Ajcody-Server-Topics

Contents

Ajcody Server Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


I moved the following pages out of this section to Ajcody-Server-Plan-Move-Migration-Upgrade-DR. It was getting to large to edit and load in web browser.

Server Topics

Actual Server Topics Homepage

Please see Ajcody-Server-Topics

Issues Being Investigated

Actual Server Issues Being Investigated Homepage

Please see Ajcody-Server-Issues-Being-Investigated

License Issues

Getting License Details Via Soap - Consumed Licenses

First, flush the cache on all servers for the license information. Then do the query via soap.

zmprov fc -a license
zmsoap -z GetLicenseRequest

Two lines that are generally of interest are, for example :

   <attr name="TotalAccounts">3</attr>
   <attr name="ArchivingAccounts">3</attr>

What Should Count Against License

Real accounts, as listed in admin console under Addresses > Accounts. The admin account will count against this but the ham, spam, and wiki ones will not.

Accounts or entries listed under : Aliases , Distribution Lists, Resources should not. See below for bug about Resources though.

Deleted Accounts Still Show In Use

Please see:

Another suggestion if zimbra restarts don't work, as zimbra:

zmprov fc license

When you have multi ZCS servers:

zmprov fc -a license

Resources Counting Against License

Please see:

Workaround is :

  • zmcontrol stop
  • zmcontrol start

Tested on 5.0.9

  • license count 5
    • created two resources
  • license count 7
    • zmcontrol stop
    • zmcontrol start
  • license count 5

Performance Issues When Using Mini-Cal And You Have zimbraMailCanonicalAddress Set To Domains You Don't Have

Background Bugs:

Do you have any user's with the variable zimbraMailCanonicalAddress set using a domain that is not within your Zimbra infrastructure? There was case that had that set for a particular user to a domain they didn't have within Zimbra and the symptom showed as a performance issue within the mini-calendar & calendar. The root cause was actually the ldap lookups occurring in the background (those against the zimbraMailCanonicalAddress domain).

  • One work around was setting:
    • zmlocalconfig -e ldap_starttls_supported=0
      •  ldap stop
      •  ldap start
    • zmlocalconfig -e zimbra_require_interprocess_security=0
    • To update the postfix configuration files.
      • /opt/zimbra/libexec/zmmtainit
    • To update amavis config files.
      • /opt/zimbra/libexec/zmmtaconfig amavis
    • Then restart the system. Still need to double check this will be necessary.
  • The other workaround was to remove the zimbraMailCanonicalAddress variable.

5.0.7+ Performance & Hanging Issues

Administrators might or might not catch this events being tied to calendars or ics data. Here's what I've gather from other cases so far about the issue, there's about 5 of them I've seen. None are resolved at this time (July 23, 08), so use with caution.

1. bug: http://bugzilla.zimbra.com/show_bug.cgi?id=29596 The resolution for this bug would involve an upgrade to 5.0.8 .

  • One customer has reported the upgrade to 5.0.8 has resolved their issue so far. They also confirm that the ics files were being processed with much faster times as logged in mailbox.log
  • Second customer has confirmed upgrade to 5.0.8 has resolved their issue.

2. Check a the thread dump if the message is getting stuck during an invite email delivery to a conference room. You can guess the calendar object based on the emails in the conference room's Inbox.

3. Also check their recurrence expansion configuration in LDAP with:

"zmprov gacf | grep zimbraCalendarRecurrence". 

On a clean install you should see:

zimbraCalendarRecurrenceDailyMaxDays: 730
zimbraCalendarRecurrenceMaxInstances: 0
zimbraCalendarRecurrenceMonthlyMaxMonths: 360
zimbraCalendarRecurrenceOtherFrequencyMaxYears: 1
zimbraCalendarRecurrenceWeeklyMaxWeeks: 520
zimbraCalendarRecurrenceYearlyMaxYears: 100

If these are set to 0, the sysadmin enabled near-infinite expansion on purpose. If these are missing, it's an upgrade problem. The code will default the values to 0 and thus infinite loop. Set them to the above values to avoid long expansions.If these are set to 0, please set to the above values to avoid long exp.

  • One customer has reported that the variables weren't set and they set them to the defaults. Restarted zimbra and issues appear to be resolved. They are holding off on 5.0.8 upgrade at this point.

4. Also you are might hitting bug ( http://bugzilla.zimbra.com/show_bug.cgi?id=28397 - this is a private bug) or something similar like this caused by an offending appointment. You can also find out the mailbox (conference room/user) and put it into maintenance mode to keep the mails flowing. Then try to flush the queue.

Upgrade Issues

Please check the Support Portal page for the most recent issues related to newly released ZCS versions. That is were "issues" are generally posted when we discover "new" situations arising from newly released versions.

Very Long Upgrade Times

zmfixperms Causing Long Upgrade Times - HSM Configurations Effected Usually

Please see:

Upper Case Hostname Causes Problems With Install/Upgrade

I believe this is new for version 5.0.8+. Until you adjust the case, the installer script will not continue. It's usually picking up the upper case hostname from the server's /etc/hosts entry. Please don't do this, use upper case in your hosts file ... Unix is not Windows.



LDAP Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual LDAP Topics Homepage

Please see Ajcody-LDAP-Topics

LDAP Error Codes

A nice reference on ldap errors codes:

Working With ldap Commands - The Easy Way

Tired of working with long ldap strings on the CLI with ldapmodify, ldapsearch, ldapdelete.

zimbra$ source ~/bin/zmshutil 
zimbra$ zmsetvars 

You can now use this string syntax to make things a little easier.

ldapCOMMAND -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password ACTION

Anonymous Binds

For new installations of ZCS 6.0, anonymous searches of the directory are disabled. (Bug 15378) When you upgrade to 6.0, anonymous searches of the directory are enabled, matching previous release behavior.

  • To disable anonymous search after upgrading, on each LDAP server, as zimbra run
    • /opt/zimbra/libexec/zmldapanon -d
  • To enable anonymous access at any point after it is disabled, on each LDAP server run
    • /opt/zimbra/libexec/zmldapanon -e

Important: Enabling anonymous binds is not recommended as it may expose data not intended for anonymous access

Ref:

Searching For Account In LDAP

To do ldapsearch for the account, and see if there are any related entries in ldap.

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "mail=USER@DOMAIN.com"

To just dump the whole thing [to grep and so forth]:

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password


Searching For Accounts On A Particular Mailstore

To do ldapsearch for the account, and see if there are any related entries in ldap.

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "zimbraMailHost=YOURMAILSTORE.COM"


Other LDAP Search Example

See http://wiki.zimbra.com/wiki/ShanxT-LDAP-CheatSheet

ldapsearch over 636 from non-ZCS linux client

From your ZCS ldap server, you'll want to get the following information:

zmhostname
zmlocalconfig -s | egrep 'ldap_master_url|ldap_url|ldap_starttls_supported|ldap_port|zimbra_ldap_password'

Replace the details below as followed: ZMHOSTNAME with zmhostname's output above, PASSWORD with zimbra_ldap_password from above. Also adjust the -b 'ou=people,dc=DOMAIN,dc=com' to reflect your domain string. The other variables should state port 636 if your setup for ldaps [ref: How_to_enable_ldaps Now try the following now on the ldap server below to confirm ldapsearch works :

ldapsearch -x -H ldaps://ZMHOSTNAME:636 -D uid=zimbra,cn=admins,cn=zimbra -w PASSWORD -LLL -b 'ou=people,dc=DOMAIN,dc=com' -Z

Now, example uses a centos/rhe machine and therefor I use yum vs apt-get, let's setup the non-ZCS linux machine to test the query:

yum install openldap-clients 
vi /etc/openldap/ldap.conf  
  * add 
    TLS_REQCERT allow 

And now the search test from the non-zcs linux host [I provide a couple lines of the output in the example below]. Remember to replace the ZMHOSTNAME and PASSWORD values below with your variables and the -b 'ou=people,dc=DOMAIN,dc=com' to reflect your domain string. :

 ldapsearch -x -H ldaps://ZMHOSTNAME:636 -D uid=zimbra,cn=admins,cn=zimbra -w PASSWORD -LLL -b 'ou=people,dc=DOMAIN,dc=com' -Z
 
   ldap_start_tls: Operations error (1) 
   additional info: TLS already started 
   dn: ou=people,dc=DOMAIN,dc=com    
   objectClass: organizationalRole 
   ou: people 
   cn: people 

Deleting An Account In LDAP

Via zmprov

Caution - this should normally only be done under guidance or request by support.

This will delete the account from ldap and not from the db (mysql). It also retains the mail store and index data:

zmprov -l da <USER@DOMAIN.com>

Via ldapdelete

Caution - this should normally only be done under guidance or request by support.

One way:

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -LLL -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "mail=ajcody@zimbra.DOMAIN.com" dn
    dn: uid=ajcody,ou=people,dc=zimbra,dc=DOMAIN,dc=com
ldapdelete -r -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password uid=ajcody,ou=people,dc=zimbra,dc=DOMAIN,dc=com

Once done, you should be able to add or remove the account using 'zmprov ca' command.

db_recover For OpenLdap DB In /opt/zimbra/openldap-data

Caution - this should normally only be done under guidance or request by support.

For ZCS 5.x

This will cause an impact to your user base, since we'll be stopping the ldap service.

su - zimbra
cd /opt/zimbra/openldap-data
ls -la
  **Notice the __db.00# files**
ldap stop
/opt/zimbra/sleepycat/bin/db_recover
ls -la
  **Notice the __db.00# files are gone**
ldap start

Attempt To Cover Versions Higher Than ZCS5 - I've yet to confirm the below

ZCS 6.X.X
# su - zimbra
$ ldap stop
$ cd /opt/zimbra/openldap-data
$ /opt/zimbra/sleepycat/bin/db_recover

and also, if this is a ldap master:

$ cd /opt/zimbra/openldap-data/accesslog/db
$ /opt/zimbra/sleepycat/bin/db_recover
ZCS 7.0.x

unconfirmed

7.1.x
# su - zimbra
$ ldap stop
$ cd /opt/zimbra/data/ldap/hdb/db
$ /opt/zimbra/bdb/bin/db_recover
7.1.x Ldap Replica & Mailstore - Case Notes

Error customer had in /var/log/zimbra.log after /opt/zimbra partition hit 100% usage.

Aug 25 15:51:12 SERVER postfix/smtpd[20470]: NOQUEUE: reject: MAIL from 
localhost.localdomain[127.0.0.1]: 452 4.3.1 Insufficient system storage; 
proto=ESMTP helo=<localhost>
Aug 25 15:51:12 SERVER amavis[16494]: (16494-03) smtp resp to MAIL (pip): 
452 4.3.1 Insufficient system storage

and later....

Aug 25 17:34:27 SERVER slapd[5627]: @(#) $OpenLDAP: slapd 2.4.26 (Sep 7 2011 
12:24:16) 
$#012#011build@zre-rhel6-64.eng.vmware.com:/home/build/p4/HELIX/ThirdParty/openldap/openldap-2.4.26.5z/servers/slapd
Aug 25 17:34:27 SERVER slapd[5628]: hdb_db_open: database "": unclean shutdown 
detected; attempting recovery.
Aug 25 17:34:27 SERVER slapd[5628]: bdb(): file unknown has LSN 146/8895192, 
past end of log at 146/7885578
Aug 25 17:34:27 SERVER slapd[5628]: bdb(): Commonly caused by moving a database 
from one database environment
Aug 25 17:34:27 SERVER slapd[5628]: bdb(): to another without clearing the database 
LSNs, or by removing all of
Aug 25 17:34:27 SERVER slapd[5628]: bdb(): the log files from a database environment
Aug 25 17:34:28 SERVER slapd[5628]: bdb(): file id2entry.bdb has LSN 146/8895192, 
past end of log at 146/7887443
Aug 25 17:34:28 SERVER slapd[5628]: bdb(): Commonly caused by moving a database 
from one database environment
Aug 25 17:34:28 SERVER slapd[5628]: bdb(): to another without clearing the database 
LSNs, or by removing all of
Aug 25 17:34:28 SERVER slapd[5628]: bdb(): the log files from a database environment
Aug 25 17:34:28 SERVER slapd[5628]: bdb(): /opt/zimbra/data/ldap/hdb/db/id2entry.bdb: 
unexpected file type or format
Aug 25 17:34:28 SERVER slapd[5628]: hdb_db_open: database "": 
db_open(/opt/zimbra/data/ldap/hdb/db/id2entry.bdb) failed: Invalid argument (22).
Aug 25 17:34:28 SERVER slapd[5628]: backend_startup_one (type=hdb, suffix=""): 
bi_db_open failed! (22)
Aug 25 17:34:28 SERVER slapd[5628]: bdb_db_close: database "": alock_close failed
Aug 25 17:34:28 SERVER slapd[5628]: slapd stopped.
Aug 25 17:34:32 SERVER slapd[5631]: @(#) $OpenLDAP: slapd 2.4.26 (Sep 7 2011 12:24:16) 
$#012#011build@zre-rhel6-64.eng.vmware.com:/home/build/p4/HELIX/ThirdParty/openldap/openldap-2.4.26.5z/servers/slapd
Aug 25 17:34:32 SERVER slapd[5632]: bdb(): file id2entry.bdb has LSN 146/8895192, 
past end of log at 146/7887499
Aug 25 17:34:32 SERVER slapd[5632]: bdb(): Commonly caused by moving a database 
from one database environment
Aug 25 17:34:32 SERVER slapd[5632]: bdb(): to another without clearing the database 
LSNs, or by removing all of
Aug 25 17:34:32 SERVER slapd[5632]: bdb(): the log files from a database environment
Aug 25 17:34:32 SERVER slapd[5632]: bdb(): /opt/zimbra/data/ldap/hdb/db/id2entry.bdb: 
unexpected file type or format
Aug 25 17:34:32 SERVER slapd[5632]: hdb_db_open: database "": 
db_open(/opt/zimbra/data/ldap/hdb/db/id2entry.bdb) failed: Invalid argument (22).
Aug 25 17:34:32 SERVER slapd[5632]: backend_startup_one (type=hdb, suffix=""): 
bi_db_open failed! (22)
Aug 25 17:34:32 SERVER slapd[5632]: bdb_db_close: database "": alock_close failed
Aug 25 17:34:32 SERVER slapd[5632]: slapd stopped.

Error from the command line when attempting zmcontrol start or ldap start:

Starting ldap...Done.
Failed.
Failed to start slapd. Attempting debug start to determine error.
hdb_db_open: database "": db_open(/opt/zimbra/data/ldap/hdb/db/id2entry.bdb) 
failed: Invalid argument (22).
backend_startup_one (type=hdb, suffix=""): bi_db_open failed! (22)
bdb_db_close: database "": alock_close failed 

Attempted ldap db recovery.

su - zimbra
zmcontrol stop
cd /opt/zimbra/data/ldap/hdb/db
/opt/zimbra/bdb/bin/db_recover

That didn't work.

Removal of the alock [/opt/zimbra/data/ldap/hdb/db/alock] file also didn't work, ldap start failed with same error and created a new alock file.

Proceeded with some of the steps taken from this reference: http://wiki.zimbra.com/wiki/LDAP_data_import_export

cd /opt/zimbra/data/ldap/
mv hdb hdb.old

Create the new directory structure :

mkdir -p hdb/db
mkdir -p hdb/logs
mv hdb hdb.old
ldap start

Confirmed ldap started ok and also checked replica status.

/opt/zimbra/libexec/zmreplchk
Code: 0 Status: In Sync

zimbra.log looked good.

zmcontrol start

And the rest of the zimbra services came up cleanly.

Ldap Restore

To find the LDAP session labels type -lbs.

zmrestoreldap -lbs

Restore the complete LDAP directory server [example]

zmrestoreldap -lb full20061130135236

ldapmodify Examples

Removing An Alias That Is Also Primary Account

Bug Reference:

External Reference:

Description of problem:

When I try to remove the alias that matches the primary account with zmprov or to delete the Alias in the web console it fails. And attempt to restore the account to another name [ -ca -pre old_] fails as well [Error occurred: Read timed out].

An attempt to rename the primary account doesn't avoid the issue with the matching alias name.

[zimbra@mail root]$ zmprov ra USER@DOMAIN.com USER_OLD@DOMAIN.com
[zimbra@mail root]$ zmprov raa USER_OLD@DOMAIN.com USER@DOMAIN.com
ERROR: account.NO_SUCH_ALIAS (no such alias: USER@DOMAIN.com)
[zimbra@mail root]$ zmprov ra USER_OLD@DOMAIN.com USER@DOMAIN.com

Also, whenever I rename the account, the alias gets renamed with it. Even when using the zimbraID to rename the account.

The following will confirm the issue as it will show a zimbraMailAlias matching a mail variable.

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "mail=USER@DOMAIN.com"
##shows us something like this##
[cut]
# USER, people, DOMAIN.com
dn: uid=USER,ou=people,dc=DOMAIN,dc=com
[cut]
mail: USER@DOMAIN.com
mail: USER_Alias1@DOMAIN.com
mail: USER_Alias2@DOMAIN.com
mail: USER_Alias3@DOMAIN.com
zimbraMailAlias: USER@DOMAIN.com
zimbraMailAlias: USER_Alias1@DOMAIN.com
zimbraMailAlias: USER_Alias2@DOMAIN.com
zimbraMailAlias: USER_Alias3@DOMAIN.com
[cut]

To use ldapmodify to replace the aliases, you would construct a statement like this:

[if you haven't already done this in the current shell]
su - zimbra
source ~/bin/zmshutil
zmsetvars
[end]
ldapmodify -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password
dn: uid=USER,ou=people,dc=DOMAIN,dc=com
changetype: modify
replace: zimbraMailAlias
zimbraMailAlias: USER_Alias1@DOMAIN.com
zimbraMailAlias: USER_Alias2@DOMAIN.com
zimbraMailAlias: USER_Alias3@DOMAIN.com
[ctrl-D executes this change and drops you to prompt]
zmprov flushCache account USER@DOMAIN.com

Notice the absence of the zimbraMailAlias: USER@DOMAIN.com variable.

To use ldapmodify to delete ALL aliases, you would construct a statement like this:

[if you haven't already done this in the current shell]
su - zimbra
source ~/bin/zmshutil
zmsetvars
[end]
ldapmodify -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password
dn: uid=USER,ou=people,dc=DOMAIN,dc=com
changetype: modify
delete: zimbraMailAlias
[ctrl-D executes this change and drops you to prompt]
zmprov flushCache account USER@DOMAIN.com

You can also place the edit's in a text file and run it like:

[if you haven't already done this in the current shell]
su - zimbra
source ~/bin/zmshutil
zmsetvars
[end]
ldapmodify -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password -f fix-account.ldif


zmprov flushCache account USER@DOMAIN.com

If you were to do multiple operations, you would need to include the - marker. For example:

userprompt> ldapmodify -D bindDN -w password -h server1
 dn: cn=Niels Nelissen,ou=people,dc=example,dc=com
 changetype: modify
 delete: telephonenumber
 -
 add: manager
 manager: cn=Peter Petersen,ou=people,dc=example,dc=com
 ^D
 userprompt>

db_recover For OpenLdap Accesslog DB In /opt/zimbra/openldap-data/accesslog/db

Caution - this should normally only be done under guidance or request by support.

For ZCS 5.x Only

This will cause an impact to your user base, since we'll be stopping the ldap service.

For replication issues.

Steps Removed At This Time.

Re-indexing Openldap

Caution - this should normally only be done under guidance or request by support.

This will cause an impact to your user base, since we'll be stopping the ldap service.

su - zimbra
cd /opt/zimbra/openldap-data
ldap stop
/opt/zimbra/openldap/sbin/slapindex -f /opt/zimbra/conf/slapd.conf

Purging Logs From /opt/zimbra/openldap-data/logs

Caution - this should normally only be done under guidance or request by support.

DB_CONFIG sets the log variable, it should be /opt/zimbra/openldap-data/logs .

ldap stop
db_checkpoint -1 -h /opt/zimbra/openldap-data
db_archive -h /opt/zimbra/openldap-data
rm <logs listed from db_archive>
ldap start

What Does - connection_read : no connection! - In zimbra.log Indicate

Developer responses I've had on this question:

  • One ldap server is seeing it and others aren't, then confirm the logging levels are set the same
  • This informative message indicates that a client disconnected without sending an unbind request first. It is quite common and certainly something to ignore.

Note, customer also gave me feedback that they ended up seeing this as a result of they way their load-balancers were operating.

Change LDAP Port On Zimbra

It is recommend that there is no other LDAP service running on the ZCS besides Zimbra's. But if you find the need to change it, here's the steps.

You can modify the default [389] port ldap uses to port 390 by doing the following [change LDAPHOSTNAME.com to your server name]:

zmlocalconfig -e ldap_port=390
zmlocalconfig -e ldap_master_url=ldap://LDAPHOSTNAME.com:390
zmlocalconfig -e ldap_url=ldap://LDAPHOSTNAME.com:390

Note you need to do all three of these or things will break. Once you've run those commands, you will need to restart ZCS:

zmcontrol stop
zmcontrol start

Once this is completed, Zimbra will run with LDAP on port 390 rather than port 389 (the default). If you'd like to use a port other than 390, substitute that port for 390 and use the same process.

Can't Setup/Install LDAP Replica

Please see bug against documentation:

Checking /tmp/zmsetup.log will expose errors with installation configuration, for example below, others are listed in my notes farther down:

: Thu Aug 21 16:00:12 2008 *** Running as zimbra user: /opt/zimbra/bin/zmlicense -c
Error: exception occurred: system failure: ZimbraLdapContext
 when running 'zmcontrol start':
[zimbra@mail1b ~]$ zmcontrol start
Host mail1b.DOMAINNAME
Unable to determine enabled services from ldap.
Unable to determine enabled services. Cache is out of date or doesn't exist.

Make sure you are using the right passwords. If the ldap replica can't authenticate to the master LDAP server it will not be able to pull down the ldap configurations it needs - one of which is the license data.

My Notes From The Case That I Made For Bug 26117

Verified Fixed for 5.0.10+ in regards to bug 26117
Summary

Action Items:

  • Update doc's to reflect ldap repli password setting during install (all ref docs miss this step)
    • If this is done during install, no other action is needed except logger and sshkeys (zmupdateauthkeys)
  • Update doc's to reflect recovery steps on an improper install for ldap replication server
  • Make comments consistent. See LDAP wiki page
  • Update installer to require ldap repli password rather default to random set

password.

References:

LDAP replication has some comments that aren't in other places

  • Set the master LDAP password to the correct value (run zmlocalconfig -s ldap_root_password on the master to determine this value)
  • Note: In order to install an LDAP replica server with no MBS (Mailbox Server), set zimbra_zmprov_default_to_ldap to true, using the following command:
    • zmlocalconfig -e zimbra_zmprov_default_to_ldap=true.
    • If you later add an MBS to your LDAP replica server, set zimbra_zmprov_default_to_ldap to false.
  • After the installation is complete, run /opt/zimbra/libexec/zmldapenablereplica on the replica server. This will enable replication in the LDAP server and will force an LDAP restart to begin pulling data from the master. zmldapenablereplica must be run on both the master and replica for LDAP replication to work.
The Work

Duplicated on ZCS 5.0.2 - OS Redhat.

Current Servers For Test:

  • Setup LDAP MAIN server - zldap1 (ldap only configured server)
    • setting passwords to "PASSWORD"
  • Mailstore server - zmail2 (mailstore only config)
  • MTA server - zmta1 (mta only config)
  • Post install
    • enable logger
    • enable ssh keys
      • run zmupdateauthkeys on servers
    • created two test accounts and confirmed email delivery between the two.
    • On LDAP MAIN (zldap1)- zmldapenablereplica

Install LDAP repli - zldap3

  • Doc show only to set
    • ldap master host
    • Master ldap server password
    • Create Domain to no
  • It fails to include
    • Replication Password (part of "Ldap configuration")
      • If this is not done, install will finish but you get these errors.
[zimbra@zldap3 ~]$ zmcontrol status
Cannot determine services - exiting
zldap3.DOMAIN.com...ERROR: service.FAILURE (system failure: getDirectContext)
(cause: javax.naming.AuthenticationException [LDAP: error code 49 - Invalid Credentials])
To Correct Without Reinstalling

If this has happened and you want to correct without a reinstall. Do the following, please adjust for HOSTNAMES for LDAP MAIN and LDAP REPLICA.

  • confirm ssh keys are updated
run zmupdateauthkeys on all servers
  • confirm current settings on LDAP MAIN
zmlocalconfig -s | grep replication
grep credentials /opt/zimbra/conf/slapd.conf
  • confirm current settings on LDAP REPLI
grep credentials /opt/zimbra/conf/slapd.conf
zmlocalconfig -s | grep replication
  • Now reconfigure on LDAP REPLI
zmldappasswd -l [passwd from ldap main slapd.conf]
    • This does not dynamically update the slapd.conf variable, it puts it in the zmconfig file /opt/zimbra/libexec/zmldapenablereplica
    • You'll see that it updates the slapd.conf
    • There might be one auth error, until the slapd.conf is reconfigured.
    • zmprov gacf will fail with auth errors
  • Confirm again settings on LDAP REPLI
grep credentials /opt/zimbra/conf/slapd.conf
zmlocalconfig -s | grep replication
zmlocalconfig | grep ldap_url
    • Should have repli first and ldap main second
  • Now to confirm it worked
zmcontrol stop
zmcontrol start
zmcontrol status
    • Create a test account on LDAP MAIN (example uses test3)
    • On LDAP REPLI - replace hostname and test account below
      • ldapsearch -x -H ldap://LDAPREPLICA.DOMAIN.com:389 | grep test3

Disable LDAP Replica

References:

http://wiki.zimbra.com/index.php?title=Promoting_Replica_to_LDAP_Master

http://www.zimbra.com/docs/os/latest/multi_server_install/LDAP%20Replication.6.1.html

Remove LDAP Replica From All Active Servers

On each member server, including the replica itself, verify the ldap_url value.

zmlocalconfig ldap_url

Modify the ldap_url to only include enabled ZCS LDAP servers. The master LDAP server should always be at the end of the ldap_url string value.

zmlocalconfig -e ldap_url="ldap://<replica-server-host> ldap://<master-server-host>"

Disable LDAP On The Replica

Stop Zimbra services.

zmcontrol stop

The - in front of zimbraServiceEnabled is [off], rather than a + for [on].

zmprov -l ms `zmhostname` -zimbraServiceEnabled ldap

To enable the ldap service, prefix the zimbraServiceEnabled attribute with a "+".

zmprov -l ms `zmhostname` +zimbraServiceEnabled ldap

If other services are enabled on this host, start them.

zmcontrol start

Additional Steps for MTA hosts

After updating the ldap_url with zmlocalconfig, rerun /opt/zimbra/libexec/zmmtainit. This rewrites the Postfix configuration with the updated ldap_url.

Disabling Replication On The Master

ZCS 5.x

Use only if disabling replication entirely across all nodes.

Edit /opt/zimbra/conf/slapd.conf.in adding the following comments. Please use the precise number of hash marks (#) shown.

change

include /opt/zimbra/conf/master-accesslog.conf

to

###include /opt/zimbra/conf/master-accesslog.conf

change

overlay syncprov
syncprov-checkpoint 20 10
syncprov-sessionlog 500
include /opt/zimbra/conf/master-accesslog-overlay.conf

to

#overlay syncprov
#syncprov-checkpoint 20 10
#syncprov-sessionlog 500
###include /opt/zimbra/conf/master-accesslog-overlay.conf

Restart the master LDAP server

ldap stop; ldap start

Promoting Replica To LDAP Master

Please see:

Importing LDAP data from master to replica 6.0

Please see:

BDB - Underlying Database Used For LDAP Data

BDB is the underlying high-performance transactional database used to store the LDAP data.

See:

db_stat

The db_stat utility displays statistics for Berkeley DB environments.

