King0770-Notes: Difference between revisions

(48 intermediate revisions by 5 users not shown)
Line 1: Line 1:
==Additional Articles by King0770==
http://wiki.zimbra.com/index.php?title=King0770-Notes-Merge_Two_Independent_Machines<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-MovingUsers<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Change-LDAP-Log-Levels<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Postconf_or_localconfig<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Bulk_Upload_To_Briefcase<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Sieve_Rules_By_Proxy<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Find_Out_When_Message_Was_Read<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-FireFox_MimeTypes<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-SearchGal-Edit<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-ZCO-Repair<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Download-JDK<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Drop-Single-Mboxgroup-and-Reimport<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-When_innodb_force_recovery_Fails<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Removal_of_Bad_Contact_Address<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Access_GAL_from_Clients_6.0<br>
http://wiki.zimbra.com/index.php?title=King0770-Notes-Nuking_everything_in_a_folder<br>
http://wiki.zimbra.com/wiki/King0770-Notes-error-decoding-message<br>
http://wiki.zimbra.com/wiki/King0770-Notes-YAMM<br>
http://wiki.zimbra.com/wiki/King0770-Notes-Chameleon-Skin<br>
http://wiki.zimbra.com/wiki/King0770-Notes-InnoDB_is_in_the_future<br>
http://wiki.zimbra.com/wiki/King0770-Notes-Calendar-Notes<br>
http://wiki.zimbra.com/wiki/King0770-Notes-Milter_And_DistributionLists<br>
http://wiki.zimbra.com/wiki/King0770-Notes-Check-Submission-Port-587<br>
http://wiki.zimbra.com/wiki/King0770-Notes-Header-Checks<br>
https://wiki.zimbra.com/wiki/King0770-Notes-Verify-LDAP-Passwords<br>
https://wiki.zimbra.com/wiki/King0770-Notes-SpamTitan<br>
https://wiki.zimbra.com/wiki/King0770-Notes-Enable-webui-for-cbpolicyd-Unsupported<br>
https://wiki.zimbra.com/wiki/King0770-Notes-Installing-Proxy-For-Single-Server<br>
https://wiki.zimbra.com/wiki/King0770-Notes-ldapsearch-to-csv<br>
https://wiki.zimbra.com/wiki/King0770-Notes-My-Github<br>
https://wiki.zimbra.com/wiki/King0770-Notes-VNC-Safe<br>
https://wiki.zimbra.com/wiki/King0770-Notes-Whitelist-Spamassassin-MTA<br>
==Removing Messages with Zmmailbox based on the Subject==
==Removing Messages with Zmmailbox based on the Subject==


Line 59: Line 94:
Notable bug report: http://bugzilla.zimbra.com/show_bug.cgi?id=14088
Notable bug report: http://bugzilla.zimbra.com/show_bug.cgi?id=14088


==Spam Info==
If you haven't already, try implementing the use of RBL's. This is from: http://wiki.zimbra.com/index.php?title=Configuring_and_Monitoring_Postfix_DNSBL
<code><pre>
su - zimbra
zmprov mcf \
zimbraMtaRestriction reject_invalid_hostname \
zimbraMtaRestriction reject_non_fqdn_hostname \
zimbraMtaRestriction reject_non_fqdn_sender \
zimbraMtaRestriction "reject_rbl_client dnsbl.njabl.org" \
zimbraMtaRestriction "reject_rbl_client cbl.abuseat.org" \
zimbraMtaRestriction "reject_rbl_client bl.spamcop.net" \
zimbraMtaRestriction "reject_rbl_client dnsbl.sorbs.net" \
zimbraMtaRestriction "reject_rbl_client sbl.spamhaus.org" \
zimbraMtaRestriction "reject_rbl_client relays.mail-abuse.org"
zmmtactl reload
**don't forget to reload Postfix**
</pre></code>
RBL's will usually cut 50% of unwanted mail flow off the top before scanning for spam.
You can also decrease kill and tag percentages, have a look what they are at now. Basically, the lower the numbers, the more aggressive a potential spam will be tagged; I believe we ship with those numbers a little high.
<code><pre>zmprov gacf | grep -e zimbraSpamTagPercent -e zimbraSpamKillPercent</pre></code>
If you decide to adjust zimbraSpamTagPercent & zimbraSpamKillPercent, don't forget to run this command:
<code><pre>zmamavisdctl restart</pre></code>
With the RBL's in place, with a lower threshold, wait for a couple of days, see what the spam traffic is like then.




