Lotus Nut

Actually, you may want to consider running this on your servers this weekend if you haven't already implemented DAOS. Get it out of the way... :)

load compact mail -c -ZU - While you're at it, throw in the -v -n switches too to enable body and design compression. And make sure that you've enabled these settings in the advanced properties tab of the templates so that the compression options do not get turned back off by the design task.

You should no longer use the -ZU switch at the same time that you use the -daos on switch. This will make sure that all of the attachments are converted to the LZ1 compression algorithm prior to enabling DAOS. IBM has also recently released Technote 1411563 with information on how they also have changed their recommendations. There is a specific SPR DROO7XBS9B that addresses a specific daoscat issue with doing this in 8.5.2.

 This is definitely an age-old recommendation, but it is something that most customers have problems with. OS-level Antivirus. IBM has finally published a technote (1417504) Recommendations for exclusions when running Operation (sic) System Antivirus. This will definitely be handy to be able to show a customer direct instructions from IBM and not "just" recommendations from a third party (who sees this all the time). Also, you need to disable any specific Lotus Notes scanning on your desktop AV software if it's enabled.

First of all, not setting the exclusions will cause performance issues as the AV software has to scan/check the database/application prior to letting Domino use it. Your disk I/O will be abysmal. Trust me. Secondly, it can cause other random problems (see below) or database corruption.

If you are running a Domino server that also has AV for the OS, you need to get this technote to your Security Administrators and make sure they enable these exclusions! And also, don't just get *.nsf excluded. This technote is very timely because I just had a customer today with some exclusions in place who didn't just have the entire data directory excluded. When a 16GB mail db was going through a copy-style compact, the *.tmp file that was created for the compact couldn't get renamed back to the proper *.nsf file because the AV software had a lock on the tmp file. I just searched for this while writing this blog post (so that you could see how compact -c works in general) and there is also a technote from IBM (1102756) on a similar scenario when running AV software for Domino.

In a nutshell, if you are running OS-level AV on your Domino servers, you need to exclude the following from being scanned:

• Domino Data directory
• View rebuild directory
• Transaction Log directory
• DAOS directory
• Directory links
  

One of the nice tricks with the Domino Administrator Client Files tab is the ability to update ACL's and properties for all databases in a folder and sub-folders. To do this, just right-click the folder and choose from the list of available options. Such as Access Control > Manage:
 
At which point you will receive this window where you can see that all 87 databases are selected and you can Add, Modify, or Remove entries from the ACL of all databases (applications). Note, if you're Adding entries you may have to go back in a second time and also Modify that entry in case the entry previously was listed with a different level of access.


This can also work for Advanced Properties for databases. The trick to this window is that if you choose something in the "Select" column and leave the "Enable or disable" option blank, then it will set that property to OFF for all of the databases. If you check the option to enable, then it will turn it ON. Remember this and don't assume that if you just select it that it will enable it. If you don't select an option, it will not be touched. Note the properties I'm selecting below and that many of them can also be done via the Compact task. But this is a nice UI way to do this.


Also note that any of the options in the right-click list that are not greyed-out are available for this - such as compact, quotas, etc...

And completely unrelated, but if you're a Star Wars geek, try to telnet to towel.blinkenlights.nl...

Earlier today I was renewing the SSL certificate for BleedYellow's IHS server. But I ran into a slight issue in that the IBM SSL Key Management utility (ikeyman) was only giving me the choice of 512 or 1024 bit key length. But now, 2 years later (wow, time flies!), GoDaddy requires 2048 or 4096 bit requests and does not accept a 1024 bit request. This is good to know, for sure! After a quick use of my google-fu, I was able to find this technote and after installing the Java SDK 1.5 SR6 Cumulative Fix for WebSphere Application Server I was immediately able to create the 2048 bit request. Happy SSL'ing!

For Domino 8.5 + there is a new notes.ini setting to create i/o optimized transaction logs for platforms with a block size different than the default 512 bytes.

The notes.ini variable is: Create_R85_Log=1. With notes.ini variables, also make sure you're using the Configuration Document to set these instead of directly in the notes.ini.

A little known ECL setting for Domino is "<ECLOwner>". Adding this in as an entry to the ECL will allow you to control exactly what the workstation user can do with code signed as himself and running on the workstation. More information can be found here. Recently I have seen where -Default- has allowed all of the methods (please, do NOT have your ECL configured this way!!!) and when it was previously removed in testing the users were prompted to add ECL entries for themselves when opening folders (or doing other such things). The solution is to grant <ECLOwner> the proper rights first and then to begin the process of revoking rights for -Default- and "No Signature".

And if you haven't looked in a while, please go review your ECL (carefully, don't just go revoking people and make sure the account you use has access to modify the ECL within the ECL so that you don't have users receiving those prompts!)

This blog post from the Notes Design Blog by Mary Beth Raven states that unread marks will now work for iNotes folders with 8.5.1 (along with automatic inbox refreshing)! This is something that I've been wanting to see since I first used iNotes in Domino 6.0. Actually, back at both Lotusphere 2003 and 2004 the company I was working for was told by IBM that this would be coming with DWA 7. I even posted an idea for this.

