SlideShare a Scribd company logo

Best And Worst Practices Deploying IBM Connections

Download as PPTX, PDF
LetsConnect, profile picture
LetsConnect

The document outlines best and worst practices for deploying IBM Connections, focusing on installation requirements, performance tuning, and user experience enhancements. Key recommendations include ensuring adequate system resources, disabling security software during installation, and implementing effective monitoring and backup strategies. The author emphasizes the importance of configuring settings correctly to optimize performance and maintain user satisfaction.

Technology
1 of 57
Downloaded 27 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
Best And Worst Practices Deploying Connections Christoph Stoettner panagenda
@stoeps PLATINUM & CHAMPAGNE SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
Christoph Stöttner Senior Consultant – panagenda IBM Notes / Domino since 1999 IBM Connections since Version 2.5 / 2009 Consultant in various projects • Migration • Administration and Installation • Performance analysis With panagenda since 2015, core competence • IBM Connections Deployment and Optimizations • IBM Connections Monitoring Dad, Bavarian, IBM Champion 3 a @stoeps j christoph-stoettner
@stoeps Agenda • Installation and Requirements • Tuning • Enhance the user experience • Backup • Checklists • Resources 4
@stoeps INSTALLATION & REQUIREMENTS 5
@stoeps System Requirements • Regularly check requirement documents • All versions • http://short.stoeps.de/vwzrv • IBM Connections 5 • http://short.stoeps.de/mspdi • Check all notes • Download PDF • Be careful with installation documents • Sometimes wrong dependencies mentioned 6
@stoeps Sizing • Be prepared for future growth • Do not overact • Some hundred users mostly won't need a large deployment • I'm not a fan of multi instance database machines • If I run in database performance issues I split the databases to different machines • Performance tuning guide • Multi instance is best practice, if you have enough resources 7
@stoeps Sizing (2) • A word to minimum requirements • 4 GB memory minimum is too less, better starting with 8 or 12 GB • memory swapping kills all tuning efforts • CPU cores • 2 cores minimum only on small deployments • thumb rule: calculate one core for each jvm • Disk • using network storage or virtualized servers • easier to extend 8
@stoeps Prepare your Installation • Download all software packages • all paths shouldn't contain spaces • no spaces in source and destination folders • Use a dedicated administration user • especially on Windows avoid users with applied group policies 9
@stoeps Security Extensions • During installation you should disable all "Security" Software • SELinux • AppArmor • Antivirus • Firewalls • Self developed scripts and extensions • It's not fun, when a script deletes databases, because you forgot to add the directory to the script exclusions 10
@stoeps Network • Name lookup / DNS • all servers must be resolvable • knowing the protocol • avoid round robin • Network storage (file locking is important) • nfs v4 / smb|cifs • no dfs • Reverse Proxies / Proxies • Test your deployment without proxies • when everything works -> enable them 11
@stoeps Operating system - Linux • Different operating systems need special settings • Always use the operating system where you have the best skills • Linux • /etc/security/limits.conf • Increase nofile and nproc (see tuning guides) • Example from tuning guide • root soft nproc 2047 • root hard nproc 16384 • Default nproc (max number of processes) for user root 2047 • You can extend the nproc with ulimit –p up to 16384 (e.g. within bashrc) • Or set soft and hard limit to equal sizes, avoids additional changes with profile 12
@stoeps Operating system - Windows • Always use UNC path as Shared Directory • Easier to add additional WebSphere Nodes for failover or load balancing • WebSphere services • technical user account • password never expires • must change password on next login • Default: LocalSystem has no network access • check access rights on Shared Directory 13
@stoeps Register a service to start WebSphere • Service for Deployment Manager and NodeAgent(s) are enough • wasservice.bat|sh • Map service to a technical user • any Active Directory User is possible • allowed to read / write network share with Shared Content • Service can parse commands to nodeagent • -stopArgs "<NA commands>" • Configure monitoring policy 14
@stoeps WasService.bat|sh – Register service cd D:IBMCNXWebSphereAppServerbin WASService.exe -add CnxNode01 -serverName nodeagent -profilePath d:ibmcnxwebsphereappserverprofilesCNXNode01 -stopArgs "-username wasadmin -password password -stopservers" -userid cnxtec -password password -encodeParams -restart true -startType automatic parsed to nodeAgent stops AppServer 15
@stoeps Monitoring Policy • Each Application Server • change Node restart state to "RUNNING" • Large deployment on Windows • Default timeout for service shutdown = 20 seconds • HKEY_Local_Machine: SYSTEMCurrentControlSetControl WaitToKillServiceTimeout 16
@stoeps Directories and Synchronization • Prepare your LDAP • Better data within LDAP, better Profiles • Switching Authentication directories is possible, but must be planned • Dependencies • Quality of LDAP data • Plans to activate SPNEGO • Domino Mail integration 17
@stoeps Federated Repositories - Best Practices • I normally leave the file based wasadmin with WebSphere Application Server • Fallback if LDAP Bind Credentials changed • Solving problems with Federated Repositories • Default does not allow this (you have to disable security to change configuration) 18
@stoeps Set English for all Logs - WebSphere • WebSphere • Add "-Duser.language=en –Duser.region=US" to Generic JVM arguments of • Each application server (Process definition – Java Virtual Machine) • dmgr (System Administration – Deployment Manager – Process Definition ...) • nodeagents (System Administration – Node agents – nodeagent – Process Def ...) 19
@stoeps Set English for all logs - TDI • TDI • edit ibmdisrv.bat|sh • add -Duser.language=en –Duser.region=US to LOG_4J variable • Linux: • Windows: 20
@stoeps Log rotate - WebSphere • WebSphere Logs too small for Troubleshooting • Default: 5 Logs 1 MB each (SystemOut and SystemErr) • Better 5-10 Logs 20 MB each • Setting for each Application Server • remember Nodeagents and Dmgr 21