Example output:

[zimbra@mail3 openldap-data]$ db_stat -c -h /opt/zimbra/openldap-data
462	Last allocated locker ID.
2147M	Current maximum unused locker ID.
9	Number of lock modes.
3000	Maximum number of locks possible.
1500	Maximum number of lockers possible.
1500	Maximum number of lock objects possible.
19	Number of current locks.
73	Maximum number of locks at any one time.
62	Number of current lockers.
68	Maximum number of lockers at any one time.
19	Number of current lock objects.
50	Maximum number of lock objects at any one time.
1784391	Total number of locks requested.
1784372	Total number of locks released.
0	Total number of lock requests failing because DB_LOCK_NOWAIT was set.
8	Total number of locks not immediately available due to conflicts.
0	Number of deadlocks.
0	Lock timeout value.
0	Number of locks that have timed out.
0	Transaction timeout value.
0	Number of transactions that have timed out.
968KB	The size of the lock region..
6	The number of region locks granted after waiting.
3543865	The number of region locks granted without waiting.
db_archive

The db_archive utility writes the pathnames of log files that are no longer in use (for example, no longer involved in active transactions), to the standard output, one pathname per line. These log files should be written to backup media to provide for recovery in the case of catastrophic failure (which also requires a snapshot of the database files), but they may then be deleted from the system to reclaim disk space.

db_checkpoint

The db_checkpoint utility is a daemon process that monitors the database log, and periodically calls DB_ENV->txn_checkpoint to checkpoint it.

db_deadlock
db_dump
db_load
db_recover

Ldap Replica Styles And Timeframes

Please see this external reference:

LDAP And OverLays

We don't [officially] support running additional overlays with OpenLDAP.

SLAPO-RWM OVERLAY RWM

And slapo-rwm is known to be buggy in OpenLDAP 2.3.43 and continues to be buggy to this day in OpenLDAP 2.4. It certainly won't work with ZCS 5.0.16.

We would advise customers to avoid using it until it stabilizes, though they need to understand it's still going to be unsupported by us.

Where one places "overlay rwm" in the slapd.conf file has been known to cause issues as well. RWM has problems in the order in which it is loaded. There are at least 2 open bugs currently in the OpenLDAP ITS tracker.



GAL (Server) Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.

Actual GAL (Server) Topics Notes Homepage

Please see Ajcody-Notes-ServerGAL

GAL Behavior Bugs/RFE's

GAL And Alises

Please see the following:

Canonical Addresses - Beyond GAL Issues Really

Please see the following:

External GAL Source

Please see:

Setting/Checking GAL Varaibles

CLI To Sync Gal On Server

Truthfully, I'm not sure of the reasoning behind the command but this might be useful in trouble shooting connector issues with GAL sync issues.

zmprov syg DOMAINNAME.com

4.5.x versions will need quotes at the end.

zmprov syg DOMAINAME.com ""

My Gal & LDAP Settings For A Domain

To see your setting, do the following - replacing with domainname with the domain in question.

su - zimbra
zmprov gd [domainname] zimbraGalLdapSearchBase
zmprov gd [domainname] zimbraGalSyncLdapSearchBase

You'll see more GAL/LDAP related variables with:

zmprov gd domainname | egrep -i 'ldap|gal'

They are set using:

zmprov md [domainname] zimbraGalLdapSearchBase variable
zmprov md [domainname] zimbraGalSyncLdapSearchBase variable

Want My GAL To See All Domains

The default of a domain GAL [zimbraGalInternalSearchBase] is to see only it's domain. To have the GAL for a domain to see all domains on the server you need to set the variable to ROOT.

To see the existing setting:

zmprov gd [domainname] zimbraGalLdapSearchBase

To change the variable for the domain:

zmprov md [domainname] zimbraGalInternalSearchBase ROOT

All global change would be done with:

zmprov mcf zimbraGalInternalSearchBase ROOT
Some Other Ideas - Especially With Multiple Domains And ZCS Servers

This is just some notes I made for a specific case where there were multiple ZCS installs across sister companies. They didn't have a multi-server install and weren't sharing LDAP data therefore.

Here's some ideas I'm considering for this situation:

  1. Dump GAL data from each server and combine date to either:
    1. an external LDAP server you can then configure the ZCS servers to use as an external GAL
      • admin console > domain > GAL > Configure GAL > Both or External
    2. reformat GAL data so it can then be imported as an address book via the CLI into a sharead adddressbook on each server. Setup command to run from cron.
  2. Just setup an external Openldap server (which would have replica's at each site) that can be used as an external GAL - make this authoritative in your company. Then setup the ZCS to use it as an external GAL.
  3. To actually move your infrastructure of ZCS servers into one primary ZCS configuration. Instead of having each site/domain having it's own primary LDAP/ZCS server they would become LDAP replica servers with their domain mailstore's being local to each site. Configure each site/domain to use it's own MTA - if you want/need. And then internally to Zimbra you could set the GAL to be ROOT rather than DOMAIN.

Some bugs to review that touch on this:

I'm sure there's some other possibilities.

GAL Related Attributes Usage

This is from earlier 5.x versions, newer version might include more variables.

Attribute                                 scope                  For              GAL op
                                                                 - zimbra         - autocomplete
                                                                 - external       - serarch
                                                                 - both           - sync
                                                                                  - all
======================================================================================================================================================================
zimbraHideInGal                           account,DL,CR          zimbra           all
zimbraFeatureGalEnabled                   account,cos            both             search,sync
zimbraFeatureGalAutoCompleteEnabled       account,cos            both             autocomplete
zimbraPrefGalAutoCompleteEnabled          account,cos            both             autocomplete
zimbraGalMode                             domain                 both             all
zimbraGalLdapFilterDef                    globalConfig           both             all
zimbraGalLdapAttrMap                      domain,globalConfig    both             all
zimbraGalMaxResults                       domain,globalConfig    both             autocomplete, search (for sync, system does not specify a max when searching LDAP)
zimbraGalTokenizeAutoCompleteKey          domain                 both             autocomplete
zimbraGalTokenizeSearchKey                domain                 both             search

zimbraGalLdapPageSize                     domain,globalConfig    both             autocomplete, search, (sync if zimbraGalSyncLdapPageSize is not set)
zimbraGalSyncLdapPageSize                 domain,globalConfig    both             sync

----------------------------------------------------------------------------------------------------------------------------------------------------------------------
zimbraGalInternalSearchBase               domain,globalConfig    zimbra           autocomplete, search, (sync if zimbraGalSyncInternalSearchBase is not set)
zimbraGalSyncInternalSearchBase           domain,globalConfig    zimbra           sync

----------------------------------------------------------------------------------------------------------------------------------------------------------------------
zimbraGalLdapURL                          domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapURL is not set)
zimbraGalSyncLdapURL                      domain                 external         sync

zimbraGalLdapSearchBase                   domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapSearchBase is not set)
zimbraGalSyncLdapSearchBase               domain                 external         sync

zimbraGalLdapAuthMech                     domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapAuthMech is not set)
zimbraGalSyncLdapAuthMech                 domain                 external         sync

zimbraGalLdapBindDn                       domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapBindDn is not set)
zimbraGalSyncLdapBindDn                   domain                 external         sync

zimbraGalLdapBindPassword                 domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapBindPassword is not set)
zimbraGalSyncLdapBindPassword             domain                 external         sync

zimbraGalLdapKerberos5Principal           domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapKerberos5Principal is not set)
zimbraGalSyncLdapKerberos5Principal       domain                 external         sync

zimbraGalLdapKerberos5Keytab              domain                 external         autocomplete, search, (sync if zimbraGalSyncLdapKerberos5Keytab is not set)
zimbraGalSyncLdapKerberos5Keytab          domain                 external         sync

zimbraGalAutoCompleteLdapFilter           domain,globalConfig    external         autocomplete
zimbraGalLdapFilter                       domain                 external         search, (sync if zimbraGalLdapSyncFilter is not set)
zimbraGalSyncLdapFilter                   domain                 external         sync



External Authentication

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual External Authentication Homepage

Please see Ajcody-External-Authentication

General Topics

Zimbra supports the ability to use an external authentication source, but we don't support the external authentication servers setup and configuration.

Please see the following for more details:

You can also use the forums to see if others have worked out some good instructions when working with your particular external authentication server.

http://www.zimbra.com/forums/

Another possibility is the use of Preauth, see:

SSO with Sun IAM - Identity And Access Manager

There is no Access Manager Policy Agent for Jetty Application Server [Oct 21, 2008]. We suggest the following.

  1. Build a webpage that is protected by Sun Java Access Manager. Presumably this would be an apache tomcat served page so that SJAM would be able to manage it with its existing policy agent for apache tomcat. This page would interact with SJAM to get access checks and then use the standard Zimbra pre-auth mechanism to pre-auth the user and bounce them into the zimbra app.
  2. In Zimbra, you would configure (on the domain) zimbraWebClientLoginURL (and zimbraWebClientLogoutURL), to the address of that apache tomcat served webpage from step 1 above. If someone attempts to login to zimbra directly, they would be redirected to the page which is controlled by SJAM. And when logging out, they would be again redirected to the webpage that is controlled by SJAM. There would be no way to log into or out of Zimbra without the approval and control of SJAM.

For details on the preauth mechanism, see:

JA-SIG Central Authentication Service Or CAS

CAS is an authentication system originally created by Yale University to provide a trusted way for an application to authenticate a user. CAS became a JA-SIG project in December 2004.

Bugs/RFE's:

CAS and Public Share Issues

Adding the following as reported by a customer, with their permission.

When a Zimbra calendar has a Public share added, the url is something like 
"https://my.server.edu/home/user@domain.edu/Calendar.html".  Once the Zimbra 
app determines that this calendar has a Public share, it gets the calendar 
data through the /home directory path, but it requests the images and css data 
from the /zimbra/img and /zimbra/css directories.  We previously did not let 
unauthenticated users access /zimbra/img or /zimbra/css.  We added a modification 
to our casclient.jar code to allow requests from non-authenticated users to 
return data from these two directories, since these two directories do not 
contain any user or private system data.

And a more detailed explanation:

In the CASifying Zimbra setup, this is the default filter mapping they have you 
set up in the /opt/zimbra/jetty/etc/zimbra.web.xml.in file:

<filter-mapping>
   <filter-name>CAS Filter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>

This default url pattern will trigger Zimbra to run any request made to 
"https://my.server.edu/zimbra/..." through the casclient.jar filter.

Note, one thought my co-worker and I had was to modify this section of the 
zimbra.web.xml.in file to exclude /img and /css, which should accomplish the 
same thing we did by modifying the casclient.jar file.  Unfortunately, in our 
web-searching for Jetty Servlet 2.4 information about what you can do with the 
url-pattern, it did not appear that you could exclude or negate any url-patterns.  
If you or some other individual had any desire, you might have more luck in 
finding a way to accomplish this.  We thought it was better to modify the 
casclient.jar file anyway, as that carries over through upgrades, but changes to 
the zimbra.web.xml.in file have to be reapplied after every upgrade. **

Any custom filtering you wish to do for your location would be made in the 
casclient.jar archive.  After unjarring casclient.jar, the file you will modify is:  

casclient/src/edu/yale/its/tp/cas/client/filter/CASFilter.java

Certain requests could be filtered out before being sent on to the CAS server 
to reduce traffic and cpu usage.  Some examples would be requests for the login 
or logout pages, as the user is on their way to authenticate or de-authenticate, 
so checking these requests would usually be unnecessary.  This is also the place 
where we added code that excluded the /zimbra/img and /zimbra/css directories.  
Your code would look something like:

String uri = ((HttpServletRequest)request).getRequestURI();

if(uri.startsWith("/zimbra/img") || uri.startsWith("/zimbra/css"))
{
      fc.doFilter(request, response);
      return;
}

Support for SAML Shibboleth

Please see the following RFE:

References:


Support for SSO SPNEGO - ZWC, ZCO Outlook, And AD

Commonly Asked Questions That Need Answers
Existing References And Documentation

See the following [As of Apr 3, 2012]

Relevant Background Bugs/ RFE's
Comment #25 From David Pitt 2011-05-18 01:54:01
Approach adopted in current solution:

If you're signed onto a domain with a Windows username that matches the Zimbra
name used in the Outlook profile, then ZCO will attempt to use SSO, falling
back to a conventional signon if SSO fails.

This holds both for existing ZCO profiles and for new ones (so there's
currently no concept of a SSO-specific profile). In this respect ZCO largely
mirrors the SSO behaviour of the web client, always trying to use SSO first if
it's available. One key difference from the web client is that a ZCO user can
create a non-SSO profile for a different email account on the same server
(whereas if you point the web client at an SSO-configured server then you are
not given the opportunity to specify a username).

If the target server hasn't been set up with a SPNEGO redirect then SSO will
quickly fail (before any attempt to authenticate against the server) & fall
back to a normal signon. (So the impact on servers which aren't set up for SSO
is minimal.)

There's no new UI content at this stage for SSO. When creating a new profile
for an SSO target account the password can simply be left empty.

For correct operation ZCO must be configured with StorePassword=0 in the Zimbra
registry settings. (This can be set within the MSI using ZmCustomizeMsi.js
prior to installation.)

------- Comment #31 From David Pitt 2011-05-20 01:51:39

One extra bit of clarification on Comment #25:-  as with the web client, the
server name specified in the profile must match that used in the SPNEGO SPN (in
the Windows domain controller setup) for SSO to be used.
(See ZimbraServer/docs/spnego.txt for notes on configuring SPNEGO.)

So if, for example, the URL to be used with the web client in order to use SSO
is
   z32.puneqa.lab/zimbra/
then the ZCO profile will only use SSO if the server name is set to
   z32.puneqa.lab

------- Comment #32 From Nidhi Vyas 2011-05-20 02:23:05

Verified on ZimbraConnectorOLK_7.1.1.6321_x86/
7.1.1_GA_3183.RHEL4_64_20110516213106

Signed onto a domain with a Windows username that matches the Zimbra
name used in the Outlook profile then no need to specify the password while
creating profile.
Store password was set to 0.

Tried for both exsiting and new profile.
The target server had SPNEGO redirect enabled.

Marking this as verified.

Ajcody MTA Postfix Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Postfix - MTA

Actual MTA & Postfix Topics Homepage

Please see Ajcody-MTA-Postfix-Topics

Missing main.cf Error

Moved to Missing_main.cf_Error_-_MTA

MTA Mail Flow - Birds-eye Overview

Moved to Postfix-Amavisd_Mail_Flow_-_Birds-eye_Overview_-_MTA

Understanding /var/log/zimbra.log And Postfix Log Events

Moved to: Understanding_zimbra.log_And_Postfix_Log_Events_-_MTA

Postfix Queue ID vs. message-id

Moved to: Postfix_Queue_ID_vs._message-id_-_MTA

Authentication Log Events

Moved to Understanding_And_Troubleshooting_Authentication_Log_Events

IMAP And Authenticated SMTP [SSL] Example

Moved to Understanding_And_Troubleshooting_Authentication_Log_Events#IMAP_And_Authenticated_SMTP_.5BSSL.5D_Example

IMAP Test Via Telnet And Logging Events Of It - Proxy Included

Moved to Understanding_And_Troubleshooting_Authentication_Log_Events#IMAP_Test_Via_Telnet_And_Logging_Events_Of_It_-_Proxy_Included

IMAP Login Via Openssl - LOGIN TLS - Proxy Included

Moved to Understanding_And_Troubleshooting_Authentication_Log_Events#IMAP_Login_Via_Openssl_-_LOGIN_TLS_-_Proxy_Included

Network Tracing Between A Remote Host And A ZCS MTA

Moved to Network_Tracing_Between_A_Remote_Host_And_A_ZCS_MTA

Finding Messages - zmmsgtrace

See the following for details [for 7.1.1+]:

Documentation at CLI_zmmsgtrace . Note, if you get command not found as the zimbra user, try /opt/zimbra/libexec/zmmsgtrace instead.

How To Increase SMTP Debug Logging - MTA

Moved to How_To_Increase_SMTP_Debug_Logging_-_MTA

Simple Troubleshooting For SMTP Via Telnet, Openssl

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl

First - Understanding Your Authentication Requirements In ZCS

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#First_-_Understanding_Your_Authentication_Requirements_In_ZCS

Second - Encoding Username And Passwords For AUTH Sequence

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#Second_-_Encoding_Username_And_Passwords_For_AUTH_Sequence

For ESMTP Auth is LOGIN - Example

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#For_ESMTP_Auth_is_LOGIN_-_Example

For ESMTP Auth is Plain - Example

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#For_ESMTP_Auth_is_Plain_-_Example

For TLS/SSL - Example

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#For_TLS.2FSSL_-_Example

Testing Against Port 465

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#Testing_Against_Port_465

To Confirm An Auth User Can't Send With Another FROM Address

Moved to Simple_Troubleshooting_For_SMTP_Via_Telnet_And_Openssl#To_Confirm_An_Auth_User_Can.27t_Send_With_Another_FROM_Address

Adding A New MTA Server

Basic instructions can be found here:

Additional instructions needed beyond the above will follow as I hear about them.

Load Balancing For SMTP - Out Bound Mail

Currently, 5.x code, you have the following options:

    • An external load balancing device that will then split the traffic behind it
    • Setup a round-robin A record situation in your DNS for the external mta's you'll be using.

In, GNR/6.x, you are able to add multiple targets to the variables and we'll have some degree of "balancing" between them.

User Alias Mapping And Mail Transport with Postfix & LDAP

See User_Alias_Mapping_and_Mail_Transport_with_Postfix_&_LDAP

Multiple LDAP Servers?

Completed RFE:

  • "mta should be able to take a list of LDAP servers to take advantage of replicas."

From :

        server_host (default: localhost)
              The name of the host running the LDAP server,  e.g.

                  server_host = ldap.example.com

              Depending  on the LDAP client library you're using,
              it should be possible to specify  multiple  servers
              here,  with the library trying them in order should
              the first one fail. It should also be  possible  to
              give  each  server  in  the  list  a different port
              (overriding server_port below), by naming them like

                  server_host = ldap.example.com:1444

              With OpenLDAP, a (list of) LDAP URLs can be used to
              specify both the hostname(s) and the port(s):

                  server_host = ldap://ldap.example.com:1444
                              ldap://ldap2.example.com:1444

              All LDAP URLs accepted by the OpenLDAP library  are
              supported,  including  connections over UNIX domain
              sockets, and LDAP SSL (the last one  provided  that
              OpenLDAP was compiled with support for SSL):

                  server_host = ldapi://%2Fsome%2Fpath
                              ldaps://ldap.example.com:636

 **my note**
 This thread - http://archives.neohapsis.com/archives/postfix/2004-09/1763.html
 give me the impression they made a mistake in modifying the help file on this
 and they dropped the use/need of the command:

  server_host = ldap://ldap.example.com:1444, ldap://ldap2.example.com:1444

Just a small note on where var shows up:

[root@mail3 conf]# pwd
/opt/zimbra/conf
[root@mail3 conf]# grep server_host *
amavisd.conf.in:$myhostname = '@@zimbra_server_hostname@@';  # must be a fully-qualified domain name!
ldap-scm.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
ldap-transport.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
ldap-vad.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
ldap-vam.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
ldap-vmd.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
ldap-vmm.cf:server_host = ldap://mail3.zimbra.DOMAIN.com:389
localconfig.xml:  <key name="zimbra_server_hostname">
zmmta.cf:	LOCAL zimbra_server_hostname
zmmta.cf:	POSTCONF myhostname		LOCAL zimbra_server_hostname

References:

Traditional Aliases Use - /etc/aliases Type Lookups

Moved to Traditional_Aliases_Use_-_/etc/aliases_Type_Lookups

Allowing Accounts To Change The From Address

Please see:

Related BUG/RFE's

Creating A Domain Alias

Please see ManagingDomains#Creating_a_Domain_Alias

Relay Domain Forwarding

Please see ManagingDomains#Relaying.2FDomain_Forwarding

Domain Catchall

Please see ManagingDomains#Domain_Catchall

Rewriting From Address For Outbound Email

Please see ManagingDomains#Domain_Masquerading

Rewrite Recipient Address For Incoming Email

There is a way to rewrite the incoming mail, but it's not a standard Zimbra feature. You can implement it as a configuration change in Postfix. Here's what you do:

  1. Create a file in /opt/zimbra/conf named 'postfix_recipientmap'.
    • The format is a single line that reads something like: @alias.domain.com @domain.com
  2. Run 'postmap postfix_recipientmap' in the conf directory.
  3. Run "postconf -e recipient_canonical_maps=hash:/opt/zimbra/conf/postfix_recipientmap".
  4. Run 'postfix reload'.

This will cause postfix to map any incoming mail with a recipient of '@alias.domain.com' to '@domain.com'. You will need to re-apply this postconf change after upgrades, though the postfix_recipientmap file should survive.

Automatic BCC

Option 1 - Via Postfix Customization

From the postfix website:

  • always_bcc = address
    • Deliver a copy of all mail to the specified address. In Postfix versions before 2.1, this feature is implemented by smtpd(8), qmqpd(8), or pickup(8).
  • sender_bcc_maps = type:table
    • Search the specified "type:table" lookup table with the envelope sender address for an automatic BCC address. This feature is available in Postfix 2.1 and later.
  • recipient_bcc_maps = type:table
    • Search the specified "type:table" lookup table with the envelope recipient address for an automatic BCC address. This feature is available in Postfix 2.1 and later.
  • Note: automatic BCC recipients are produced only for new mail. To avoid mailer loops, automatic BCC recipients are not generated for mail that Postfix forwards internally, nor for mail that Postfix generates itself.

Please see the following:

Option 2 - Via ZCS Legal Intercept

Generally used for Managing Legal Requests for Information

Description:

The ZCS legal intercept feature is used to obtain copies of email messages that are sent, received, or saved as drafts from targeted accounts and send these message to a designated “shadow” email address. Legal Intercept can be configured to send the complete content of the message or to send only the header information. When a targeted account sends, receives, or saves a draft message, an intercept message is automatically created to forward copies of the messages as attachments to the specified email address.

Please see:

Option 3 - Zimbra's Archiving And Discovery

See Ajcody-Notes-Archive-Discovery concerning A&D setup and options.

Limiting Or Increasing Number Of Recipents / Messages

Mailing Lists - Distribution Lists

Please see Ajcody-MailingLists-And-Mailman#Problems_Resolving_Virtual_Aliases_For_Members_Of_Large_Distribution_Lists

Policy Daemon

If you want to restrict messages per hour, you can look into Policy Daemon:

Beta release in ZCS 7 , see:

Postfix

Also, there are some default postfix parameters set to control sending a message to x amount recipients. The parameters you will need to look at are smtpd_recipient_limit & smtpd_recipient_overshoot_limit, these have a default value of 1000.

Postfix defines these parameters as:

  • smtpd_recipient_limit: The maximum number of recipients that the Postfix SMTP server accepts per message delivery request.
  • smtpd_recipient_overshoot_limit: The number of recipients that a remote SMTP client can send in excess of the limit specified with $smtpd_recipient_limit, before the Postfix SMTP server increments the per-session error count for each excess recipient.

From the command line you can change the default values.

su - zimbra
postconf -e smtpd_recipient_limit=<new value>
postconf -e smtpd_recipient_overshoot_limit=<new value>
postfix reload

Bugs RFE's For Customers To Get Behind

I'm wondering if policyd gives one the control everyone is looking for? I've not used it myself.

Policyd References:

There's other additions [add-on's] one can get for policyd.

We have this RFE in regards to policyd support:

Other related rfe/bugs, specially to push variables into admin web console:

Controlling SMTPD Client Connections

Mmorse did a good write up on these variables in the forum:

Postfix Resources At Their Site (All Clients/Connections):

Postfix Resources At Their Site (Exceptions To Clients/Connections Or Single Source):

Restrictions

Besides using external mailing list software, Mailman or Sympa, here's some other topical items in regards to restrictions.

Some user contributed articles:

Some Postfix references:

Some RFE's related to mta based restrictions [targets are based upon today - July 21, 2010]:

Spam Control And Related Issues

High Over View Steps Of What To Do

  • Step 1: Confirm your not an open relay and double check your postfix $mynetworks variable.
  • Step 2: Stop or put on-hold mail queue.
    • Put all messages into HOLD queue:
      • Get a report of your current mailq [can be useful if you clean out the queue later but need to identify what external mail hosts are now denying you and who you'll need to contact about getting removed from their denial list]
        • Example: /opt/zimbra/postfix/sbin/mailq > /tmp/zimbra_mailq_report.txt
      • /opt/zimbra/postfix/sbin/postsuper -h ALL
    • Or put all messages match compromised account into HOLD queue:
      • /opt/zimbra/postfix/sbin/mailq | grep user_compromised@domain | awk '{ print $1 }' | tr -d '!*' | /opt/zimbra/postfix/sbin/postsuper -h -
        • Note, this is an example - you might with the grep grab more than the compromised account with the match.
    • See whole section - Managing The Postfix Queue
  • Step 3: Check your mail log [On ZCS servers running MTA services] - /var/log/zimbra.log
  • Step 4: Identify compromised account authenticating SMTP AUTH connection or block ip address where emails are coming from at firewall.
    • Who's My Spammer?
    • Continue to monitor compromised account and block ip addresses:
      • tail -f /var/log/zimbra.log | grep username | grep sasl
        • Jun 8 18:14:10 mail postfix/smtpd[15794]: 004358EEB16: client=unknown[XXXX.236.197.216], sasl_method=LOGIN, sasl_username=username@domain
  • Step 5: Disable the exploited email account, expire auth session, etc.
  • Step 6: Move the mail queue or delete the spam email
  • Step 7: Release Mail queue

Who's My Spammer?

Getting Some Initial Summary Data
zmdialyreport

First, some notable bug/RFE's in regards to the zmdailyreport:

You can first get some summary data by doing the following:

[zimbra@zcs806 ~]$ /opt/zimbra/libexec/zmdailyreport

Grand Totals
------------
messages

      7   received
     11   delivered
      0   forwarded
      0   deferred
      0   bounced
      3   rejected (21%)
      0   reject warnings
      0   held
      0   discarded (0%)

   2780   bytes received
  10914   bytes delivered
      2   senders
      1   sending hosts/domains
      1   recipients
      1   recipient hosts/domains


Per-Hour Traffic Summary
    time          received  delivered   deferred    bounced     rejected
    --------------------------------------------------------------------
    0000-0100           0          0          0          0          0
    0100-0200           1          3          0          0          0
    0200-0300           0          0          0          0          0
    0300-0400           0          0          0          0          0
    0400-0500           0          0          0          0          0
    0500-0600           0          0          0          0          0
    0600-0700           0          0          0          0          0
    0700-0800           1          0          0          0          2
    0800-0900           1          0          0          0          0
    0900-1000           0          0          0          0          1
    1000-1100           0          0          0          0          0
    1100-1200           0          0          0          0          0
    1200-1300           4          8          0          0          0
    1300-1400           0          0          0          0          0
    1400-1500           0          0          0          0          0
    1500-1600           0          0          0          0          0
    1600-1700           0          0          0          0          0
    1700-1800           0          0          0          0          0
    1800-1900           0          0          0          0          0
    1900-2000           0          0          0          0          0
    2000-2100           0          0          0          0          0
    2100-2200           0          0          0          0          0
    2200-2300           0          0          0          0          0
    2300-2400           0          0          0          0          0

Host/Domain Summary: Message Delivery (top 50)
 sent cnt  bytes   defers   avg dly max dly host/domain
 -------- -------  -------  ------- ------- -----------
     11    10914        0     7.4 s   24.0 s  zcs806.DOMAIN.com

Host/Domain Summary: Messages Received (top 50)
 msg cnt   bytes   host/domain
 -------- -------  -----------
      5     2780   zcs806.DOMAIN.com

top 50 Senders by message count
-------------------------------
      4   zimbra@zcs806.DOMAIN.com
      1   admin@zcs806.DOMAIN.com

top 50 Recipients by message count
----------------------------------
     11   admin@zcs806.DOMAIN.com

top 50 Senders by message size
------------------------------
   1974   zimbra@zcs806.DOMAIN.com
    806   admin@zcs806.DOMAIN.com

top 50 Recipients by message size
---------------------------------
  10914   admin@zcs806.DOMAIN.com

message deferral detail: none

message bounce detail (by relay): none

message reject detail
---------------------
  MAIL
    5.3.4 Message size exceeds fixed limit (total: 3)
           3   domain-ext.com

message reject warning detail: none

message hold detail: none

message discard detail: none

smtp delivery failures: none

Warnings
--------
  sendmail (total: 3)
         1   or the command is run from a set-uid root process
         1   the Postfix sendmail command has set-uid root file permissions
         1   the Postfix sendmail command must be installed without set-uid ...
  smtpd (total: 1)
         1   7A735345A: queue file size limit exceeded

Fatal Errors: none

Panics: none

Master daemon messages: none
client_usage_report.py

This will give some stats on your mail activity. Note, there are some issue with this script double reporting mail counts etc, but it's useful to identify the top 50 for activity.