Thanks to IBM for finally enabling this. I can say that this was one of the reasons that iNotes wasn't rolled out as the only mail option for many people at that time. This will be a big success as now iNotes users can get the most out of their email and use rules more effectively since they will now know in which folder that new email lives. :)

Or: Can I DAOSify a Server With < 8.5 Clients?

Recently I have had some colleagues and clients asking about updating a Domino Server to 8.5 and turning on DAOS while still running a mix of 6 and 7 Notes Clients. There is some confusion related to some upgrade seminars that are happening that appear to be using this slideshow. Here is slide 18 that is causing some confusion:


The last bullet is causing confusion. Of course "Domino 6 and 7 clients will not recognize DAOS" - even the 8.0.x client would fall into this category as it was released pre-DAOS - DAOS is a server feature. However, there are no known problems with using an older client against a DAOSified mail template. Here is why: the Domino Server is aware of DAOS. Any requests for an attachment from clients, servers, or services such as BES will be honored by the Domino server sending the attachment. The server will still have to get the nlo file and serve it to the requesting client (or server) over the wire. And, if you are running local replicas it does not matter either because the replica will be pulled down with all attachments inside the database.

Do I recommend a long-term strategy of having 6 and 7 clients with an 8.5 server? Negative. But you can immediately reap some benefits by upgrading your server and enabling DAOS while you are working on your client rollout strategy. And, as the slide above states, you'll need to wait until the clients are upgraded before you can update the template to mail85.ntf. Finally, DAOS is not just for mail databases. I have also sensed some confusion around this. Of course, in most environments, the mail store is where most databases would have duplicate attachments (either internal or shared) and most of DAOS's storage and i/o savings has been revolved around mail files.

Hopefully this helps!

Just thought I would remind everyone out there about the webadmin logo that IBM has been using over the years. Funny how close the 7.0 Beta 4 was to the actual Star Trek logo with the starship in the center. It was changed for the 7.0 GOLD release.

So, I wonder what IBM is trying to say about administrators?? By the way, I'm hoping to go see the new movie this week!

Are you curious to see just how much space you will save with DAOS? Well, first of all, you do know what DAOS is, right? If not, here is some information.

IBM has released a tool that will analyze a set of databases you specify and compare the duplicate attachments to let you know how much space you can save after enabling DAOS. Here is a document on how to use the tool. And here is another document with the information on how to download the tool. The tool can run against 6.0+ servers.

So....how much will you save?

Prior to Domino 8.5, if you wanted to enforce custom notes.ini settings or location preferences you would have to modify the design of the Desktop Policy settings form to include $Pref or $LocAll fields, respectively. I know a lot of people who have shied away from doing this because they weren't "developers" and did not want to go into Designer and modify the Directory. With Domino 8.5 this has been made much simpler.

Just open the Desktop Policy settings form and go to the "Custom Settings" tab. This gives you the following:


From here, you can click "Edit list" to get the following dialog:


You can then add, modify, or remove the Notes.ini, Locations, and Managed settings.

"What is a 'Managed setting'?", you may ask. It is a setting that controls Eclipse plugin configurations. Here is some further information on Managed Settings. If you want to enforce Notes SSO with Sametime, you would have a setting that looks like this:


Thanks IBM - this is much simpler. Now, could we have lists in the value boxes with possible settings names? :)

At the official IBM Domino Blog, Andrea Waugh-Metzger has asked for feedback on how you use (or don't use) Domino Policies. Here are the questions that you should go answer:

So, policies can really help make your administrative life much, much easier and can help you control a significant portion of your environment.  So let me ask you a couple questions...

1. Do you use policies in your organization today?
2. If so, how do you have them implemented?  Is it by OU?  By groups of users?  Or just one big policy?
3. What do you leverage policies for?
4. What would you like to see done with policies?
5. What questions do you have about policies and/or how they work?

I know that I've seen Domino Policies severely underused by most companies. So, do you use policies?

I would like to introduce you all to David Brown (that guy who sits beside me at work!) and his new blog Port 1352.

I would like to inform you of a new blogger - Chad Scott. From his introductory post:


Chad also has a post related to some Issues in Notes and Domino 8.0.1 and how IBM is handling them.

Welcome Chad!

The other week I was made aware of something I did not know was possible. It turns out that the reason I never knew it was possible was that it is new with Domino 8. I found this out after attempting the trick on a Domino 7.0.3 server... :)

With previous releases of Domino, if you wanted to remove a line from the notes.ini, you had to manually edit the file. But now, with Domino 8, you can type set config Notes_ini_Setting= and this will remove the line completely. In previously releases, the line would still exist but it would just have a null value. Below is a screen capture of me doing this.



You can see that I show config to verify the entry exists. Then I set it to = null. Then I show config again and get "Invalid value for command option" (which means the entry does not exist. Finally, I set it back to its original value and show config again to validate that it exists.

Note: If you really want to make sure the entry is gone (and doesn't re-appear or stay enforced), be sure to look through your configuration documents and also remove the entry from the notes.ini section.