Darren Duke Blog Zone

IBM Domino now includes IBM HTTP Server - but how do you find it?

Darren Duke — Wed, 15 May 2013 12:24:29 -0400

Well, first you probably want to know why IBM added the IBM HTTP Server (IHS) to Domino.....basically to allow Domino to do TLS over HTTP (which native Domino HTTP cannot do....it can do TLS over SMTP but not HTTP), but I think it was also a roundabout "fix" some SSL scaling issues that Domino can have.

So how do I get it?

Well, it's built into the 9.0 installer for Windows Domino servers (other OSes, you are out of luck....complain via a PMR) but you only see it when you do a custom Domino install:

Once you select that you now get a new option on the next screen:

Check that new option and IBM HTTP Server will be installed on the same server as Domino. You can use this for Traveler too, just make sure you install Domino 9.0 IF1 if you are as there is a bug on the gold code.

Once you have it installed there are still some tasks to do with the server's notes.ini file as outlined in the 9.0 admin help and it is worth nothing when you add the following to the notes.ini file

HTTPIHSEnabled=1

the Domino HTTP now listens on port 9288 for loopback connections from IHS and that Domino will only accept connections that originate from the same computer.

Running Domino on VMware or other "sub-capacity" platform? You know about ILMT right?

Darren Duke — Thu, 9 May 2013 10:25:57 -0400

This post came out of an email where an IBMer threatened to audit an STS customer because they didn't renew. The customer got a better deal switching to a different license type (thanks to STS) which ended up being a new-net purchase and not a renewal, hence the IBMer was none too pleased. Lisa convinced me not to make this ass-hat IBMer famous in this post. But what I will do is outline what you need to know as a customer who uses sub-capacity licensing within your organization.

When you accept your IBM software agreement (you know, that thing you never read and click "OK" on to get the software) there are several stipulations in that agreement that you should be doing as you have now agreed to them (you clicked "OK").

The backbone of this is that you agree to install and keep the results of the "IBM Licensing and Metric Tool" (ILMT). This tool basically tries to estimate your compliance to the PVUs you use to the PVUs you have purchased (I have a spreadsheet that does this way better, but that is a different story).

I will distill the requirements for ILMT into what I believe is fairly close to letter of the license. I am not a lawyer, nor did I stay at a Holiday Inn so do not take this as a guarantee of accuracy. This is IBM's license, so IBM would probably win in an argument (and they almost certainty have more lawyers than you do).

All of this information is based off the Sub-capacity licesnsing FAQ on the IBM site.

The rules basically follow:
1. All PVU licensed software installed on a "supported" sub-capacity platform is applicable to ILMT monitoring unless you are exempted (I have listed the exemptions below)
2. No information is sent to IBM, but you are required to retain 24 months of historic ILMT data (presumably for IBM audit purposes)
3. If you are required to use ILMT then you must install ILMT within 90 days of accepting your first PPA agreement that would fall within the need for ILMT
4. There is no separate sub-capacity agreement any more, as it was combined into the standard agreement in 2011

So, pretty bullet proof right? Well there are some exemptions:
1. Any per user software is not applicable, that would include CEO and most Express Domino licenses (but Domino Utility Express *is* as this is PVU based)
2. If the ILMT is not yet supported on your chosen sub-capacity platform
3. Customers with less than 1,000 worldwide employees, excluding service providers
4. Customers with total physical capacity of their servers with sub-capacity licensing within their worldwide enterprise is less than 1,000 PVUs
5. You have purchased PVUs for the full physical capacity of the server running a sub-capacity license

OK, so there you have it. Unless you can check off one of the above boxes for all your sub-capacity licenses then you are required to use and record ILMT results.

Also note, that even if you are exempt from tracking ILMT results, it does not absolve you from the need to be in compliance.

Here is the actual text from the link above describing the exemptions:

What are the exceptions to the requirement to use ILMT for sub-capacity licensing?