Line 98: Line 102:
* Spam, Ham, Wiki accounts don't count toward user count total
* Spam, Ham, Wiki accounts don't count toward user count total


==Preferred Method Moving Users To New Machine==
<p>I believe the best method to transfer users from one ZCS machine to another ZCS machine would be to use the "move mailbox" method. The concept behind the move mailbox method is that the user's account is transferred from one host to another keeping their data intact, i.e. mail, contacts, and calendar. It will move accounts one at a time, and the account being moved will only be inaccessible for the duration of the move. Basically, you would make the new server to be an ldap replica to the old server; configure the old server to be the ldap master on the new server. Once you have moved all of the accounts to the new server/replica, promote the replica to be the master, documentation on promoting the replica to master is here: http://wiki.zimbra.com/index.php?title=Promoting_Replica_to_LDAP_Master. The move mailbox function can be accomplished by using the Admin Console, or by CLI. In the Admin Console, there is a button labeled "move mailbox" when you edit an account. From the CLI, here is an article detailing the zmmailboxmove, http://wiki.zimbra.com/index.php?title=Zmmailboxmove. <strong>Zmmailboxmove is only available for NE</strong>.</p>
<br>
Basically follow this methodology:<br>
<br>
Basic Scenario would be that you have an old server called mail1, and you have a new server called mail2. You wish to transfer users from mail1 to mail2. And you are installing ZCS on mail2, configured as an ldap-replica.<br>
Note: These steps are basically the same as the following link. Except, you will want to install all the important packages, zimbra-ldap, zimbra-mta, zimbra-store, zimbra-logger, zimbra-snmp, & zimbra-spell; basically, install the same packages on the new server, as the old server.<br>
http://www.zimbra.com/docs/os/latest/multi_server_install/LDAP%20Replication.6.1.html<br>
<br>
0) Run /opt/zimbra/libexec/zmldapenablereplica on mail1<br>
1) Install ZCS on mail2. <strong>Use the same zcs version as mail1</strong>.<br>
Before you begin, make note of the passwords used on the master, as you will need the same password(s) on the replica.<br>
<code><pre>
zmlocalconfig -s | grep pass
</pre></code>
The password used for "Ldap Admin Password is: zmlocalconfig -s | grep zimbra_ldap_password<br>
2) You should see something like this for the Common Configuration:<br>
<code><pre>
Common configuration
  1) Hostname:                                    mail2.mydomain.com       
  2) Ldap master host:                            mail1.mydomain.com       
  3) Ldap port:                                  389                         
  4) Ldap Admin password:                        set          <<= Make sure this is the same password used on mail1               
  5) Require secure interprocess communications:  yes                         
  6) TimeZone:                                (GMT-08.00) Pacific Time (US & Canada)
</pre></code>


3) Next is the LDAP Configuration<br>
<code><pre>
Ldap configuration
  1) Status:                                Enabled                     
  2) Create Domain:                  no  <<=Make sure this is set to no                         
  3) Ldap Root password:              set  <<=Make sure this is the same password as mail1                       
  4) Ldap Replication password:      set  <<=Make sure this is the same password as mail1                       
  5) Ldap Postfix password:          set  <<=Make sure this is the same password as mail1                       
  6) Ldap Amavis password:            set  <<=Make sure this is the same password as mail1
</pre></code>             
<br>
4) Store Configuration<br>
Since this is an ldap replica, you shouldn't need to enable the Admin, Spam, & Ham accounts. You should be able to transfer these accounts to mail2 if you wish.<br>
<code><pre>
Store configuration
  1) Status:                                  Enabled                     
  2) Create Admin User:                      no                           
  3) Enable automated spam training:          no                           
  4) Global Documents Account:                wiki@mydomain.com       
  5) SMTP host:                              mail2.mydomain.com
</pre></code>
<br>
5) Move users over to the new machine, mail2. Use the Admin console, or with CLI. The account being moved will only be inaccessible for the duration of the move.<br>
http://wiki.zimbra.com/index.php?title=Zmmailboxmove<br>
6) Promoting a Replica Server – Demoting the Master Server.<br>
Straight forward instructions found here: http://wiki.zimbra.com/index.php?title=Promoting_Replica_to_LDAP_Master<br>
Optional - Converting the master to be a replica. Not needed if you are decommissioning the old machine. If you are decommissioning the old machine, you can remove the old server from the new machine.<br>
Don't do this command until after the users are moved over to the new machine.<br>
<code><pre>zmprov ds mail1.mydomain.com</pre></code>
NOTE: Moving from one server to the other with zmmailboxmove is a staged process. If you wish, you can leave the old server up as an ldap master or the MTA after the accounts are migrated,  just to minimize the number of changes happening at one time.<br>
7) DNS - Be sure to edit your DNS records to include the new server.<br>
Before the migration:<br>
mydomain.com mail is handled by 10 mail1.mydomain.com.<br>
After the migration:<br>
mydomain.com mail is handled by 10 mail2.mydomain.com.<br>
<br>
7a) If you wish to maintain the same exact zmhostname as the old server, you'll have to change the hostname. Instructions are found here: http://wiki.zimbra.com/index.php?title=ZmSetServerName
<br>
8) Things to consider.<br>
- Zimlets - Be sure to install the same zimlets on the new machine as on the old machine.<br>
- Custom Skins will need to be installed on the new machine.<br>
- Branding will need to be configured on the new machine if you were using custom branding on the old machine.<br>
- Don't forget to run "zmupdateauthkeys" on both machines to update their SSH keys.<br>
- You should be able to use your existing license from the master for this multi node setup.<br>
9) Commercial Certificate.<br>
If the hostname stays the same, you'll need to follow the steps outlined here to reimport them: http://wiki.zimbra.com/index.php?title=Commercial_Certificate_in_5.x#.2Fopt.2Fzimbra.2Fbin.2Fzmcertmgr <br>
If the hostname has changed, you'll need to generate a CSR, submit CSR to Commercial Certificate vendor, i.e. GoDaddy, and import them using the Admin Console Wizard.<br>


