can use IHS (IBM HTTP Server) as a reverse proxy to access iNotes
  • 46. Single Sign On - LtpaToken 46 • It’s possible but not recommended to change the cookie name • Default one are • LtpaToken • LtpaToken2 • Name dependencies • Web-SSO document name for Domino • Web SSO within WebSphere • sametime.ini • ST_TOKEN_TYPE=CustomLtpaName • Connections scheduler
  • 47. Single Sign On - SPNEGO 47 • Requirements • Windows 2003 / 2008 / 2012 Active Directory • Configure use documentation and http://de.slideshare.net/david_hay/dave-hay-desktop-single-signon- in-an-active-directory-world?related=1 • Real additional value for users • Easy to deploy, when you have the rights and clue what to do • Do not test Browser Single Sign On with Chrome, because process does not end when you close the last window • Tip: SPNEGO is not working with a SPN which is a CNAME DNS alias
  • 48. Mail integration 48 • Use IBM HTTP Server as reverse proxy to access iNotes LoadModule rewrite_module modules/mod_rewrite.so <IfModule mod_ibm_ssl.c> Listen 0.0.0.0:1443 <VirtualHost *:1443> ServerName connections.example.com SSLEnable RewriteEngine on ProxyRequests Off ProxyPass / http://inotes.example.local/ ProxyPassReverse / http://inotes.example.local/ </VirtualHost> </IfModule>
  • 49. iNotes Web Mail Redirect 49 https://connections.example.com:1443
  • 50. Socialmail-config.xml 50 • When you use reverse proxy to access iNotes • Mail integration works only when you use http or https • Add UseConfiguredProtocolto your configuration • Problem when you need to access multiple iNotes Servers <ServerConfig name="domino-redirect"> <ConfigType>REDIRECT</ConfigType> <RedirectURL>https://connections.example.com:1443/iwaredir.nsf</RedirectURL> <MailPattern type="example.com" /> </ServerConfig> <GadgetConfig> <GadgetPreference id="UseConfiguredProtocol">true</GadgetPreference> </GadgetConfig>
  • 51. Mail integration and SPNEGO 51 • LtpaToken contains AD $DN • Lookup in Domino Directory with this DN -> user is not allowed to open mail • Solution • Add AD $DN to ACL • Or add AD $DN to Domino Fullname (AD DN contains , as delimiter between ou) • Or: • http://tdiblog.anderls.com/2015/02/adding-user-active-directory.html • Thanks Andreas Artner
  • 52. Toronto, June 6-7 2016 Backup
  • 53. What to Backup • Using an example Connections installation guide rarely explains backups • These guides normally do not mention backup, or what to back up • Disk crash means data loss • Database backups through file backup are not supported and mostly not restorable • Important!!! • Database Backup through Online Backups can be taken when Connections is up • Offline backups are also possible • Ensure the file system & DB backup are run at the same time of day • DB and Filesystem data will stay in sync – if you take your DB backup at midnight and the file system at midday they will be out of sync 53
  • 54. Backup • Most important (minimum daily) • Databases (offline or online) • Shared content • Important • Configuration • WebSphere Application Server • Connections • IBM HTTP Server • TDI Solution • Test if restore is possible!!!! • Several issues with WebSphere restores, where binaries weren't on the tape 54
  • 55. Toronto, June 6-7 2016 Checklists
  • 56. Checklist Do • Document your installation steps • The official documentation is sometimes confusing, because all OS within one document • Use a LDAP user for connectionsAdmin • Be prepared for scaling • Shared directory on UNC path • No small deployment installations • Tune your environment • READ THE DOCUMENTATION!!!! Don’t • Use multiple instances DB2 with small resources • Install on a single machine (unless the environment is very small or for test) • Copy customizations to newer versions • jsp, ftl copy will break something • Use unstable file shares • Test deployment with server IE • Test with only one language 56
  • 57. Install Checklist • WebSphere Application Server • Configure Federated Repository • LtpaToken, enable security • WebSphere Application Server Supplements (IHS, Plugins) • DB2 (or other DBM) • TDI • Add Webserver to Dmgr (use configurewebserver.bat) • Enable SSL on IHS • Import IHS Root Key within WebSphere cell trust keystore (retrieve from port) • Configure CCM • Install optional Addonslike Forms Experience Builder, IBM Docs, Cognos 57
  • 59. Documentation • Everyone hates writing documentation • BUT – make notes as you go, it doesn’t need to be a full step by step guide with screenshots • Document all customizataions • Any additional changes made • Anything of note that deviates from the guides • Lessons learnt or how you solved issues • Use the scripts to output some of it 59
  • 60. Toronto, June 6-7 2016 Resources
  • 61. Useful Tools • Editor with syntax highlighting • vim, geany • notepad++, pspad, UltraEdit • Tail • baretail • multitail • mtail • Proxy • Fiddler (often asked for by IBM Support) • Burpsuite (intercept proxy) • Browser • Firefox (portable) / Firefox ESR • Chrome • IE (download vm with different versions) • https://www.modern.ie • Network analyzer • Wireshark • tcpdump • Unzip / Unarchiver • 7-zip • WinRar 61
  • 62. Links and References • IBM Connections System Requirements • http://www-01.ibm.com/support/docview.wss?uid=swg27012786 • IBM Connections Family Documentation • http://www.ibm.com/support/knowledgecenter/SSYGQH/welcome • IBM Connections 4 Performance Tuning Guide • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tuning_Guide • IBM Connections 4.5 Performance Tuning Guide Addendum • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tuning_Guide_Addendum • IBM Connections 5 CR1 Performance Tuning Guide • https://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide 62
  • 63. Useful Blogs • http://ibmconnections.com • http://turtleblog.info • http://portal2portal.blogspot.de • https://www.urspringer.de • http://socialconnections.info • http://blog.robertfarstad.com • http://www.curiousmitch.com • http://www.ramsit.com/category/blog • http://techblog.gis-ag.info • https://milanmatejic.wordpress.com • http://ibmdocs.com • http://domino.elfworld.org • https://dontforgetthe0.com • http://dilf.me.uk/socialshazza • http://www.stoeps.de • http://scripting101.org • http://meisenzahl.org • http://martin.leyrer.priv.at • http://kbild.ch • http://www.notesgoddess.net • http://www.dominodiva.com • http://notesbusters.com • https://rob59blog.wordpress.com • http://connections101.info • http://brandlrainer.blogspot.de • https://collaborationben.com 63
  • 64. Thank you very much for your attention! panagenda GmbH – Make Your Data Work for You Lahnstr. 17 ● 64646 Heppenheim (Germany) Skype: christophstoettner ● Cell: +49 173 8588719 E-Mail: christoph.stoettner@panagenda.com Christoph Stoettner Senior Consultant panagenda GmbH – Make Your Data Work for You Lahnstr. 17 ● 64646 Heppenheim (Germany) Skype: nico.meisenzahl ● Cell: +49 170 7355081 E-Mail: nico.meisenzahl@panagenda.com Nico Meisenzahl Consultant 64