[zimbra@zcs806 ~]$ /opt/zimbra/libexec/client_usage_report.py
Reading /opt/zimbra/log/access_log.2014-04-17 ..
Reading /opt/zimbra/log/access_log.2014-04-18 ..
Reading /opt/zimbra/log/access_log.2014-04-19 ..
Reading /opt/zimbra/log/access_log.2014-04-20 ..
Reading /opt/zimbra/log/access_log.2014-04-21 ..
Reading /opt/zimbra/log/access_log.2014-04-22 ..
Reading /opt/zimbra/log/access_log.2014-04-23 ..
Writing /opt/zimbra/zmstat/client_usage_report_2014-04-24.csv ..

Then review the file it will create , it will give : "user_agent","client_IP","req_count"

[zimbra@zcs806 ~]$ cat /opt/zimbra/zmstat/client_usage_report_2014-04-24.csv
"user_agent","client_IP","req_count"
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:28.0) Gecko/20100101 Firefox/28.0","192.168.1.166","14"
"Mozilla/5.0 (Windows NT 6.2; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0","192.168.1.166","93"
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0","192.168.1.174","6"
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0) Gecko/20100101 Firefox/28.0","192.168.1.166","71"
qshape

You can also look at the results of [qshape] - the default is the active queue. For more on qshape, see [Postfix Qshape Readme] .

qshape deferred
               T  5 10 20 40 80 160 320 640 1280 1280+
        TOTAL 12  0  0  0  0  0   0   0   0    0     12
    gmail.com  9  0  0  0  0  0   0   0   0    0     9
    yahoo.com  3  0  0  0  0  0   0   0   0    0     3
3rd Party Log Reports - postfix-logwatch and amavis-logwatch

Created RFE for us to include these in ZCS:

You can download them from http://logreporters.sourceforge.net/ . It's a fairly simply install, download and then extract - cd into extracted directory and as root type :

make install-standalone

They will install to /usr/local/bin/amavis-logwatch & postfix-logwatch . The config files are in /usr/local/etc/amavis-logwatch.conf & postfix-logwatch.conf . Here's an example of the output.

/usr/local/bin/amavis-logwatch output example:

[root@zcs806 amavis-logwatch-1.51.02]# /usr/local/bin/amavis-logwatch /var/log/zimbra.log
****** Summary *************************************************************************************

       4   Total messages scanned ------------------  100.00%
   1.926K  Total bytes scanned                          1,972
========   ==================================================

       4   Passed ----------------------------------  100.00%
       4     Clean passed                             100.00%
========   ==================================================

       4   Ham -------------------------------------  100.00%
       4     Clean passed                             100.00%
========   ==================================================


==================================================================================
Spam Score Percentiles        0%       50%       90%       95%       98%      100%
----------------------------------------------------------------------------------
Score Ham (4)             -1.900    -1.900    -1.900    -1.900    -1.900    -1.900
==================================================================================

======================================================================================================
Spam Score Frequency      <= -10     <= -5      <= 0      <= 5     <= 10     <= 20     <= 30      > 30
------------------------------------------------------------------------------------------------------
Hits (4)                       0         0         4         0         0         0         0         0
Percent of Hits            0.00%     0.00%   100.00%     0.00%     0.00%     0.00%     0.00%     0.00%
======================================================================================================

/usr/local/bin/postfix-logwatch output example:

[root@zcs806 amavis-logwatch-1.51.02]# /usr/local/bin/postfix-logwatch /var/log/zimbra.log

****** Summary *************************************************************************************

       1   *Warning: Queue file size limit exceeded

   6.512K  Bytes accepted                               6,668
   1.928K  Bytes sent via SMTP                          1,974
   4.584K  Bytes sent via LMTP                          4,694
========   ==================================================

      10   Accepted                                    76.92%
       3   Rejected                                    23.08%
--------   --------------------------------------------------
      13   Total                                      100.00%
========   ==================================================

       3   5xx Reject message size                    100.00%
--------   --------------------------------------------------
       3   Total 5xx Rejects                          100.00%
========   ==================================================

      10   Connections
      10   Disconnections
       8   Removed from queue
       4   Sent via SMTP
       4   Sent via LMTP
       4   Filtered

****** Detail (10) *********************************************************************************

       3   5xx Reject message size -----------------------------------------------------------------
       3      192.168.1.166     remote.domain.com
       3         *unavailable
       3            *unavailable

       4   Sent via SMTP ---------------------------------------------------------------------------
       4      zcs806.DOMAIN.com

       4   Sent via LMTP ---------------------------------------------------------------------------
       4      zcs806.DOMAIN.com

       4   Filtered --------------------------------------------------------------------------------
       2      smtp-amavis:[127.0.0.1]:10024
       2         Sender address
       1            admin@zcs806.DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  192.168.1.166     remote.domain.com
       1            user@DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  192.168.1.184     remote2.domain.com
       2      smtp-amavis:[127.0.0.1]:10026
       2         Sender address
       1            admin@zcs806.DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  192.168.1.166     remote.domain.com
       1            user@DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  192.168.1.184     remote2.domain.com

=== Delivery Delays Percentiles ============================================================
                    0%       25%       50%       75%       90%       95%       98%      100%
--------------------------------------------------------------------------------------------
Before qmgr       0.04      0.09      0.11      0.11      0.23      0.35      0.43      0.48
In qmgr           0.00      0.00      0.01      0.01      0.04      0.07      0.08      0.09
Conn setup        0.00      0.01      0.29      1.30      2.05      2.23      2.33      2.40
Transmission      0.10      2.81      4.85      9.60     21.00     21.00     21.00     21.00
Total             0.20      2.91      5.20     11.00     23.30     23.65     23.86     24.00
============================================================================================

Note - First, look at the options each command has using the -h output. You might want to use --full when doing an investigation and also include a wildcard - /var/log/zimbra.lo* to take in all the log data. For example:

[zimbra@zcs806 ~]$ /usr/local/bin/postfix-logwatch --full /var/log/zimbra.lo*
****** Summary *************************************************************************************

       9   *Fatal:   General fatal
       1   *Warning: Queue file size limit exceeded
      21   Miscellaneous warnings

 710.888K  Bytes accepted                             727,949
 193.036K  Bytes sent via SMTP                        197,669
 520.114K  Bytes sent via LMTP                        532,597
========   ==================================================

    1041   Accepted                                    99.71%
       3   Rejected                                     0.29%
--------   --------------------------------------------------
    1044   Total                                      100.00%
========   ==================================================

       3   5xx Reject message size                    100.00%
--------   --------------------------------------------------
       3   Total 5xx Rejects                          100.00%
========   ==================================================

      65   Connections
      65   Disconnections
    1041   Removed from queue
     523   Sent via SMTP
     517   Sent via LMTP
       2   Bounced (local)
       1   Bounced (remote)
       9   Filtered
       2   Notifications sent

       4   Timeouts (inbound)
       1   PIX workaround enabled

****** Detail (10) *********************************************************************************

       9   *Fatal:   General fatal -----------------------------------------------------------------
       3      Queue report unavailable - mail system is down
       3      Usage: sendmail [options]
       2      The Postfix mail system is not running
       1      Usage: send-mail [options]

      21   Miscellaneous warnings ------------------------------------------------------------------
       7      or the command is run from a set-uid root process
       7      the Postfix sendmail command has set-uid root file permissions
       7      the Postfix sendmail command must be installed without set-uid root file permissions

       3   5xx Reject message size -----------------------------------------------------------------
       3      10.X.X.166     fence.DOMAIN.com
       3         *unavailable
       3            *unavailable

     523   Sent via SMTP ---------------------------------------------------------------------------
     507      86.lab
      15      zcs806.DOMAIN.com
       1      domaina.com

     517   Sent via LMTP ---------------------------------------------------------------------------
     507      86.lab
      10      zcs806.DOMAIN.com

       2   Bounced (local) -------------------------------------------------------------------------
       2      5.0.0: Permanent failure: Other/Undefined status: Other undefined status
       2         zcs806.DOMAIN.com
       2            Zcs806.DOMAIN.com
       1               subject:test
       1               zimbra

       1   Bounced (remote) ------------------------------------------------------------------------
       1      5.0.0: Permanent failure: Other/Undefined status: Other undefined status
       1         domain.com
       1            user
       1               64.X.X.28      sentry.DOMAIN.com
       1                  505 5.0.0 Unknown recipient: RCPT TO

       9   Filtered --------------------------------------------------------------------------------
       7      smtp-amavis:[127.0.0.1]:10026
       7         Sender address
       3            admin@zcs806.DOMAIN.com
       3               admin@zcs806.DOMAIN.com
       2                  10.X.X.36     zcs806.DOMAIN.com
       1                  10.X.X.166     gatewayXX.DOMAIN.com
       2            zimbra@zcs806.DOMAIN.com
       2               admin@zcs806.DOMAIN.com
       2                  10.X.X.36     zcs806.DOMAIN.com
       1            ajcody@DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  10.X.X.184     edgeXX.DOMAIN.com
       1            san5@zcs806.DOMAIN.com
       1               b@zcs806.DOMAIN.com
       1                  10.X.X.36     zcs806.DOMAIN.com
       2      smtp-amavis:[127.0.0.1]:10024
       2         Sender address
       1            admin@zcs806.DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  10.X.X.166     gatewayXX.DOMAIN.com
       1            ajcody@DOMAIN.com
       1               admin@zcs806.DOMAIN.com
       1                  10.X.X.184     edgeXX.DOMAIN.com

       2   Notifications sent ----------------------------------------------------------------------
       2      Non-delivery
       2         sender

       4   Timeouts (inbound) ----------------------------------------------------------------------
       4      After END-OF-MESSAGE

       1   PIX workaround enabled ------------------------------------------------------------------
       1      disable_esmtp delay_dotcrlf
       1         64.X.X.28      sentry.DOMAIN.com

=== Delivery Delays Percentiles ============================================================
                    0%       25%       50%       75%       90%       95%       98%      100%
--------------------------------------------------------------------------------------------
Before qmgr       0.01      0.03      0.06      0.14      0.27      0.34      0.48      2.60
In qmgr           0.00      0.00      0.08    117.50    193.00    216.00    231.48    246.00
Conn setup        0.00      0.00      0.00      0.00      0.02      0.04      0.22     20.00
Transmission      0.05      0.09      3.60      9.80     10.00     10.00     11.00    160.00
Total             0.07      0.13      3.80    129.00    203.00    226.00    241.64    259.00
============================================================================================
zmaccts

One way to note accounts that are actively logging in vs. those that aren't, can help shrink the number of accounts you might want to investigate or monitor. [example below, I cut out a lot of the accounts]

           account                          status             created       last logon
------------------------------------   -----------     ---------------  ---------------
zcstest001@zcs806.DOMAIN.com                active      01/20/14 18:47   03/02/14 21:11
zcstest002@zcs806.DOMAIN.com                active      01/30/14 01:48   02/19/14 00:07
admin-20140415@zcs806.DOMAIN.com            active      04/15/14 14:42            never
archtest-prod-20140402@zcs806.DOMAIN        active      04/02/14 07:42            never

           account                          status             created       last logon
------------------------------------   -----------     ---------------  ---------------
bruce@test1.lab                             active      02/22/14 09:32            never
test.cal@test1.lab                          active      04/06/14 05:35   04/06/14 05:35
test200@test1.lab                           active      04/12/14 00:50            never

                                 domain summary

    domain                  active    closed    locked    maintenance     total
-----------------------   --------  --------  --------  -------------  --------
test1.lab                        3         0         0              0         3
test2.com                        2         0         0              0         2
angad.com                        2         0         0              0         2
test.test                        3         0         0              0         3
test.DOMAIN.com                  6         0         0              0         6
zcs806.DOMAIN.com               58         0         0              0        58
zcs806.DOMAIN.com                2         0         0              0         2
By Authentication Attempts

A fast way to see who is doing a lot of authentications, which normally happens when a spammer has compromised an account with a weak password, is to do:

# cat /var/log/zimbra.log | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n
      1 Auser@domain.com
      3 Buser@domain.com
      4 Cuser@domain.com
      5 Duser@domain.com
     36 SPAMMER@domain.com

Note - This might take a long time, if so - try pruning it down

Example:

# cat /var/log/zimbra.log | grep sasl_username > /tmp/zimbra_sasl_username.txt
# cat /tmp/zimbra_sasl_username.txt | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n
      1 Auser@domain.com
      3 Buser@domain.com
      4 Cuser@domain.com
      5 Duser@domain.com
     36 SPAMMER@domain.com

The full log event will look like this:

zimbra1 postfix/smtpd[29431]: B28914D5978: client=xxxxx.server.com[w.x.y.z], sasl_method=LOGIN, sasl_username=user
zimbra1 postfix/cleanup[5522]: B28914D5978: message-id=<20090420154255.B28914D5978@zimbraserver.com>
zimbra1 postfix/qmgr[20690]: B28914D5978: from=<spam@spam.com>, size=6026, nrcpt=10 (queue active)
zimbra1 postfix/cleanup[3983]: 2BA56465D28: message-id=<20090420154255.B28914D5978@zimbraserver.com>

Against your older logs, you could:

# zcat /var/log/zimbra.log* | sed -n 's/.*sasl_username=//p' | sort | uniq -c | sort -n

And you can look at the specific information for the user in question with:

# grep -C2 "sasl_username=SPAMMER@domain.com" /var/log/zimbra.log

Or if searching against the older logs:

# zgrep -C2 "sasl_username=SPAMMER@domain.com" /var/log/zimbra.log*

If you want to check on a specific message ID, do:

grep 9DF7520804A /var/log/zimbra.log*

For older message logs:

zgrep 9DF7520804A /var/log/zimbra.log*

To read/view the message in the queue:

/opt/zimbra/postfix/sbin/postcat -q 9DF7520804A 

One would then normally lock/change password on the one account showing the most activity. Grep'ing the /var/log/zimbra.log with the username in question will also show the ip address being used, this can be blocked with your firewall.

To be alerted of a compromised account and have it lock automatically see below. Slightly modified from this reference : http://www.zimbra.com/forums/administrators/62613-identify-compromised-accounts.html#post278732 :


#!/bin/bash
# checks log file and gets a count of authentications sent per minute, per user
# and if the count exceeds the maxmails value the user's account is locked.

logfile="/var/log/zimbra.log"
maxmails="10"
mydomain="example.com"
support="<postmaster-userid>@$mydomain"
accounts="/tmp/active_accounts"

su zimbra -c "/opt/zimbra/bin/zmaccts" | grep "@" | grep active | awk '{print $1}' > $accounts

zgrep -i "auth ok" $logfile | sed 's/  / /g' | awk -F"[ :]" '{print $3":"$4,$11;}' | uniq -c | sort -n | \
while read line
do
    count=`echo ${line} | cut -d' ' -f 1`
    userid=`echo ${line} | cut -d' ' -f 3`
    timestamp=`echo ${line} | cut -d' ' -f 2`
    active=`grep "$userid@$mydomain" $accounts`

    if [ "$count" -gt "$maxmails" ] && [ "$active" == "$userid@$mydomain" ]; then
        echo "Maximum email rate exceeded, $userid@$mydomain will be locked"
        su zimbra -c "/opt/zimbra/bin/zmprov ma $userid@$mydomain zimbraAccountStatus locked"
        subject="$userid account locked due to excessive connections"
        # Email text/message
        message="/tmp/emailmessage.txt"
        echo "$userid account has been locked as there were $count connections made at"> $message
        echo "$timestamp.  Please have the user change their password, and check for phishing" >>$message
        echo "emails if possible." >>$message
        # send an email using /bin/mail
        /usr/bin/mail -s "$subject" "$support" < $message
        rm -f $message

        #update list of active accounts
        su zimbra -c "/opt/zimbra/bin/zmaccts" | grep "@" | grep active | awk '{print $1}' > $accounts
    fi
done

rm -f $accounts

Then run it as a cron job. The frequency will depend on the number of accounts you're managing.

* * * * * /opt/zimbra/find_spammer.sh
By Connecting IP - Useful For Blocking IP At Firewall

See also the following:

To find the originating IP address of where the emails are coming from:

grep 'connect from' /var/log/zimbra.log | sed 's/.*connect from.*\[\(.[^]]*\)\]/\1/g' | sort | uniq -c | sort -nr | head

To check your older logs [example output below]:

zgrep 'connect from' /var/log/zimbra.log* | sed 's/.*connect from.*\[\(.[^]]*\)\]/\1/g' | sort | uniq -c | sort -nr | head
     36 10.137.xx.34
     34 127.0.0.1
Open Relay Check

You should also confirm you aren't an open relay.

$ host -t mx DOMAIN.com
DOMAIN.com mail is handled by 10 mail.DOMAIN.com.

$ telnet mail.DOMAIN.com 25
Trying 184.###.##.## ...
Connected to mail.DOMAIN.com.
Escape character is '^]'.
220 mail.DOMAIN.com ESMTP Postfix
helo support.test
250 mail.DOMAIN.com
mail from:<SPAMMER@domain.com>
250 2.1.0 Ok
rcpt to:<TEST@DOMAIN.COM>
554 5.7.1 <TEST@DOMAIN.COM>: Relay access denied

rcpt to:<SPAMMER@domain.com>
554 5.7.1 Service unavailable; Client host [71.XXX.XX.XX] blocked 
 using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=71.202.XX.XX
quit
221 2.0.0 Bye
Connection closed by foreign host.
Telnet Test To Confirm/Show Authentication Required For SMTP/Port 25

This is an example:

esx2:~ ajcody$ telnet zcs723.EXAMPLE.com 25

Trying 10.137.27.32...
Connected to zcs723.EXAMPLE.com.
Escape character is '^]'.
220 zcs723.EXAMPLE.com ESMTP Postfix
helo zcs723.EXAMPLE.com   << I typed
250 zcs723.EXAMPLE.com
mail from:ajcody@zcs723.EXAMPLE.com   << I typed
250 2.1.0 Ok
rcpt to:ajcody2@zcs723.EXAMPLE.com   << I typed
553 5.7.1 <ajcody@zcs723.EXAMPLE.com>: Sender address rejected: not logged in

But note - if you do this from the ZCS server or a server that is within the ip range or has it's specific ip listed in the mynetworks, you will not get this authentication requirement.

[root@zcs723 ~]# telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 zcs723.EXAMPLE.com ESMTP Postfix
helo myworkstation
250 zcs723.EXAMPLE.com
ehlo myworkstation
250-zcs723.EXAMPLE.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:<ajcody@zcs723.EXAMPLE.com>
250 2.1.0 Ok
rcpt to: <ajcody2@zcs723.EXAMPLE.com>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
From: Adam <ajcody@zcs723.EXAMPLE.com>
To: Adam 2 <ajcody2@zcs723.EXAMPLE.com>
Subject: From Localhost - NOT Auth
test
.
250 2.0.0 Ok: queued as 8B19E1E78D1
quit
221 2.0.0 Bye
Connection closed by foreign host.

Resources

A list of resources you'll find useful:

Wiki articles that have been assigned to the anit-spam category:

Down to the end-user:

External Relay Test Pages
  • http://www.checkor.com/
    • Note - this test is in regards to the From spoofing spammers sometimes do for DL's.
    • Also, for the test - make an account/DL on your system for test1@[your domain] . Otherwise you'll just error about account not existing.
RSET
250 2.0.0 Ok
MAIL FROM: spam@mail59.DOMAIN.com
250 2.1.0 Ok
RCPT TO: test1@mail59.DOMAIN.com
Test Failed, 250 2.1.5 Ok 

Blocking MAIL FROM - smtpd_sender_restrictions - Default Is Empty

External References
Zimbra References And Bugs & RFE's
Protecting DL's From Spammers - Forging Mail From
First Recommendation - As Given By Dev's From Critical Meeting Notes

  • Enabled SASL/SMTP Authentication
  • Implement how-to as described in :
    • Permitted Senders: RestrictPostfixRecipients
      • Note: You'll see on the above page a reference to the spoof hole.
        • "This method can be spoofed by forging the MAIL FROM: header (so mail appears to originate from within the domain), so it isn't foolproof, but it works for basic needs."
      • Note: You'll also modify the instructions as above with addition details provided below.
  • Force authentication for local-domain senders:
    • modify the main.cf to have the following:
      • smtpd_sender_restrictions = check_sender_access hash:/path/to/file
    • Then for the /path/to/file that you used in the mail.cf for smtpd_sender_restrictions, you'll have a line like:
      • example.com permit_sasl_authenticated, reject
Second Recommendation - Unpredictable DL name or Non-routing Domain

Do not use predictable DL names. Instead of using everyone@company.com , use something like everyone-[random-string]@company.com .

Another option is to use a non-routing domain - company.local - and setup your DL's there. You'll want to configure your main domain to be able to query the GAL of this domain.

To see the existing setting:

zmprov gd [domainname] zimbraGalLdapSearchBase

To change the variable for the domain:

zmprov md [domainname] zimbraGalInternalSearchBase ROOT
Third Recommendation - Using smtpd_sender_restrictions

Work In Progress. I'm testing this now. Please don't attempt until this line is removed.

Update: See the following:

This should work if your "clients" are using ZWC, ZCO, or ActiveSync mobile devices. If you are using IMAP/POP + STMP thick clients, you'll most likely have to enable smtp authentication [sasl] and use the reject_authenticated_sender_login_mismatch variable instead.

postconf -e smtpd_sender_restrictions=reject_sender_login_mismatch
postfix reload

This option is described as:

reject_sender_login_mismatch
Reject the request when $smtpd_sender_login_maps specifies an owner for the MAIL FROM address, but the client is not (SASL) logged in as that MAIL FROM address owner; or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address according to $smtpd_sender_login_maps. Man page

Some Other SMTP Sending Restrictions

Blocking Incoming From Domain And By User

See the following:

check_client_access

The smtpd_client_restrictions parameter restricts what clients this system accepts SMTP connections from. The default behavior is to allow SMTP connections from any client. This is discussed under Spam Controls on the Postfix site.

Example:

check_client_access regexp:/etc/postfix/access_sender_client_server,

Example:

check_sender_access regexp:/etc/postfix/access_sender_toplevel
smtpd_reject_unlisted_sender

Details can be found on the mail.cf Postfix page.

Example:

smtpd_reject_unlisted_sender = yes

Possible Bug:

http://bugzilla.zimbra.com/show_bug.cgi?id=24889

What's Your SPF Records Say, When Getting "does not designate 74.x.x.x as permitted sender Errors"

This is most likely related to the SPF records for your domain and what the header content of the sending email states as it's Mail From. For example, this is from the header of an email that was "received":

Received: from mail.XYZ-FAKE.com (mailhost.XYZ-FAKE.com [74.X.X.244]) by mta01.ABC-FAKE.com with ESMTP id 
Cft0mO3fjlFGQjTA for <support@ABC-FAKE.com>; Tue, 21 Apr 2009 05:14:13 -0700 (PDT)
X-Barracuda-Envelope-From: testuser@XYZ-FAKE.com
Received-SPF: pass (mta01.ABC-FAKE.com: domain of testuser@XYZ-FAKE.com designates 74.X.X.244 as permitted sender) 
receiver=mta01.ABC-FAKE.com; client_ip=74.X.X.244; envelope-from=testuser@XYZ-FAKE.com;

To see what this check was done against, do the following below. I'll trim the output and adjust the information used to protect the innocent. Also, notice how a DNS "alias" might cause an issue here? :


$ host 74.X.X.244
244.X.X.74.in-addr.arpa domain name pointer mailhost.XYZ-FAKE.com.

$ host mailhost.XYZ-FAKE.com
mailhost.XYZ-FAKE.com has address 74.X.X.244

$ host mail.XYZ-FAKE.com
mail.XYZ-FAKE.com is an alias for mailhost.XYZ-FAKE.com.
mailhost.XYZ-FAKE.com has address 74.X.X.244

$ dig XYZ-FAKE.com MX

;; QUESTION SECTION:
;XYZ-FAKE.com.			IN	MX

;; ANSWER SECTION:
XYZ-FAKE.com.		3600	IN	MX	22 serverA.DNS-FAKE.com.
XYZ-FAKE.com.		3600	IN	MX	11 serverB.DNS-FAKE.com.

$ dig XYZ-FAKE.com TXT

;; QUESTION SECTION:
;XYZ-FAKE.com.			IN	TXT

;; ANSWER SECTION:
XYZ-FAKE.com.		3600	IN	TXT	"v=spf1 a:mail.XYZ-FAKE.com ~all"

See the following for more information:

Using Different SMTP Server For Webclient (ZWC), Mobiles, And ZCO

Note Of Caution About Using External MTAs

Using non-zimbra MTA's can cause some options in zimbra to not function anymore - since it no longer has zimbra's mta services available.

Zimbra Mail Forwarding Possibly Will Not Work - Turn Off User Option To Set MailForwarding

Mail forwarding might no longer work depending on the configuration you setup regarding the use of your external mta's. When this happens you'll most likely want to disable the option for users to set a mail forwarding address in their preferences. This can be done via their COS or USER configuration.

  • In the admin console, goto the COS configuration the user/s are using and the "Features" tab. Uncheck the option "Allow the user to specify a forwarding address" under Mail Features. It is in the same location under a USERs configuration panel in the admin console.

In the CLI, you will see these set as the defaults for the default COS. The admin gui option above only adjusts the zimbraFeatureMailForwardingEnabled variable :

$ zmprov gc default | grep zimbraFeatureMailForwarding
    zimbraFeatureMailForwardingEnabled: TRUE
    zimbraFeatureMailForwardingInFiltersEnabled: TRUE
$ zmprov ga ajcody@`zmhostname` | grep zimbraFeatureMailForwarding
    zimbraFeatureMailForwardingEnabled: TRUE
    zimbraFeatureMailForwardingInFiltersEnabled: TRUE

More details about them are in the /opt/zimbra/conf/attrs/zimbra-attrs.xml file.

<attr id="342" name="zimbraFeatureMailForwardingEnabled" type="boolean" cardinality="single" 
 optionalIn="account,cos" flags="accountInfo,accountInherited,domainAdminModifiable">
  <defaultCOSValue>TRUE</defaultCOSValue>
  <desc>enable end-user mail forwarding features</desc>
</attr>

<attr id="704" name="zimbraFeatureMailForwardingInFiltersEnabled" type="boolean" 
 cardinality="single" optionalIn="account,cos" flags="accountInfo,accountInherited,
 domainAdminModifiable" since="5.0.10">
  <defaultCOSValue>TRUE</defaultCOSValue>
  <desc>enable end-user mail forwarding defined in mail filters features</desc>
</attr>
Configure External MTA To Use LDAP Virtual Alias Maps

Here's the basic info in regards to how Zimbra's mta [postfix/etc] uses Zimbra's LDAP to get the forwarding information:

$ grep Forward conf/ldap-*
conf/ldap-vam.cf:result_attribute =  
zimbraMailDeliveryAddress,zimbraMailForwardingAddress,
zimbraPrefMailForwardingAddress,zimbraMailCatchAllForwardingAddress
$ postconf |grep vam
virtual_alias_maps = proxy:ldap:/opt/zimbra/conf/ldap-vam.cf

See http://www.postfix.org/postconf.5.html#virtual_alias_maps for more information.

Confirming And Setting zimbraMtaRelayHost And zimbraMtaDnsLookupsEnabled

First we'll set zimbraMtaRelayHost and zimbraMtaDnsLookupsEnabled variables. These options are also shown in the admin console and can be configured there. These variable alone will not redirect ALL traffic to an external MTA first though. There's alao a variable called zimbraSmtpHostname that is in the global (zmprov gacf) and server (zmprov gs `hostname`) configs - addressed in the section below. It's defaulted value is 'localhost' - at least on a single ZCS configuration.