==Handy Commands==
==Handy Commands==
===Read the install history file in a readable format===
===Read the install history file in a readable format===
<code><pre>perl -e 'while (<>) { ($date, $op) = split(/:/, $_); print scalar localtime($date) . "  " . $op; }' < /opt/zimbra/.install_history</pre></code>
<code><pre>perl -e 'while (<>) { ($date, $op) = split(/:/, $_); print scalar localtime($date) . "  " . $op; }' < /opt/zimbra/.install_history</pre></code>
Or<br>
<code><pre>perl -an -F: -e 'print scalar localtime(shift @F), " @F";' /opt/zimbra/.install_history</pre></code>
===Get the version in ZWC===
===Get the version in ZWC===
Type the following in the search bar:  
Type the following in the search bar:  
Line 209: Line 128:
6) su - root
6) su - root
7) mv /opt/zimbra/openldap-data /opt/zimbra/openldap-data.OLD
7) mv /opt/zimbra/openldap-data /opt/zimbra/openldap-data.OLD
8) mkdir -p /opt/zimbra/openldap-data/logs
8) mkdir -p /opt/zimbra/openldap-data/logs && mkdir -p /opt/zimbra/openldap-data/accesslog/db
9) chown -R zimbra:zimbra /opt/zimbra/openldap-data/
9) chown -R zimbra:zimbra /opt/zimbra/openldap-data/
10) su - zimbra
10) su - zimbra
11) /opt/zimbra/openldap/sbin/slapadd -f /opt/zimbra/conf/slapd.conf -l /tmp/ldap.ldif  
11) /opt/zimbra/openldap/sbin/slapadd -f /opt/zimbra/conf/slapd.conf -b "" -l /tmp/ldap.ldif  
12) zmcontrol start
12) zmcontrol start
</pre></code>
</pre></code>
Line 415: Line 334:


==Manually Delete Index Directories==
==Manually Delete Index Directories==
Ran across a case where the admin had to remove the index directories for a mailbox. Looking at the mailbox.log file, there was this error:<br>
Ran across a case where the admin had to remove the index directories for a mailbox.   Looking at the mailbox.log file, there was this error:<br>
A couple of the symtoms are:<br>
A couple of the symtoms are:<br>
- The reindex of a mailbox runs too fast.<br>
- The reindex of a mailbox runs too fast.<br>
Line 543: Line 462:
701 - account expired<br>
701 - account expired<br>
773 - user must reset password<br>
773 - user must reset password<br>
775 - user account locked<br>
<br>
<br>
http://forum.java.sun.com/thread.jspa?messageID=4227692
http://forum.java.sun.com/thread.jspa?messageID=4227692
Line 562: Line 483:
http://bugzilla.zimbra.com/show_bug.cgi?id=6353<br>
http://bugzilla.zimbra.com/show_bug.cgi?id=6353<br>
http://bugzilla.zimbra.com/show_bug.cgi?id=7235
http://bugzilla.zimbra.com/show_bug.cgi?id=7235
===Mix external authentication users with local users===
Lets say, you are using external authentication; however, you would like to create a few users locally on the Zimbra system without provisioning users on the external authentication system (openldap, AD etc etc).<br>
This should be possible with setting the following domain attribute.
<code><pre>
zmprov md yourdomain.com zimbraAuthFallbackToLocal TRUE
</pre></code>


==Sending Attachments==
==Sending Attachments==
Line 617: Line 547:




==Postconf or localconfig==
==Change LDAP Log Levels==
For Admins out there wanting to change their Postfix settings, and also want changes to the main.cf to survive upgrades, you maybe asking yourself what's the best method.<br>
There are two methods.<br>
Edit main.cf directly or add the postfix line to the localconfig.xml file?<br>
 
Example:<br>
1)<br>
 
<code><pre>
 
zmlocalconfig -e ldap_log_level=256
 
ldap stop
 
ldap start
 
</pre></code>
 
2)<br>
 
<code><pre>
<code><pre>
zmlocalconfig -e postfix_<some_postfix_parameter>
**this method does not require ldap stop/start**
 
ldapmodify -x -h <host> -D "cn=config" -W <hit enter>
<enter ldap_root_password>
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: 256 **if you want to disable ldap log, type in 'none'**
<enter> <enter>
 
</pre></code>
</pre></code>
Currently, the best method is to apply your customization with postconf directly to the main.cf file, and reapply it after each upgrade. Only values defined in /opt/zimbra/conf/zmmta.cf are substituted from localconfig/ldap.