There are four exceptions – the tool is not required when:
1. IBM License Metric Tool does not support the customer's eligible virtualization technology. Once support for an eligible virtualization technology becomes available (via Fix Pack, new version, release, or modification), they will be required to install IBM License Metric Tool within 90 days of that availability date. In order to be notified when IBM License Metric Tool support for eligible virtualization technologies become available, they will need to subscribe to "My Notifications". They may also monitor the Eligible Virtualization Technology exhibit for additions on the Sub-Capacity Licensing page available from the Passport Advantage Web.
2. The customer's worldwide enterprise has fewer than 1,000 employees and contractors, excluding Service Providers, and customers who have contracted with a Service Provider to manage their virtualized server environment. Therefore all Service Providers must use the IBM License Metric Tool. (Service Providers are any entity that provides IT Services for end user customers, either directly or through a reseller.)
3. The customer's total physical capacity of their servers with sub-capacity licensing within their worldwide enterprise is less than 1,000 PVUs
4. The customer's servers, with PVU-based products that are eligible for Sub-Capacity licensing, are licensed to the full capacity of the servers.

ATLUG is May 16th and I will be presenting on IBM Lotus Traveler security

Darren Duke — Mon, 6 May 2013 13:28:04 -0400

Luckily there is also another presenter so don't let the fact that I'm presenting keep you away :)

Here's the abstracts and the registration details for the IBM hosted event from 11:30AM to 1:30PM on May 16th :

We have two presenters for our May meeting.
Brad Balassaitis of the PSC Group will present,
Presenting Data Effectively with XPages

A critical feature of any application is the organization and display of the data. In the Lotus Notes client, data views generally all look the same, but when designing an application for the web, users expect more and XPages delivers!
In this session, we will review many options for displaying data. We will cover core controls (including the View Panel and Repeat Control), Extension Library Controls (including the Data View and Dojo Data Grid), and even a third party option. After taking a look at each control’s features and drawbacks, you’ll be armed to make the best decisions for displaying data in your applications.
Brad Balassaitis has been developing Notes and Domino applications for 17 years, focusing on XPages for the past 3 years. He is a Senior Consultant on the Collaboration Team at PSC Group (psclistens.com), developing custom XPages applications to meet clients' needs. He blogs about XPages at xcellerant.net and has recently been published in The View and on NotesIn9.

Darren Duke of Simplified Technology Solutions (STS) will present,
“I have a Traveler server; maybe I should secure it some”.

An iPhone or iPad was given to you, "Make this work with Lotus", you were told. And so your Traveler server was born, much like BES before it, with nary a thought for "production use".
Traveler is a virulent technology, users flinging iPhones, iPads and Android devices at you at an alarming rate. There is no one-to-one relation for devices to users here… some folks have 4 or more devices attached to your Traveler server. You look like a rock star! "About time" you say to yourself.
But is it secure? Am I letting my users send free text passwords OTA (even with HTTPS there are more secure options)? Do you even know the security options available to you? Come learn what you can do to secure these slippery endpoints, these public facing servers and keep looking like a rock star……
Darren, technical guru at STS, the once vocal "bad cop" on "This Week In Lotus" podcast, Lotusphere and Connect speaker, sporadic blogger, ranting tweeter, and all round snarky guy will endeavor to both entertain and educate you in this neglected but very important area.

--Lunch will be provided by IBM! –
--Due to IBM security you need to reply if you are planning to attend the meeting. --
Please reply to randy.davison@macys.com no later than early morning, Tuesday, May 14, 2013.

Update to the Domino cluster post, when to use "SERVER_RESTRICTED"

Darren Duke — Wed, 1 May 2013 12:02:39 -0400

After the last clustering post, Stop users accidentally connecting to passive Domino cluster servers I've had several people ask when I would use SERVER_RESTRICTED as I'd indicated I would not use that to keep users off my clusters.

