Jan Schulz

Oh my, wasn't there a more professional way to do this:


Basicly it looks like they took two things and just placed them on top of each other... When you click on the splash screen you can move it around, but without the progress bar. If you click on another process and then on the notes process, only the progressbar is shown (fun again...).

Anyway: back to the basic client... Why?

• You can open two ID Files/ Notes instances at the same time (normal and Admin)
• Simple much faster
• a lot easier for the admin (i know the internals of my data directory to fix any isue I came across, but not of the data/workspace one...)
• I haven't found anything in the fancy new UI, which I really need.
  

8.5 will be bad: I can't open two IDs anymore, because I need the designer client in my admin instance, which is usually the second client I open. And using Designer in 8.5 means that I have to open my admin notes first (one of them can be a standard client, but it must be the first one), which basicly means that each time I have to look something up in the design, I have to close my normal basic notes, my admin basic notes, open the admin standard notes, switch to designer and open my normal notes. And it takes ages to open a not-yet-opend database in DDE. This sucks!

Our Domino Mailserver crashed or better became unresponsive with the server task at 100%CPU. The log showed during that time:

• Unable to access notes.ini. Determine what application or hardware fault is preventing access. Previous cache values used.
• Error updating local ID file: Could not open the ID file

Also, there were a few "Too many open Files" Error in DDM (mostly fulltext index files, sometimes also databases) which I at first didn't relate to this. It started after the 8.0.2 update in fall and got worse after that. A restart of the domino "fixed" the problem, but after the xmas holidays we had to do this every day :-(

The Server was a ubuntu linux (latest LTS-release). The first level IBM Support couldn't help and the second level Support didn't want to support us as we are running an unsuported OS :-(

I turns out, that the problem was a too low "ulimit -n" of 1024. This limits the open files of processes and can be set via PAM configuration files. Our domino server process has about 700 open DBs + other files in normal mode:

# lsof |grep " lotus " |grep "^server" |wc -l
1135

I suspect that the IO changes in 8.0.x and also that we had to add a few new databases during the start of term (we are a student organsation and we get new member during that time) were the reason why we never saw that before and also didn't see this on a different domino on the same Server, but without so many mailfiles.

The changes to fix it were:
/etc/security/limits.conf
+ lotus            hard    nofile          4096
+ lotus            soft    nofile          4096
also add this line in /etc/pam.d/su:
+ session    required   pam_limits.so

The last change is because we use the rcdomino startscript, which uses su to start the domino server.

After that: no more hangs...

Anyway: I still suspect a bug, as the domino should not hang without an error if that problem occures. Lets see if the report in our PMR gets a reaction :-)

Another question: what is this limit on RedHat or Suse systems? We are not really big, so othere should have run into this much earlier if the limit wouldn't be higher... Or it really is an ubuntu problem...

I remembered that eclipse had an application container (used to be tomcat in eclipse 2.x, if I remember correctly, but should be something else today) to display help. But it looks as if that's not the cause for the firewall warning: When I open help I get another process, which listens on 0.0.0.0:4xxx (x is something different each time). Unfortunately it also listens to all interfaces :-(

Fun: you can get at help via your normal browser (try righ click -> Open in new Window in the help system):

Seems that I really have to try if I can access that URL from a different computer via LAN (and after adding the Firewall exception...)... A complete JSP Container...

Anybody with some experiences with package sniffing and some fun for trying to get at the other process? A normal telnet didn't help :-(

Our user are not allowed to change the "owner" of the mailfile via Mail-Policy.

Unfortunately you can still change the owner via web:

=> You can change it and it is saved.

We discovered this by accident: our mailfile is slightly altered, so that we can put Mail-In Names into it and use it as Teammailbox. The only change is to remove part of the validation formular for the owner field (which checks for hierarchical Names), so that the preferences can be saved (like for a signature change). Unfortunately this also is not so in the web version: you still get the message that the Owner must be hierarchical and so some clever person changed the group mailbox to his own name :-(

As this is anyway changeable by tools (and we have some people who discoverd such tools...) it does not seem to be a security risk, but it seems that this makes using the default template as a team mailbox or generaly in the web slightly more troublesome :-(

This is 8.0.x... Fun...

Notes 8 and higher seems to listen to some ports. Unfortunatelly it seems that it listen to the wrong interface, as I get a firewall warning:


TCPView shows this:


So notes listen on all interfaces (0.0.0.0) instead of on an local one (which would show 127.0.0.1). To show another example, here is "hamster", a local mailserver, which does the right thing and binds only to the 127.0.0.1 interface and never showed up via such a firewall warning:

So two things:

• Why does Notes need to listen on all interfaces?
  If I guess right it is used to communicate between the 'oldstyle' nlnotes and the new eclipse user interface. If so: no need to bind to 0.0.0.0, 127.0.0.1 is enought. This could also mean that someone outside can use my nlnotes autenticated client to see the information?
  Or is notes expecting callbacks from the server? That would be something new for me and as calling nlnotes itself does not do this, so I suspect that this is not the case.
  => So I see no reason why notes couldn't bind to 127.0.0.1 only: less problems with security and no problems with the firewall...
  
• If notes needs to bind to that interface, the installer needs to drill a hole into the firewall, as *every* other windows ("server"-) programm, which needs to do that (this includes skype, bittorent thingies and so on...). I've normaly no admin rights on my laptop (hapy user of sudo fror windows) and our normal office users do not have that at all -> we had to add that to all clients -more or less- manually after installing the client :-(

So: did I miss something? If not: can someone at IBM please fix either the interface-binding or the installer? Thanks!

I've a linux server, which sometimes hangs with a server task at 100% CPU and lines like this in the log: "Unable to access notes.ini. Determine what application or hardware fault is preventing access. Previous cache values used." or " Error updating local ID file: Could not open the ID file". A restart fixes this, but never for long (sometimes same day, sometimes weeks). It seems like this started with the 8.0.2 Domino.

I searched the IBM site for similar bugreports an found Domino server hang after NTI error iError: 9, failed with TLOOK. Unfortunatelly I've no idea, if that's really our bug (somedebug output needs to be enabled, but the article does not say what) and also the SPR seems not yet in the fix list.

We habe a PA Account, but I couldn't find the "report a bug" link on the IBM site and it seems I don't have the rights to open a Service request. So: How do I report a bug? Just write it in the forums?