In situations where you need/want all mail to be processed by, for example, an external non-Zimbra spam filter box you could set this variable to the spam filter servers hostname.

Normally, when zimbraMtaRelayHost is set to a non-zimbra external MTA would disable DNS lookups. If you disable DNS Lookups (under the MTA tab of the admin console, or with zmprov), Zimbra will end up using (according to the postconf man page) the "gethostbyname() system library routine which normally also looks in /etc/hosts" (based on the entries on the "hosts" line in /etc/nsswitch.conf). If you do this but don't also specify an SMTP relay host (typically your ISP's SMTP server), which will take care of checking DNS, you will reverse your ability to send mail: suddenly you can send mail to other users on the Zimbra server, but you can't send to the internet (though you can still receive mail from the internet either way).

Query Global - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov gacf zimbraMtaRelayHost
zmprov gacf zimbraMtaDnsLookupsEnabled

Query Per Server - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov gs `zmhostname` zimbraMtaRelayHost
zmprov gs `zmhostname` zimbraMtaDnsLookupsEnabled

Note - if you get errors about doing the query on your non-mailstores like, "ERROR: zclient.IO_ERROR (invoke Connection refused, server: localhost) (cause: java.net.ConnectException Connection refused)" then you might need to adjust this variable. First query it, it's most likely set to localhost

zmlocalconfig zimbra_zmprov_default_soap_server

If you had the error and it was set to localhost, modify it to be one of your mailstores.

zmlocalconfig -e zimbra_zmprov_default_soap_server=mailstore.example.com

No restart of anything is needed, the zmprov query should now work.

Modify Global - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov mcf zimbraMtaRelayHost hostname-of-ext-server:PORT
 ** ex : zmprov mcf zimbraMtaRelayHost primary.YYY.state.XX.us:25
 ** At the end, 25 is the port number for smtp on the targeted system. 
 ** Adjust this number if you changed the smtp port.
zmprov mcf zimbraMtaDnsLookupsEnabled FALSE

Modify Per Server - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov ms `zmhostname` zimbraMtaRelayHost hostname-of-ext-server:PORT
 ** ex : zmprov ms `zmhostname` zimbraMtaRelayHost primary.YYY.state.XX.us:25
 ** At the end, 25 is the port number for smtp on the targeted system. 
 ** Adjust this number if you changed the smtp port.
zmprov ms `zmhostname` zimbraMtaDnsLookupsEnabled FALSE

Confirming And Setting zimbraSmtpHostname

I'm assuming you already set, zimbraMtaRelayHost and zimbraMtaDnsLookupsEnabled for your needs - see above section. The variable called zimbraSmtpHostname is in the global (zmprov gacf) and server (zmprov gs `hostname`) configs. It's default value is set to 'localhost' - at least on a single ZCS configuration.

In cases where you need/want all mail to be processed by, for example, an external non-Zimbra spam filter box you could set this variable to the spam filter boxes hostname.

Query Global - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov gacf zimbraSmtpHostname

Query Per Server - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov gs `zmhostname` zimbraSmtpHostname

Note - if you get errors about doing the query on your non-mailstores like, "ERROR: zclient.IO_ERROR (invoke Connection refused, server: localhost) (cause: java.net.ConnectException Connection refused)" then you might need to adjust this variable. First query it, it's most likely set to localhost

zmlocalconfig zimbra_zmprov_default_soap_server

If you had the error and it was set to localhost, modify it to be one of your mailstores.

zmlocalconfig -e zimbra_zmprov_default_soap_server=mailstore.example.com

No restart of anything is needed, the zmprov query should now work.

Modify Global - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov mcf zimbraSmtpHostname hostname-of-ext-server
 ** ex : zmprov mcf zimbraSmtpHostname primary.YYY.state.XX.us

Modify Per Server - `zmhostname` would use the value returned, you can manual type out the servername as well :

zmprov ms `zmhostname` zimbraSmtpHostname hostname-of-ext-server
 ** ex : zmprov ms `zmhostname` zimbraSmtpHostname primary.YYY.state.XX.us

External Email Clients Setting A SMTP Server

The above variable, zimbraSmtpHostname, will not alter your third party email clients that are setting the smtp server to your ZCS mta's. Here are your options if you also need to have that traffic to go through another device [mta, spam filter, etc.] prior to local delivery [lmtp] to an internal address.

  • Set your clients to use the another devices ip address or hostname that you set for zimbraSmtpHostname.

If you can't do the above, for whatever reason -- maybe security constraints or issues that might arise being a hosting provider, then see below.

  1. You could investigate the alternation of postfix's content_filter option to place the external device/host [a barracuda for example] within that process. postfix.org has information on this - Postfix After-Queue Content Filter. This would be unsupported by Zimbra.
  2. Contact Zimbra's Professional Services [PS] team for help.
  3. Setup another server using a mta of your choice [postfix , sendmail] that the clients can use for the smtp server variable. This "new" mta would then simply relay to the device - a barracuda box for example. The barracuda would then do what it needs to and then forwards the messages to the appropriate servers for delivery. Your ZCS mta's in the case of local delivery that would of normally occurred over lmtp - userA@domainC.com sending to userB@domainC.com .

Global Or System Wide Filters

There is no "supported" solution for this - depending on the exact circumstances. It's a complex issue because each request for "global filters" tends to be very specific on either what's to be filter, what actions are to be taken, and so forth.

RFE's Related To Global Filters

Use The Legal Intercept Method

Depending on the details of your request, using the Legal Intercept options might be useful. You could take the results that goto the LI mailbox and then perform your admin global searches against your mailbox accounts to take the appropriate action.

See Legal_Intercept

Sieve Filter Set For Every Account

One could setup a forloop for all of your users and setup a sieve filter. Downside here is the rules are editable by the users and you would have to manage the rules for new accounts going forward.

See User_Migration#Migrating_Sieve_Filter_Rules for details.

Double Check The Current Anti-Spam Options

Make sure your request can't be solved by the current solutions described in articles.

Postfix , Amavis Customizations

I've seen some posts on the forums that customers found their own workarounds by customizing postfix and amavis. This will most likely result in an unsupported situation. Unfortunately, those forum posts don't also include details that I can share here. Hopefully I can find them going forward and I'll post them here.

Global Disclaimer Options

Here's the url to review for a "current" possibility:

And in the notes section there's a comment about multi-servers:

Please note though, "This article is a community contribution and may include unsupported customizations." Meaning, it's an unsupported customization, so please take the necessary precautions.

In regards to an official and supported way to do this, please review this RFE:

Quota Issues

Where To Adjust Message User Gets When They Are Over Quota

Moved to How_To_Adjust_The_Over_Quota_Message_The_User_Receives

See Current User Qoutas

Moved to Getting_All_Users_Quota_Data

Controlling Behavior For Messages Sent To Over Quota Mailbox - LMTP

Moved to Controlling_Behavior_For_Messages_Sent_To_Over_Quota_Mailbox_-_LMTP

Controlling Behavior For Messages Sent To Over Quota Mailbox - SMTP

Moved to Controlling_Behavior_For_Messages_Sent_To_Over_Quota_Mailbox_-_SMTP

Message Senders Receive About Mailbox Over Quota

Moved to Message_Senders_Receive_About_Mailbox_Over_Quota

Quota Not Showing In Admin Console - After ZCS Upgrade

Moved to Quota_Not_Showing_In_Admin_Console_-_After_ZCS_Upgrade

Managing Postfix Queue

Moved to Managing_The_Postfix_Queues#Managing_The_Postfix_Queues

Postfix, Amavis, Clamav Spool Directory Paths And Names

Moved to Managing_The_Postfix_Queues#Postfix.2C_Amavis.2C_Clamav_Spool_Directory_Paths_And_Names

Stop And Starting Postfix And Mta

Moved to Managing_The_Postfix_Queues#Stop_And_Starting_Postfix_And_Mta

To See Postfix Queue

Moved to Managing_The_Postfix_Queues#To_See_The_Postfix_Queues

Qshape - Print Postfix queue domain and age distribution

Moved to Managing_The_Postfix_Queues#Qshape_-_Print_Postfix_queue_domain_and_age_distribution

To View A Message In The Queue

Moved to Managing_The_Postfix_Queues#To_View_A_Message_In_The_Queue

To Flush Postfix Queue

Moved to Managing_The_Postfix_Queues#To_Flush_Postfix_Queue

To Requeue Messages In Postfix

Moved to Managing_The_Postfix_Queues#To_Requeue_Messages_In_Postfix

To Put Messages On Hold

Moved to Managing_The_Postfix_Queues#To_Put_Messages_On_Hold

To Delete Messages From Queue

Moved to Managing_The_Postfix_Queues#To_Delete_Messages_From_Queue

Cautionary Note

Moved to Managing_The_Postfix_Queues#Cautionary_Note

Relevant Sections Of Postsuper Man Page

Moved to Managing_The_Postfix_Queues#Relevant_Sections_Of_Postsuper_Man_Page

To Delete Single Message From Queue

Moved to Managing_The_Postfix_Queues#To_Delete_Single_Message_From_Queue

To Delete ALL Messages From Queue

Moved to Managing_The_Postfix_Queues#To_Delete_ALL_Messages_From_Queue

To Delete ALL Messages From The Deferred Queue

Moved to Managing_The_Postfix_Queues#To_Delete_ALL_Messages_From_The_Deferred_Queue

To Delete ALL Messages From The Hold Queue

Moved to Managing_The_Postfix_Queues#To_Delete_ALL_Messages_From_The_Hold_Queue

To Delete Many Messages From Queue

Moved to Managing_The_Postfix_Queues#To_Delete_Many_Messages_From_Queue

Delete From Queue By Email Address

Moved to Managing_The_Postfix_Queues#Delete_From_Queue_By_Email_Address

From CLI

Moved to Managing_The_Postfix_Queues#From_CLI

Script To Delete From Queue By Email Address

Moved to Managing_The_Postfix_Queues#Script_To_Delete_From_Queue_By_Email_Address

Script To Delete From Queue By Various Variable Targets

Moved to Managing_The_Postfix_Queues#Script_To_Delete_From_Queue_By_Various_Variable_Targets

Verified Against: Zimbra Collaboration 8.0, 7.0 Date Created: 04/16/2014
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-Server-Topics Date Modified: 06/21/2016



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »




Ajcody MySQL Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Mysql

Actual Mysql Topics Homepage

Please see Ajcody-Mysql-Topics

Mysql Issues And Memory Usuage

My Ajcody-General-Notes#Trouble_Shooting_Memory_Issues has some stuff on memory troubleshooting - generalities.

Our performance guide for Mysql:

http://wiki.zimbra.com/index.php?title=Performance_Tuning_Guidelines_for_Large_Deployments#MySQL

Variable Within MySQL & Zimbra

These percentages below are used against physical RAM - disregard swap in the percentage division.

From the above url, we get some details.

"By default, we try to reserve 30% of system memory for use by this process, and 40% for use by MySQL."
# ZCS 5.0 and later
$ zmlocalconfig -e mailboxd_java_heap_memory_percent=40
Java - mailboxd_java_heap_memory_percent

The command to set the java percentage is:

 zmlocalconfig -e mailboxd_java_heap_memory_percent=30
Mysql - mysql_memory_percent & my.cnf w/ innodb_buffer_pool_size

Looks like there's an issue with the command/variable (zmlocalconfig -e mysql_memory_percent=##) in regards to MySQL though.

"There is a local config variable [mysql_memory_percent] for mysql memory percent, but today my.cnf doesn't get rewritten after install, so you have to edit my.cnf for this setting if you want to change it."

In summary, this variable [ mysql_memory_percent ] for MySQL is basically not working.

Do this to get memory in bytes for division numbers:

free -b

Figure out what your % in bytes using the physical memory (Mem:) output. Now edit the /opt/zimbra/conf/my.cnf file to change the following line with your memory percentage in bytes:

vi /opt/zimbra/conf/my.cnf
#Modify this var to adjust memory usage
innodb_buffer_pool_size = xxx

This will require a restart.

A GREAT forum post on this is here:

So other background info:

Mysql And Swap

See this article first before exploring the options below.

Should you have your swap file enabled while running MySQL ?

Set swappiness Kernel Var To 0

Source of this summary is here: [http://www.mysqlperformanceblog.com/2007/09/28/heikki-tuuri-to-answer-your-in-depth-innodb-questions/#comment-174442 Swappiness To 0"

Set it on running box:

echo 0 > /proc/sys/vm/swappiness

Set it to persist after reboot - vi /etc/sysctl.conf :

vm.swappiness = 0

The value is a percentage. By setting it to 100, Linux will always swap programs out and never shrink the buffer cache.

Swap Ram Disk Instead Of Disk

Source of this summary is here:

MySQL and the Linux swap problem

Make a (or some) swap disks:

mkdir /mnt/ram0
dd bs=1024 count=14634 if=/dev/zero of=/mnt/ram0/swapfile
mkswap /mnt/ram0/swapfile
swapon /mnt/ram0/swapfile

Will look like this:

[root@mail3 ~]# mkdir /mnt/ram0

[root@mail3 ~]# dd bs=1024 count=14634 if=/dev/zero of=/mnt/ram0/swapfile
14634+0 records in
14634+0 records out
14985216 bytes (15 MB) copied, 0.246329 seconds, 60.8 MB/s

[root@mail3 ~]# mkswap /mnt/ram0/swapfile 
Setting up swapspace version 1, size = 14979 kB

[root@mail3 ~]# free
             total       used       free     shared    buffers     cached
Mem:       1555472    1461200      94272          0     159400     344328
-/+ buffers/cache:     957472     598000
Swap:      2031608        104    2031504

[root@mail3 ~]# swapon /mnt/ram0/swapfile 

[root@mail3 ~]# free
             total       used       free     shared    buffers     cached
Mem:       1555472    1476252      79220          0     159404     344376
-/+ buffers/cache:     972472     583000
Swap:      2046232        104    2046128

[root@mail3 ~]# swapon -s
Filename				Type		Size	Used	Priority
/dev/mapper/VolGroup00-LogVol01         partition	2031608	104	-1
/mnt/ram0/swapfile 
                     file		14624	0	-2
[root@mail3 ~]# cat /proc/swaps 
Filename				Type		Size	Used	Priority
/dev/mapper/VolGroup00-LogVol01         partition	2031608	104	-1
/mnt/ram0/swapfile                      file		14624	0	-2


Just add those lines to your relevant startup file, like /etc/rc.d/rc.local, and it’ll persist after reboots. </pre>

O_DIRECT On Linux And INNODB To Fix Swapping

Source reference for this part is here:

Using O_DIRECT on Linux and INNODB to Fix Swap Insanity

See also: Ajcody-Mysql-Topics#IO_DIRECT_And_Ext3_On_Linux_As_Possible_Reason_For_Corruption

IO_DIRECT And Ext3 On Linux As Possible Reason For Corruption

This is being investigated. Below are my notes on the issue.

Mysql Backup And Restore

Please see the MySQL_Backup_and_Restore page.

Mysql Database Corruption/Repair/Checks

Please see the Mysql_Crash_Recovery page rather than the normal search results that give mysql-logger details.

Mysql Table Checks

Mysql Table Types - InnoDB or MyISAM

Tables are either InnoDB or MyISAM. Putting this information here because if a table is in need of repair or something, the steps to fix it might be different depending on the tables ENGINE type.

Example for MyISAM:

$ mysql -e "show create table zimbra.jiveRoster"
 [cut]
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8 | 
 [cut]

Example for InnoDB:

$ mysql -e "show create table zimbra.mailbox"
 [cut]
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8 | 
 [cut]
check zimbra.mailbox database tables
$ mysql -e "check table zimbra.mailbox"
+----------------+-------+----------+----------+
| Table          | Op    | Msg_type | Msg_text |
+----------------+-------+----------+----------+
| zimbra.mailbox | check | status   | OK       | 
+----------------+-------+----------+----------+
check mboxgroup[#].mail_item table
$ mysql -e "check table mboxgroup3.mail_item"
+----------------------+-------+----------+----------+
| Table                | Op    | Msg_type | Msg_text |
+----------------------+-------+----------+----------+
| mboxgroup3.mail_item | check | status   | OK       | 
+----------------------+-------+----------+----------+
jive.Roster or zimbra.jiveUserProp Errors From Daily Report With mysqlcheck Errors
Please note, these tables are MyISAM. Don't use the below steps for other type of tables as each table might be treated differently or with extra caution. [InnoDB vs MyISAM]

Your report from /opt/zimbra/libexec/zmdbintegrityreport might give the following for example:


Database errors found.
/opt/zimbra/mysql/bin/mysqlcheck --defaults-file=/opt/zimbra/conf/my.cnf -S /opt/zimbra/db/mysql.sock
 -A -C -s -u root --password=[mysql password]
zimbra.jiveID
 warning  : 1 client is using or hasn't closed the table properly  zimbra.jiveRoster  warning  :
  1 client is using or hasn't closed the table properly  zimbra.jiveUserProp
 warning  : 2 clients are using or haven't closed the table properly

Attempt the following:

mysql -e "check table zimbra.jiveRoster" 
+-------------------+-------+----------+----------+ 
| Table             | Op    | Msg_type | Msg_text | 
+-------------------+-------+----------+----------+ 
| zimbra.jiveRoster | check | status   | OK       |  
+-------------------+-------+----------+----------+

To see if the data "looks" fine or works correctly against a select, do:

mysql -e "select * from zimbra.jiveRoster"

Note, if the above command might dump out a lot of data, try:

mysql -e "select * from zimbra.jiveRoster" > /tmp/zimbra.jiveRoster.out

Yours might show something different for Msg_text. If you need to repair, you would run:

mysql -e "repair table zimbra.jiveRoster"

You can also do the same above but replacing zimbra.jiveRoster with zimbra.jiveUserProp .

Manual Change Of Mysql Passwords

Please see:

http://wiki.zimbra.com/index.php?title=Issues_with_mysql_and_logmysql_passwords

Working Within Mysql For Accounts

Note, the mailboxId is specific to the mailstore the user resides on. The zimbraId is the users unique id system wide - zmprov ga user@domain.com zimbraId .

Other References:

Getting User Variables We Need To Query MySQL

Getting The Users mailboxId # - zmprov gmi user@domain

For Mysql, this # returned below will become apart of mailbox_id=### . Example used is mailbox_id=3 .

Note, the mailboxId is specific to the mailstore the user resides on. The zimbraId is the users unique id system wide - zmprov ga user@domain.com zimbraId .
[root@mail39 ~]# su - zimbra
[zimbra@mail39 ~]$ zmprov gmi ajcody@mail39.zimbra.DOMAIN.com
  mailboxId: 3
  quotaUsed: 169831
Getting The Users Mailstore That Their DB Resides On - zmprov ga user@domain zimbraMailHost

The mailboxId found above for the user is unique to their actual mailstore and the db that resides there. Again:

Note, the mailboxId is specific to the mailstore the user resides on. The zimbraId is the users unique id system wide - zmprov ga user@domain.com zimbraId .

To get their particular mailstore their database resides on:

$ zmprov ga ajcody@mail39.zimbra.DOMAIN.com zimbraMailHost
# name ajcody@mail39.zimbra.DOMAIN.com
zimbraMailHost: mail39.zimbra.DOMAIN.com

So you would now log onto that mailstore to do your mysql operations (searches).

Confirm zimbra_mailbox_groups Variable

Need to confirm zimbra_mailbox_groups variable to get the users mboxgroup# since we'll then need to run the expression below to determine it.

[zimbra@mail39 ~]$ zmlocalconfig zimbra_mailbox_groups
zimbra_mailbox_groups = 100
The Mysql group_id Value

The group_id is controlled by a local configuration value. It defaults to 100.

 $ zmlocalconfig zimbra_mailbox_groups
   zimbra_mailbox_groups = 100

You'll see group_id in the following:

 $ mysql -e 'SELECT * FROM zimbra.mailbox WHERE id=3\G'

 *************************** 1. row ***************************
                 id: 3
           group_id: 3

*** CUT REST OF OUTPUT ***
Get Users mboxgroup #

Finally confirming what the mboxgroup is for the user by running the following below. The mboxgroup is comprised of multiple users that are unique by way of their mailbox_id number. This is to minimize the number of db's that are needed on the mailstore, rather than doing one db per user.

3 ='s the users mailboxId
100 ='s the variable from zimbra_mailbox_groups

For Mysql, this # returned below will become apart of mboxgroup###.mail_item = mboxgroup3.mail_item

 
[zimbra@mail39 ~]$ expr 3 % 100
3

Queries Against Mysql For User Information In The zimbra DB And mailbox Table - zimbra.mailbox

By mailboxId

You'll need to know the mailboxId for the user for this. [ zmprov gmi USER@DOMAIN.com ]

Format:

$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE id=<mailboxID of USER>\G'

Working example:

 $ mysql -e 'SELECT * FROM zimbra.mailbox WHERE id=3\G'

 *************************** 1. row ***************************
                 id: 3
           group_id: 3
         account_id: 3be48432-926c-4a54-bd66-3b16185a37a4
    index_volume_id: 2
 item_id_checkpoint: 339
      contact_count: 5
    size_checkpoint: 35912
  change_checkpoint: 7200
      tracking_sync: 0
      tracking_imap: 0
     last_backup_at: 1231567229
            comment: ajcody@zimbra.DOMAIN.com
   last_soap_access: 1229584283
       new_messages: 1
 idx_deferred_count: 0
By zimbraId

You'll need to know the zimbraId for the user for this.

Via zmprov:

$ zmprov ga ajcody@zimbra.DOMAIN.com zimbraId
  # name ajcody@zimbra.DOMAIN.com
  zimbraId: 3be48432-926c-4a54-bd66-3b16185a37a4

Or ldap:

$ su - zimbra
$ source ~/bin/zmshutil
$ zmsetvars
$ ldapsearch -LLL -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "mail=ajcody@zimbra.DOMAIN.com" zimbraId
   dn: uid=ajcody,ou=people,dc=zimbra,dc=DOMAIN,dc=com
   zimbraId: 3be48432-926c-4a54-bd66-3b16185a37a4

Format:

$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE account_id=<zimbraID of USER>\G'

Working example:

 $ mysql -e 'SELECT * FROM zimbra.mailbox WHERE account_id="3be48432-926c-4a54-bd66-3b16185a37a4"\G'

 *************************** 1. row ***************************
                 id: 3
           group_id: 3
         account_id: 3be48432-926c-4a54-bd66-3b16185a37a4
    index_volume_id: 2
 item_id_checkpoint: 339
      contact_count: 5
    size_checkpoint: 35912
  change_checkpoint: 7200
      tracking_sync: 0
      tracking_imap: 0
     last_backup_at: 1231567229
            comment: ajcody@zimbra.DOMAIN.com
   last_soap_access: 1229584283
       new_messages: 1
 idx_deferred_count: 0
By Comment Field - I.E. Username

This way searches against the "comment field". The comment field is mostly correct, but it is deemed unreliable since there are some corner cases where it can be duplicated. Use it in a pinch.

Format:

$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE comment LIKE "<USER>%"\G'

Working example:

 $ mysql -e 'SELECT * FROM zimbra.mailbox WHERE comment LIKE "ajcody%"\G'

 *************************** 1. row ***************************
                 id: 3
           group_id: 3
         account_id: 3be48432-926c-4a54-bd66-3b16185a37a4
    index_volume_id: 2
 item_id_checkpoint: 339
      contact_count: 5
    size_checkpoint: 35912
  change_checkpoint: 7200
      tracking_sync: 0
      tracking_imap: 0
     last_backup_at: 1231567229
            comment: ajcody@zimbra.DOMAIN.com
   last_soap_access: 1229584283
       new_messages: 1
  idx_deferred_count: 0
Show all accounts on mailstore

Show all accounts on mailstore.

$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE comment LIKE "%"\G' | grep comment
           comment: admin@zimbra.DOMAIN.com
           comment: wiki@zimbra.DOMAIN.com
           comment: spam.1c4mokie@zimbra.DOMAIN.com
           comment: ham.iudu0ic_mz@zimbra.DOMAIN.com
           comment: shared-account@zimbra.DOMAIN.com
           comment: testuser@zimbra.DOMAIN.com
           comment: large-share@zimbra.DOMAIN.com
           comment: cos-user@zimbra.DOMAIN.com
           comment: arch-prod@zimbra.DOMAIN.com
Query All Users In A mboxgroup##

This is very useful, for example, if you experience corruption in one of your mboxgroup## db files when you want to see who is effected. Remember, these are unique to mailstore (group_id = mboxgroup)(id = userid). The account_id is a global variable, the comment field should reflect the account_id's email address - another global variable.

Note - I'm on a small test server, hence why only one account is showing. zimbra_mailbox_groups = 100 [default] determines the 'round-robin' behavior of assigning users to mboxgroup's

$ mysql -e 'select id, comment, account_id, group_id from zimbra.mailbox where group_id=5'
+----+-------------------------------------------+--------------------------------------+----------+
| id | comment                                   | account_id                           | group_id |
+----+-------------------------------------------+--------------------------------------+----------+
|  5 | ham.1msrt1ugis@mail37.DOMAIN.com          | 9ded4fa5-62fe-4ae4-ac14-7a8928386ea8 |        5 | 
+----+-------------------------------------------+--------------------------------------+----------+

You can also, double check, information the account_id and comment with zmprov then:

$ zmprov gmi 9ded4fa5-62fe-4ae4-ac14-7a8928386ea8
mailboxId: 5
quotaUsed: 0

$ zmprov gmi ham.1msrt1ugis@mail37.DOMAIN.com
mailboxId: 5
quotaUsed: 0

Just to be complete, below I'll list the location of the various db's in question based upon the filesystem.

$ pwd
/opt/zimbra/db/data/zimbra

$ ls mailbox*
mailbox.frm  mailbox.ibd  mailbox_metadata.frm  mailbox_metadata.ibd

$ cd ../mboxgroup5/

$ pwd
/opt/zimbra/db/data/mboxgroup5

$ ls
appointment.frm       data_source_item.ibd  imap_folder.ibd   mail_item.frm          
open_conversation.ibd  revision.frm   tombstone.ibd appointment.ibd       db.opt
imap_message.frm  mail_item.ibd          pop3_message.frm       revision.ibd
data_source_item.frm  imap_folder.frm       imap_message.ibd  
open_conversation.frm  pop3_message.ibd       tombstone.frm

Deleting An Account In Mysql

This comes up in very rare circumstances, usually when an account rename was attempted and for some reason it fails -- leaving the account in an odd state, where ldap and mysql data no longer match up. Use with extreme caution and under guidance of support staff.

The Steps To Delete User In Mysql

Caution - This Should Almost Never Need To Be Done. Usually Only Needed When Ldap Doesn't Have Account Anymore And For Some Reason Account Still Exists In Mysql

Use the above section, Ajcody-Mysql-Topics#Getting_User_Variables_We_Need_To_Query_MySQL , to get mailboxId or other needed data. The below example will most likely fail with the zmprov command because of missing data in ldap. You still might need to do the expr example below when you do your mysql delete commands.

# Fetch the user's mailbox Id
# zmprov will most likely fail in the situation where you need to do this process
# Use Ajcody-Mysql-Topics#Getting_User_Variables_We_Need_To_Query_MySQL
# alternative methods to get this variable - mailboxId

[root@]# su - zimbra
[zimbra@]$ zmprov getMailboxInfo user1@example.com
mailboxId: 11
quotaUsed: 30620 

# Fetch the user's mboxgroup Id
# Default is 100 for zimbra_mailbox_groups
$ zmlocalconfig zimbra_mailbox_groups
  zimbra_mailbox_groups = 100
# expr [mailboxId] % [zimbra_mailbox_groups]
$ expr 11 % 100
11


Each user is referenced by a unique mailboxId within Mysql. Each mailstore has it's own Mysql database and therefore the user mailboxId's are only locally unique - i.e., the id isn't a unique global variable. Replace id=#####, mboxgroup## and mailbox_id=##### with relevant data. An example might have mboxgroup77 , id=18577 and mailbox_id=18577.

