Jan Schulz

Another "Fun with..." blog entry...

Substitution are great: tired of domian.com/subdir/blog.nsf/dx/something? Then define a URL substitution (/subdir/blog.nsf -> /blog) and you get domain.com/blog/dx/something. Thats nice!

Unfortunately there are some gotchas as we found today:

• You can't use the substituted URL as a homepage: putting in /blog/dx/default will result in an 404. Which would anyway be stupid as your linked content (css, js, pictures) is not anymore available, as the browser gets the result of it as / and not anymore as /blog/dx/something. So looking for ../css/default.css would result in domain.com/../css/default.css, which is of course not available. The workaround: put the complet URL there: http://www.domain.com/blog/dx/default and the browser gets a redirect to that URL. Unfortunately this results in an additional dns request in most browsers, (= a little more wasted time) . Just redirecting to /blog/dx/default seems not to be possible (please prove me wrong...).
• You can't get the browsed un-substituted URL *anywhere* in the called code: there you only get the translated CGI Variables, meaning you have no clue what you are called. This is a problem if you want to redirect to a DB configured default homepage. An example: I would browse domain.com/blog, this would open the subdir/blog.nsf and in there the configured element. In my case it is a page (form or agent not possible :-( ), which has some ComputedText on it, which redirects to the default document (/dx/default, configured in a profile doc). As the redirect needs to be absolute, I need the pathentry before the view name. @WebDBName gives /subdir/blog.nsf, as gives *all* CGI variables with path infos (at least in an agent). Now I need to have this piece of information available in the DB Profil, that this DB is called /blog and not /subdir/blog.nsf. Keeping the same data in two place is bad.
• The same problem arise, when you use logins and substituted URLs: call "/blog/page?OpenPage&login" and you get redirected to "/subdir/blog.nsf/page?OpenPage&login" (using "/blog/dx/default?login" you get redirected to "/". WTF?). This is not nice if you really want to hide your internal structures. I haven't yet tried what happens if you just put anonymous as No access and so get a loginpage without ?login. I suspect it's the same.
  

All in all: URL substituition is really usefull, but doing somethin more facy with it and it becomes a struggle...

Our Domino Mailserver crashed or better became unresponsive with the server task at 100%CPU. The log showed during that time:

• Unable to access notes.ini. Determine what application or hardware fault is preventing access. Previous cache values used.
• Error updating local ID file: Could not open the ID file

Also, there were a few "Too many open Files" Error in DDM (mostly fulltext index files, sometimes also databases) which I at first didn't relate to this. It started after the 8.0.2 update in fall and got worse after that. A restart of the domino "fixed" the problem, but after the xmas holidays we had to do this every day :-(

The Server was a ubuntu linux (latest LTS-release). The first level IBM Support couldn't help and the second level Support didn't want to support us as we are running an unsuported OS :-(

I turns out, that the problem was a too low "ulimit -n" of 1024. This limits the open files of processes and can be set via PAM configuration files. Our domino server process has about 700 open DBs + other files in normal mode:

# lsof |grep " lotus " |grep "^server" |wc -l
1135

I suspect that the IO changes in 8.0.x and also that we had to add a few new databases during the start of term (we are a student organsation and we get new member during that time) were the reason why we never saw that before and also didn't see this on a different domino on the same Server, but without so many mailfiles.

The changes to fix it were:
/etc/security/limits.conf
+ lotus            hard    nofile          4096
+ lotus            soft    nofile          4096
also add this line in /etc/pam.d/su:
+ session    required   pam_limits.so

The last change is because we use the rcdomino startscript, which uses su to start the domino server.

After that: no more hangs...

Anyway: I still suspect a bug, as the domino should not hang without an error if that problem occures. Lets see if the report in our PMR gets a reaction :-)

Another question: what is this limit on RedHat or Suse systems? We are not really big, so othere should have run into this much earlier if the limit wouldn't be higher... Or it really is an ubuntu problem...

Our user are not allowed to change the "owner" of the mailfile via Mail-Policy.

Unfortunately you can still change the owner via web:

=> You can change it and it is saved.

We discovered this by accident: our mailfile is slightly altered, so that we can put Mail-In Names into it and use it as Teammailbox. The only change is to remove part of the validation formular for the owner field (which checks for hierarchical Names), so that the preferences can be saved (like for a signature change). Unfortunately this also is not so in the web version: you still get the message that the Owner must be hierarchical and so some clever person changed the group mailbox to his own name :-(

As this is anyway changeable by tools (and we have some people who discoverd such tools...) it does not seem to be a security risk, but it seems that this makes using the default template as a team mailbox or generaly in the web slightly more troublesome :-(

This is 8.0.x... Fun...

I've a linux server, which sometimes hangs with a server task at 100% CPU and lines like this in the log: "Unable to access notes.ini. Determine what application or hardware fault is preventing access. Previous cache values used." or " Error updating local ID file: Could not open the ID file". A restart fixes this, but never for long (sometimes same day, sometimes weeks). It seems like this started with the 8.0.2 Domino.

I searched the IBM site for similar bugreports an found Domino server hang after NTI error iError: 9, failed with TLOOK. Unfortunatelly I've no idea, if that's really our bug (somedebug output needs to be enabled, but the article does not say what) and also the SPR seems not yet in the fix list.

We habe a PA Account, but I couldn't find the "report a bug" link on the IBM site and it seems I don't have the rights to open a Service request. So: How do I report a bug? Just write it in the forums?