Well, let's look at this scenario where you are running an active-passive cluster (that is one server handles all user requests-the active; the other handles fail over when the active is down-the passive):
1. Your active server goes boom for whatever reason, hardware, crash, virus, asteroid hit..... Users fail over to passive.
2. You replace, repair or otherwise get active back online and the server is up and accepting user requests.
3. To get users off the passive and back to the active I would add SERVER_RESTRICTED=1 (or 2, 3 or 4 see below) to the passive server notes.ini. This will redirect all new open database requests to the rejected and forced back to the active. Users with active requests continue as usual on passive.
4. I would let the happen for a few hours or days then drop all users off passive after hours.
5. I would then remove SERVER_RESTRICTED from the passive notes.ini and let SERVER_AVAILABILITY_THRESHOLD on the passive protect is from users drifting back to it. All users should now be back on active.

You can also use this technique to force users off an active and onto a passive for maintenance reasons by applying basically the same theory.

This is not to say this is the only use for SERVER_RESTRICTED, but it is what I use it for. Note that there are multiple options for SERVER_RESTRICTED (1-4) and these are documented in IBM Technote 1089278 and what you choose will depend upon your outage reason.

Integrating Lotus Notes (or is that IBM Notes) with TAPI so you can call from contacts

Darren Duke — Mon, 22 Apr 2013 17:21:25 -0400

While technically this *should* work with any TAPI provider I got it to work with an Avaya IP Office 500 which I see at a ton of SMB's. I like them too, nice pieces of kit.

Anyway, thanks to Ulrich Krause's post on SearchDomino with code that can hook into TAPI I finally got around to trying to tie my Contact DB with the IP Phone. Here is how I did it....

Caveats:

This is is on Windows 7 x64
This can be done for any Notes app.....knock your self out, just change Ulrich's code to look at the field you want
Using the vendor provided TAPI driver, in this case Avaya that came with 4.2.46 user software from the Avaya web site

1) Install TAPI from the vendor of your phone system. Reboot.
2) Once installed go to Control Panel/Phone and Modem, Advanced and hit "Add":

3) Select your vendors TAPI provider here and click Add. With the new provider in the list select it and click Configure:

4) Enter your IP Office server IP address and your user name or extension and password (if set):

5) Reboot. Yes, lots of reboots.

6) After the reboot use the Windows Phone dialer (dialer.exe) and go to Tools/Connect Using.... and pick the TAPI you just added, in my case it is called IP Office Phone (if you don't see it here in the list, go back to step 2, remove the provider and immediately re-add it, this worked for me):

7) Make sure that the dialing properties are set correctly by entering Tools/Dialing Properties. I had to play with Area Code Rules to get my dialing out correctly, specifically Include the are code and to dial a "9" for an outside line:

8) With that done, you should be able to make a call out via the dialer app:

9) With that done you have set up TAPI and can now move on to Notes......copy Ulrich's code from the link above, create an Agent in your Contacts DB and paste the code in (I called mine "Dial Number"). The website above seems to have truncated the code so make sure you have it right.....DDE complains but for me ensuring all the IF's and the Declare were on the same line as in this screen shot fixed the errors:

10) With the agent created open your contact DB and from a view or the document, click Actions/Dial Number:

11) The Dialer.exe app will fire up and the number in the OfficePhoneNumber field will be called. Provided you correctly configured dialing properties it should dial out and put your phone into speaker phone mode:

Pretty simple when you know how, but nowhere on the web could I find all the instructions in one place.

Again, I all did was screen shot the crap out of this, Ulrich's code is the part that makes it "easy".

PVU changes with new Intel CPUs - yes, just when you thought you knew Domino PVU calculations.....

Darren Duke — Thu, 18 Apr 2013 18:06:00 -0400

Not sure when this happened, but IBM has now tiered the PVU requirements, which also affects Domino. This affects Intel CPUs (AMD are still all 50 PVUs per core)

Basically this tiered approach requires you to have a higher number of PVUs per core the more sockets you have in a single server. It's basically this:

<= 2 sockets : 70 PVUs per core (this is also any 5xxx series Xeon)

3 & 4 sockets : 100 PVUs per core

> 4 sockets : 120 PVUs per core

So just when you thought there was no way on earth you could hate the evil that is PVU, well....you were misguided. This seems to be a high end server tax, but maybe I'm just jaded (look at the link below.....jadeAction....erm....) and see this as a way to wring dollars out of audits.....or not. It's worth pointing out that some of these servers could have the same model of CPU, but the more sockets you add to a single server, the more you add to the higher the PVU "tax". More than eyebrow raising.