[root@]# su - zimbra
[zimbra@]# mysql
mysql> SET foreign_key_checks = 0;
mysql> use mboxgroup##;
mysql> delete from appointment where mailbox_id=#####;
mysql> delete from data_source_item where mailbox_id=#####;
mysql> delete from imap_folder where mailbox_id=#####;
mysql> delete from imap_message where mailbox_id=#####;
mysql> delete from mail_item where mailbox_id=#####;
mysql> delete from open_conversation where mailbox_id=#####;
mysql> delete from pop3_message where mailbox_id=#####;
mysql> delete from revision where mailbox_id=#####;
mysql> delete from tombstone where mailbox_id=#####;
mysql> use zimbra;
mysql> delete from mailbox where id=#####;
mysql> delete from mailbox_metadata where mailbox_id=#####;
mysql> SET foreign_key_checks = 1
mysql> quit
[zimbra@]# zmprov fc account

Useful Mysql Query Examples

First - Get User Variables we need to query MySQL

Please see Ajcody-Mysql-Topics#Getting_User_Variables_We_Need_To_Query_MySQL

Mysql Query For A Users Specific Blob-Data ID

Query of Mysql against users mboxgroup [mboxgroup#.mail_item] for a SPECIFIC message [id=#]

Note, in this case, the users mailbox_id isn't necessary
[zimbra@mail39 ~]$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE id=321\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 321
        type: 5
   parent_id: NULL
   folder_id: 5
    index_id: 321
     imap_id: 321
        date: 1281984004
        size: 448
   volume_id: 1
 blob_digest: 0pe,M6lHRy4KBXbIyEeR7AJzfkA=
      unread: 0
       flags: 8193
        tags: 0
      sender: Adam Cody
     subject: test w mobile sending
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 21394
 change_date: 1281984004
 mod_content: 21394
Content Of Message Example Above As On Filesystem
How To Locate Users Mailstore and Message Store Directory

The basics:

  • $ zmprov ga USER@DOMAIN zimbraMailHost
  • $ zmprov gmi USER@DOMAIN
    • Note the mailboxId for the user.
  • Then ssh to the zimbraMailHost the user is on.
  • $ zmvolume -l
    • Confirm the path for the primaryMessage volume, default is /opt/zimbra/store .
  • cd to the primaryMessage volume path, example uses the default path.
    • $ cd /opt/zimbra/store
    • find . -maxdepth 2 -name [replace with the mailboxId of the user] -print
    • or do perl -e 'print mailboxId# >> 12 ; print "\n"'
  • You can now cd to the users msg directory.

Working example:

 $ zmprov ga userA@DOMAIN zimbraMailHost
    # name userA@mail71.DOMAIN.com
    zimbraMailHost: mail71.DOMAIN.com

[I'm already on the zimbraMailHost for this user, no need to ssh to it]

 $ zmprov gmi userA@DOMAIN
    mailboxId: 17
   quotaUsed: 2032

 $ zmvolume -l
   Volume id: 1
        name: message1
        type: primaryMessage
        path: /opt/zimbra/store
  compressed: false
     current: true

   Volume id: 2
        name: index1
        type: index
        path: /opt/zimbra/index
  compressed: false
     current: true

 $ find . -maxdepth 2 -name 17 -print
   ./0/17

or to find the top directory the user directory is in:

$ perl -e 'print 17 >> 12 ; print "\n"'                                                                                                   
0                                                

 $ cd 0/17/msg/

 $ find . -name \*.msg -print        
   ./0/268-751.msg
   ./0/269-756.msg
   ./0/306-2119.msg
The Message On The Filesystem - id index_id imap_id

Change directory to the users root directory under your mailstores 'store' path. Default is /opt/zimbra/store , this example user is under /opt/zimbra/store/0/3 . Everything under that is "theirs".

[zimbra@mail39 0]$ pwd
/opt/zimbra/store/0/3/msg/0

[zimbra@mail39 0]$ ls
267-9778.msg  280-13700.msg  287-13743.msg  291-13777.msg  295-13763.msg  300-13771.msg  305-13784.msg
268-9780.msg  283-13715.msg  288-13747.msg  292-13758.msg  296-13764.msg  301-13774.msg  307-13791.msg
269-9782.msg  284-13740.msg  289-13752.msg  293-13759.msg  297-13765.msg  302-13775.msg  320-21392.msg
270-9854.msg  285-13741.msg  290-13755.msg  294-13760.msg  299-13769.msg  304-13782.msg  321-21394.msg

In our example above, we used "WHERE id=321". Remember, "id=321" is correlated to the 321 in the filename, 321-21394.msg. Also, you'll notice there's actually 3 matches :

  • id: 321
  • index_id: 321
  • imap_id: 321
mod_metadata And mod_content

From the output above, you see two matches for 21394 - remember, filename is 321-21394.msg :

  • mod_metadata: 21394
    • mod_metadata might not as there are changes exclusively in the db.
      • For example - marking read/unread, tagging, flagging, moving to a new folder, etc..
  • mod_content: 21394
    • mod_content should always be reflected in the filename on the system
      • mod_content is updated, for example, when saving a draft, editing a briefcase document, etc.
        • Note : "Edit As New" on a message actually creates a new file on the filesystem and uses a different id .
        • In ZCS6+ , using the "Remove Attachments" option on an email with attachments would most likely alter the mod_content number as well.

Notice that the main difference between the two is where changes are only exclusively made in the db vs. a change that would necessary alter the "file".

If I then "tag" the message in ZWC for this message, you'll notice the mod_metadata is altered to 23826 but mod_content and the filename on the fs still uses 21394 . Notice as well, "tags: 0" was now changed to "tags: 1" .

[zimbra@mail39 data]$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE id=321\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 321
        type: 5
   parent_id: NULL
   folder_id: 5
    index_id: 321
     imap_id: 321
        date: 1281984004
        size: 448
   volume_id: 1
 blob_digest: 0pe,M6lHRy4KBXbIyEeR7AJzfkA=
      unread: 0
       flags: 1
        tags: 1
      sender: Adam Cody
     subject: test w mobile sending
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 23826
 change_date: 1282864623
 mod_content: 21394

$ cd /opt/zimbra/store/0/3/msg/0

$ ls -la 321*
-rw-r----- 1 zimbra zimbra 448 Aug 16 14:40 321-21394.msg
Mysql Query For date And change_date For ALL id's For A Specific User

Another item to point out in this example is the change_date and date fields. Notice that change_date has changed compared to the first time we ran the query. The change_date use to match the date variable number - date: 1281984004 . This field, change_date, is updated when the item has 'changed', not necessarily a mod_metadata type change -- that might be reflected in the time stamp of the file on the filesystem.

date: 1281984004
change_date: 1281984004
vs. after we applies a 'tag' to message
date: 1281984004
change_date: 1282864623

To convert that into a 'normal' readable time format, using perl:

# perl -e 'print localtime(1281984004). "\n"'
   Mon Aug 16 14:40:04 2010
 *** Which matches the ls -la time above. ***

vs.

# perl -e 'print localtime(1282864623). "\n"'
   Thu Aug 26 19:17:03 2010  
 *** Which is the time I tagged the message in ZWC. ***

To translate Thursday Aug 26 2010 19:17:03 to epoch seconds and back again, for example [Replace '-d' with '-ud' for GMT/UTC time]:

# date +%s -d "08/26/2010 19:17:03"
   1282864623

or

# date +%s -ud "Thu Aug 26 19:17:03 EDT 2010"
   1282864623

And to prove the conversion goes back again with the date command:

# date -d @1282864623
   Thu Aug 26 19:17:03 EDT 2010

Another reference is, the from_unixtime() and unix_timestamp() mysql functions - see :

Examples within mysql:

$ mysql -e 'SELECT UNIX_TIMESTAMP("2010-08-26 19:17:03")'
  +---------------------------------------+
  | UNIX_TIMESTAMP("2010-08-26 19:17:03") |
  +---------------------------------------+
  |                            1282864623 | 
  +---------------------------------------+

And back again:

$ mysql -e 'SELECT FROM_UNIXTIME(1282864623)'
  +---------------------------+
  | FROM_UNIXTIME(1282864623) |
  +---------------------------+
  | 2010-08-26 19:17:03       | 
  +---------------------------+

An example mysql search query using this format:

$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND change_date=(SELECT UNIX_TIMESTAMP("2010-08-26 19:17:03"))\G'

This might be useful if you find yourself wanting to query against the change_date for a particular user and see what messages were altered at that time or time range. Example might be, where the user is reporting their "problem" occurring at a certain time or during a time range.

A search against the change_date field and mailbox_id we've been discussing here, shows:

$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND change_date=1282864623\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 64
        type: 3
   parent_id: NULL
   folder_id: 8
    index_id: NULL
     imap_id: NULL
        date: 1282864623
        size: 0
   volume_id: NULL
 blob_digest: NULL
      unread: NULL
       flags: 0
        tags: 0
      sender: NULL
     subject: Test-Tag
        name: Test-Tag
    metadata: d1:vi10ee
mod_metadata: 23825
 change_date: 1282864623
 mod_content: 23825
*************************** 2. row ***************************
  mailbox_id: 3
          id: 321
        type: 5
   parent_id: NULL
   folder_id: 5
    index_id: 321
     imap_id: 321
        date: 1281984004
        size: 448
   volume_id: 1
 blob_digest: 0pe,M6lHRy4KBXbIyEeR7AJzfkA=
      unread: 0
       flags: 1
        tags: 1
      sender: Adam Cody
     subject: test w mobile sending
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 23826
 change_date: 1282864623
 mod_content: 21394

See how we also identified the 'tag' entry, id: 64 type: 3 , that was made as the id=321 type=5 was altered.

To search by a range of the change_date variable. Notice the syntax of :

  • change_date>=1282864600  ; meaning greater than or equal to
    • we could also use this instead, change_date>=(SELECT UNIX_TIMESTAMP("2010-08-26 19:17:03")
  • change_date<=1282865366  ; meaning less than or equal to
    • we could also use this instead, change_date<=(SELECT UNIX_TIMESTAMP("2010-08-26 19:29:26")
$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND change_date>=1282864600 AND change_date<=1282865366\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 64
        type: 3
   parent_id: NULL
   folder_id: 8
    index_id: NULL
     imap_id: NULL
        date: 1282864623
        size: 0
   volume_id: NULL
 blob_digest: NULL
      unread: NULL
       flags: 0
        tags: 0
      sender: NULL
     subject: Test-Tag
        name: Test-Tag
    metadata: d1:vi10ee
mod_metadata: 23825
 change_date: 1282864623
 mod_content: 23825
*************************** 2. row ***************************
  mailbox_id: 3
          id: 321
        type: 5
   parent_id: NULL
   folder_id: 5
    index_id: 321
     imap_id: 321
        date: 1281984004
        size: 448
   volume_id: 1
 blob_digest: 0pe,M6lHRy4KBXbIyEeR7AJzfkA=
      unread: 0
       flags: 1
        tags: 1
      sender: Adam Cody
     subject: test w mobile sending
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 23826
 change_date: 1282864623
 mod_content: 21394
*************************** 3. row ***************************
  mailbox_id: 3
          id: 323
        type: 5
   parent_id: NULL
   folder_id: 6
    index_id: 323
     imap_id: 323
        date: 1282865366
        size: 444
   volume_id: 1
 blob_digest: l5E3l5rbE5XUzHcp+hRNkN1E7os=
      unread: 0
       flags: 65
        tags: 0
      sender: Adam Cody
     subject: test w mobile sending - edit as new
        name: NULL
    metadata: d1:dd2:do3:3214:idnt36:db166bd3-2405-49d2-aa38-91159a3c9302e1:f4:test1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 23829
 change_date: 1282865366
 mod_content: 23829
Confirming subject Matches Subject Line In Message

You'll see that the message 321-21394.msg on the filesystem also matches the output we had with our mysql query - compare the Subject line.

[zimbra@mail39 0]$ head 321-21394.msg
Date: Mon, 16 Aug 2010 14:40:04 -0400 (EDT)
From: Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>
To: admin@mail38.zimbra.DOMAIN.com
Message-ID: <27950055.531281984004882.JavaMail.root@mail39.zimbra.DOMAIN.com>
Subject: test w mobile sending
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [192.168.0.13]
X-Mailer: Zimbra 5.0.23_GA_3242.RHEL5 (zclient/5.0.23_GA_3242.RHEL5)

This is a good field to query against also. See Mysql Query For Subject Line In Message Of A Specific User.

Mysql Query For Subject Line In Message Of A Specific User

This is a good field to query against, depending on your circumstances. User's have very little information from their end, ZWC, that correlates into the mysql fields we've been discussing [generally speaking]. They can't see the message id as needed for id= in mboxgroup#.mail_item. Let's say you only have the mailbox_id of the user, therefor the mboxgroup#, and the Subject line of the message in question. You would do something like the following:

$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND subject="test w mobile sending"\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 321
        type: 5
   parent_id: NULL
   folder_id: 5
    index_id: 321
     imap_id: 321
        date: 1281984004
        size: 448
   volume_id: 1
 blob_digest: 0pe,M6lHRy4KBXbIyEeR7AJzfkA=
      unread: 0
       flags: 1
        tags: 1
      sender: Adam Cody
     subject: test w mobile sending
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t32:admin@mail38.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 23826
 change_date: 1282864623
 mod_content: 21394

Mysql Query For ALL Message ID's Of A User

As you'll see in the above query, it has type=5 . Description of mboxgroup[#].mail_item Type shows that type 5 is 'messages'.

[zimbra@mail39 ~]$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND type=5\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 261
        type: 5
   parent_id: 263
   folder_id: 5
    index_id: 261
     imap_id: 261
        date: 1273609779
        size: 458
   volume_id: 3
 blob_digest: baQatWGZSt5THO6tAGImpEOqVQY=
      unread: 0
       flags: 1
        tags: 0
      sender: Adam Cody
     subject: test test
        name: NULL
    metadata: d1:f9:test test1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:vi10ee
mod_metadata: 6216
 change_date: 1273609779
 mod_content: 6215
*************************** 2. row ***************************
  mailbox_id: 3
          id: 262
        type: 5
   parent_id: 263
   folder_id: 2
    index_id: 262
     imap_id: 262
        date: 1273609779
        size: 1599
   volume_id: 3
 blob_digest: s2BgZHas3+fgRhBYpIHv7uAEuCY=
      unread: 0
       flags: 0
        tags: 0
      sender: Adam Cody
     subject: test test
        name: NULL
    metadata: d1:f9:test test1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:vi10ee
mod_metadata: 6217
 change_date: 1273609784
 mod_content: 6216
*************************** 3. row ***************************
  mailbox_id: 3
          id: 264
        type: 5
   parent_id: NULL
   folder_id: 2
    index_id: 264
     imap_id: 264
        date: 1273610021
        size: 3467
   volume_id: 3
 blob_digest: n,VKvXmfL,jiA6kC8zE2g3TkWuM=
      unread: 0
       flags: 0
        tags: 0
      sender: Test User
     subject: test html
        name: NULL
    metadata: d1:f14:BOLD Underline1:s43:Test User <test@mail39.zimbra.DOMAIN.com>1:vi10ee
mod_metadata: 6220
 change_date: 1273610084
 mod_content: 6219
*************************** 4. row ***************************
cut -- it then continues for all the messages that exist for this account

Mysql Query For ALL Message ID's In A Particular Folder Of A User

As you'll see in the above query, it has type=5 . Description of mboxgroup[#].mail_item Type shows that type 5 is 'messages'.

Get folder_id Number And Description

One way to get the folder_id is to use the zmmailbox against the user to find the id# that we want.

[zimbra@mail39 ~]$ zmmailbox -z -m ajcody@mail39.zimbra.DOMAIN.com gaf
        Id  View      Unread   Msg Count  Path
----------  ----  ----------  ----------  ----------
         1  conv           0           0  / ()
        16  docu           0           1  /Briefcase ()
        10  appo           0           1  /Calendar ()
        14  mess           0           6  /Chats ()
         7  cont           0           1  /Contacts ()
         6  mess           0           1  /Drafts ()
        13  cont           0           2  /Emailed Contacts ()
         2  mess          10          19  /Inbox ()
         4  mess           0           0  /Junk ()
        12  wiki           0           0  /Notebook ()
         5  mess           0           6  /Sent ()
        15  task           0           0  /Tasks ()
         3  conv           0           0  /Trash ()

Or we could use a mysql query to get the output of the descriptions as well. folder_type=1 if for "Folders" and instead of selecting * , we'll use "id,name".

[zimbra@mail39 ~]$ mysql -e 'SELECT id,name FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND type=1\G'
*************************** 1. row ***************************
  id: 1
name: USER_ROOT
*************************** 2. row ***************************
  id: 2
name: Inbox
*************************** 3. row ***************************
  id: 3
name: Trash
*************************** 4. row ***************************
  id: 4
name: Junk
*************************** 5. row ***************************
  id: 5
name: Sent
*************************** 6. row ***************************
  id: 6
name: Drafts
*************************** 7. row ***************************
  id: 7
name: Contacts
*************************** 8. row ***************************
  id: 8
name: Tags
*************************** 9. row ***************************
  id: 9
name: Conversations
*************************** 10. row ***************************
  id: 10
name: Calendar
*************************** 11. row ***************************
  id: 11
name: ROOT
*************************** 12. row ***************************
  id: 12
name: Notebook
*************************** 13. row ***************************
  id: 13
name: Emailed Contacts
*************************** 14. row ***************************
  id: 14
name: Chats
*************************** 15. row ***************************
  id: 15
name: Tasks
*************************** 16. row ***************************
  id: 16
name: Briefcase
The Query For ALL Message ID's In A Particular Folder Of A User

Now we'll setup the query to also use the folder_id. In this example folder_id=5 for the users "Sent" folder.

[zimbra@mail39 ~]$ mysql -e 'SELECT * FROM mboxgroup3.mail_item WHERE mailbox_id=3 AND type=5 AND folder_id=5\G'
*************************** 1. row ***************************
  mailbox_id: 3
          id: 261
        type: 5
   parent_id: 263
   folder_id: 5
    index_id: 261
     imap_id: 261
        date: 1273609779
        size: 458
   volume_id: 3
 blob_digest: baQatWGZSt5THO6tAGImpEOqVQY=
      unread: 0
       flags: 1
        tags: 0
      sender: Adam Cody
     subject: test test
        name: NULL
    metadata: d1:f9:test test1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:vi10ee
mod_metadata: 6216
 change_date: 1273609779
 mod_content: 6215
*************************** 2. row ***************************
  mailbox_id: 3
          id: 281
        type: 5
   parent_id: 286
   folder_id: 5
    index_id: 281
     imap_id: 281
        date: 1277122331
        size: 463
   volume_id: 3
 blob_digest: LifXXOMYCgjFsIj,+bsxi0cboOQ=
      unread: 0
       flags: 1
        tags: 0
      sender: Adam Cody
     subject: test mail39
        name: NULL
    metadata: d1:f0:1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t33:ajcody@mail59.zimbra.DOMAIN.com1:vi10ee
mod_metadata: 13741
 change_date: 1278082563
 mod_content: 13701
*************************** 3. row ***************************
  mailbox_id: 3
          id: 297
        type: 5
   parent_id: 286
   folder_id: 5
    index_id: 297
     imap_id: 297
        date: 1278084134
        size: 14896
   volume_id: 1
 blob_digest: 66QUCgivALxwGk+p3hnQ4viVZXU=
      unread: 0
       flags: 8195
        tags: 0
      sender: Adam Cody
     subject: test mail39
        name: NULL
    metadata: d1:f22:-- Original Message --1:p4:Re: 1:s45:Adam Cody <ajcody@mail39.zimbra.DOMAIN.com>1:t45:Adam Cody <ajcody@mail59.zimbra.DOMAIN.com>1:vi10ee
mod_metadata: 13765
 change_date: 1278084134
 mod_content: 13765
*************************** 4. row ***************************


cut -- it then continues for all the messages that exist for this account

The Query For ALL Appointments For A Particular User

$ mysql -e 'SELECT * FROM mboxgroup3.appointment WHERE mailbox_id=3\G'
*************************** 1. row ***************************
mailbox_id: 3
       uid: 3252c10b-b889-41ab-bbea-e07eafba0d76
   item_id: 325
start_time: 2010-08-27 18:55:00
  end_time: 2010-08-27 20:00:00
*************************** 2. row ***************************
mailbox_id: 3
       uid: 87fa4fc8-70c6-4459-9d3d-e139c0f6e64a
   item_id: 266
start_time: 2010-06-01 17:40:00
  end_time: 2010-06-01 18:00:00

The only relationship I find so far at this point with the above data to 'other' areas within ZCS in regards to mysql or the filesystem is the UID [ 3252c10b-b889-41ab-bbea-e07eafba0d76 ] above will be the UID as well in the ics format that will be in the message that is sent. And that messages will be on the filesystem under the user's store directory path. The message filename was 326-24060.msg - which doesn't match the item_id [325] .

$ pwd
/opt/zimbra/store/0/3/msg/0

$ grep 3252c10b-b889-41ab-bbea-e07eafba0d76 *
326-24060.msg:UID:3252c10b-b889-41ab-bbea-e07eafba0d76

$ ls -la 326-24060.msg 
-rw-r----- 1 zimbra zimbra 4619 Aug 27 18:04 326-24060.msg

$ cat 326-24060.msg

## CUT ###
BEGIN:VEVENT
UID:3252c10b-b889-41ab-bbea-e07eafba0d76
SUMMARY:Test for Mysql Query
LOCATION:My office
ATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE:mailto:admin@m
 ail39.zimbra.DOMAIN.com
ORGANIZER;CN=Adam Cody:mailto:ajcody@mail39.zimbra.DOMAIN.com
DTSTART;TZID="(GMT-06.00) Central Time (US & Canada)":20100827T180000
DTEND;TZID="(GMT-06.00) Central Time (US & Canada)":20100827T190000
### ###

Mail Items Received Per Day

Actually saw this query from a customer in a case, thought it might be useful for others. Example uses mboxgroup3 and mailbox_id3 , you would adjust that for your own purposes.

$ mysql

mysql> connect mboxgroup3;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Connection id:    18414
Current database: mboxgroup3

mysql> select FROM_UNIXTIME( date, '%d %m %Y'), count(*) from mail_item where mailbox_id=3 group by  FROM_UNIXTIME( date, '%d %m %Y') order by  date;

+----------------------------------+----------+
| FROM_UNIXTIME( date, '%d %m %Y') | count(*) |
+----------------------------------+----------+
| 13 09 2010                       |       17 | 
| 14 09 2010                       |        5 | 
| 15 09 2010                       |        4 | 
| 16 09 2010                       |        4 | 
| 17 09 2010                       |        4 | 
+----------------------------------+----------+
5 rows in set (0.00 sec)

mysql>

All Blobs Associated With A Particular Volume ID

Assumptions to the command below. There's 100 mboxgroups and the volume we are searching for is volume id 3 [zmvolume -l] . Also, this was against ZCS 8.6 - which uses locator instead of volume_id field. Older versions of ZCS will need to swap locator below to read volume_id .

for i in `seq 100`; do mysql --skip-column-names -e "SELECT CONCAT_WS(',',mailbox_id,id,locator) \
FROM mboxgroup$i.mail_item WHERE locator=1" ; done >> /tmp/locator.txt

Mysql Tables

zimbra database

SHOW zimbra Database Tables

This output shows the tables of the zimbra database. From ZCS 8.6 :

mysql -e 'SHOW tables FROM zimbra'
+-------------------+
| Tables_in_zimbra  |
+-------------------+
| config            |
| current_sessions  |
| current_volumes   |
| deleted_account   |
| mailbox           |
| mailbox_metadata  |
| mobile_devices    |
| out_of_office     |
| pending_acl_push  |
| scheduled_task    |
| service_status    |
| table_maintenance |
| volume            |
| volume_blobs      |
+-------------------+
DESCRIBE zimbra.mailbox Database Table

Description of the zimbra.mailbox table in the zimbra database. From ZCS 8.6 :

mysql -e 'DESCRIBE zimbra.mailbox'
+----------------------+---------------------+------+-----+---------+-------+
| Field                | Type                | Null | Key | Default | Extra |
+----------------------+---------------------+------+-----+---------+-------+
| id                   | int(10) unsigned    | NO   | PRI | NULL    |       |
| group_id             | int(10) unsigned    | NO   |     | NULL    |       |
| account_id           | varchar(127)        | NO   | UNI | NULL    |       |
| index_volume_id      | tinyint(3) unsigned | NO   | MUL | NULL    |       |
| item_id_checkpoint   | int(10) unsigned    | NO   |     | 0       |       |
| contact_count        | int(10) unsigned    | YES  |     | 0       |       |
| size_checkpoint      | bigint(20) unsigned | NO   |     | 0       |       |
| change_checkpoint    | int(10) unsigned    | NO   |     | 0       |       |
| tracking_sync        | int(10) unsigned    | NO   |     | 0       |       |
| tracking_imap        | tinyint(1)          | NO   |     | 0       |       |
| last_backup_at       | int(10) unsigned    | YES  | MUL | NULL    |       |
| comment              | varchar(255)        | YES  |     | NULL    |       |
| last_soap_access     | int(10) unsigned    | NO   |     | 0       |       |
| new_messages         | int(10) unsigned    | NO   |     | 0       |       |
| idx_deferred_count   | int(11)             | NO   |     | 0       |       |
| highest_indexed      | varchar(21)         | YES  |     | NULL    |       |
| version              | varchar(16)         | YES  |     | NULL    |       |
| last_purge_at        | int(10) unsigned    | NO   |     | 0       |       |
| itemcache_checkpoint | int(10) unsigned    | NO   |     | 0       |       |
+----------------------+---------------------+------+-----+---------+-------+
Example Of User Information Of zimbra.mailbox

I use both the user's :

{ldap} mailboxId equals id {mysql}
remember, this is for the zimbra.mailbox and not the mboxgroup# db, for mboxgroup# you would use mailbox_id.
{ldap} zimbraId equals account_id {mysql}

below in this example.

Example is from ZCS 8.6

$ zmprov gmi user1@`zmhostname`
mailboxId: 7
quotaUsed: 17000


$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE id=7\G'
*************************** 1. row ***************************
                  id: 7
            group_id: 7
          account_id: 2aa65168-7b18-4b13-b0e5-a91e4cd87bf5
     index_volume_id: 2
  item_id_checkpoint: 266
       contact_count: 0
     size_checkpoint: 17000
   change_checkpoint: 800
       tracking_sync: 0
       tracking_imap: 0
      last_backup_at: 1423893615
             comment: user1@ldap2.zimbra.DOMAIN.com
    last_soap_access: 0
        new_messages: 10
  idx_deferred_count: 0
     highest_indexed: NULL
             version: 2.7
       last_purge_at: 1424184635
itemcache_checkpoint: 0

$ zmprov ga user1@`zmhostname` zimbraId
# name user1@ldap2.zimbra.homeunix.com
zimbraId: 2aa65168-7b18-4b13-b0e5-a91e4cd87bf5

$ mysql -e 'SELECT * FROM zimbra.mailbox WHERE account_id="2aa65168-7b18-4b13-b0e5-a91e4cd87bf5"\G'
*************************** 1. row ***************************
                  id: 7
            group_id: 7
          account_id: 2aa65168-7b18-4b13-b0e5-a91e4cd87bf5
     index_volume_id: 2
  item_id_checkpoint: 266
       contact_count: 0
     size_checkpoint: 17000
   change_checkpoint: 800
       tracking_sync: 0
       tracking_imap: 0
      last_backup_at: 1423893615
             comment: user1@ldap2.zimbra.DOMAIN.com
    last_soap_access: 0
        new_messages: 10
  idx_deferred_count: 0
     highest_indexed: NULL
             version: 2.7
       last_purge_at: 1424184635
itemcache_checkpoint: 0

mboxgroup[#] database

Users are associated with a mboxgroup database. Each mboxgroup database will be comprised of multiple users, the users and their data are unique by way for the mailbox_id of the user.