@stoeps Rotate Logs – IBM HTTP Server • Default: no max size for access_log and error_log • Often some GB of Log files • Open with an Editor? • Disk size • Search for this lines in httpd.conf: • Comment out: 22 # CustomLog log/access_log common # ErrorLog logs/error_log CustomLog log/access_log common ErrorLog logs/error_log
@stoeps Rotate Logs – IBM HTTP Server • Add: • Delete Log Files older than x days • Linux • Windows (Batch through Task Scheduler or Powershell) 23 Linux: CustomLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/error_log.%Y%m%d 86400“ Windows: CustomLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/error_log.%Y%m%d 86400" crontab -e # Delete logfiles older than 3 days in logs 10 0 * * * find /opt/IBM/HTTPServer/logs/*_log.* -mtime +3 -exec rm -rf {} ; forfiles -p "D:IBMHTTPServerlogs" -s -m *_log.* -d -3 -c "cmd /c echo @file"
@stoeps Rotate Logs – DB2 • db2diag.log • Default: no maximum size • Always stored on C: • Full C-Partition in Windows still hard to solve 24 [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 0 [db2inst1@cnx-db2 ~]$ db2 update dbm cfg using DIAGSIZE 1024 DB20000I The UPDATE DATABASE MANAGER CONFIGURATION command completed successfully. [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 1024
@stoeps HTTP Server Keystore • Several Reviews showed • Keystore of WebSphere Plugin used for IHS SSL Key • Why is this worse? • What would you do when you get SSL Errors within Connections? • This overwrites plugin-key.kdb on your Webserver • SSL Key away • Backup? 25
@stoeps HTTP Server Key store • When you want to reuse Plugin Key store • Import SSL Key into CMSKeyStore • But never seen this in the wild • BP: Create a Key store for IHS • ikeyman will help you 26
@stoeps TUNING 27
@stoeps Performance Tuning Guide • 4.0 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tuning_Guide • 4.5 Addendum • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tuning_Guide_Add endum • 5.0 CR1 • http://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide • Read everything carefully • check and understand dependencies 28
@stoeps Worst practice example – Tuning • Customer showed me a system with following infrastructure • WebSphere • Large deployment • 16 GB RAM • 4 Cores • DB2 • 12 instances • 8 GB RAM • 4 Cores • Connections restart 22 minutes Web Server ihs.example.local WebSphere was1.example.local Db2 / TDI db2.example.local Freigabe LDAP domino1.example.local User SynchronisationAuthentication 29
@stoeps Solving this • Large deployment means about 15 JVM on the machine • restart shows 15 min 100% CPU usage • adding 4 cores and restart time get down to 7 minutes • other option would be midsize deployment, but then you have to reinstall Connections • Java Heap Sizes set to default (256 MB and 768 MB) -> increase to 1.5 – 2.5 GB • Perf Guide mentions that multiple instances on DB2 only increase performance with enough resources • but that was not the real problem • DataSource connectionPool Sizes are set to Default 1/10 • increase this values to the proposals in the guide and ... • Restart time comes down under 3 minutes • Key point: read the complete guide 30
@stoeps Java Heap Size • Default Java Heap Sizes on Midsize Deployment: 2506 MB / application server • Large Deployment depends on application: 0.5 to 2.5 GB • Main part in memory tuning • never exeed the system memory • SWAPPING KILLS ALL YOUR TUNING EFFORTS • counting the JVM Heap sizes is not enough • maximum heap is not the maximum amount of memory the jvm uses! • libraries, jars and so on count additional to memory usage • JVM memory usage may be 3 * JVM maximum Heap • initial and maximum Heap Size should be equalized 31
@stoeps IBM HTTPServer • enable compression • important • see Slides from BP307 - IBM Connect 2014 • save up to 70% network traffic • minimal increase of CPU load • enable file download through IHS • depend on your deployment • often security forbids storage access from DMZ • if you have no access to file share from IHS -> Files should be installed in a separate Cluster 32
@stoeps Midsize Deployment - Files • Often IHS positioned in the red zone (DMZ) • No Access to SHARED DIRECTORY • Create a Cluster for Files • No Problem with Large Deployments • With Midsize you can add an additional Cluster during Setup • http://www- 01.ibm.com/support/docview.wss?uid=swg21317658 33
@stoeps Activate Synchronous File transfer • Servers -> Application Servers -> serverName -> Web Container Settings -> Web Container -> Custom Properties • com.ibm.ws.webcontainer.channelwritetype=sync 34
@stoeps ENHANCE USER EXPERIENCE Happy admins with happy users 35
@stoeps User Synchronization • IBM provides some great batch files and assembly lines • TDI Solution Best Practices • do not use tdisol from Wizards Archive • I find often scheduler which links directly to the used wizard folder • never seen updates applied to these folders • Updated archives can be found in <connections root>tdisol • with 4 and 4.5 often special TDISOL Update packages on Fixcentral 36
@stoeps Be aware of sync_updates_hash_field • Possible values • uid (default) • guid • email • Value is used to find matching persons between LDAP and peopleDB • Possible problems • User renaming • Shortname reuse (retired and newly hired users) • What happens when you rename a Domino user? • Email address changes • Shortname (uid) changes 37
@stoeps What can happen • sync_updates_hash_field=uid • User is renamed • Normally no problem, because in Domino Shortname can store multiple values • User retires • Inactivated or deleted user within Profiles • User hires again • User is reactivated • Other User with same UID hires • Will get all data from old user account (picture, tags, community membership) • Splitting of this content is not possible 38
@stoeps What can happen • sync_updates_hash_field=email • User is renamed • On First TDI run the user gets inactivated • new profile will be created • no content available -> you must manually map the content to the new account • User retires • inactivated or deleted user within Profiles • User hires again • User is reactivated • other User with same mail address hires • will get all data from old user account (picture, tags, community membership) 39