Revision as of 20:09, 29 December 2016

Additional Articles by King0770

http://wiki.zimbra.com/index.php?title=King0770-Notes-Merge_Two_Independent_Machines
http://wiki.zimbra.com/index.php?title=King0770-Notes-MovingUsers
http://wiki.zimbra.com/index.php?title=King0770-Notes-Change-LDAP-Log-Levels
http://wiki.zimbra.com/index.php?title=King0770-Notes-Postconf_or_localconfig
http://wiki.zimbra.com/index.php?title=King0770-Notes-Bulk_Upload_To_Briefcase
http://wiki.zimbra.com/index.php?title=King0770-Notes-Sieve_Rules_By_Proxy
http://wiki.zimbra.com/index.php?title=King0770-Notes-Find_Out_When_Message_Was_Read
http://wiki.zimbra.com/index.php?title=King0770-Notes-FireFox_MimeTypes
http://wiki.zimbra.com/index.php?title=King0770-Notes-SearchGal-Edit
http://wiki.zimbra.com/index.php?title=King0770-Notes-ZCO-Repair
http://wiki.zimbra.com/index.php?title=King0770-Notes-Download-JDK
http://wiki.zimbra.com/index.php?title=King0770-Notes-Drop-Single-Mboxgroup-and-Reimport
http://wiki.zimbra.com/index.php?title=King0770-Notes-When_innodb_force_recovery_Fails
http://wiki.zimbra.com/index.php?title=King0770-Notes-Removal_of_Bad_Contact_Address
http://wiki.zimbra.com/index.php?title=King0770-Notes-Access_GAL_from_Clients_6.0
http://wiki.zimbra.com/index.php?title=King0770-Notes-Nuking_everything_in_a_folder
http://wiki.zimbra.com/wiki/King0770-Notes-error-decoding-message
http://wiki.zimbra.com/wiki/King0770-Notes-YAMM
http://wiki.zimbra.com/wiki/King0770-Notes-Chameleon-Skin
http://wiki.zimbra.com/wiki/King0770-Notes-InnoDB_is_in_the_future
http://wiki.zimbra.com/wiki/King0770-Notes-Calendar-Notes
http://wiki.zimbra.com/wiki/King0770-Notes-Milter_And_DistributionLists
http://wiki.zimbra.com/wiki/King0770-Notes-Check-Submission-Port-587
http://wiki.zimbra.com/wiki/King0770-Notes-Header-Checks
https://wiki.zimbra.com/wiki/King0770-Notes-Verify-LDAP-Passwords
https://wiki.zimbra.com/wiki/King0770-Notes-SpamTitan
https://wiki.zimbra.com/wiki/King0770-Notes-Enable-webui-for-cbpolicyd-Unsupported
https://wiki.zimbra.com/wiki/King0770-Notes-Installing-Proxy-For-Single-Server
https://wiki.zimbra.com/wiki/King0770-Notes-ldapsearch-to-csv
https://wiki.zimbra.com/wiki/King0770-Notes-My-Github
https://wiki.zimbra.com/wiki/King0770-Notes-VNC-Safe
https://wiki.zimbra.com/wiki/King0770-Notes-Whitelist-Spamassassin-MTA

Removing Messages with Zmmailbox based on the Subject

#!/bin/bash
# rm_message.sh user@domain.com subject
if [ -z "$2" ]; then
echo "usage:  rm_message.sh user@domain.com <subject>"
exit 0
else
addr=$1
subject=$2
echo "Searching $addr  for Subject:  $subject"
for msg in `zmmailbox -z -m "$addr" s -l 999 -t message "subject:$subject"|awk '{ if (NR!=1) {print}}' | grep -v -e Id -e "-" -e "^$" | awk '{ print $2 }'`
  do
echo "Removing "$msg""
zmmailbox -z -m $1 dm $msg
done
fi

Copy/Paste the script into a file, call it what you want, something like, "rm_message.sh". The syntax using the script would be something like:

./rm_message.sh user@domain.com subjectName

If the subject contains more than one word, put double quotes around the subject.

./rm_message.sh user@domain.com "Hello World"

Special thanks to Matt Fox.

Logger Issues - Reinitialize the Logger DB

Worst case scenario for the logger db's: If some for reason the USE_FRM option fails, you could move the old logger db out of the way and start over. The only bad part is that you would lose historical data, however it would resolve the corrupted table issue(s).

If you wish the start over with the logger db's, here are the steps (run as zimbra).

$ zmloggerctl stop
$ mv /opt/zimbra/logger/db /opt/zimbra/logger/db-old
$ source /opt/zimbra/bin/zmshutil 
$ zmsetvars 
$ /opt/zimbra/libexec/zmloggerinit ${mysql_logger_root_password}
$ zmlogswatchctl start

Logger Issues - Improve Disk Utilization for the logger service

a) Keep less log on disk by editing the zimbraLogRawLifetime and the zimbraLogSymmaryLifetime attributes and run zmlogprocess utility. The default values for those two attributes are:
zimbraLogRawLifetime: 31d
zimbraLogSummaryLifetime: 730d

You can be set these two attributes aggressively if you opted to. Below is an example:

su - zimbra
zmprov mcf zimbraLogRawLifetime 14d
zmprov mcf zimbraLogSummaryLifetime 30d
/opt/zimbra/libexec/zmlogprocess

The zmlogprocess script does optimize the logger database tables as it runs.