SHOW mboxgroup[#] Database Tables

This output shows the tables of the mboxgroup# database. From ZCS 8.6 :

$ mysql -e 'SHOW tables FROM mboxgroup7'
+----------------------+
| Tables_in_mboxgroup7 |
+----------------------+
| appointment          |
| appointment_dumpster |
| data_source_item     |
| imap_folder          |
| imap_message         |
| mail_item            |
| mail_item_dumpster   |
| open_conversation    |
| pop3_message         |
| revision             |
| revision_dumpster    |
| tag                  |
| tagged_item          |
| tombstone            |
+----------------------+
DESCRIBE mboxgroup[#].mail_item Database Table

Description of the mail_item table in the mboxgroup# database. From ZCS 8.6 :

$ mysql -e 'DESCRIBE mboxgroup7.mail_item'
+--------------+---------------------+------+-----+---------+-------+
| Field        | Type                | Null | Key | Default | Extra |
+--------------+---------------------+------+-----+---------+-------+
| mailbox_id   | int(10) unsigned    | NO   | PRI | NULL    |       |
| id           | int(10) unsigned    | NO   | PRI | NULL    |       |
| type         | tinyint(4)          | NO   |     | NULL    |       |
| parent_id    | int(10) unsigned    | YES  |     | NULL    |       |
| folder_id    | int(10) unsigned    | YES  |     | NULL    |       |
| prev_folders | text                | YES  |     | NULL    |       |
| index_id     | int(10) unsigned    | YES  |     | NULL    |       |
| imap_id      | int(10) unsigned    | YES  |     | NULL    |       |
| date         | int(10) unsigned    | NO   |     | NULL    |       |
| size         | bigint(20) unsigned | NO   |     | NULL    |       |
| locator      | varchar(1024)       | YES  |     | NULL    |       |
| blob_digest  | varchar(44)         | YES  |     | NULL    |       |
| unread       | int(10) unsigned    | YES  |     | NULL    |       |
| flags        | int(11)             | NO   |     | 0       |       |
| tags         | bigint(20)          | NO   |     | 0       |       |
| tag_names    | text                | YES  |     | NULL    |       |
| sender       | varchar(128)        | YES  |     | NULL    |       |
| recipients   | varchar(128)        | YES  |     | NULL    |       |
| subject      | text                | YES  |     | NULL    |       |
| name         | varchar(255)        | YES  |     | NULL    |       |
| metadata     | mediumtext          | YES  |     | NULL    |       |
| mod_metadata | int(10) unsigned    | NO   |     | NULL    |       |
| change_date  | int(10) unsigned    | YES  |     | NULL    |       |
| mod_content  | int(10) unsigned    | NO   |     | NULL    |       |
| uuid         | varchar(127)        | YES  |     | NULL    |       |
+--------------+---------------------+------+-----+---------+-------+
Description of mboxgroup[#].mail_item Type

Ref: /source/xref/zimbra-zcs-JUDASPRIEST-860/ZimbraServer/src/java/com/zimbra/cs/mailbox/MailItem.java


75 public abstract class MailItem implements Comparable<MailItem>, ScheduledTaskResult {
76
77    public enum Type {
78        UNKNOWN(-1),
79        /** Item is a standard {@link Folder}. */
80        FOLDER(1),
81        /** Item is a saved search {@link SearchFolder}. */
82        SEARCHFOLDER(2),
83        /** Item is a user-created {@link Tag}. */
84        TAG(3),
85        /** Item is a real, persisted {@link Conversation}. */
86        CONVERSATION(4),
87        /** Item is a mail {@link Message}. */
88        MESSAGE(5),
89        /** Item is a {@link Contact}. */
90        CONTACT(6),
91        /** Item is a {@link InviteMessage} with a {@code text/calendar} MIME part. */
92        @Deprecated INVITE(7),
93        /** Item is a bare {@link Document}. */
94        DOCUMENT(8),
95        /** Item is a {@link Note}. */
96        NOTE(9),
97        /** Item is a memory-only system {@link Flag}. */
98        FLAG(10),
99        /** Item is a calendar {@link Appointment}. */
100        APPOINTMENT(11),
101        /** Item is a memory-only, 1-message {@link VirtualConversation}. */
102        VIRTUAL_CONVERSATION(12),
103        /** Item is a {@link Mountpoint} pointing to a {@link Folder}, possibly in another user's {@link Mailbox}. */
104        MOUNTPOINT(13),
105        /** Item is a {@link WikiItem} */
106        @Deprecated WIKI(14),
107        /** Item is a {@link Task} */
108        TASK(15),
109        /** Item is a {@link Chat} */
110        CHAT(16),
111        /** Item is a {@link Comment} */
112        COMMENT(17),
113        /** Item is a {@link Link} pointing to a {@link Document} */
114        LINK(18);
115
DESCRIBE mboxgroup[#].appointment Database Table

Description of the appointment table in the mboxgroup# database.

$ mysql -e 'DESCRIBE mboxgroup7.appointment'
+------------+------------------+------+-----+---------+-------+
| Field      | Type             | Null | Key | Default | Extra |
+------------+------------------+------+-----+---------+-------+
| mailbox_id | int(10) unsigned | NO   | PRI | NULL    |       |
| uid        | varchar(255)     | NO   | PRI | NULL    |       |
| item_id    | int(10) unsigned | NO   |     | NULL    |       |
| start_time | datetime         | NO   |     | NULL    |       |
| end_time   | datetime         | YES  |     | NULL    |       |
+------------+------------------+------+-----+---------+-------+

Mysql Database Location On Filesystem

mboxgroup# Database Default Example for ZCS5

Using my examples above of the mboxgroup3 .

[zimbra@mail39 data]$ pwd
/opt/zimbra/db/data

[zimbra@mail39 data]$ ls -F
backup/  ib_logfile0  ib_logfile1  ibdata1  mboxgroup1/  mboxgroup2/  mboxgroup3/  mboxgroup4/  mboxgroup5/  mboxgroup6/  mysql/  test/  zimbra/

[zimbra@mail39 data]$ ls mboxgroup3/
appointment.frm       data_source_item.ibd  imap_folder.ibd   mail_item.frm          open_conversation.ibd  revision.frm   tombstone.ibd
appointment.ibd       db.opt                imap_message.frm  mail_item.ibd          pop3_message.frm       revision.ibd
data_source_item.frm  imap_folder.frm       imap_message.ibd  open_conversation.frm  pop3_message.ibd       tombstone.frm

You'll notice there's matching files on the system for the various tables reported with:

$ mysql -e 'SHOW tables FROM mboxgroup3'

zimbra Database Default Example for ZCS5

[zimbra@mail39 data]$ pwd
/opt/zimbra/db/data

[zimbra@mail39 data]$ ls -F
backup/  ib_logfile0  ib_logfile1  ibdata1  mboxgroup1/  mboxgroup2/  mboxgroup3/  mboxgroup4/  mboxgroup5/  mboxgroup6/  mysql/  test/  zimbra/

[zimbra@mail39 data]$ ls zimbra
config.frm                jiveGroupUser.MYI    jiveProperty.MYD          jiveSASLAuthorized.frm  mucAffiliation.MYD      mucRoomProp.frm
config.ibd                jiveGroupUser.frm    jiveProperty.MYI          jiveUserProp.MYD        mucAffiliation.MYI      out_of_office.frm
current_volumes.frm       jiveID.MYD           jiveProperty.frm          jiveUserProp.MYI        mucAffiliation.frm      out_of_office.ibd
current_volumes.ibd       jiveID.MYI           jiveRemoteServerConf.MYD  jiveUserProp.frm        mucConversationLog.MYD  scheduled_task.frm
db.opt                    jiveID.frm           jiveRemoteServerConf.MYI  jiveVCard.MYD           mucConversationLog.MYI  scheduled_task.ibd
deleted_account.frm       jiveOffline.MYD      jiveRemoteServerConf.frm  jiveVCard.MYI           mucConversationLog.frm  service_status.MYD
deleted_account.ibd       jiveOffline.MYI      jiveRoster.MYD            jiveVCard.frm           mucMember.MYD           service_status.MYI
jiveExtComponentConf.MYD  jiveOffline.frm      jiveRoster.MYI            jiveVersion.MYD         mucMember.MYI           service_status.frm
jiveExtComponentConf.MYI  jivePrivacyList.MYD  jiveRoster.frm            jiveVersion.MYI         mucMember.frm           table_maintenance.frm
jiveExtComponentConf.frm  jivePrivacyList.MYI  jiveRosterGroups.MYD      jiveVersion.frm         mucRoom.MYD             table_maintenance.ibd
jiveGroupProp.MYD         jivePrivacyList.frm  jiveRosterGroups.MYI      mailbox.frm             mucRoom.MYI             volume.frm
jiveGroupProp.MYI         jivePrivate.MYD      jiveRosterGroups.frm      mailbox.ibd             mucRoom.frm             volume.ibd
jiveGroupProp.frm         jivePrivate.MYI      jiveSASLAuthorized.MYD    mailbox_metadata.frm    mucRoomProp.MYD
jiveGroupUser.MYD         jivePrivate.frm      jiveSASLAuthorized.MYI    mailbox_metadata.ibd    mucRoomProp.MYI

You'll notice there's matching files on the system for the various tables reported with :

$ mysql -e 'SHOW tables FROM zimbra'

Getting The Size Of The Mbox Tables In MBs

Here is what you would run.

$ su - zimbra

## Note : I added \'s in the command below so it would format ok in wiki ##

$ mysql -e "SELECT table_schema AS 'Mbox table', \
Round( Sum( data_length + index_length ) / 1024 / 1024, 3)\
AS 'Mbox Size (MB)' FROM information_schema.tables \
GROUP BY table_schema ;"
+--------------------+----------------+
| Mbox table         | Mbox Size (MB) |
+--------------------+----------------+
| information_schema |          0.004 | 
| mboxgroup1         |          0.453 | 
| mboxgroup2         |          0.453 | 
| mboxgroup3         |          0.516 | 
| mboxgroup4         |          0.453 | 
| mboxgroup5         |          0.453 | 
| mboxgroup6         |          0.453 | 
| mysql              |          0.520 | 
| zimbra             |          0.319 | 
+--------------------+----------------+

This was a response from the developers on a question a customer had concerning the sizes of their mboxgroup*ibd files and why they were of varying sizes and if the larger ones could be "shrunk".

The innodb tablespace can physically grow, but won't shrink. We set innodb_file_per_table to store an idb file per table instead of one large idb file for all tables. If a table has a lot of activity, the idb file will grow. The rows can be deleted but the idb file will still be at the high-water mark. That doesn't mean there isn't a bunch of free space that can be used, just that it will remain large on the filesystem. You can find out the actual size of the space being used by querying the information_schema dictionary view.
Note - see syntax above that I did. Adam
SELECT table_schema AS 'Mbox table',
Round( Sum( data_length + index_length ) / 1024 / 1024, 3) AS Mbox Size (MB)',
FROM information_schema.tables
GROUP BY table_schema ;
As you can see, you can include both the data and index lengths, or you could exclude one and run separately to see exactly how large each is. That will get you the actual size which you can compare to the physical size of the idb on disk.If you want to reclaim the disk space by data, I think you are going to have to export the data, drop the table (I don't think a truncate will do it), then import the data again. As far as checking for the percentage of fragmentation, you can't really determine if the difference between physical size and data size is due to many records being deleted or due to fragmentation waste. You can STILL take the same administrative action of rebuilding the tables to help avoid the problem though.

Concerning the dropping of data/tables, see the Mysql_Crash_Recovery on the basic concepts for that. Zimbra Support uses the steps on the Mysql_Crash_Recovery for extreme or DR sitautions, falling back to a full DR recovery process using the zmrestore if the Mysql Crash Recovery steps fail. One should not pursue the Mysql_Crash_Recovery steps unless your willingly to accept the possible need of doing a full DR restore if things don't work out.

To see or understand more about the data in the mboxgroup* mail_item tables, see:

Also, for future references since 608 is at 5.0.90 - this query might prove useful in regards to the fragmentation question:

Misc Issues Related To Mysql

Error - inconsistent state: unread

You might see a error like the following:

"com.zimbra.common.service.ServiceException: system failure:
 inconsistent state: unread < 0 for item X"
 (X is the id of the folder in question.)

Please see the following on the issue and the work around and/or later fix.

Third Party Tools And References

Recovery Issues

Verified Against: Zimbra Collaboration 8.0, 7.0 Date Created: 04/16/2014
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-Server-Topics Date Modified: 06/21/2016



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »




Ajcody Logger Issues

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.

You might want to cross review these other sections as well:

Actual Logger Issues Homepage

Please see Ajcody-Logger-Issues

Logger and ZCS 6.x+

Please see Logger(GnR) , as logger has changed dramatically in 6.x+ as compared to 5.x.

Missing Stats

Are You Using rsyslog, syslog-ng, or syslog

See this forum thread: upgrade to 6.0.2 stats and status no longer working

See the bugs listed below as well.

Confirm All hosts Are Still Present

Follow the instructions at Ajcody-Logger-Issues#What_Tables_And_To_View_Them and confirm all the hosts displayed are still present in your environment. You'll probably also see an error about this in the output from the instructions given at Logger(GnR)#Statistics_show_no_data_available

Logger Not Running

You might want to check /opt/zimbra/log/zmlogswatch.out and see if it mentions a missing file or directory. For example:

tail -f log/zmlogswatch.out
   Error opening /var/log/zimbra-stats.log: No such file or directory at
   /opt/zimbra/data/tmp/.swatch_script.21119 line 92

Here's the ownership as that file should be:

ls -la /var/log/zimbra-stats.log
-rw-r--r-- 1 zimbra zimbra 2500220 Feb 17 05:37 /var/log/zimbra-stats.log

Logger 6.x Bugs To Review

Some bugs to review:

sqlite3 and Logger

External Reference: Command Line Shell For SQLite

Login To DB and Quit

How to log into the logger db and to quit:

[zimbra@mail3 data]$ pwd
/opt/zimbra/logger/db/data
[zimbra@mail3 data]$ sqlite3 logger.sqlitedb
SQLite version 3.3.6
Enter ".help" for instructions
sqlite> .quit
[zimbra@mail3 data]$
What Tables And To View Them
$ pwd
 /opt/zimbra/logger/db/data

$ sqlite3 logger.sqlitedb
    SQLite version 3.3.6
    Enter ".help" for instructions
    sqlite> .mode list
    sqlite> .tables
      config           hosts            rrd_column_type  rrds
    sqlite> select * from hosts;
      1|mail3|mail3.zimbra.REMOVED.com
      2|mail3.zimbra.REMOVED.com|mail3.zimbra.REMOVED.com
    sqlite>.quit

$
Delete A Host

This is the command to delete a host, id is the number shown on the left of the line where the hostname is display from "select * from hosts;"

 sqlite>  DELETE  from hosts WHERE id=1;

That would delete the first hostname [id 1] .

Query Of ZCS Service Status History Via zmrrdfetch

Example were done on ZCS 8.0.6 and a single ZCS server setup. First, if you need a converter for unix time see : http://www.epochconverter.com/ . Secondy, note the columns are described below. Some of my examples will not include this first row. :

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,convertd,stats,antispam,mta

The below example checks to see when the archiving service was reported as up. Archiving is the 9th column.

/opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h zcs806.us.DOMAIN.com -s 1388534400 -e 1405618603 | awk -F, '$9 == 1'
[cut]
1405454400,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405458000,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405461600,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405465200,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405468800,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405472400,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405476000,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405479600,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
[cut]

The below example checks to see when the archiving service was reported as unavailable 100%. Archiving is the 9th column. [zimbra@zcs806 data]$ /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h zcs806.us.DOMAIN.com -s 1388534400 -e 1405618603 | awk -F, '$9 == ""'

1405069200,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405072800,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405076400,1,0.964354991388889,1,1,1,1,1,,1,1,1,1,1,1,1
1405080000,1,0.946143796944445,1,1,1,1,1,,1,1,1,1,1,1,1
1405083600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405087200,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405090800,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405094400,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405098000,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405101600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405105200,1,0.987032061666667,1,1,1,1,1,,1,1,1,1,1,1,1
1405108800,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405112400,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405116000,1,0.982143184166667,1,1,1,1,1,,1,1,1,1,1,1,1
1405119600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405123200,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405126800,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405130400,1,0.967078515555556,1,1,1,1,1,,1,1,1,1,1,1,1
1405134000,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405137600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405141200,1,0.920520648333333,1,1,1,1,1,,1,1,1,1,1,1,1
1405144800,1,0.9539186725,1,1,1,1,1,,1,1,1,1,1,1,1
1405148400,1,0.981826185277778,1,1,1,1,1,,1,1,1,1,1,1,1
1405152000,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405155600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405159200,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405162800,1,0.996330343333333,1,1,1,1,1,,1,1,1,1,1,1,1
1405166400,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405170000,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405173600,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
1405177200,1,1,1,1,1,1,1,,1,1,1,1,1,1,1
[cut]

The below example checks to see when the mailbox service was reported as NOT available 100% or the time but was NOT 100% unavailable either. Mailbox is the 3rd column.

[zimbra@zcs806 data]$ /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h zcs806.us.DOMAIN.com -s 1388534400 -e 1405618603 | awk -F, '$3 ~ 0'
[cut]
1405076400,1,0.964354991388889,1,1,1,1,1,,1,1,1,1,1,1,1
1405080000,1,0.946143796944445,1,1,1,1,1,,1,1,1,1,1,1,1
1405105200,1,0.987032061666667,1,1,1,1,1,,1,1,1,1,1,1,1
1405116000,1,0.982143184166667,1,1,1,1,1,,1,1,1,1,1,1,1
1405130400,1,0.967078515555556,1,1,1,1,1,,1,1,1,1,1,1,1
1405141200,1,0.920520648333333,1,1,1,1,1,,1,1,1,1,1,1,1
1405144800,1,0.9539186725,1,1,1,1,1,,1,1,1,1,1,1,1
1405148400,1,0.981826185277778,1,1,1,1,1,,1,1,1,1,1,1,1
1405162800,1,0.996330343333333,1,1,1,1,1,,1,1,1,1,1,1,1
[cut]

An example of a zmcontrol restart and what zmrrdfetch will show. Note I adjusted the ending flag to be : -e `date +%s --date="1 minute ago"  : as compared to the above examples :

[zimbra@zcs806 data]$ /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h zcs806.us.DOMAIN.com -s `date +%s --date="15 minute ago"` -e `date +%s --date="1 minute ago"`
timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,convertd,stats,antispam,mta
1405621920,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405621950,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405621980,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622010,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622040,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622070,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622100,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622130,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622160,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622190,,0,,,,,,,,,,,,,
1405622220,,0,,,,,,,,,,,,,
1405622250,,0,,,,,,,,,,,,,
1405622280,,0,,,,,,,,,,,,,
1405622310,,0,,,,,,,,,,,,,
1405622340,,0.893621444444444,,,,,,,,,,,,,
1405622370,,0.893621444444444,,,,,,,,,,,,,
1405622400,,0.893621444444444,,,,,,,,,,,,,
1405622430,,1,,,,,,,,,,,,,
1405622460,,1,,,,,,,,,,,,,
1405622490,,1,,,,,,,,,,,,,
1405622520,,1,,,,,,,,,,,,,
1405622550,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622580,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1

Logger Related Bugs

5.0.11 - Fixed in 5.0.12 But See Below Before Upgrading

UPDATE: From release notes: kill all zmlogger processes before upgrading to 5.0.12 from 5.0.10+

Steps To Resolve
  1. Edit /opt/zimbra/conf/my.logger.cnf, and modify this line for 20 connections.
    • max_connections = 20
  2. Review the following bug and download the zmlogswatchctl script listed in the attachments section.
  3. Shutdown logger.
    • zmloggerctl stop
    • find any orphaned logger or swatch processes, and kill them
      •  ps -ef | grep logg
      •  ps -ef | grep watch
    • Replace the logswatch control file
      • mv /opt/zimbra/bin/zmlogswatchctl /opt/zimbra/bin/original.zmlogswatchctl
    • Add the new zmlogswatchctl file from the above bug to /opt/zimbra/bin
      • as root
        chown root:root /opt/zimbra/bin/zmlogswatchctl
      • as root
        chmod 755 /opt/zimbra/bin/zmlogswatchctl
  4. Start up the logger process.
    • zmloggerctl start

You can be checking the output in the following as well to see if any errors are still being reported:

  • /tmp/logprocess.out
  • /tmp/gengraphs.out
  • /opt/zimbra/logger/db/data/<hostname>.err
Logger Table Check And Repair

Other items to check:

Also, check the logger tables to see if any of the tables need to be repaired

logmysql -e "check table zimbra_logger.amavis"
logmysql -e "check table zimbra_logger.amavis_aggregate"
logmysql -e "check table zimbra_logger.config"
logmysql -e "check table zimbra_logger.disk_aggregate"
logmysql -e "check table zimbra_logger.disk_status"
logmysql -e "check table zimbra_logger.mta"
logmysql -e "check table zimbra_logger.mta_aggregate"
logmysql -e "check table zimbra_logger.processing_history"
logmysql -e "check table zimbra_logger.raw_logs"
logmysql -e "check table zimbra_logger.service_status"

If any of the tables need to be repaired, you replace 'check' with 'repair'. Example:

logmysql -e "repair table zimbra_logger.amavis"
/tmp/logprocess.out Shows MySQL Can't Connect

Please follow these instructions:

Logger Not Working , No Stats, Services Show Not Running In Admin Console

ZCS 6 And Above

On The Logger Host Server

On the Logger monitor host [zmprov gacf |grep zimbraLogHostname] start with the following. Note: run below steps in non-peak hours.

su - zimbra
zmcontrol stop ; exit

Run as root user:

/opt/zimbra/libexec/zmfixperms -e -v

On the logger monitor host, you must enable syslog [if your running rsyslog, see below] to log statistics from remote machines. Run the following as root also :

  • Edit the /etc/sysconfig/syslog file, add -r to the SYSLOGD_OPTIONS setting, SYSLOGD_options=”-r -m 0”
  • Run : /opt/zimbra/libexec/zmsyslogsetup
  • Stop the syslog daemon. Type : /etc/init.d/syslogd restart
    • Or by: service syslog restart
    • Use stop / start if restart isn't available.

If you are using rsyslog instead of syslog, then you will need the following changes in rsyslog config. First, enable the module for remote logging on the logger host. Edit the rsyslog config file "/etc/rsyslog.conf" and enable "imudp" module by uncommenting the same:

$ModLoad imudp
$UDPServerRun 514

After the above changes to the following if you are running rsyslog: restart rsyslog service.

  • Run : /opt/zimbra/libexec/zmsyslogsetup
  • Restart rsyslog with : /etc/init.d/rsyslog restart
    • Or by: service rsyslog restart
    • Use stop / start if restart isn't available.

Your last steps are to then run:

su - zimbra 
zmcontrol start 
/opt/zimbra/libexec/zmloggerinit 
/opt/zimbra/bin/zmsshkeygen
/opt/zimbra/bin/zmupdateauthkeys
On The Other Servers

On all other servers (if you have multiple zimbra servers in your setup). Verify the LogHostname (it should be set to name of Logger monitor Host on all servers) if its different, change the same to Logger monitor Host using below command.

su - zimbra
zmprov gacf |grep zimbraLogHostname  

If it is set wrong, you can correct it by doing:

zmprov mcf zimbraLogHostname <Logger monitor Hostname>

Then run the following after the zimbraLogHostname variable is confirmed or set correctly:

/opt/zimbra/bin/zmsshkeygen
/opt/zimbra/bin/zmupdateauthkeys ; exit
/opt/zimbra/libexec/zmsyslogsetup (run as root user)
Restart either syslogd or rsyslog, depending on what your server is using
service syslog restart or service rsyslog restart
su - zimbra
zmcontrol restart

Reference Link:

This Section Written For ZCS5

Check the following log files first to gather some information:

  • Make sure the /etc/hosts details make the actual hostname and the zmhostname output
    • If someone recently changed the hostname variables for this box, logger can be effected if done improperly and will not log the obvious issue.
  • /tmp/logprocess.out
  • /tmp/gengraphs.out
  • /opt/zimbra/logger/db/data/<hostname>.err
  • /var/log/zimbra.log (logswatch monitors this file)
    • grep'ing for things such as:
      •  egrep 'postfix|amavis|STATUS|DISK|QUEUE' /var/log/zimbra.log
  • You might also want to look at the following directory:
    • /opt/zimbra/logger/db/work/
    • You should see data in here, gif and rrd files.

Then proceed with the following wiki pages, as ordered:

Large Logger Database Killing Performance Of ZCS

Review the following to see what might be best option for you:

Reinitializing Logger Database From Scratch

This will effectively blow away your old logger database, allowing you to start over.

zmloggerctl stop
cd /opt/zimbra/logger/db

Remove the old database:

mv db db-old

or data , if db doesn't exist

mv data data-old

You can remove (rm -rf db or data) the directory if your not worried about old directory being perserved

Reinitialize a new logger database:

/opt/zimbra/libexec/zmloggerinit

Logger is probably running after this, but to make sure

zmloggerctl start

You'll need to manually start this one though

zmlogswatchctl start

You'll have to allow some time to pass for there to be enough data for the graphs to be built in the web interface.

Turning Off Logger

To not have logger startup [ use `hostname` or type in hostname] :

zmprov ms `hostname` -zimbraServiceEnabled logger

To manually shutdown logger

zmloggerctl stop

Customization Or Modification Of Swatch Config

The swatch config file is :

/opt/zimbra/conf/swatchrc.in

If you make a customization, you'll need to do the following for it to take effect:

zmsnmpinit
zmlogswatchctl stop
zmlogswatchctl start
zmswatchctl stop
zmswatchctl start
Verified Against: Zimbra Collaboration 7.0, 6.0 Date Created: 04/16/2014
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-Server-Topics Date Modified: 06/21/2016



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »




Lucene

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.

Actual Lucene Topics Homepage

Please see Ajcody-Lucene-Topics

Other References to Lucene Index

Please see:

Some General Questions On The Lucene Indexing

Index Directory Numbering

We know the directory under the index volume path is like the following:

/opt/zimbra/index/ "X" / "Y" / index / "Z" /

We believe that "X" is the number which is determined by bitshifting the mailbox_id to the right by 12 bits. That the "Y" is the maibox_id of the user. However, how do you get "Z"?

Answer: It's always '0'.

When Is User Message Store Directory Created

When is the directory for the message data for an account (/opt/zimbra/store/0/...) created? When a message is stored for the first time? Which would also mean, that it would not be created if message data does not exist, correct?

Answer: Yes.

When Is User Index Directory And Index Files Created

Concerning the index directory. We know the index directory already exists even when mail data does not exist [see question above]. When will the index directory be created? With the account's first login?

Answer: The directory is created with user creation. The index files that will exist in the user's directory are created with the first indexing or search event.
Example Walk Through

On my 5.0.24 test box.

Create a test account:

[zimbra@mail37 ~]$ zmprov gmi index-test@`zmhostname`
mailboxId: 6
quotaUsed: 0

Notice that the 'store' directory ISN'T automatically created for the user upon user creation :

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/store/0
total 20
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 1
drwxr-xr-x 4 zimbra zimbra 4096 Sep 13 14:57 ..
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 2
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 15:05 3
drwxr-x--- 5 zimbra zimbra 4096 Sep 13 15:05 .

Notice that the 'index' directory IS automatically created for the user upon user creation but the actual indexing files are not :

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/index/0/6/index/0/
total 8
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:11 ..
drwxr-x--- 2 zimbra zimbra 4096 Oct 21 12:11 .

Let's see what changes when the user is sent and email BUT they still have not logged in yet:

[zimbra@mail37 ~]$ mail index-test@`zmhostname`
tSubject:test from localhost
test
.
Cc: 

Checking the relevant user directory for changes. Notice we now have a 6 directory, matching the users mailboxId. We don't see any index files though under their index directory:

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/store/0/
mailboxId: 6
quotaUsed: 1563
total 24
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 1
drwxr-xr-x 4 zimbra zimbra 4096 Sep 13 14:57 ..
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 2
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 15:05 3
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:13 6
drwxr-x--- 6 zimbra zimbra 4096 Oct 21 12:13 .

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/index/0/6/index/0/
total 8
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:11 ..
drwxr-x--- 2 zimbra zimbra 4096 Oct 21 12:11 .

Let's see if logging into the webclient as the user changes anything. Log into the webclient and then check the user directories again. Still no change, no index files created.