@stoeps What can happen • sync_updates_hash_field=guid • User is renamed • all data synchronize with LDAP • User retires • inactivated or deleted user within Profiles • within Domino the person document is deleted • User hires again • newly registered user has new guid • new profile • duplicate login data -> no new profile -> you can use populate_from_dn_file.bat 40
@stoeps Single Sign On - LtpaToken • Single Sign On within IBM portfolio • Domino only supports one domain per Web SSO Document • You can copy & paste Web SSO Documents and change Domain names (see e.g. Paul Mooney - AdminBlast 2012 – Tip #4 • DNS Domain is multi value (works until Domino 8.5.x, but not with Domino 9.x) • Servers with mixed Internet Site and Non-Internet Site usage: copy & paste too! • Often internal servers use local domains, when Connections is external accessible SSO needs workaround • adding additional hostnames to domino • You can use IHS (IBM HTTP Server) as a reverse proxy to access iNotes 41
@stoeps Single Sign On - SPNEGO • Requirements • Windows 2003 / 2008 Active Directory • Websphere Service must start as Domain User • connectionsAdmin j2c Alias must be a LDAP User • configure use documentation and http://de.slideshare.net/david_hay/dave-hay-desktop- single-signon-in-an-active-directory-world?related=1 • real additional value for users • easy to deploy, when you have the rights and clue what to do • do not test Browser Single Sign On with Chrome, because process does not end when you close the last window 42
@stoeps Mail integration • Use IBM HTTP Server as reverse proxy to access iNotes LoadModule rewrite_module modules/mod_rewrite.so <IfModule mod_ibm_ssl.c> Listen 0.0.0.0:1443 <VirtualHost *:1443> ServerName connections.example.com SSLEnable RewriteEngine on ProxyRequests Off ProxyPass / http://inotes.example.local/ ProxyPassReverse / http://inotes.example.local/ </VirtualHost> </IfModule> 43
@stoeps iNotes Web Mail Redirect https://connections.example.com:1443 44
@stoeps Socialmail-config.xml • when you use reverse proxy to access iNotes • Mail integration works only when you use http or https • Add UseConfiguredProtocol to your configuration • Problem when you need to access multiple iNotes Servers <ServerConfig name="domino-redirect"> <ConfigType>REDIRECT</ConfigType> <RedirectURL>https://connections.example.com:1443/iwaredir.nsf</RedirectURL> <MailPattern type="example.com" /> </ServerConfig> <GadgetConfig> <GadgetPreference id="UseConfiguredProtocol">true</GadgetPreference> </GadgetConfig> 45
@stoeps Mail integration and SPNEGO • LtpaToken contains AD $DN • Lookup in Domino Directory with this DN -> user is not allowed to open mail • Solution • Add AD $DN to ACL • Or add AD $DN to Domino Fullname (AD DN contains , as delimiter between ou) • Or: • http://tdiblog.anderls.com/2015/02/adding-user-active- directory.html • Thanks Andreas Artner (He attends SocCNX, so bring him a beer) 46
@stoeps BACKUP 47
@stoeps Backup - Overview • I got several calls from customers which installed Connections with installation guides • these guides normally do not mention backup • disk crash means data loss • Database backups through file backup are not supported and mostly not restorable • Important • Database Backup through Online Backups can be taken, when Connections is up 48
@stoeps Backup • Most important (minimum daily) • Databases (offline or online) • Shared content • Important • Configuration • WebSphere Application Server • Connections • IBM HTTP Server • TDI Solution • Test if restore is possible!!!! • Several issues with WebSphere restores, where binaries weren't on the tape 49
@stoeps Checklist Do's • Create a documentation of all installation steps • Documentation sometimes confusing, because all OS within one document • Be prepared for scaling • Shared directory on UNC path • No small deployment installations • Tune your environment • Deactivate Antivirus • Deactivate "Security" Tools during installation & SELinux / AppArmor Don'ts • Use multiple instances DB2 with small resources • install on a single machine • copy customizing to newer versions • jsp, ftl copy will break something • use unstable file shares • Test deployment with server IE • Test with only one language • unzip with builtin tool of Windows 50
@stoeps Installation Checklist • WebSphere Application Server • Configure Federated Repository • LtpaToken, enable security • WebSphere Application Server Supplements (IHS, Plugins) • DB2 (or other DBM) • TDI • Add Webserver to Dmgr (use configurewebserver.bat) • Enable SSL on IHS • Import IHS Root Key within WebSphere trust keystone (retrieve from port) • Configure CCM 51
@stoeps Documentation of your environments • Create valid documentation and keep it up-to-date • nobody likes creating documentations (except Sharon) • Good overview for troubleshooting and migrations • nobody needs long text versions or hundreds of screenshots • Use the Sheet provided within the documentation • http://www- 01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/admin/pl an/r_worksheet_installation.dita • Or download a Microsoft Excel version of this at (Kudos to Keith Brooks) • http://blog.vanessabrooks.com/p/downloads.html 52
@stoeps Tools • Editor with syntax highlighting • vim, geany • notepad++ • Tail • baretail • multitail • mtail • Proxy • Fiddler (often asked from Support) • Burpsuite (intercept proxy) • Browser • Firefox (portable) / Firefox ESR • Chrome • IE (download vm with different versions) • https://www.modern.ie • Network analyzer • Wireshark • tcpdump • Unzip / Unarchiver • 7-zip 53
@stoeps Links • IBM Connections Requirements • Official Documentation Connections family • Connections 5 Documentation • Tuning Guide 4.0 • Tuning Guide Addendum 4.5 • Tuning Guide 5.0CR1 54
@stoeps Blogs with IBM Connections stuff • http://www.stoeps.de • http://scripting101.org • http://martin.leyrer.priv.at/ • http://kbild.ch • http://dilf.me.uk/socialshazza • http://www.notesgoddess.net • http://ibmconnections.com • http://notesbusters.com • http://wannes.rams.be • http://turtleblog.info • http://portal2portal.blogspot.de • https://www.urspringer.de • http://meisenzahl.org/ • http://socialconnections.info • http://blog.robertfarstad.com • http://www.curiousmitch.com 55
@stoeps PLATINUM & CHAMPAGNE SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
@stoeps Thanks Christoph Stoettner christoph.stoettner@panagenda.com Blog: www.stoeps.de Twitter: @stoeps LinkedIn: christoph-Stoettner Download vCard: https://www.panagenda.com/download/vCard/Stoettner_Christoph.vcf