Anyway all the details are here:

https://www-112.ibm.com/software/howtobuy/passportadvantage/valueunitcalculator/vucalc.wss?jadeAction=GUIDE_TREE&CLEAR_DATA_FLAG=CLEAR_DATA_FLAG

Stop users accidentally connecting to passive Domino cluster servers

Darren Duke — Mon, 15 Apr 2013 08:17:45 -0400

In clusters I prefer to split my users between them, but if you don't do that (or can't, because as you have a Domino cluster server at a remote DR site for fail over only) then you can do the following to stop users accidentally connecting to the dormant/passive cluster member:

Add SERVER_AVAILABILITY_THRESHOLD=100 to the dormant/passive server notes.ini file.

Once you add that you should eventually see the server availability switch to this:

Some things to understand here....
1. Users will no longer "float" by accident onto the passive server
2. Admins can still access the server
3. If the non-passive server is down (crash, power outage, asteroid hit) then the Notes clients will fail over to the passive server regardless of the setting
4. You can prevent users from accessing passive servers by other means (I'm thinking of the server setting SERVER_RESTRICTED here, but know what you are doing when using this. It is *not* the same as SERVER_AVAILABILITY_THRESHOLD)

As usual this post came about because I was asked about this functionality twice in the last few weeks.....

Want to know the Achillies Heel of Domino Security? It’s internet passwords and the lack admin control over them

Darren Duke — Wed, 10 Apr 2013 12:10:07 -0400

I just sat in on the excellent "Securing Domino Web Server" open-mic hosted by IBM. Go watch the replay when it is available, easily worth 60 minutes of your life. This showed how to "harden" a Domino web server and they think handled all the points well, with one exception (and I don't think is the fault of the presenters, but more a serious Domino issue). The user side of the equation. The people with the shitty passwords like "1234" and "password".

It is no secret the users and their organizations wish to rid themselves of the Notes ID. Hell, even IBM are developing everything these days on Websphere. For some organizations this means utilizing Domino as web server, as Traveler server or as an LDAP repository for authentication to WAS based or other applications. These all have a common thread, they use the Internet Password from a Domino Person Document. So my final question on the open-mic revolves around an organization that either does not use Notes ID files (let's say for iNotes, Quickr or Connections access) or a customer using Notes Shared Login (new in 8.0 or 8.5 I don't recall). These two types of organizations have two things in common......

Their users never change the Notes ID password. Ever. Never. Never, never, never.

So, if I don't have nor have ever changed my Notes ID password how can I force them to change their HTTP passwords (yes, I can do this via a policy if they change their Notes ID password, but this is not that scenario). The same HTTP password that is used to access Traveler, iNotes, Quickr, Connections, basically everything ICS makes these days? Bottom line, you can't. This is a pretty serious issue that I have brought up several times now only to be told you can do it by policies (with an ID file and not using NSL, yes you can, otherwise you cannot) or use certificates (how does that work well unless I only ever use one PC all the time?). So here is the policy setting document screen shot:

This seems to indicate that you need a Notes ID. Swing and a miss for just forcing an Internet Password change and that, in my opinion is a really bad design flaw in Domino. I just can't, in any practicable manner, force an Internet password change policy and/or an Internet password complexity policy without tying it back to an actual ID file that forces a user to enter a password.

Why not? This is not 1994 folks. Or am I missing something? And this exists already? I'm looking forward to eating crow on this post. So what am I missing?

Go turn on two factor authentication for iTunes and Google et al

Darren Duke — Mon, 8 Apr 2013 16:20:26 -0400

Basically this will hopefully prevent hackers, ne'er-do-wellers and/or relatives from resetting your passwords.