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/store/0/
mailboxId: 6
quotaUsed: 1563
total 24
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 1
drwxr-xr-x 4 zimbra zimbra 4096 Sep 13 14:57 ..
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 14:57 2
drwxr-x--- 3 zimbra zimbra 4096 Sep 13 15:05 3
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:13 6
drwxr-x--- 6 zimbra zimbra 4096 Oct 21 12:13 .

[zimbra@mail37 ~]$ ls -latr /opt/zimbra/index/0/6/index/0/
total 8
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:11 ..
drwxr-x--- 2 zimbra zimbra 4096 Oct 21 12:11 .

Let's do a manual index of the user account and confirm index files are made.

[zimbra@mail37 ~]$ zmprov rim index-test@`zmhostname` start
status: started
[zimbra@mail37 ~]$ ls -latr /opt/zimbra/index/0/6/index/0/
total 20
drwxr-x--- 3 zimbra zimbra 4096 Oct 21 12:11 ..
-rw-r----- 1 zimbra zimbra   45 Oct 21 12:15 segments_2
-rw-r----- 1 zimbra zimbra   20 Oct 21 12:15 segments.gen
-rw-r----- 1 zimbra zimbra 2455 Oct 21 12:15 _0.cfs
drwxr-x--- 2 zimbra zimbra 4096 Oct 21 12:15 .

So far, we've confirm user creation doesn't create the store directory until a message or something similar is processed. That the users index directory path will be created with user creation but the index files will not be. That the index files aren't created when the user first logs in but are created with a manual index [zmprov rim user@domain].

Let's confirm if a 'search' creates the index files. First, I'll remove the existing index files that were made. Then log into the webclient as the user and do an email search. Confirming after words that the index files were made from that search - which it does.

[zimbra@mail37 ~]$ cd /opt/zimbra/index/0/6/index/0/
[zimbra@mail37 0]$ ls
_0.cfs  segments.gen  segments_2
[zimbra@mail37 0]$ rm -rf *
[zimbra@mail37 0]$ ls

Perform webclient search and check index directory again.

[zimbra@mail37 0]$ ls
segments.gen  segments_1

Delete Flag

Does lucene create delete flag when index is deleted?

Answer: Yes.
Delete Flag Operational Details

If so, we believe that it creates only delete flag, and files having an actual index (such as segment file) will be deleted (reuse of disk space) only when segment is merged, or any function for optimization is called, is this correct?

Answer: Yes.
Update
See also this bug/rfe:
"Index data needs to reclaim disk space after deletes"
http://bugzilla.zimbra.com/show_bug.cgi?id=54969
Is It The Same For zmmailboxmove With purgeOld

The above behavior is the same when executing zmmailboxmove with purgeOld?

Answer: No, it physically deletes the entire files.

Cleaning Up Or Shrinking Index For Users

From the ZCS 8 Release Notes:

  1. "large mail volume DOS's lucene"
    • http://bugzilla.zimbra.com/show_bug.cgi?id=76414
      • Index data for mailboxes is never deleted so a mailbox index can become very large over time and might be consuming excess disk space because of the large index data. In 8.0, a new zmprov CLI, compactIndexMailbox (cim) was created to compact index data. This command can be used to reclaim disk space when the index volume starts to become full. To compact a mailbox’s index, type:
      • zmprov cim <name@domain|id> start
        • Note - Depending on the size of the mailbox and the number of deletes this might take awhile. This might require additional free space on the index directory.
        • You can run this command concurrently. It is recommended to run this command during off peak hours. You cannot cancel the command once it is started.
        • To see the status of index compaction on a mailbox, type:
      • zmprov getIndexStats <name@domain|id>
  2. "Sorting by recipient does not appear to work correctly"
    • http://bugzilla.zimbra.com/show_bug.cgi?id=74521
      • Customers currently on ZCS 7.x upgrading to latest version of ZCS will require full re-indexing mailboxes for sort-by recipients feature to work properly. Without full re-indexing the mailbox, sorting by "To" field in the "Sent" folder message view will skip all the mess ages from the sorted results added before the upgrade. Note: re-indexing mailbox is an expensive operation and if this feature is NOT so required then, its NOT recommended to do mailbox re-indexing.

Manually Deleting Lucene Index Directories

Please see King0770-Notes#Manually_Delete_Index_Directories

Performance Tuning

Please see Performance_Tuning_Guidelines_for_Large_Deployments#Lucene_Index

Some smaller notes:

  1. Upgrade to 6.0.8:
  2. These last 2 will decrease Indexing overhead, but obviously with a loss of functionality
    1. set zimbraPrefAutoAddAddressEnabled to FALSE
    2. set zimbraAttachmentsIndexingEnabled to FALSE

Ajcody Notes Archive Discovery

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual Archive & Discovery Notes Homepage

Ajcody-Notes-Archive-Discovery

References for A&D

Updated A&D Documentation In Admin Manual

Please see:

Zimbra ZSC Version 8.x

Admin Guide

The version 7.x manual is more comprehensive. Version 8 Documentation is missing a lot of content available in Version 7 documentation.

Zimbra ZSC Version 7.x

Admin Guide

Older Notes About ZAD

Important Note:

I think we need to clean up the documentation that refers to this "download" as no longer being necessary as it's bundled in the zcs-network edition tar ball now. I found an old email to the development team where I inquired about this - I didn't get a response from on it at the time.

If this assumption is true [Like I see with the 5.x setups I've helped with] then I think we need to adjust the documents for 4.5.x stuff to state:

You'll need to download your version of 4.5.x zcs network edition tarball, untar it, and then run the install script . Which effectively will allow you to now select the "archive" package which will also include the search zimlet [zmbxsearch].


The two main A&D references are :

http://wiki.zimbra.com/index.php?title=ZAD

http://www.zimbra.com/pdf/Zimbra%20Archiving%20and%20Discovery%20Release%20Notes.pdf

But I Just Want Some BCC's To Happen - Not All This A&D Stuff

Please see Ajcody-MTA-Postfix-Topics#Automatic_BCC instead then.

But We Have A Non-Zimbra MTA - zimbraSmtpHostname & zimbraMtaRelayHost Pointed To External Device

Please see this RFE I made:

  • "RFE: Ability to handle A&D when another MTA systems is being specified"

Notable Bugs Or RFE's

Update Jan 22, 2015 . I filed these while testing against ZCS 8.6 .


Older Bug/RFE's I've noted:

Archive Stop Working After Upgrade Or Disabling Anti-Spam - Anti-Virus

Prior to JP/8.5 , the archiving feature required the anti-spam or anti-virus service to be enabled. If you disabled both of them, then amavis as a whole was disabled. This is required for archiving to work. The following bug resolves this for JP/8.5 - it makes amavis its own service:

Also note, my testing on ZCS 8.0.7 did confirm that disabling av/as [therefore, amavis] will cause archiving to not work. This is very confusing since zmcontrol status AND the admin console will show that the service for "archiving" is running - though archiving is not actually working since amavis is disabled.

Update Jan 22, 2015. New bug filed to deal with other upgrade issues we discovered.

First - Short & Sweet How-To On CLI With Single ZCS 8.6 Server

In this example, I'll turn off the antivirus and antispam service in 8.6 and then enable amavis and archiving. Create an archive cos and then archive user. This was a single ZCS 8.6 server with all services installed during the installation - just using default values. This was NOT an upgrade to ZCS 8.6 .

[zimbra@ldap2 ~]$ zmcontrol -v 
Release 8.6.0_GA_1153.RHEL6_64_20141215151258 RHEL6_64 NETWORK edition. 

[zimbra@ldap2 ~]$ zmprov gs `zmhostname` | grep Service | egrep 'amavis|antivirus|antispam|archiving' 
zimbraServiceEnabled: amavis 
zimbraServiceEnabled: antivirus 
zimbraServiceEnabled: antispam 
zimbraServiceEnabled: archiving 
zimbraServiceInstalled: amavis 
zimbraServiceInstalled: antivirus 
zimbraServiceInstalled: antispam 
zimbraServiceInstalled: archiving 

[zimbra@ldap2 ~]$ zmprov ms `zmhostname` +zimbraServiceInstalled archiving +zimbraServiceEnabled archiving 

[zimbra@ldap2 ~]$ zmprov ms `zmhostname` -zimbraServiceEnabled antispam -zimbraServiceEnabled antivirus 

[zimbra@ldap2 ~]$ zmprov gs `zmhostname` | grep Service | egrep 'amavis|antivirus|antispam|archiving' 
zimbraServiceEnabled: amavis 
zimbraServiceEnabled: archiving 
zimbraServiceInstalled: amavis 
zimbraServiceInstalled: antivirus 
zimbraServiceInstalled: antispam 
zimbraServiceInstalled: archiving 


!! Note - zmmtactl restart didn't cause the amavisd.conf file to change, hence why I then went with zmcontrol restart. 

[zimbra@ldap2 ~]$ zmcontrol restart 

[zimbra@ldap2 ~]$ grep archive_quar /opt/zimbra/conf/amavisd.conf 
archive_quarantine_method => undef, # Don't run archiving a second time 
$archive_quarantine_method = 'smtp:[127.0.0.1]:10025'; 
$archive_quarantine_to = undef; 


[zimbra@ldap2 ~]$ zmprov cc archive 
71f9d7f4-54cc-4bf3-a6e1-94a1fc38a129 

[zimbra@ldap2 ~]$ zmarchiveconfig enable user1@`zmhostname` archive-cos archive 

[zimbra@ldap2 ~]$ vi /tmp/email.txt 

[zimbra@ldap2 attrs]$ cat /tmp/email.txt
To: user1@ldap2.zimbra.DOMAIN.com
Subject: Test For Archive - CLI
From: admin@ldap2.zimbra.DOMAIN.com
test

[zimbra@ldap2 ~]$ /opt/zimbra/postfix/sbin/sendmail -t < /tmp/email.txt 

[zimbra@ldap2 ~]$ grep archive /var/log/zimbra.log 

Jan 15 16:09:43 ldap2 amavis[29283]: (29283-01) h9nw0WdCl1Tw(h9nw0WdCl1Tw) SEND from <> -> <user1-20150115@ldap2.zimbra.DOMAIN.com.archive>,
ENVID=AM.h9nw0WdCl1Tw.20150115T210943Z@ldap2.zimbra.DOMAIN.com BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued 
as 2DE506445C 
Jan 15 16:09:43 ldap2 amavis[29283]: (29283-01) Passed CLEAN {RelayedInbound,Archived}, <zimbra@ldap2.zimbra.DOMAIN.com> -> 
<user1@ldap2.zimbra.DOMAIN.com>, quarantine: user1-20150115@ldap2.zimbra.DOMAIN.com.archive, Message-ID: 
<20150115210943.087106438E@ldap2.zimbra.DOMAIN.com>, mail_id: h9nw0WdCl1Tw, Hits: -, size: 351, queued_as: 3049C64466, 138 ms 
Jan 15 16:09:45 ldap2 postfix/lmtp[3478]: 2DE506445C: to=<user1-20150115@ldap2.zimbra.DOMAIN.com.archive>, 
relay=ldap2.zimbra.homeunix.com[192.168.1.172]:7025, delay=2.2, delays=0/0.02/0.17/2, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)

When Was A ZCS Service Enabled Or Disabled

Note - single ZCS server deployment example. Have to double check on multi-server deployment if the command needs to be tweaked.

Check Current Status Of Services Enabled-Disable and Installed-NotInstalled

Example is done on the host in question:

zmprov -l gs `zmhostname` | egrep 'zimbraServiceEnabled|zimbraServiceInstall'

The -l is used in case mailboxd is the service in question, -l makes the call to ldap to check the configuration of the server.

Check Backups And What LDAP Has Stored

Do the following, adjust the backup path if your not using the default path:

 for i in `find /opt/zimbra/backup/sessions/ -name ldap.bak.gz -print`;  \
 do echo $i; zgrep zimbraServiceEnabled $i; done

Will show you something like :

zimbraServiceEnabled: antivirus
zimbraServiceEnabled: antispam
zimbraServiceEnabled: opendkim
zimbraServiceEnabled: logger
zimbraServiceEnabled: mailbox
zimbraServiceEnabled: mta
zimbraServiceEnabled: convertd
zimbraServiceEnabled: stats
zimbraServiceEnabled: snmp
zimbraServiceEnabled: ldap
zimbraServiceEnabled: spell
zimbraServiceEnabled: archiving
Check The History Of The Service Status In zimbra-stats.log

In /var/log/ you'll see zimbra-stats.log and archives of that file, for example - zimbra-stats.log-20140714 . Here's an example of a zgrep for the archive service:

[zimbra@zcs807 log]$ zgrep archiv zimbra-stats* | tail
zimbra-stats.log:Jul 22 08:24:08 zcs807 zimbramon[27645]: 27645:info: 2014-07-22 08:24:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log:Jul 22 08:26:09 zcs807 zimbramon[28689]: 28689:info: 2014-07-22 08:26:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:40:19 zcs807 zimbramon[21519]: 21519:info: 2014-07-15 14:40:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Stopped
zimbra-stats.log-20140714:Jul 15 14:42:06 zcs807 zimbramon[24998]: 24998:info: 2014-07-15 14:42:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Stopped
zimbra-stats.log-20140714:Jul 15 14:44:09 zcs807 zimbramon[29250]: 29250:info: 2014-07-15 14:44:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:46:08 zcs807 zimbramon[32188]: 32188:info: 2014-07-15 14:46:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:48:26 zcs807 zimbramon[3174]: 3174:info: 2014-07-15 14:48:07, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:50:15 zcs807 zimbramon[6466]: 6466:info: 2014-07-15 14:50:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:52:10 zcs807 zimbramon[10260]: 10260:info: 2014-07-15 14:52:02, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
zimbra-stats.log-20140714:Jul 15 14:54:10 zcs807 zimbramon[19004]: 19004:info: 2014-07-15 14:54:01, 
 STATUS: zcs807.us.zimbralab.com: archiving: Running
Check The Logger/RRD Data And Service History Uptime

Let's pull the stats from the logger database going back to Jan 1st of this year. Here's an example on how to do that and what to expect. Please send me a copy of the output also. Notice in the example below the lines that have ",," for column 9 - which is for archiving. This is how I can tell when the service was first enabled and running. Ref for timestamp: http://www.epochconverter.com/

Note: The columns are identified by:

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,
  convertd,stats,antispam,mta

Please adjust the commands below to suit your needs. I use `zmhostname` below in the command rather than typing out the localhosts hostname. Also, see https://www.gnu.org/software/coreutils/manual/html_node/Examples-of-date.html for examples on the --date string.


For this example, I'm looking to see when the "archiving" service was running 100%. Archiving is the 9th column - '$9 == 1' and the 1 means it was available 100% for the time period. I searched a year's worth of data by using this part below in the examples : "-s `date +%s --date="12 month ago"` -e `date +%s --date="1 minute ago"`"

 /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h `zmhostname` -s `date +%s \
 --date="12 month ago"` -e `date +%s --date="1 minute ago"` | awk -F, '$9 == 1'

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,
  convertd,stats,antispam,mta
 [cut]
1405454400,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405458000,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405461600,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405465200,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405468800,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405472400,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405476000,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405479600,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
 [cut]

For this example, I'm looking to see when the "archiving" service was NOT enabled or running at all. Archiving is the 9th column - '$9 == ""' and the absence of a number value means it was UNAVAILABLE 100% for the time period.

 /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h `zmhostname` -s `date +%s \
 --date="12 month ago"` -e `date +%s --date="1 minute ago"` | awk -F, '$9 == ""' | head

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,
  convertd,stats,antispam,mta
 [cut]
1388538000,,,,,,,,,,,,,,,
1388541600,,,,,,,,,,,,,,,
1388545200,,,,,,,,,,,,,,,
1388548800,,,,,,,,,,,,,,,
1388552400,,,,,,,,,,,,,,,
1388556000,,,,,,,,,,,,,,,
1388559600,,,,,,,,,,,,,,,
1388563200,,,,,,,,,,,,,,,
1388566800,,,,,,,,,,,,,,,
1388570400,,,,,,,,,,,,,,,
 [cut]

For this example, I'm looking to see when the "zmconfigd" service was NOT 100% available during the time period BUT was greater than 0% of the time. Zmconfigd is the 3rd column - '$3 ~ 0' and by using ~ [NOT] 0 , I can see when it was greater than 0 [100% UNAVAILABLE] but not 1 [100% available].

 /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h `zmhostname` -s `date +%s \
 --date="12 month ago"` -e `date +%s --date="1 minute ago"` | awk -F, '$3 ~ 0'

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,
  convertd,stats,antispam,mta
1400670000,0.926591142901235,0.882009858611111,0.962549540740741,0.962548086419753,0.926603197839506,
  1,,,0.964051042283951,1,0.962549647839506,0.962515237345679,0.292491091358025,,0.926590777777778
1400756400,1,0.968276889722222,1,1,1,1,,,1,1,1,1,1,,1
1401678000,0.9323037375,0.937399301388889,1,0.964109132777778,0.932308961111111,1,,,0.932305973888889,
  1,0.964109800277778,1,0.932309575,,0.932302677222222
1401692400,0.999979394166667,0.9999799825,1,0.9999993925,0.999979395277778,1,,,0.999979393333333,1,
  0.9999993975,1,0.999979395555556,,0.999979393333333
1401966000,1,0.964610447777778,1,1,1,1,,,1,1,1,1,1,,1
1402052400,0.999603703008394,0.999722196864111,0.999615163422937,0.999602498779275,0.999597924831049,
 0.999619443248889,,,0.99959995491499,0.999626231525528,0.99961180945684,0.999632334525742,
 0.999591523017581,,0.999607517027221
1402765200,1,0.966623691358025,1,1,0.966623606481481,1,1,,0.966623565432099,1,1,1,0.966623647530864,
 1,0.966623437345679
1402768800,0.999471892261905,0.999587652037617,0.999491736309524,0.999464918452381,0.999464358928571,
 0.999495648214286,0.999508635119048,,0.999464445238095,0.999496001785714,0.999483839285714,
 0.999503813095238,0.999461091071429,0.99951724702381,0.999478128571429
1402776000,0.9999910775,0.999972398888889,0.999993851388889,0.999991085555555,0.999972394722222,
 0.999991074166667,0.999991234166667,,0.999972394722222,0.999995651111111,0.999991075833333,
 0.999991235277778,0.999972394722222,0.999991233333333,0.999972392777778
1403175600,0.999841834656085,0.999841587301587,0.999841991402116,0.999841788690476,0.999841692791005,
 0.999842046957672,0.999842196097884,,0.999841743386243,0.999842097222222,0.999841937830688,
 0.99984214484127,0.999841638227513,0.999842260251323,0.999841883267196
1405076400,1,0.964354991388889,1,1,1,1,1,,1,1,1,1,1,1,1
1405080000,1,0.946143796944445,1,1,1,1,1,,1,1,1,1,1,1,1
1405105200,1,0.987032061666667,1,1,1,1,1,,1,1,1,1,1,1,1
1405116000,1,0.982143184166667,1,1,1,1,1,,1,1,1,1,1,1,1
1405130400,1,0.967078515555556,1,1,1,1,1,,1,1,1,1,1,1,1
1405141200,1,0.920520648333333,1,1,1,1,1,,1,1,1,1,1,1,1
1405144800,1,0.9539186725,1,1,1,1,1,,1,1,1,1,1,1,1
1405148400,1,0.981826185277778,1,1,1,1,1,,1,1,1,1,1,1,1
1405162800,1,0.996330343333333,1,1,1,1,1,,1,1,1,1,1,1,1

An example of a zmcontrol restart

 /opt/zimbra/libexec/zmrrdfetch -f zmstatuslog -h `zmhostname` -s `date +%s \
 --date="15 minute ago"` -e `date +%s --date="1 minute ago"`

timestamp,opendkim,zmconfigd,mailbox,proxy,spell,logger,antivirus,archiving,snmp,ldap,memcached,
  convertd,stats,antispam,mta
1405621920,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405621950,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405621980,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622010,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622040,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622070,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,
  1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622100,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,
  1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622130,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,
  1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622160,0.105026416666667,0.1050323,1,1,0.105029991666667,1,0.105016,0.105017466666667,0.105028733333333,
  1,1,1,0.10503115,0.105014483333333,0.105025008333333
1405622190,,0,,,,,,,,,,,,,
1405622220,,0,,,,,,,,,,,,,
1405622250,,0,,,,,,,,,,,,,
1405622280,,0,,,,,,,,,,,,,
1405622310,,0,,,,,,,,,,,,,
1405622340,,0.893621444444444,,,,,,,,,,,,,
1405622370,,0.893621444444444,,,,,,,,,,,,,
1405622400,,0.893621444444444,,,,,,,,,,,,,
1405622430,,1,,,,,,,,,,,,,
1405622460,,1,,,,,,,,,,,,,
1405622490,,1,,,,,,,,,,,,,
1405622520,,1,,,,,,,,,,,,,
1405622550,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
1405622580,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
Check The audit.log File For Service Enable Changes

There is the /opt/zimbra/log/audit.log file that will note a change in a service - for example [ use: zgrep zimbraService /opt/zimbra/log/audit* ]:

audit.log:2014-07-21 12:15:44,745 INFO 
 [qtp1097575009-2632:https://127.0.0.1:7071/service/admin/soap/ModifyServerRequest]
 [name=zimbra;ip=127.0.0.1;ua=zmprov/8.0.7_GA_6029;] security - cmd=ModifyServer; 
  name=zcs807.us.DOMAIN.com; -zimbraServiceEnabled=archiving;
audit.log:2014-07-21 12:16:51,609 INFO 
 [qtp1097575009-2640:https://127.0.0.1:7071/service/admin/soap/ModifyServerRequest]
 [name=zimbra;ip=127.0.0.1;ua=zmprov/8.0.7_GA_6029;] security - cmd=ModifyServer; 
  name=zcs807.us.DOMAIN.com; +zimbraServiceEnabled=archiving;
Check The zmsetup logs For Changes During Installation/Re-installs

In regards to the /opt/zimbra/log/zmsetup.* log files, here's an example from a test machine :

[Someone rerunning the installer/zmsetup, archiving was enabled - greping' for archiv below]

zmsetup.07152014-150104.txt:Tue Jul 15 14:51:43 2014 enabled packages zimbra-logger zimbra-store 
  zimbra-mta zimbra-convertd zimbra-core zimbra-apache zimbra-archiving zimbra-proxy zimbra-snmp 
  zimbra-ldap zimbra-spell
zmsetup.07152014-150104.txt:Tue Jul 15 14:52:02 2014 archiving is enabled
zmsetup.07152014-150104.txt:Tue Jul 15 14:52:29 2014 checking isEnabled zimbra-archiving
zmsetup.07152014-150104.txt:Tue Jul 15 14:52:29 2014 zimbra-archiving is enabled
zmsetup.07152014-150104.txt:Tue Jul 15 14:54:43 2014 Updating cached config attribute for Server 
  zcs807.us.DOMAIN.com: zimbraServiceInstalled=archiving
zmsetup.07152014-150104.txt:Tue Jul 15 14:54:43 2014 *** Running as zimbra user: /opt/zimbra/bin/zmprov 
  -r -m -l ms zcs807.us.DOMAIN.com zimbraServiceInstalled 'antivirus' zimbraServiceInstalled 'antispam'
  zimbraServiceInstalled 'opendkim' zimbraServiceInstalled 'archiving' zimbraServiceInstalled 'logger' 
  zimbraServiceInstalled 'mailbox' zimbraServiceInstalled 'mta' zimbraServiceInstalled 'convertd' 
  zimbraServiceInstalled 'stats' zimbraServiceInstalled 'proxy' zimbraServiceInstalled 'snmp' 
  zimbraServiceInstalled 'ldap' zimbraServiceInstalled 'spell'
zmsetup.07152014-150104.txt:Tue Jul 15 14:54:46 2014 Updating cached config attribute for Server 
  zcs807.us.DOMAIN.com: zimbraServiceEnabled=archiving
zmsetup.07152014-150104.txt:Tue Jul 15 14:54:46 2014 *** Running as zimbra user: 
  /opt/zimbra/bin/zmprov -r -m -l ms zcs807.us.DOMAIN.com zimbraServiceEnabled 'antivirus' 
  zimbraServiceEnabled 'archiving' zimbraServiceEnabled 'antispam' zimbraServiceEnabled 'opendkim' 
  zimbraServiceEnabled 'logger' zimbraServiceEnabled 'mailbox' zimbraServiceEnabled 'mta' 
  zimbraServiceEnabled 'convertd' zimbraServiceEnabled 'stats' zimbraServiceEnabled 'proxy' 
  zimbraServiceEnabled 'snmp' zimbraServiceEnabled 'ldap' zimbraServiceEnabled 'spell'
zmsetup.07152014-150104.txt:Tue Jul 15 14:55:30 2014 *** Running as zimbra user: /opt/zimbra/bin/zmprov 
  -r -m -l mcf +zimbraComponentAvailable archiving
zmsetup.07152014-150104.txt: Stopping archiving...Done.
zmsetup.07152014-150104.txt: Starting archiving...Done.
zmsetup.07152014-150104.txt:Tue Jul 15 15:00:06 2014 com_zimbra_archive...
zmsetup.07152014-150104.txt:Tue Jul 15 15:00:06 2014 *** Running as zimbra user: 
  /opt/zimbra/bin/zmzimletctl -l deploy zimlets-network/com_zimbra_archive.zip
zmsetup.07152014-150104.txt:[] INFO: Deploying Zimlet com_zimbra_archive in LDAP.
zmsetup.07152014-150104.txt:[] INFO: Installing Zimlet com_zimbra_archive on this host.
zmsetup.07152014-150104.txt:[] INFO: Upgrading Zimlet com_zimbra_archive to 7.1.0
zmsetup.07152014-150104.txt:[] INFO: Enabling Zimlet com_zimbra_archive

Showing the ldap backup data in regards to the archiving service being disabled and then enabled after the 07/15 setup :

$ zgrep "zimbraServiceEnabled:" full-20140716.070025.112/ldap/* incr-20140714.070016.382/ldap/*

  :from the day after the re-install:
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: opendkim
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: archiving <<
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: logger
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: mailbox
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: mta
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: convertd
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: stats
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: proxy
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: snmp
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: ldap
full-20140716.070025.112/ldap/ldap.bak.gz:zimbraServiceEnabled: spell

  :from the day before the re-install:
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: logger
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: mailbox
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: mta
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: convertd
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: stats
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: snmp
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: ldap
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: spell
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: proxy
incr-20140714.070016.382/ldap/ldap.bak.gz:zimbraServiceEnabled: opendkim
Check The Zimbra Users BASH History File and .zmprov_history

You could check your .bash_history file to see if the command is still referenced there - if it goes back long enough for your purposes. I think the default lines the history file will remember is 500.

[zimbra@zcs807 ~]$ zmprov ms `zmhostname` -zimbraServiceEnabled archiving 
[zimbra@zcs807 ~]$ zmcontrol status | grep -i arch 
[zimbra@zcs807 ~]$ zmprov gs `zmhostname` | grep Enabled | grep archiving 
[zimbra@zcs807 ~]$ zmprov ms `zmhostname` +zimbraServiceEnabled archiving 
[zimbra@zcs807 ~]$ zmcontrol status | grep -i arch 
archiving Running 
[zimbra@zcs807 ~]$ zmprov gs `zmhostname` | grep Enabled | grep archiving 
zimbraServiceEnabled: archiving 

[zimbra@zcs807 ~]$ grep archiving .bash_history 
zmprov ms `zmhostname` +zimbraServiceInstalled archiving +zimbraServiceEnabled archiving 
zmprov ms `zmhostname` -zimbraServiceEnabled archiving 
zmprov gs `zmhostname` | grep Enabled | grep archiving 
zmprov ms `zmhostname` +zimbraServiceEnabled archiving 
zmprov gs `zmhostname` | grep Enabled | grep archiving 
grep archiving .bash_history 

Note, there is also a /opt/zimbra/.zmprov_history you can also review

Getting Duplicate Emails In The Archive Account

Please see the following:

Archiving Issues When Using 3rd Party MTA's

Please see the following:

Pre-Deployment Type Questions

How To Add OLD Data Or Retroactively Add Data To A&D Account

You'll want to have A&D all setup and then you can use imapsync to 'sync' the old data from the one account into the A&D account.