Notable bug report: http://bugzilla.zimbra.com/show_bug.cgi?id=14088


License - Misc

TTL for the account count cache is either 1 minute when they are very close to the limit, or 1 hour if the total account count is less than 90% of the quota. In other words, the server will correct itself without restart in an hour in the worse case. See http://bugzilla.zimbra.com/show_bug.cgi?id=24009

  • Admin counts towards user count, admin@domain.com
  • Spam, Ham, Wiki accounts don't count toward user count total


Handy Commands

Read the install history file in a readable format

perl -e 'while (<>) { ($date, $op) = split(/:/, $_); print scalar localtime($date) . "  " . $op; }' < /opt/zimbra/.install_history

Or

perl -an -F: -e 'print scalar localtime(shift @F), " @F";' /opt/zimbra/.install_history

Get the version in ZWC

Type the following in the search bar:

$set: get version

LDAP - DB Status

/opt/zimbra/sleepycat/bin/db_stat -c -h /opt/zimbra/openldap-data

LDAP - DB Recover

/opt/zimbra/sleepycat/bin/db_recover **make sure you are doing this as the zimbra user, and that slapd is not running**

LDAP - Slapindex

/opt/zimbra/openldap/sbin/slapindex -f /opt/zimbra/conf/slapd.conf

LDAP - Export & Reimport

1) su - zimbra
2) libexec/zmslapcat /tmp
3) mv /tmp/ldap.bak /tmp/ldap.ldif
4) zmcontrol stop
5) ps -aux | grep slapd **If ldap is still running, kill it**
6) su - root
7) mv /opt/zimbra/openldap-data /opt/zimbra/openldap-data.OLD
8) mkdir -p /opt/zimbra/openldap-data/logs && mkdir -p /opt/zimbra/openldap-data/accesslog/db
9) chown -R zimbra:zimbra /opt/zimbra/openldap-data/
10) su - zimbra
11) /opt/zimbra/openldap/sbin/slapadd -f /opt/zimbra/conf/slapd.conf -b "" -l /tmp/ldap.ldif 
12) zmcontrol start

Clear SA DB

This would be handy if you are getting a lot of false positives

/opt/zimbra/libexec/sa-learn -p /opt/zimbra/conf/salocal.cf.in --dbpath /opt/zimbra/amavisd/.spamassassin/ --siteconfigpath /opt/zimbra/conf/spamassassin --clear

or

/opt/zimbra/libexec/sa-learn -p /opt/zimbra/conf/salocal.cf --dbpath /opt/zimbra/amavisd/.spamassassin --siteconfigpath \ /opt/zimbra/conf/spamassassin --force -expire –sync

KeyTool Commands

keytool -list -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`

keytool -delete -alias jetty or tomcat -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`

Excessive Load Info Needed - What you need to show Zimbra Support

In general, when troubleshooting performance issues, we would like to know the following:
1. What exactly is slow?
2. Timestamps when problem is observed
3. Repro steps, if applicable
4. When the problem occurs, generate a few threaddumps (30 seconds apart) and send us zmmailboxd.out:
5. generate zmstat charts covering the times when the problem occurs

There are a few commands you can run to help us diagnose; the only stipulation is to run these commands *during* the excessive high load. We'll need to see what's going on during the high load.

1) Run the following command *during* the high load, run this command as root. This should write the output to the /opt/zimbra/log/zmmailboxd.out file.

for i in 1 2 3; do /opt/zimbra/libexec/zmmailboxdmgr threaddump; sleep 30; done

2) On the day of the excessive high load, we'll need you to generate graphs; this will help the engineers see any problems. Run as the zimbra user

zmstat-chart -s /opt/zimbra/zmstat/<day of the excessive load> -d /tmp/zmstats
tar -czvf /tmp/zmstats.tar.gz /tmp/zmstats

3) Find out the PID of the jetty process and run pstack on it, send us the results from the pstack command. Please run this command during the excessive load.

ps -ef | grep jetty
pstack <jetty_pid>


Sometime, Zimbra engineers need to know as much as possible about your machine in these types of excessive load situations. Using the script below could be helpful - no such thing as too much info. :)