Apple instructions are available at https://support.apple.com/kb/HT5570

Google instructions are available at http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html

There are also others available, like DropBox, AWS, etc and Life Hacker lists some others.....

While we are on about security, I use KeePass Password Safe, the free and open source password manager to create and store passwords. It will create a password like this:

TQErlxux5sKY66zaZCj9

(no, this is not one of mine.....I created it from a blank KeePass entry)

I then sync this via DropBox (the KeyPass datastore is encrypted, mine is AES 256) to my other computers and devices. Great stuff it is to.

Android Traveler updates in 9

Darren Duke — Mon, 25 Mar 2013 18:02:21 -0400

As you would expect the icons have changed:

But you now also get a monthly view in the calendar, along with a handy "Create new event...." at the bottom:

Here's hoping we see "pull down to refresh" and "hold to create event in time-slot" soon as well......

Planet Lotus access via mobile devices

Darren Duke — Wed, 27 Feb 2013 06:37:35 -0400

Wow, really? The first post in 2013. Whoops.

Anyway it used to be that you could go to http://m.planetlotus.org and get the mobile UI for the site. I had issues with getting to any page after page one (basically paging was borked) but after talking with the legendary Yancy Lent he informed me of a change to the URL.

The new URL is now:

http://planetlotus.org/m

I can now page again. My life is complete again. Oh, and I'm loving the auto HTTP link creation in R9 which really makes posts like this a whole lot faster to write, oh and using CTRL+Click to go to the URL.

The curse of the failed Windows Update - not just a Lenovo issue

Darren Duke — Wed, 26 Dec 2012 09:16:23 -0400

Over the past few months almost every Lenovo PC I've staged fails Windows 7 Updates with a "Reverting Updates" and proceeds to reboot several times and none of the updates get installed. I tweeted the solution I found a while back here but I find myself looking for the exact Windows update giving the issue and sometimes Twitter is difficult to get too.....hence the blog, so I can kind it easier, and also this is slide time for Connect 2013 so I find myself doing *anything* but writing slides.....may be tomorrow I should get on to that...

Anyway at first I thought this was limited to Lenovo PC's (mainly as that is all I deal with), but this morning while staging a Panasonic Toughbook I had the same issue.

So the fix? Simple really, just deselect KB2647753 install *all* the other updates at once, then when no updates remain, install 7753 by itself. Issue fixed.

Oh, and and so far this seems to affects both 32 and 64 bit Windows 7 machines.

The somewhat snarky review of 2012

Darren Duke — Mon, 17 Dec 2012 00:08:00 -0400

The year would not be complete without a review of the past 52 weeks of activity, so here goes:

Firefox started the year at version 9 and will most likely end with version 17. Firefox's aging is on par with a dog.

Google Chrome started the year at version 17 and will most likely end at version 25. Chrome's aging is on par with a dog.

IE started the year as shit browser. It will definitely end the year as a shit browser. IE is on par with a dog turd.

Not to be out done by not having an *actual* browser, HP has had almost as many CEO's as Firefox has had releases.

Lotusphere was renamed. But not at Lotusphere. And not in a timely manner. So as not confuse potential attendees it was renamed to Connect. And to further *not* confuse potential attendees a "stream" was added called "Lotusphere". Ironically the word "stream" is very confusing. I expect that in the coming years all IBM conferences will be named the same. This should significantly reduce the chances for IBM cocking up the renaming.

Quickr nary gained a mention during the whole of LS12. I'm guessing we will never see Mac Connectors. Will we see another Quickr?

I wrote a total of 20 blog posts during 2012. Previously that would have been two months worth of posts. There are reasons, mainly I have zero interest in Connections and/or WAS based products. I used Java Application Servers in 2001-2005 and they were bloated then. Oh, and the Domino Blog is getting harder and harder to use. I really need to move it....

Speaking of Connections, Connect should not be confused with Connections. One is a product, the other is a conference to sell said product.

My trusty Lenovo T500 finally gave up on me. I now have a Lenovo W520 with 16GB RAM. Yeah, I'm bragging.