More Related Content

PDF
IBM Connections administration – keep your systems running the right way
LetsConnect
 
PDF
Your App deserves more – The Art of App Modernization
Christian Güdemann
 
PPTX
IBM Connections Adminblast - Connect17 (DEV 1268)
Nico Meisenzahl
 
PDF
Victor Toal - IBM Connections: So you have it installed – now what?
LetsConnect
 
PPTX
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
PDF
What We Wish We Had Known: Becoming an IBM Connections Administrator
Gabriella Davis
 
PPTX
Social Connections 12 - IBM Connections Adminblast
Nico Meisenzahl
 
PDF
1050: TDI Solutions Best Practises with IBM Connections Deployments - IBM Con...
panagenda
 
IBM Connections administration – keep your systems running the right way
LetsConnect
 
Your App deserves more – The Art of App Modernization
Christian Güdemann
 
IBM Connections Adminblast - Connect17 (DEV 1268)
Nico Meisenzahl
 
Victor Toal - IBM Connections: So you have it installed – now what?
LetsConnect
 
Soccnx10: Best and worst practices deploying IBM Connections
panagenda
 
What We Wish We Had Known: Becoming an IBM Connections Administrator
Gabriella Davis
 
Social Connections 12 - IBM Connections Adminblast
Nico Meisenzahl
 
1050: TDI Solutions Best Practises with IBM Connections Deployments - IBM Con...
panagenda
 

What's hot (19)

PPTX
Soccnx10: IBM Connections Troubleshooting or “Get the Cow off the Ice”
panagenda
 
PDF
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
PDF
Planning & Completing An IBM Connections Upgrade
Gabriella Davis
 
PDF
IBM Connect 2016 - 60+ in 60 - Admin Tips Power Hour
Chris Miller
 
PPTX
AdminCamp 2017 - IBM Connections Adminblast
Nico Meisenzahl
 
PDF
1693: 21 Ways to Make Your Data Work for You - IBM Connect 2016
panagenda
 
PDF
BP1491: Virtual, Faster, Better - How to Virtualize the Rich Client and Brows...
panagenda
 
PDF
Best and worst practices deploying IBM Connections
LetsConnect
 
PDF
IBM Think 2018 - IBM Connections Troubleshooting
Nico Meisenzahl
 
PDF
IBM Connections Troubleshooting or “Get the Cow off the Ice”
LetsConnect
 
PPTX
Our take on Domino 10 - a Ytria webinar
Benedek Menesi
 
POTX
IBM Domino / IBM Notes Performance Tuning
Vladislav Tatarincev
 
PPTX
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Nico Meisenzahl
 
PDF
Engage / Belsoft Collaboration - Using IBM Domino data in IBM Connections – a...
Belsoft
 
PDF
You don't want to do it like that
Sharon James
 
PPTX
Yes, It's Number One it's TOTP!
Keith Brooks
 
PPTX
Webinar: IBM Connections Adminblast
Nico Meisenzahl
 
PDF
engage 2019 - 15 Domino v10 Admin features we LOVE
Christoph Adler
 
PPTX
Migration:Impossible ... Not so
ICON UK EVENTS Limited
 
Soccnx10: IBM Connections Troubleshooting or “Get the Cow off the Ice”
panagenda
 
1049: Best and Worst Practices for Deploying IBM Connections - IBM Connect 2016
panagenda
 
Planning & Completing An IBM Connections Upgrade
Gabriella Davis
 
IBM Connect 2016 - 60+ in 60 - Admin Tips Power Hour
Chris Miller
 
AdminCamp 2017 - IBM Connections Adminblast
Nico Meisenzahl
 
1693: 21 Ways to Make Your Data Work for You - IBM Connect 2016
panagenda
 
BP1491: Virtual, Faster, Better - How to Virtualize the Rich Client and Brows...
panagenda
 
Best and worst practices deploying IBM Connections
LetsConnect
 
IBM Think 2018 - IBM Connections Troubleshooting
Nico Meisenzahl
 
IBM Connections Troubleshooting or “Get the Cow off the Ice”
LetsConnect
 
Our take on Domino 10 - a Ytria webinar
Benedek Menesi
 
IBM Domino / IBM Notes Performance Tuning
Vladislav Tatarincev
 
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Nico Meisenzahl
 
Engage / Belsoft Collaboration - Using IBM Domino data in IBM Connections – a...
Belsoft
 
You don't want to do it like that
Sharon James
 
Yes, It's Number One it's TOTP!
Keith Brooks
 
Webinar: IBM Connections Adminblast
Nico Meisenzahl
 
engage 2019 - 15 Domino v10 Admin features we LOVE
Christoph Adler
 
Migration:Impossible ... Not so
ICON UK EVENTS Limited
 
Ad

Similar to Best And Worst Practices Deploying IBM Connections (20)

PDF
BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS
Nico Meisenzahl
 
PDF
be the captain of your connections deployment
Sharon James
 
PDF
Bp307 Practical Solutions for Connections Administrators, tips and scrips for...
Sharon James
 
PDF
Connections install in 45 mins
Sharon James
 
PDF
Practical solutions for connections administrators lite
Sharon James
 
PDF
Tip from ConnectED 2015: Best and Worst Practices Deploying IBM Connections
SocialBiz UserGroup
 
PDF
Sa106 – practical solutions for connections administrators
Sharon James
 
PPTX
SUTOL 2016: IBM Connections Deployment Best and Worst Practices
panagenda
 
PDF
Practical solutions for connections administrators
Sharon James
 
PPTX
DEV-1269: Best and Worst Practices for Deploying IBM Connections – IBM Conne...
panagenda
 
PDF
Performance tuning for ibm tivoli directory server redp4258
Banking at Ho Chi Minh city
 
PDF
Redbook: Running IBM WebSphere Application Server on System p and AIX: Optimi...
Monty Poppe
 
PDF
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
PDF
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
PDF
Introducing tivoli personalized services manager 1.1 sg246031
Banking at Ho Chi Minh city
 
PDF
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
PDF
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
PDF
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
siwbramy
 
PDF
Hadoop Operations - Best practices from the field
Uwe Printz
 
ODP
Debugging IBM Connections for the Impatient Admin - Social Connections VII
Martin Leyrer
 