#!/bin/sh

if [ `whoami` != "zimbra" ]; then
echo "Must be executed as the zimbra user."
exit 1
fi 
zmcontrol -v

echo "Number of users"
echo "---------------"
zmprov gaa | wc -l

echo

echo "Processor Version"
echo "-----------------"
PROC_VER=`cat /proc/version`
echo "$PROC_VER"

echo

echo "Processor Info"
echo "--------------"
PROC_INFO=`cat /proc/cpuinfo`
echo "$PROC_INFO"

echo "Mem Info"
echo "--------"
FREE=`free -m`
echo "$FREE"
echo "`dmesg | grep Mem`"

echo

echo "FSTAB File"
echo "----------"
echo "`cat /etc/fstab`"

echo

echo "Mtab file"
echo "---------"
echo "`cat /etc/mtab`"

echo 

echo "Disk Space"
echo "----------"
echo "`df -h`"

echo

echo "Threads"
echo "-------"
zmprov gacf | grep -i threads
echo
echo "Message Cache Size"
echo "------------------"
zmprov gacf | grep zimbraMessageCacheSize
echo
echo "Info from zmlocalconfig"
echo "-----------------------"
zmlocalconfig -d | grep java_options
zmlocalconfig -n | grep maxActive
zmlocalconfig | grep max_uncommitted_operations
zmlocalconfig | grep percent
echo

echo "Mysql Info"
echo "----------"
grep max_connections /opt/zimbra/conf/my.cnf
grep innodb_buffer_pool_size  /opt/zimbra/conf/my.cnf
grep innodb_max_dirty_pages_pct  /opt/zimbra/conf/my.cnf
grep innodb_flush_method  /opt/zimbra/conf/my.cnf

echo

echo "Java Process"
echo "------------"
ps -ef | grep java

echo

echo "LDAP Info"
echo "---------"
/opt/zimbra/sleepycat/bin/db_stat -m -h /opt/zimbra/openldap-data | head -n 11

echo

/opt/zimbra/sleepycat/bin/db_stat -m -h /opt/zimbra/openldap-data | head -n 12

Small Favor

Please install the following tools, sometimes the engineers use pstack and/or strace for troubleshooting.
1) pstack
2) strace

Enable Away Messages (Vacation)

1) Access your account using the web interface, https://mail.domain.com
2) Once you have accessed your account, go to Preferences => Mail
3) If you scroll down in the Mail section, look for "Send auto-reply message:". You should then type your away message, and pick the start date and finish date.
4) Don't forget to click "Save" in the upper left hand.

Auto-Reply Not Working

Organizations using the Split-Domain configuration *may* encounter problems with the auto-replies not working.
Mail that is arriving to user@somedomain.com and the zimbra server only knows about user@mail.domain.com. So the code that tries not to send vacation message if the mail was not directly sent to the account kicks in. This is as intended. The "was it sent directly to this acct" check only checks To: and Cc: headers and not envelope RCPT TO address (as it should).

Workaround:

zmprov ma user@domain.com +zimbraPrefOutOfOfficeDirectAddress user@mail.domain.com
zmprov ma user@domain.com zimbraPrefOutOfOfficeReplyEnabled TRUE

Apple's .Mac Mail Service

It was recently discovered Apple's .Mac Mail Service removes messages in the Trash from their server after one week. This is not configurable.


Directory Permissions on /tmp

It is possible that during ZCS install, if the /tmp directory does not have the correct permissions, it could hinder your efforts to install ZCS. Make sure the /tmp directory has the following permissions.

drwxrwxrwt 17 root root 4096 2008-07-07 08:33 tmp

If your /tmp permissions do not match the above, run the following commands as root:

# chmod 777 /tmp
# chmod +t /tmp

The "t" in the end of the permissions is called the "sticky bit". It replaces the "x" and indicates that in this directory, files can only be deleted by their owners, the owner of the directory or the root superuser. This way, it is not enough for a user to have write permission on /tmp, he also needs to be the owner of the file to be able to delete it.

Columns are MisMatch in the GAL using ZCO

1) Remove ZCO profile(s) from Outlook - Start ==> Control Panel ==> Mail

2) Once the ZCO profile is removed, go into the following directories and remove everything in the specified directories:
c:\documents and settings\<user>\local settings\application data\microsoft\outlook
&
c:\documents and settings\<user>\application data\microsoft\outlook

3) Recreate ZCO profile for Outlook - Start ==> Control Panel ==> Mail

Once you have recreated the zco profile, open Outlook, then have a look again at the GAL.

Manually Delete Index Directories

Ran across a case where the admin had to remove the index directories for a mailbox. Looking at the mailbox.log file, there was this error:
A couple of the symtoms are:
- The reindex of a mailbox runs too fast.
- When the user attempts a search in the ZWC, no results are found when there should be a result.