Lotus as a brand is dead. But not really. The messaging was confused and the IT press seemly got the wrong end of the stick. Or IBM did. I'm seeing a pattern here.....

New IBM Champions were added, others jettisoned. I'm sure IBM has it's reasons, but it sure does look like writing a RedBook gets you voted on the island. Telling the Emperor they have no clothes seems to be a sure fire way of getting voted off.

Speaking of no clothes (see how I did that? Smooth eh?), I actually did naked Tweet the LS12 OGS from my hotel bed. You get a lot of followers when you use the word "naked" in a tweet. The video feed was not half bad (of the OGS, not me being naked). Kudos to IBM for that.

Speaking of LS12, that was by far the most uncomfortable CGS in memory. I attended in person, fully clothed and even made it up on stage. A lot of people on the front rows were probably hoping I'd slip and land on a knife.

This Week In Lotus has shuddered to a halt. There are reasons, mainly I have zero interest in Connections. Oh, and the Emperor having no clothes thing....

Notes 8.5.4 was renamed to 9.0. Lotus Notes was renamed to IBM Notes. This is going to make navigating IBM Fix Central interesting.

Symphony is no longer a real product. At least I think. I'm confused over where this leaves users of it.

Passport Advantage is still one of the worst customer facing download sites I have ever used. IBM need to take a look at Microsoft's Volume Licensing site. Truly a wonderful site to use and download software from. Vmware is starting to get bad too.

RIM are still around! Everything will work out for them when they release BlackBerry X, I mean BlackBerry 10. Or more likely not. There is good news, the two pilots that flew this jumbo jet into the ground are gone. But that's the only good news.

To ensure RIM would have plenty of BlackBerry 10 devices at launch they decided to not participate in the Christmas device rush.

MS are using celebs to shift their new phones. Normally this would have no effect on me. But they used Jessica Alba. Touche.

I still have my iPhone 4 (non-s). It'll be replaced with an iPhone 5 sometime in 2013.

I have an iPad 3 now too. I like it lot. Except reading in bed. Fall asleep with it above you head and "iPad" becomes English for "Guillotine".

Someone told me they like the iPad Mini as it fits in their pocket. Are you wearing clown pants? Really? An iPAQ is small too.....

IBM bought Kenexa and dropped it into ICS. It's a "talent management" software application. I don't think that means strippers or prostitutes but if it does IBM deserve kudos for thinking outside the box......imagine the services revenue!

IBM Notes 9.0 Beta Screen Shots

Darren Duke — Thu, 13 Dec 2012 17:43:16 -0400

Well, it seems I've inadvertently deleted the previous screen shot post so I'll keep the URL the same......doh! I've added calendar now too....and for whatever reason embedded images are borked. Wordpress I hear you calling!

Email:
email.png

Calendar:
calendar.png

Domino Blog, so you can see the theme works on non-themed NSF files:
blog.png

new blue icon set:
icons.png

Sametime:
sametime.png

Credit where credit is due - IBM Notes now as an option sure to please the masses

Darren Duke — Thu, 13 Dec 2012 11:14:51 -0400

And I mean users here, not LotiCS faithful.

Over the years I have beat IBM up over the fact the Notepad is superior to Notes when pasting. See here this old post from October 2009 along with the accompanying IdamJam post.....

Anyway with IBM Notes 9 there is a new option (and a keyboard shortcut!!!) in the Edit bar:

Paste as Plain Text

And it works! I just copied some HTML that would give Notes < 9 a heart attack and sure enough across it comes as *expected*. Beautiful.

Kudos to IBM.

Notes and Domino 9.0 beta - a quick list of what floats my boat

Darren Duke — Thu, 13 Dec 2012 09:37:34 -0400

The IBM Notes and Domino 9.0 beta files are downloading to my machine as I type. This is what we used to call 8.5.4 in the Design Partner program, but as everyone now knows it is not Lotus Domino 8.5.4 but IBM Domino (and Notes) 9.0.