BEST AND WORST PRACTICES DEPLOYING IBM CONNECTIONS
Nico Meisenzahl
 
be the captain of your connections deployment
Sharon James
 
Bp307 Practical Solutions for Connections Administrators, tips and scrips for...
Sharon James
 
Connections install in 45 mins
Sharon James
 
Practical solutions for connections administrators lite
Sharon James
 
Tip from ConnectED 2015: Best and Worst Practices Deploying IBM Connections
SocialBiz UserGroup
 
Sa106 – practical solutions for connections administrators
Sharon James
 
SUTOL 2016: IBM Connections Deployment Best and Worst Practices
panagenda
 
Practical solutions for connections administrators
Sharon James
 
DEV-1269: Best and Worst Practices for Deploying IBM Connections – IBM Conne...
panagenda
 
Performance tuning for ibm tivoli directory server redp4258
Banking at Ho Chi Minh city
 
Redbook: Running IBM WebSphere Application Server on System p and AIX: Optimi...
Monty Poppe
 
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
Deployment guide series ibm tivoli composite application manager for web sphe...
Banking at Ho Chi Minh city
 
Introducing tivoli personalized services manager 1.1 sg246031
Banking at Ho Chi Minh city
 
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
Setup and configuration for ibm tivoli access manager for enterprise single s...
Banking at Ho Chi Minh city
 
WebSphere Application Server Administration Using Jython 1st Edition Robert A...
siwbramy
 
Hadoop Operations - Best practices from the field
Uwe Printz
 
Debugging IBM Connections for the Impatient Admin - Social Connections VII
Martin Leyrer
 
Ad

More from LetsConnect (20)

PDF
Installing Component Pack 6.0.0.6
LetsConnect
 
PPTX
Oh $h@# - How to deal with emotional outbursts and hate in social situations
LetsConnect
 
PPTX
It is not About Connections vs Office 365 - You can have the best of the both...
LetsConnect
 
PPTX
Using ibm connections to enhance university courses
LetsConnect
 
PPTX
IBM Connections 6 Component Pack
LetsConnect
 
PPTX
IBM Connections 6.0 CR3 New Features
LetsConnect
 
PDF
10 years of IBM Connections
LetsConnect
 
PDF
IBM Collaboration Framework in action: Customer success stories
LetsConnect
 
PDF
Design for the Digital Workspace
LetsConnect
 
PDF
New Ways to Deliver Business Outcomes with INtelligent Workstream Collaboration
LetsConnect
 
PDF
Power up your Salesforce Opportunities by using IBM Watson Workspace as your ...
LetsConnect
 
PDF
There is nothing more practical than a good theory
LetsConnect
 
PDF
Kubernetes Basics for Connections Admins
LetsConnect
 
PDF
Intelligent Collaboration driving Digital Transformation
LetsConnect
 
PDF
Developing IBM Connections Community Apps using Domino
LetsConnect
 
PDF
IBM Connections - Have it YOUR Way!
LetsConnect
 
PDF
You Get What You Give
LetsConnect
 
PDF
Building Custom ibm Watson Workspace Templates to make you and your team more...
LetsConnect
 
PDF
ICS INtegration with Node-RED and Open Source
LetsConnect
 
PDF
Communities as the fundament of social learning
LetsConnect
 
Installing Component Pack 6.0.0.6
LetsConnect
 
Oh $h@# - How to deal with emotional outbursts and hate in social situations
LetsConnect
 
It is not About Connections vs Office 365 - You can have the best of the both...
LetsConnect
 
Using ibm connections to enhance university courses
LetsConnect
 
IBM Connections 6 Component Pack
LetsConnect
 
IBM Connections 6.0 CR3 New Features
LetsConnect
 
10 years of IBM Connections
LetsConnect
 
IBM Collaboration Framework in action: Customer success stories
LetsConnect
 
Design for the Digital Workspace
LetsConnect
 
New Ways to Deliver Business Outcomes with INtelligent Workstream Collaboration
LetsConnect
 
Power up your Salesforce Opportunities by using IBM Watson Workspace as your ...
LetsConnect
 
There is nothing more practical than a good theory
LetsConnect
 
Kubernetes Basics for Connections Admins
LetsConnect
 
Intelligent Collaboration driving Digital Transformation
LetsConnect
 
Developing IBM Connections Community Apps using Domino
LetsConnect
 
IBM Connections - Have it YOUR Way!
LetsConnect
 
You Get What You Give
LetsConnect
 
Building Custom ibm Watson Workspace Templates to make you and your team more...
LetsConnect
 
ICS INtegration with Node-RED and Open Source
LetsConnect
 
Communities as the fundament of social learning
LetsConnect
 

Recently uploaded (20)

PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
KodekX | Application Modernization Development
KodekX
 
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Approach and Philosophy of On baking technology
30anthuong17
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
KodekX | Application Modernization Development
KodekX
 
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
A Presentation on Artificial Intelligence
memembruh336
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
Cloud computing and distributed systems.
kkkkkhan
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 