2008-07-18 00:13:52,477 INFO [MailboxPurge] [name=jsmith@mydomain.com;mid=11;] index - ignoring error while deleting index entries for items: [-28865, 28865]
java.io.IOException: Could not create index com.zimbra.cs.index.Z23FSDirectory@/opt/zimbra/index/0/11/index/0 (directory already exists)
 at com.zimbra.cs.index.Lucene23Index.openIndexWriter(Lucene23Index.java:1359)
 at com.zimbra.cs.index.Lucene23Index.deleteDocuments(Lucene23Index.java:292)
 at com.zimbra.cs.index.MailboxIndex.deleteDocuments(MailboxIndex.java:267)
 at com.zimbra.cs.mailbox.Mailbox.commitCache(Mailbox.java:6927)
 at com.zimbra.cs.mailbox.Mailbox.endTransaction(Mailbox.java:6824)
 at com.zimbra.cs.mailbox.Mailbox.purgeMessages(Mailbox.java:6182)
 at com.zimbra.cs.mailbox.PurgeThread.run(PurgeThread.java:147)
 Caused by: java.io.IOException: read past EOF
 at org.apache.lucene.store.BufferedIndexInput.refill(BufferedIndexInput.java:146)
 at org.apache.lucene.store.BufferedIndexInput.readByte(BufferedIndexInput.java:38)
 at org.apache.lucene.store.IndexInput.readChars(IndexInput.java:126)
 at org.apache.lucene.store.IndexInput.readString(IndexInput.java:112)
 at org.apache.lucene.index.SegmentInfo.<init>(SegmentInfo.java:137)
 at org.apache.lucene.index.SegmentInfos.read(SegmentInfos.java:220)
 at org.apache.lucene.index.SegmentInfos$1.doBody(SegmentInfos.java:254)
 at org.apache.lucene.index.SegmentInfos$FindSegmentsFile.run(SegmentInfos.java:636)
 at org.apache.lucene.index.SegmentInfos.read(SegmentInfos.java:251)
 at org.apache.lucene.index.IndexWriter.init(IndexWriter.java:710)
 at org.apache.lucene.index.IndexWriter.<init>(IndexWriter.java:666)
 at com.zimbra.cs.index.Lucene23Index.openIndexWriter(Lucene23Index.java:1340)

While there are probably multiple situations where the index directory needs to be removed (or reindexed), this was one case I recently ran across.
To remove the index directories in this example, follow this method:

1) su - zimbra
2) rm -rf /opt/zimbra/index/0/11/index/0
3) zmmailboxdctl stop
4) zmmailboxdctl start
5) Then reindex the mailbox from the Admin Console.

Upper Case Letters in the hostname in /etc/hosts will prevent the install from continuing

Make sure the hostname in the /etc/hosts do not contain upper case letters. Or else the install will not continue.
http://bugzilla.zimbra.com/show_bug.cgi?id=30413

Main menu

   1) Common Configuration:                                                  
        +Hostname:                             KLAATU.blue.local
        +Ldap master host:                     klaatu.blue.local
        +Ldap port:                            389                           
        +Ldap Admin password:                  set                           
        +Require secure interprocess communications: yes                           
        +TimeZone:                             (GMT-08.00) Pacific Time (US & Canada)

   2) zimbra-ldap:                             Enabled                       
   3) zimbra-store:                            Enabled                       
   4) zimbra-mta:                              Enabled                       
   5) zimbra-snmp:                             Enabled                       
   6) zimbra-logger:                           Enabled                       
   7) zimbra-spell:                            Enabled                       
   8) Default Class of Service Configuration:                                
   9) Enable default backup schedule:          yes                           
   r) Start servers after configuration        yes                           
   s) Save config to file                                                    
   x) Expand menu                                                            
   q) Quit                                    

Address unconfigured (**) items or correct ldap configuration  (? - help)

External Authentication with LDAP

Requires one of the following:
1) set
Set domain attribute zimbraAuthMech to ldap.
zimbraAuthLdapSearchBindPassword => bind DN of the admin user of the external directory
zimbraAuthLdapSearchBindDn => password of the admin user of the external directory
zimbraAuthLdapSearchFilter
zimbraAuthLdapSearchBase (optional, if not set "" will be used).
Three things are needed for auth to the external LDAP server:
- URL of the LDAP server: zimbraAuthLdapURL
- password entered by user
- the bind DN for the user, this can be setup using one of the following 3 ways. (A) is preferred over (B) because (C) does an extra LDAP search.

(A) zimbraAuthLdapBindDn
This is the bind DN template

(B) zimbraAuthLdapSearchFilter
If set, then zimbraAuthLdapSearchBindPassword, zimbraAuthLdapSearchBindDn, and zimbraAuthLdapSearchBase also need to be set.
Server uses the four attrs to get the bind DN for the user.
Server first does a LDAP search using the zimbraAuthLdapSearchBindDn/zimbraAuthLdapSearchBindPassword credential by zimbraAuthLdapSearchFilter under zimbraAuthLdapSearchBase. The search would return the bind DN for the user, if found.
example for zimbraAuthLdapSearchFilter: (&(mail=%u@%d)(objectclass=person)) (whatever object class they are using)

(C) Account attribute zimbraAuthLdapExternalDn
Unlike (A) and (B), which are domain settings, this is an account level setting. This overrides the bind template and/or search setting, and directly contains the DN for the user in the external ldap server.