Now the NDA has been lifted this is a quick overview (literally 100,000 feet) of what I'm looking forward to.

In no particular order:

Domino on Linux now has a 64 bit version. The 32 bit version is still here too.
Traveler is now available in the i platform (aka AS400, i5, iSeries).
New look UI using OneUI as a basis. (this can be turned off via policy). Also available in iNotes too
New ways to to automatically download an ID file to a new users PC (this Shared Login on steroids)
IBM Notes Browser Plug-in
Windows 8 and Windows Server 2012 support
Windows Phone 7 and 8 (although I still have yet to see either of these in the wild)

I'm sure there are many more, and once I start using the "official" beta I'll post more.

Want to run Quickr on Domino 8.5.3? Well now you can - oh, and IE 9 support

Darren Duke — Mon, 10 Dec 2012 11:34:25 -0400

Update 12/11/2012 - be sure to get the fix pack for your version of Domino! They are now split. See Technote 4029024 for more details.

"Lotus" Quickr....remember that? Starting with Quickr 8.5.1 FP34 you are now able to run on top of Domino 8.5.3.

There are some other items that need to do this:
1. Domino 8.5.3 32 bit
2. Domino 8.5.3 Fix Pack 1
3. A hotfix for Domino 8.5.3 FP1 (available from Fix Central, and here for Windows). See the FP 34 documentation for other platforms.

You can either do this on a new install OR upgrade a current 8.5.1FP5 Domino install. Again, detailed directions are the in the Fix Pack doc file.

Get the Quickr Windows fix pack 34 and the FP doc here.

Also included in FP34 is IE9 support with Luis Benitez blogged about a few weeks ago. No more hacking.....and that's a good thing.

Old school - how to auto delete dead mail in the Domino mail.box

Darren Duke — Tue, 11 Sep 2012 16:54:45 -0400

It happens to all Domino servers. Dead mail. Lots of it. And you have two options, (a) manually clean it up every few days or (b) leave it to grow and grow.

Well, there is a third option. Have Domino delete the dead mail for you automatically. With no code. Like magic. Seriously, I'm not lying. Now, you may have an underlying issue about why you are getting dead mail, but let's ignore that for now and fix the issue, not the symptom.....

Open Domino Administrator, enable full access administration and go the Messaging tab. From here you will see one or many mail.box files:

Click on one of the mail.boxes (you will have to do this for all listed mail.boxes).

With the mail.box open, go to File/Replication/Options for this Application menu item. You should get this window and select "Space Savers" tab:

Simply check the "remove documents not modified in the last (days)". Set the number to whatever you are comfortable with.

Yes, this is a replication setting. But really it's not. No, it's not. Really.

Now any dead mail older than 7 days will be automatically removed.

See. No code. Just magic.

If you have Transaction Logging enabled on your servers and you run a FIXUP.....

Darren Duke — Mon, 27 Aug 2012 10:46:45 -0400

.....be sure to use the -J option.

Transaction logging is good for servers. It's like your parents telling you to eat more fiber, you don't ask why just know that it is. However if you run fixup on database that is transaction logged then it will not actually do anything to that database.

Unless you run it like this that is:

load fixup -F -J dbname

How many Lotus Notes users do I have to license?

Darren Duke — Thu, 23 Aug 2012 11:59:10 -0400

Yep, been asked this quite a bit lately.....

Well, Domino has a function built in but is not turned on that will answer this very question. Not surprisingly called "License Tracking" is a task that runs on the server and outputs a rolling 30 day count of Lotus Notes, HTTP, IMAP and POP3 users that have access the system.

Once license tracking is enabled a new database (UserLicenses.nsf) is created on your administration server and over the next few days or weeks you will start to see this get populated as users authenticate with the Domino servers in your environment.

One of the cool things about using the in-built tracking tool is that users deleted from the Domino Directory are removed from user tracking too.

To enable it, edit the server configuration settings document and change the field "License Tracking" to enabled:

Here is a userlicences.nsf showing the number of currently active users:

So in this case the number of user licenses required is 14. Simple eh?