Best And Worst Practices Deploying IBM Connections

  • 1. Best And Worst Practices Deploying Connections Christoph Stoettner panagenda
  • 2. @stoeps PLATINUM & CHAMPAGNE SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
  • 3. Christoph Stöttner Senior Consultant – panagenda IBM Notes / Domino since 1999 IBM Connections since Version 2.5 / 2009 Consultant in various projects • Migration • Administration and Installation • Performance analysis With panagenda since 2015, core competence • IBM Connections Deployment and Optimizations • IBM Connections Monitoring Dad, Bavarian, IBM Champion 3 a @stoeps j christoph-stoettner
  • 4. @stoeps Agenda • Installation and Requirements • Tuning • Enhance the user experience • Backup • Checklists • Resources 4
  • 6. @stoeps System Requirements • Regularly check requirement documents • All versions • http://short.stoeps.de/vwzrv • IBM Connections 5 • http://short.stoeps.de/mspdi • Check all notes • Download PDF • Be careful with installation documents • Sometimes wrong dependencies mentioned 6
  • 7. @stoeps Sizing • Be prepared for future growth • Do not overact • Some hundred users mostly won't need a large deployment • I'm not a fan of multi instance database machines • If I run in database performance issues I split the databases to different machines • Performance tuning guide • Multi instance is best practice, if you have enough resources 7
  • 8. @stoeps Sizing (2) • A word to minimum requirements • 4 GB memory minimum is too less, better starting with 8 or 12 GB • memory swapping kills all tuning efforts • CPU cores • 2 cores minimum only on small deployments • thumb rule: calculate one core for each jvm • Disk • using network storage or virtualized servers • easier to extend 8
  • 9. @stoeps Prepare your Installation • Download all software packages • all paths shouldn't contain spaces • no spaces in source and destination folders • Use a dedicated administration user • especially on Windows avoid users with applied group policies 9
  • 10. @stoeps Security Extensions • During installation you should disable all "Security" Software • SELinux • AppArmor • Antivirus • Firewalls • Self developed scripts and extensions • It's not fun, when a script deletes databases, because you forgot to add the directory to the script exclusions 10
  • 11. @stoeps Network • Name lookup / DNS • all servers must be resolvable • knowing the protocol • avoid round robin • Network storage (file locking is important) • nfs v4 / smb|cifs • no dfs • Reverse Proxies / Proxies • Test your deployment without proxies • when everything works -> enable them 11
  • 12. @stoeps Operating system - Linux • Different operating systems need special settings • Always use the operating system where you have the best skills • Linux • /etc/security/limits.conf • Increase nofile and nproc (see tuning guides) • Example from tuning guide • root soft nproc 2047 • root hard nproc 16384 • Default nproc (max number of processes) for user root 2047 • You can extend the nproc with ulimit –p up to 16384 (e.g. within bashrc) • Or set soft and hard limit to equal sizes, avoids additional changes with profile 12
  • 13. @stoeps Operating system - Windows • Always use UNC path as Shared Directory • Easier to add additional WebSphere Nodes for failover or load balancing • WebSphere services • technical user account • password never expires • must change password on next login • Default: LocalSystem has no network access • check access rights on Shared Directory 13
  • 14. @stoeps Register a service to start WebSphere • Service for Deployment Manager and NodeAgent(s) are enough • wasservice.bat|sh • Map service to a technical user • any Active Directory User is possible • allowed to read / write network share with Shared Content • Service can parse commands to nodeagent • -stopArgs "<NA commands>" • Configure monitoring policy 14
  • 15. @stoeps WasService.bat|sh – Register service cd D:IBMCNXWebSphereAppServerbin WASService.exe -add CnxNode01 -serverName nodeagent -profilePath d:ibmcnxwebsphereappserverprofilesCNXNode01 -stopArgs "-username wasadmin -password password -stopservers" -userid cnxtec -password password -encodeParams -restart true -startType automatic parsed to nodeAgent stops AppServer 15
  • 16. @stoeps Monitoring Policy • Each Application Server • change Node restart state to "RUNNING" • Large deployment on Windows • Default timeout for service shutdown = 20 seconds • HKEY_Local_Machine: SYSTEMCurrentControlSetControl WaitToKillServiceTimeout 16
  • 17. @stoeps Directories and Synchronization • Prepare your LDAP • Better data within LDAP, better Profiles • Switching Authentication directories is possible, but must be planned • Dependencies • Quality of LDAP data • Plans to activate SPNEGO • Domino Mail integration 17
  • 18. @stoeps Federated Repositories - Best Practices • I normally leave the file based wasadmin with WebSphere Application Server • Fallback if LDAP Bind Credentials changed • Solving problems with Federated Repositories • Default does not allow this (you have to disable security to change configuration) 18
  • 19. @stoeps Set English for all Logs - WebSphere • WebSphere • Add "-Duser.language=en –Duser.region=US" to Generic JVM arguments of • Each application server (Process definition – Java Virtual Machine) • dmgr (System Administration – Deployment Manager – Process Definition ...) • nodeagents (System Administration – Node agents – nodeagent – Process Def ...) 19
  • 20. @stoeps Set English for all logs - TDI • TDI • edit ibmdisrv.bat|sh • add -Duser.language=en –Duser.region=US to LOG_4J variable • Linux: • Windows: 20
  • 21. @stoeps Log rotate - WebSphere • WebSphere Logs too small for Troubleshooting • Default: 5 Logs 1 MB each (SystemOut and SystemErr) • Better 5-10 Logs 20 MB each • Setting for each Application Server • remember Nodeagents and Dmgr 21
  • 22. @stoeps Rotate Logs – IBM HTTP Server • Default: no max size for access_log and error_log • Often some GB of Log files • Open with an Editor? • Disk size • Search for this lines in httpd.conf: • Comment out: 22 # CustomLog log/access_log common # ErrorLog logs/error_log CustomLog log/access_log common ErrorLog logs/error_log