OR

2) set
Set domain attribute zimbraAuthMech to ldap.
zimbraAuthLdapBindDn to the template filter for the user in the external directory.
For example, if the user exists at uid=jsmith,cn=users,dc=zimbra,dc=com , set zimbraAuthLdapBindDn on the domain to: uid=%u,cn=users,dc=zimbra,dc=com
Another example uid=%u,ou=people,%D (whatever LDAP DIT structure they are using)

zimbraAuthLdapBindDn and zimbraAuthLdapSearchFilter can contain expansion variables that are to be substituted by components in the account name:
%n = username with @ (or without, if no @ was specified)
%u = username with @ removed
%d = domain as foo.com
%D = domain as dc=foo,dc=com

e.g. for user rking@zimbra.com
%n => rking@zimbra.com
%u => rking
%d => zimbra.com
%D => dc=zimbra,dc=com

example for zimbraAuthLdapBindDn: uid=%u,ou=people,%D (whatever LDAP DIT structure they are using)

External Authentication Errors

525 - user not found
52e - invalid credentials
530 - not permitted to logon at this time
532 - password expired
533 - account disabled
701 - account expired
773 - user must reset password
775 - user account locked


http://forum.java.sun.com/thread.jspa?messageID=4227692

Example in the /opt/zimbra/log/mailbox.log file:

Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece^@]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:2985)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2931)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2732)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2646)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:283)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
.......

Notable bugs:
http://bugzilla.zimbra.com/show_bug.cgi?id=6353
http://bugzilla.zimbra.com/show_bug.cgi?id=7235

Mix external authentication users with local users

Lets say, you are using external authentication; however, you would like to create a few users locally on the Zimbra system without provisioning users on the external authentication system (openldap, AD etc etc).

This should be possible with setting the following domain attribute.

zmprov md yourdomain.com zimbraAuthFallbackToLocal TRUE

Sending Attachments

If you are having trouble sending attachments, and you *think* you've set the zimbraFileUploadMaxSize & zimbraMtaMaxMessageSize, correctly, then find out how much larger a MIME version of a file will be after base-64 encode.

If you want to find out just how much larger a MIME version of a given file will be, run the file through UUDeview (windows app) - try 'base 64' in the encode settings. Won't wreck your current file, it creates a converted duplicate. This should give you an idea of what values to use if you don't want to use an arbitrary value. http://www.miken.com/uud/

Removing older version inside /opt/zimbra

Question:
Can I delete older versions of software that is in the /opt/zimbra directory? I have older version of amavisd, clamav, cyrus-sasl, etc.

Answer: I am not sure *why* the prior versions are still around after an upgrade. The answer I received was, we (Zimbra), shouldn't remove things during an upgrade. My impression was this was a policy decision. I'd say move those older versions out of the way into another directory. And if there are no problems, I'd say you are good to go. To be honest, I am paranoid - I never suggest remove anything on a system. :)

SOAP API

The relevant docs are in /opt/zimbra/doc. The /opt/zimbra/doc directory has most (if not all) our docs for soap.
Regarding the URL using the admin soap stuff you need to talk to the admin server (by default port 7071).
Example for the admin url for soap:

https://myhost:7071/service/admin/soap/

Another point of interest: /opt/zimbra/conf/attrs/zimbra-attrs.xml

Hardware Support

Question
In the server, one of the hard disks is showing a red light. It is Raid 5 configured. Not sure where to look.

Answer
Zimbra Support can't help very much here. We support the Zimbra software, not the server hardware or the OS RAID infrastructure. If it's a standard Linux RAID, you can remove it from the RAID group with mdadm, replace the device, and add a new device to replace it. If it's a separate array or something, you'll have to go to the manufacturer instructions to find the procedure for replacing the device. You'll probably find more information with a web search than you can get from us on this topic.

Zimbra Mobile and BIS

Customers using utilizing AT&T and Verizon for their Blackberry Internet Services (BIS) will need to make sure port 993 is accessible. Apparently, BIS services will authenticate using port 993. I had a case where the admin was using AT&T to setup an account; however, he was getting the "connection timed out" message, or "cannot authenticate" from the AT&T app. On a hunch I suggested opening port 993 through his firewall (because it wasn't accessible to the outside world) . After that was done, AT&T was able to authenticate.

Distribution Lists and Duplicates

The scenario is that you are a member of a distribution list, and also was CC'd separately, and you have noticed you have received two messages instead of one; send to: you@someZimbraList.com, you@domain.com.

Have a look at the following global setting:

zmprov gacf | grep zimbraMessageIdDedupeCacheSize

If this setting was set to zero, that would probably explain the duplicates you may see.

If you need to suppress the duplicates, run this command:

zmprov mcf zimbraMessageIdDedupeCacheSize 3000
**3000 is the default**

This would require to restart Jetty services.

zmmailboxdctl restart
**be advised this would be a slight disruption of services. you may need to restart jetty during low-peak times, or after business hours.**


Change LDAP Log Levels

There are two methods.

1)


zmlocalconfig -e ldap_log_level=256

ldap stop

ldap start

2)

**this method does not require ldap stop/start**

ldapmodify -x -h <host> -D "cn=config" -W <hit enter>
<enter ldap_root_password>
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: 256 **if you want to disable ldap log, type in 'none'**
<enter> <enter>

Jump to: navigation, search