  • 23. @stoeps Rotate Logs – IBM HTTP Server • Add: • Delete Log Files older than x days • Linux • Windows (Batch through Task Scheduler or Powershell) 23 Linux: CustomLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|/opt/IBM/HTTPServer/bin/rotatelogs /opt/IBM/HTTPServer/logs/error_log.%Y%m%d 86400“ Windows: CustomLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/access_log.%Y%m%d 86400" common ErrorLog "|D:/IBM/HTTPServer/bin/rotatelogs.exe D:/IBM/HTTPServer/logs/error_log.%Y%m%d 86400" crontab -e # Delete logfiles older than 3 days in logs 10 0 * * * find /opt/IBM/HTTPServer/logs/*_log.* -mtime +3 -exec rm -rf {} ; forfiles -p "D:IBMHTTPServerlogs" -s -m *_log.* -d -3 -c "cmd /c echo @file"
  • 24. @stoeps Rotate Logs – DB2 • db2diag.log • Default: no maximum size • Always stored on C: • Full C-Partition in Windows still hard to solve 24 [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 0 [db2inst1@cnx-db2 ~]$ db2 update dbm cfg using DIAGSIZE 1024 DB20000I The UPDATE DATABASE MANAGER CONFIGURATION command completed successfully. [db2inst1@cnx-db2 ~]$ db2 get dbm cfg |grep -i diagsize Size of rotating db2diag & notify logs (MB) (DIAGSIZE) = 1024
  • 25. @stoeps HTTP Server Keystore • Several Reviews showed • Keystore of WebSphere Plugin used for IHS SSL Key • Why is this worse? • What would you do when you get SSL Errors within Connections? • This overwrites plugin-key.kdb on your Webserver • SSL Key away • Backup? 25
  • 26. @stoeps HTTP Server Key store • When you want to reuse Plugin Key store • Import SSL Key into CMSKeyStore • But never seen this in the wild • BP: Create a Key store for IHS • ikeyman will help you 26
  • 28. @stoeps Performance Tuning Guide • 4.0 • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.0_Performance_Tuning_Guide • 4.5 Addendum • http://www- 10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connections_4.5_Performance_Tuning_Guide_Add endum • 5.0 CR1 • http://www-10.lotus.com/ldd/lcwiki.nsf/dx/IBM_Connection_V5_CR1_Tuning_guide • Read everything carefully • check and understand dependencies 28
  • 29. @stoeps Worst practice example – Tuning • Customer showed me a system with following infrastructure • WebSphere • Large deployment • 16 GB RAM • 4 Cores • DB2 • 12 instances • 8 GB RAM • 4 Cores • Connections restart 22 minutes Web Server ihs.example.local WebSphere was1.example.local Db2 / TDI db2.example.local Freigabe LDAP domino1.example.local User SynchronisationAuthentication 29
  • 30. @stoeps Solving this • Large deployment means about 15 JVM on the machine • restart shows 15 min 100% CPU usage • adding 4 cores and restart time get down to 7 minutes • other option would be midsize deployment, but then you have to reinstall Connections • Java Heap Sizes set to default (256 MB and 768 MB) -> increase to 1.5 – 2.5 GB • Perf Guide mentions that multiple instances on DB2 only increase performance with enough resources • but that was not the real problem • DataSource connectionPool Sizes are set to Default 1/10 • increase this values to the proposals in the guide and ... • Restart time comes down under 3 minutes • Key point: read the complete guide 30
  • 31. @stoeps Java Heap Size • Default Java Heap Sizes on Midsize Deployment: 2506 MB / application server • Large Deployment depends on application: 0.5 to 2.5 GB • Main part in memory tuning • never exeed the system memory • SWAPPING KILLS ALL YOUR TUNING EFFORTS • counting the JVM Heap sizes is not enough • maximum heap is not the maximum amount of memory the jvm uses! • libraries, jars and so on count additional to memory usage • JVM memory usage may be 3 * JVM maximum Heap • initial and maximum Heap Size should be equalized 31
  • 32. @stoeps IBM HTTPServer • enable compression • important • see Slides from BP307 - IBM Connect 2014 • save up to 70% network traffic • minimal increase of CPU load • enable file download through IHS • depend on your deployment • often security forbids storage access from DMZ • if you have no access to file share from IHS -> Files should be installed in a separate Cluster 32
  • 33. @stoeps Midsize Deployment - Files • Often IHS positioned in the red zone (DMZ) • No Access to SHARED DIRECTORY • Create a Cluster for Files • No Problem with Large Deployments • With Midsize you can add an additional Cluster during Setup • http://www- 01.ibm.com/support/docview.wss?uid=swg21317658 33
  • 34. @stoeps Activate Synchronous File transfer • Servers -> Application Servers -> serverName -> Web Container Settings -> Web Container -> Custom Properties • com.ibm.ws.webcontainer.channelwritetype=sync 34
  • 35. @stoeps ENHANCE USER EXPERIENCE Happy admins with happy users 35
  • 36. @stoeps User Synchronization • IBM provides some great batch files and assembly lines • TDI Solution Best Practices • do not use tdisol from Wizards Archive • I find often scheduler which links directly to the used wizard folder • never seen updates applied to these folders • Updated archives can be found in <connections root>tdisol • with 4 and 4.5 often special TDISOL Update packages on Fixcentral 36
  • 37. @stoeps Be aware of sync_updates_hash_field • Possible values • uid (default) • guid • email • Value is used to find matching persons between LDAP and peopleDB • Possible problems • User renaming • Shortname reuse (retired and newly hired users) • What happens when you rename a Domino user? • Email address changes • Shortname (uid) changes 37
  • 38. @stoeps What can happen • sync_updates_hash_field=uid • User is renamed • Normally no problem, because in Domino Shortname can store multiple values • User retires • Inactivated or deleted user within Profiles • User hires again • User is reactivated • Other User with same UID hires • Will get all data from old user account (picture, tags, community membership) • Splitting of this content is not possible 38
  • 39. @stoeps What can happen • sync_updates_hash_field=email • User is renamed • On First TDI run the user gets inactivated • new profile will be created • no content available -> you must manually map the content to the new account • User retires • inactivated or deleted user within Profiles • User hires again • User is reactivated • other User with same mail address hires • will get all data from old user account (picture, tags, community membership) 39
  • 40. @stoeps What can happen • sync_updates_hash_field=guid • User is renamed • all data synchronize with LDAP • User retires • inactivated or deleted user within Profiles • within Domino the person document is deleted • User hires again • newly registered user has new guid • new profile • duplicate login data -> no new profile -> you can use populate_from_dn_file.bat 40
  • 41. @stoeps Single Sign On - LtpaToken • Single Sign On within IBM portfolio • Domino only supports one domain per Web SSO Document • You can copy & paste Web SSO Documents and change Domain names (see e.g. Paul Mooney - AdminBlast 2012 – Tip #4 • DNS Domain is multi value (works until Domino 8.5.x, but not with Domino 9.x) • Servers with mixed Internet Site and Non-Internet Site usage: copy & paste too! • Often internal servers use local domains, when Connections is external accessible SSO needs workaround • adding additional hostnames to domino • You can use IHS (IBM HTTP Server) as a reverse proxy to access iNotes 41
  • 42. @stoeps Single Sign On - SPNEGO • Requirements • Windows 2003 / 2008 Active Directory • Websphere Service must start as Domain User • connectionsAdmin j2c Alias must be a LDAP User • configure use documentation and http://de.slideshare.net/david_hay/dave-hay-desktop- single-signon-in-an-active-directory-world?related=1 • real additional value for users • easy to deploy, when you have the rights and clue what to do • do not test Browser Single Sign On with Chrome, because process does not end when you close the last window 42
  • 43. @stoeps Mail integration • Use IBM HTTP Server as reverse proxy to access iNotes LoadModule rewrite_module modules/mod_rewrite.so <IfModule mod_ibm_ssl.c> Listen 0.0.0.0:1443 <VirtualHost *:1443> ServerName connections.example.com SSLEnable RewriteEngine on ProxyRequests Off ProxyPass / http://inotes.example.local/ ProxyPassReverse / http://inotes.example.local/ </VirtualHost> </IfModule> 43
  • 44. @stoeps iNotes Web Mail Redirect https://connections.example.com:1443 44
  • 45. @stoeps Socialmail-config.xml • when you use reverse proxy to access iNotes • Mail integration works only when you use http or https • Add UseConfiguredProtocol to your configuration • Problem when you need to access multiple iNotes Servers <ServerConfig name="domino-redirect"> <ConfigType>REDIRECT</ConfigType> <RedirectURL>https://connections.example.com:1443/iwaredir.nsf</RedirectURL> <MailPattern type="example.com" /> </ServerConfig> <GadgetConfig> <GadgetPreference id="UseConfiguredProtocol">true</GadgetPreference> </GadgetConfig> 45
  • 46. @stoeps Mail integration and SPNEGO • LtpaToken contains AD $DN • Lookup in Domino Directory with this DN -> user is not allowed to open mail • Solution • Add AD $DN to ACL • Or add AD $DN to Domino Fullname (AD DN contains , as delimiter between ou) • Or: • http://tdiblog.anderls.com/2015/02/adding-user-active- directory.html • Thanks Andreas Artner (He attends SocCNX, so bring him a beer) 46
  • 48. @stoeps Backup - Overview • I got several calls from customers which installed Connections with installation guides • these guides normally do not mention backup • disk crash means data loss • Database backups through file backup are not supported and mostly not restorable • Important • Database Backup through Online Backups can be taken, when Connections is up 48
  • 49. @stoeps Backup • Most important (minimum daily) • Databases (offline or online) • Shared content • Important • Configuration • WebSphere Application Server • Connections • IBM HTTP Server • TDI Solution • Test if restore is possible!!!! • Several issues with WebSphere restores, where binaries weren't on the tape 49
  • 50. @stoeps Checklist Do's • Create a documentation of all installation steps • Documentation sometimes confusing, because all OS within one document • Be prepared for scaling • Shared directory on UNC path • No small deployment installations • Tune your environment • Deactivate Antivirus • Deactivate "Security" Tools during installation & SELinux / AppArmor Don'ts • Use multiple instances DB2 with small resources • install on a single machine • copy customizing to newer versions • jsp, ftl copy will break something • use unstable file shares • Test deployment with server IE • Test with only one language • unzip with builtin tool of Windows 50
  • 51. @stoeps Installation Checklist • WebSphere Application Server • Configure Federated Repository • LtpaToken, enable security • WebSphere Application Server Supplements (IHS, Plugins) • DB2 (or other DBM) • TDI • Add Webserver to Dmgr (use configurewebserver.bat) • Enable SSL on IHS • Import IHS Root Key within WebSphere trust keystone (retrieve from port) • Configure CCM 51
  • 52. @stoeps Documentation of your environments • Create valid documentation and keep it up-to-date • nobody likes creating documentations (except Sharon) • Good overview for troubleshooting and migrations • nobody needs long text versions or hundreds of screenshots • Use the Sheet provided within the documentation • http://www- 01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/admin/pl an/r_worksheet_installation.dita • Or download a Microsoft Excel version of this at (Kudos to Keith Brooks) • http://blog.vanessabrooks.com/p/downloads.html 52
  • 53. @stoeps Tools • Editor with syntax highlighting • vim, geany • notepad++ • Tail • baretail • multitail • mtail • Proxy • Fiddler (often asked from Support) • Burpsuite (intercept proxy) • Browser • Firefox (portable) / Firefox ESR • Chrome • IE (download vm with different versions) • https://www.modern.ie • Network analyzer • Wireshark • tcpdump • Unzip / Unarchiver • 7-zip 53
  • 54. @stoeps Links • IBM Connections Requirements • Official Documentation Connections family • Connections 5 Documentation • Tuning Guide 4.0 • Tuning Guide Addendum 4.5 • Tuning Guide 5.0CR1 54
  • 55. @stoeps Blogs with IBM Connections stuff • http://www.stoeps.de • http://scripting101.org • http://martin.leyrer.priv.at/ • http://kbild.ch • http://dilf.me.uk/socialshazza • http://www.notesgoddess.net • http://ibmconnections.com • http://notesbusters.com • http://wannes.rams.be • http://turtleblog.info • http://portal2portal.blogspot.de • https://www.urspringer.de • http://meisenzahl.org/ • http://socialconnections.info • http://blog.robertfarstad.com • http://www.curiousmitch.com 55
  • 56. @stoeps PLATINUM & CHAMPAGNE SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
  • 57. @stoeps Thanks Christoph Stoettner christoph.stoettner@panagenda.com Blog: www.stoeps.de Twitter: @stoeps LinkedIn: christoph-Stoettner Download vCard: https://www.panagenda.com/download/vCard/Stoettner_Christoph.vcf

Editor's Notes

  • #12: Round Robin, example of a workshop -> 2 Domino Servers with 4 IPs and 2 DNS Names -> but LDAP was bound to only one IP of each server, so on each second lookup the ldap can't be accessed.
  • #15: Screenshots für wasservice, monitoring policy, change websphere variables
  • #31: never seen issues with one instance DB2 and some thousand users, but i always tune the DataSource connection Pool settings