Recommendations:

  • Confirm imap is enabled on the mailstores
  • Setup a sub-folder in A&D account to hold data that existed prior to the A&D account being in use.
  • Test the various imapsync flags you'll want to use first before running against all your accounts.

See also:

Can we set the archive settings for only sent mail?

Question: Can we set the archive settings for only sent mail?

Answer: No, archiving is done for any message that passes through the MTA for an account that has archiving enabled. You can setup separate MTA's for in/out bound delivery and enable archiving for only the inbound servers to achieve this goal.

Can we set the archive settings for only form port 25?

Question: Can we set the archive settings for only form port 25?

Answer: No, there are no per port level configurations. You can configure which accounts have archiving enabled and you can enable/disable the service on a per server level.

If Zimbra implemented an archive feature, is something in the following MTA files changes?

Question: If Zimbra implemented an archive feature, is something in the following MTA files changed? [ zmmta.cf , main.cf , main.cf.default , master.cf.in , master.cf ]

Answer: Nothing is specifically changed in the files you listed but settings in zmmta.cf determine how the postfix content filter is configured when archiving is enabled. Archiving functionality is handled by the amavis process on the Zimbra MTA.

Using One Archive Account For Multiple Accounts

You could also include other variable's here if they are needed, ex. - archive-cos COS_NAME

zmarchiveconfig enable user1@domainname archive-address user-archives@domainname.archive
zmarchiveconfig enable user2@domainname archive-address user-archives@domainname.archive archive-create FALSE
zmarchiveconfig enable user3@domainname archive-address user-archives@domainname.archive archive-create FALSE

You'll see the mapping in the primary email account settings that state what archive account is being used:

zmprov ga user1@example.com zimbraArchiveAccount
 zimbraArchiveAccount: user-archives@domainname.archive
zmprov ga user2@example.com zimbraArchiveAccount
 zimbraArchiveAccount: user-archives@domainname.archive
zmprov ga user3@example.com zimbraArchiveAccount
 zimbraArchiveAccount: user-archives@domainname.archive


External Host For Archive Accounts Setup

I installed 5.0.11 on a test box, selecting the archiving package during the installation.

The main domain was "zimbra.INTERNAL.com" and the servername is mail3.zimbra.INTERNAL.com .

'Note, I did have an external MTA relay server setup for zimbra. I was doing this test from home.

Once it was done, I then created a test account - ajcody@zimbra.INTERNAL.com

I then ran this from the CLI [on a multi-server environment, this is ran on the mta server]:

zmprov ms mail3.zimbra.INTERNAL.com +zimbraServiceInstalled archiving  +zimbraServiceEnabled archiving

I confirm that I can send emails to the external account that I will be using with the zimbra admin account:

  • Logged into zimbra admin web console , accounts > admin > View Mail
    • Composed new message for ajcody@EXTERNAL-DOMAIN.com

I confirmed the external account received the email and did a reply back. Again, confirming now that the admin account gets the email as well from the external account.

Created the archive account to be used:

zmarchiveconfig enable ajcody@zimbra.INTERNAL.com archive-address ajcody@EXTERNAL-DOMAIN.com archive-create false

I then stopped/started zimbra.

zmcontrol stop
zmcontrol start

Confirmed that amavis (antispam & antivirus) and archive show up as running process:

[zimbra@mail3 ~]$ zmcontrol status
Host mail3.zimbra.INTERNAL.com
	antispam                Running
	antivirus               Running
	archiving               Running
	ldap                    Running
	logger                  Running
	mailbox                 Running
	mta                     Running
	snmp                    Running
	spell                   Running
	stats                   Running

Checked my zimbra account to confirm the archive variables:

[zimbra@mail3 ~]$ zmprov ga ajcody@`hostname -d` | egrep -i archive  
amavisArchiveQuarantineTo: ajcody@EXTERNAL-DOMAIN.com
zimbraArchiveAccount: ajcody@EXTERNAL-DOMAIN.com
zimbraArchiveAccountDateTemplate: yyyyMMdd
zimbraArchiveAccountNameTemplate: ${USER}-${DATE}@${DOMAIN}.archive

Tests I then performed:

  • I sent an email from the zimbra admin account to the ajcody@zimbra.INTERNAL.com account. Confirmed that the external account [ajcody@EXTERNAL-DOMAIN.com] received a copy.
  • I sent an email to ajcody@zimbra.INTERNAL.com from my ajcody@BUSINESS.com account and confirmed a copy went to ajcody@EXTERNAL-DOMAIN.com .
  • I sent an email from ajcody@zimbra.INTERNAL.com to the zimbra admin account, again confirming a copy went to ajcody@EXTERNAL-DOMAIN.com .

What didn't work as expected:

  • Messages to/from the two accounts don't create copies. If ajcody@zimbra.INTERNAL.com sends to ajcody@EXTERNAL-DOMAIN.com a "copy" will not be generated and vis-versa .
  • The subject lines weren't altered as stated in the official A&D document.
    • p3 , "When a message is received to a mailbox with archiving enabled, a copy of the message is sent to the archive mailbox with the text “to be archived” added to the subject line."

I've sent off a request about these two items to the developers to get their feedback on them.

Multi-Server & New Mailstore A&D Setup

I also created a RFE for documentation on this.

http://bugzilla.zimbra.com/show_bug.cgi?id=25135

The following is a very rough draft document I made for multi-server / new mailstore A&D setups.

Ajcody Multi-Server & New Mailstore A&D Setup Homepage

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual Multi-Server & New Mailstore A&D Setup Homepage

Please see Ajcody-Notes-Archive-Discovery-Mailstore-Setup

Issues That Have Caused Confusion

What Gets Installed Where?
RFE To Clear Up The Confusion
zimbra-archive package/rpm - Mailstores

zimbra-archive (the package/rpm you see from the installer) should be installed on all mailstores which you want to use for cross mailbox search. This also sets the zimbraComponentAvailable archiving config attribute which allows the mta(s) to turn on archiving. zimbra-archive is not installed directly on the mta, it's just enabled.

Note, you install zimbra-archive on a mailbox server but the service runs on the mta node.

MTA's - Require Configuration

If you add zimbra-archiving to an existing install you need to :

  • Install zimbra-archiving on one or more of your mailbox servers
  • Then set zimbraServiceInstalled archiving and zimbraServiceEnabled archiving on all the mta servers
  • Restart the mta services

For example:

zmprov ms mta.example.com +zimbraServiceInstalled archiving +zimbraServiceEnabled archiving

On the mta server:

zmmtactl restart

To confirm the /opt/zimbra/conf/amavisd.conf was modified correctly, you should see on the mta:

#$archive_quarantine_method = 'smtp:[127.0.0.1]:10025'; 

Was uncommented out:

$archive_quarantine_method = 'smtp:[127.0.0.1]:10025';

You'll be able to then notice in the /var/log/zimbra.log file if the redirect to the A&D account is happening [once A&D accounts are setup that is]. Example uses example.com.archive as the archive domain I setup for the A&D accounts :

grep "example.com.archive" /var/log/zimbra.log
 Dec 11 13:38:52 mta-server amavis[1978]: (01978-19) SEND via SMTP: <> -> 
    <user-20081211@example.com.archive>,ENVID=AM.8ISxcrQG8uAj.20081211T193852Z@mailstore.example.com 
    BODY=7BIT 250 2.6.0 Ok, id=01978-19, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 
    5ADF8F120C4
 Dec 11 13:38:52 mta-server postfix/lmtp[21864]: 5ADF8F120C4: 
    to=<user-20081211@example.com.archive>, relay=archive.example.com[X.X.X.93]:7025, 
    delay=0.07, delays=0/0/0/0.06, dsn=2.1.5, status=sent (250 2.1.5 OK)
Enabling Amavis And Archiving With 8.5+ While Antispam And AntiVirus Are Disabled

With 808 and 8.5 , archiving should be able to run without as/av being enabled.

For example, disabling antispam and antivirus but enabling amavis [required] and archiving on a mta server [note - this server had the full mta package already installed on it and had antivirus, antispam, [amavis], and postfix running on it] :

[zimbra@850-mta1 ~]$ zmcontrol status | egrep 'amavis|antispam|antivirus|archiving'
	amavis                  Running
	antispam                Running
	antivirus               Running

## NOTE , the below command will disable antispam & anitvirus for this "test". ##

[zimbra@850-mta1 ~]$ zmprov ms `zmhostname` +zimbraServiceEnabled archiving \
 +zimbraServiceEnabled amavis -zimbraServiceEnabled antispam -zimbraServiceEnabled antivirus

[zimbra@850-mta1 ~]$ zmcontrol restart                
Host 850-ldap1.zimbra.homeunix.com
	Stopping vmware-ha...Done.
[cut]
	Stopping ldap...Done.
Host 850-ldap1.zimbra.homeunix.com
	Starting ldap...Done.
	Starting zmconfigd...Done.
	Starting dnscache...Done.
	Starting logger...Done.
	Starting convertd...Done.
	Starting mailbox...Done.
	Starting memcached...Done.
	Starting proxy...Done.
	Starting amavis...Done.
	Starting opendkim...Done.
	Starting archiving...Done.
	Starting snmp...Done.
	Starting spell...Done.
	Starting mta...Done.
	Starting stats...Done.
	Starting service webapp...Done.
	Starting zimbra webapp...Done.
	Starting zimbraAdmin webapp...Done.
	Starting zimlet webapp...Done.
[zimbra@850-ldap1 ~]$ zmcontrol status | egrep 'amavis|antispam|antivirus|archiving'
	amavis                  Running
	archiving               Running
zimbra_xmbxsearch zimlet

For 5.x installs, this zimbra_xmbsearch zimlet will get configured on each mailstore that you install the zimbra-archive package on. The documentation in various places might cause confusion on this matter, because for the 4.x releases it was a separate step.

You should find the zimlet already located at /opt/zimbra/zimlets-network/zimbra_xmbxsearch.zip

After the installation, you should see when you go to the admin web console on the mailstore you install the zimbra-archive package on that the cross-mailbox search zimlet is there. It shows up in two locations:

  • Left Pane : Configuration > Admin Extensions > zimbra_xmbxsearch
  • Left Pane : Tools > Search Mail

If you wanted this zimlet to also be available on a server that didn't have the zimbra-archiving packaged installed you could then deploy it on that server.

cd /opt/zimbra/zimlets-network/
zmzimletctl deploy zimbra_xmbxsearch.zip
## ls the directory and confirm the full name - you might need this:
zmzimletctl deploy com_zimbra_xmbxsearch.zip

The How-To

Reference Documents

http://www.zimbra.com/docs/ne/latest/multi_server_install/multi-server_install.5.1.html

http://www.zimbra.com/docs/ne/latest/administration_guide/Archiving.16.1.html

Assumptions

This install how-to assumes you have an existing LDAP/Mailstore/MTA server(s) for your normal production environment, the Zimbra license and logger are installed on the primary ZCS server(s), and that you are NOT running the proxy module.

Example archive mailstore hostname is : archive.example.com

Example primary ZCS hostname is : mail.example.com

Preliminary Items

Things to do or check before install:

  • DNS entry for new mailstore and primary ZCS server(s) can resolve to it.
  • DNS configured properly on mailstore server.
  • Master Root LDAP Server mail.example.com
  • Master Root LDAP Password
    • On LDAP server do : su – zimbra ; zmlocalconfig –s | grep ldap_root_password
  • Master LDAP port – default is 389
  • SMTP Server
Installation Of New Mailstore That Will Have A&D
Install Modules
  • Type y to install the zimbra-store, zimbra-archiving and zimbra-spell (optional) packages.
    • Do Not Install MTA! These Instructions Do Not Take That Into Account.
    • When zimbra-spell is installed the zimbra-apache package is also installed.
  • Installing: zimbra-core zimbra-store zimbra-apache zimbra-spell
Modify Configuration

Press Enter to modify the system. The selected packages are installed on the server.

At this point the Main menu displays the default entries for the Zimbra component you are installing.

To expand the menu to see the configuration values type x and press Enter.

To navigate the Main menu, select the menu item to change. You can modify any of the defaults.

  • Common Configuration
    • LDAP
      • Ldap master host: [set this to the FQDN of your LDAP server]
      • Ldap port: 389 [set this if your LDAP server isn’t using default]
      • Ldap Admin password: [this is your LDAP servers Root LDAP password]
        • On LDAP server do : su – zimbra ; zmlocalconfig –s ldap_root_password
      • TimeZone: [set this]
  • For zimbra-store
    • Set the Admin Password
      • +License filename: UNSET [if you see this, then something is wrong with your
    • LDAP configuration. It should of pulled the license info from the LDAP server.
    • Set the SMTP host

Type r to return to the Main menu, if you aren’t there already.

When the mailbox server is configured, return to the Main menu and type a to apply the configuration changes.

Press Enter to save the configuration data.

When Save Configuration data to a file appears, press Enter.

The next request is where to save the files. To accept the default, press Enter.

To save the files to another directory, enter the directory and then press Enter.

When “The system will be modified - continue?” appears type y and press Enter.

The server is modified.

Installing all the components and configuring the server can take a few minutes.

When Installation complete - press return to exit displays, press Enter.

The installation of the mailbox server is complete.

After Install

Confirm server status

su – zimbra ; zmcontrol status

Populate the ssh keys, on each server in your environment

su - zimbra ;  zmupdateauthkeys 

The key is updated on /opt/zimbra/.ssh/authorized_keys.

Upgrading A Zimbra Server For An Archive & Discovery Mailstore
Adding Package For A&D

This will retain your current settings for the system. Your server will experience downtime during the upgrade.

untar zcs*.tar that matches your existing system

 cd zcs-version-directory
 ./install
  choose upgrade
  select zimbra-archiving

The upgrade of the mailbox server is complete.

After Upgrade

Confirm server status

su – zimbra ; zmcontrol status

Note, zimbra-archiving only runs as a service on a MTA server.

Populate the ssh keys, on each server in your environment

su-zimbra ;  zmupdateauthkeys 

The key is updated on /opt/zimbra/.ssh/authorized_keys.

Configure Zimbra For Use Of The New Mailstore and A&D

Example A&D mailstore hostname is : archive.example.com

  • Go to your primary admin console url. [https://[example.com]:7071/zimbraAdmin]
  1. Confirm you see the new mailstore under Configuration > Servers
    1. Under Configuration > Servers > [MTA servername(s)] > Services
      1. [each MTA server needs this]
      2. You’ll see a box for Archiving and Discovery
        1. Check this to enable the MTA server(s) for Archiving and Discovery. If this is grayed out, run the command below (modified for your server) on your one of your mailstores.
          • This effectively does:
          • zmprov ms mta.example.com +zimbraServiceInstalled archiving  +zimbraServiceEnabled archiving
            • Remember, zmprov uses the variable below. A mta only server can't be set for localhost, change it to point to a mailstore.
            •  [root@mta ~]# zmlocalconfig | grep zmprov
            •     zimbra_zmprov_default_soap_server = localhost
            •  [root@mta ~]# zmlocalconfig -e zimbra_zmprov_default_soap_server=mailstore.example.com
Configuring Your COS's - Normal COS's and Archiving COS

It's recommended that the archive accounts be created on a dedicated mailstore. You can limit what mailstores are used for new account creation by restricting what mailstores are used under "Server Pool" within a COS. Your normal COS's should excluded your archive mailstores and your archive COS should only have archive mailstores selected.

You'll also want to make sure your archive COS isn't using any 'features' that aren't necessary for archive accounts. No point in consuming certain license features when they aren't needed.

  1. Go to Configuration > Class of Service > default [or your primary domain] > Server Pool
    1. You’ll want to make sure it’s limited to the correct server pools
      1. Your new mailstore for A&D should be unchecked.
    2. Click on New for a new Class of Server (COS)
      1. Call it archive or something similar
        1. Under Server Pool > Limit > have only the new mailstore checked
    3. Make sure your not using licensed features [EWS for example] that aren't necessary for your archive accounts.
Setup Initial A&D With First Account - Creation Of The Archive Domain
Revisit To COS - Naming Scheme Of Archive Accounts

When archive accounts are created they use the zimbraArchiveAccountNameTemplate variable from the COS. The default is:

$ zmprov gc default | grep -i archive
  zimbraArchiveAccountDateTemplate: yyyyMMdd
  zimbraArchiveAccountNameTemplate: ${USER}-${DATE}@${DOMAIN}.archive

I, personally, don't like the use of the $DATE variable in this. I change my ARCHIVE COS to use the normal username but retain the .archive for the domain.

zmprov mc archive zimbraArchiveAccountNameTemplate '${USER}@${DOMAIN}.archive'

Bug to be aware of:

The Creation

On server with zmarchiveconfig (most likely mailstore you installed A&D on) and as zimbra (su – zimbra) do the following to setup your first A&D account.

format : zmarchiveconfig –s servername enable user@example.com archive-cos <cos>

example :

zmarchiveconfig –s archive.example.com enable account@example.com archive-cos archive

NOTE

If the above command doesn't seem to create the archive account/domain. Drop the use of [ -s servername ]. Basically, just run this on the A&D mailstore:
zmarchiveconfig enable account@example.com archive-cos archive

The above command will create the mail domain for the archive accounts using the template defaults, user@example.com to make example.com.archive

On your main ldap server or where ever you usually access the zimbra admin web console, login to the admin web console.

  1. Confirm the archive domain was setup.
    1. Configuration > Domains > [domainname].archive > General
    2. Confirm or adjust the archive domain to use the right COS
      1. Configuration > Domains > [domainname].archive > General Information
        1. Change “Default Class of Service” to your COS [archive], if needed for your configuration.
  2. Now check for the new archive account you made
    1. Address > Accounts
    2. Click on account and hit the edit button
    3. In the top summary section you'll be able to confirm the COS and Mail Server being used for the account.
      1. NOTE, if it's showing the account is on the primary mailstore and NOT the A&D mailstore.
        1. Remove the A&D account
          •  zmprov ra [user]@[domainname].archive
        2. Add the account back again using the zmarchiveconfig command
          • zmarchiveconfig enable account@example.com archive-cos archive
        3. Now confirm, as above, that the account is using the A&D mailstore.
          • This might be a bug related to the archive domain being created for the first time.

Send the primary account a test email and then shortly afterwards do a "View Mail" within the admin console for the archive account. You should see the archive message in the archive account.

Error: unknown document: EnableArchiveRequest

If you get this error when trying to create the archive account "Error: unknown document: EnableArchiveRequest" you most likely needed to install a new license for A&D and have not restart the mailboxd services . Updating the license is not enough, you'll need to restart ZCS on the mailstores also.

See the following bug:

RFE's On Archive Accounts
Testing Of Archive Mail Flow

Send the primary account a test email and then shortly afterwards do a "View Mail" within the admin console for the archive account. You should see the archive message in the archive account.

You should confirm mail flow copies occur with the following:

  1. Inbound
    1. External Account (email) to the primary zimbra account setup for archive.
    2. A zimbra account that ISN'T the archive account in question to the primary account setup for archive.
  2. Outbound
    1. With primary account setup for archive, send an email to an external email address.
    2. With primary account setup for archive, send an email to another internal zimbra email address.
Archive Account Isn't Getting Email

Let's double check everything was done correctly up above.

Assumption on syntax of account creation:

zmarchiveconfig enable user@example.com archive-cos archive

Let's check what actually was done:

zmprov ga user@example.com | grep -i archive
 amavisArchiveQuarantineTo: user-20081211@example.com.archive
 zimbraArchiveAccount: user-20081211@example.com.archive
 zimbraArchiveAccountNameTemplate: ${USER}-${DATE}@${DOMAIN}.archive

It should reference an account that's like, if you are using the archive templates:

user-[date]@example.com.archive

that account should exist and reference lmtp, rather than smtp, for the transport:

zmprov ga user-20081211@example.com.archive | grep -i trans
  zimbraMailTransport: lmtp:archive.example.com:7025
Checking Logs For Archive Operations

On the mta-server, you should find a reference to the archive account in /var/log/zimbra.log

grep archive /var/log/zimbra.log
 Dec 11 13:38:52 mta-server amavis[1978]: (01978-19) SEND via SMTP: <> -> 
    <user-20081211@example.com.archive>,ENVID=AM.8ISxcrQG8uAj.20081211T193852Z@mailstore.example.com 
    BODY=7BIT 250 2.6.0 Ok, id=01978-19, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 
    5ADF8F120C4
 Dec 11 13:38:52 mta-server postfix/lmtp[21864]: 5ADF8F120C4: 
    to=<user-20081211@example.com.archive>, relay=archive.example.com[X.X.X.93]:7025, 
    delay=0.07, delays=0/0/0/0.06, dsn=2.1.5, status=sent (250 2.1.5 OK)

On the archive-server, you should find reference to the delivery in /opt/zimbra/log/mailbox.log

grep archive /opt/zimbra/log/mailbox.log
 2008-12-11 14:45:32,923 INFO  [LmtpServer-9] 
  [name=user-20081211@example.com.archive;mid=7;] mailop - Adding Message: id=257,
  Message-ID=<1350363939.41021229024728317.JavaMail.root@EXTERNAL-MTA.DOMAIN.com>, parentId=-1,
  folderId=2, folderName=Inbox.
Mass Accounts Configuration
Update 5/28/15, I filed the following RFE:
  • "Redesign archive account creation process [autocreate, mass creation/enabling, etc]"

https://bugzilla.zimbra.com/show_bug.cgi?id=99710

Update, our 6.0 release will have a zmarchiveconfig -f command for batch processing from a file input.

CHECK YOUR AVAILABLE LICENSES BEFORE YOU PROCEED!!

One could put all the accounts in a txt file and then use a for-loop to process the account@example.com variable.

zmprov -l gaa > /tmp/accounts.txt

Remove any accounts you've already done and those not necessary for archiving (ex. admin, ham, spam, etc.)

You can give gaa other options, look at zmprov help account. For example, you could also narrow this down to a dump of accounts in a domain:

zmprov -l gaa [DOMAIN] > /tmp/accounts.txt

Note, the below uses the above setup for A&D - You'll need to modify for your environment.

for i in `cat /tmp/accounts.txt`
do
zmarchiveconfig –s archive.example.com enable $i archive-cos archive
sleep 3
done

You can be tailing /opt/zimbra/log/mailbox.log on the archive server to watch the progress.

Searches After Configuration Is Done

Please see Ajcody-Server-Misc-Topics#Cross_Mailbox_Searches_and_Tracing

Searches Limited To 500 or 1000 Maximum Results

See Ajcody-Server-Misc-Topics#Searches_Limited_To_500_or_1000_Maximum_Results


Special Circumstance Case Scenarios

Need Primary Account Going To Two "Archive" Targets

Currently it isn't possible, I have submitted an RFE for this though:

I also submitted an RFE to clarify the difference/intention between amavisArchiveQuarantineTo and zimbraArchiveAccount

Using Legal Intercept For Secondary Target

Note - since we are setting the legal intercept against the ARCHIVE account and not the production account, we avoid what might be an issue with legal intercept's limitations. See :

Other references:

Primary Archive Account Setup
[zimbra@zcs807 ~]$ zmarchiveconfig create archive-test@zcs807.us.DOMAIN.com archive-address archive-test-manual@zcs807.us.DOMAIN.com.archive

Setup For The Legal Intercept One We'll Use - You could also use the 'normal' account creation process, but those defaults also will show up in the GAL.
[zimbra@zcs807 ~]$ zmarchiveconfig create archive-test2@zcs807.us.DOMAIN.com archive-address archive-test-manual@zcs807.us.DOMAIN.com.archive

[zimbra@zcs807 ~]$ zmprov ga archive-test@zcs807.us.DOMAIN.com | egrep -i 'archive|amavisArchiveQuarantine'      
 [cut - notes] 
confirm that amavisArchiveQuarantineTo & zimbraArchiveAccount are using only ONE of the 'archive' accounts, the primary archive account. Not the one we'll setup later to be the legal intercept target.

[zimbra@zcs807 ~]$ zmprov ma archive-test@zcs807.us.DOMAIN.com amavisArchiveQuarantineTo archive-test-manual@zcs807.us.DOMAIN.com.archive
[zimbra@zcs807 ~]$ zmprov ma archive-test@zcs807.us.DOMAIN.com zimbraArchiveAccount archive-test-manual@zcs807.us.DOMAIN.com.archive
 [note] by using just the variable name and not including a + or - in front of it, we'll set it to only be one variable if there were multiple ones set.

[zimbra@zcs807 ~]$ zmprov ga archive-test@zcs807.us.DOMAIN.com | egrep -i 'archive|amavisArchiveQuarantine'                                                       # name archive-test@zcs807.us.DOMAIN.com
amavisArchiveQuarantineTo: archive-test-manual@zcs807.us.DOMAIN.com.archive
cn: archive-test
mail: archive-test@zcs807.us.DOMAIN.com
sn: archive-test
uid: archive-test
zimbraArchiveAccount: archive-test-manual@zcs807.us.DOMAIN.com.archive
zimbraArchiveAccount: archive-test-manual2@zcs807.us.DOMAIN.com.archive
zimbraArchiveAccountDateTemplate: yyyyMMdd
zimbraArchiveAccountNameTemplate: ${USER}-${DATE}@${DOMAIN}.archive
zimbraArchiveEnabled: TRUE
zimbraMailDeliveryAddress: archive-test@zcs807.us.DOMAIN.com

Set Up your Legal Intercept Variable Now To The Production Account
[zimbra@zcs807 ~]$ zmprov ma archive-test@zcs807.us.DOMAIN.com zimbraInterceptAddress archive-test-manual2@zcs807.us.DOMAIN.com.archive

For Testing - I'm purging the Inbox on all three test accounts.
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test-manual2@zcs807.us.DOMAIN.com.archive ef /Inbox
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test-manual@zcs807.us.DOMAIN.com.archive ef /Inbox
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test@zcs807.us.DOMAIN.com ef /Inbox

Create An Email That We Can Send From The CLI
[zimbra@zcs807 ~]$ cat /tmp/email-archive.txt
To: archive-test@zcs807.us.DOMAIN.com
From: admin@zcs807.us.DOMAIN.com
Subject: Test message
test

[zimbra@zcs807 ~]$ /opt/zimbra/postfix/sbin/sendmail -t < /tmp/email-archive.txt  ; tail -f /var/log/zimbra.log | grep archive-test                                  Jul 18 11:10:27 zcs807 amavis[31986]: (31986-02) ESMTP:[127.0.0.1]:10024 /opt/zimbra/data/amavisd/tmp/amavis-20140718T105435-31986-BmFt0jbd: <zimbra@zcs807.us.DOMAIN.com> -> <archive-test@zcs807.us.DOMAIN.com> SIZE=341 Received: from zcs807.us.DOMAIN.com ([127.0.0.1]) by localhost (zcs807.us.DOMAIN.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <archive-test@zcs807.us.DOMAIN.com>; Fri, 18 Jul 2014 11:10:27 -0600 (MDT)
Jul 18 11:10:27 zcs807 amavis[31986]: (31986-02) Checking: qeJtNl1F-X9w <zimbra@zcs807.us.DOMAIN.com> -> <archive-test@zcs807.us.DOMAIN.com>
Jul 18 11:10:27 zcs807 amavis[31986]: (31986-02) SEND from <> -> <archive-test-manual@zcs807.us.DOMAIN.com.archive>,ENVID=AM.qeJtNl1F-X9w.20140718T171027Z@zcs807.us.DOMAIN.com BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as E7236E05EA
Jul 18 11:10:27 zcs807 amavis[31986]: (31986-02) FWD from <zimbra@zcs807.us.DOMAIN.com> -> <archive-test@zcs807.us.DOMAIN.com>,BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EDAEBE0B7C
Jul 18 11:10:27 zcs807 amavis[31986]: (31986-02) Passed CLEAN {RelayedInbound,Archived}, <zimbra@zcs807.us.DOMAIN.com> -> <archive-test@zcs807.us.DOMAIN.com>, quarantine: archive-test-manual@zcs807.us.DOMAIN.com.archive, Message-ID: <20140718171027.C8881E0B7B@zcs807.us.DOMAIN.com>, mail_id: qeJtNl1F-X9w, Hits: -, size: 341, queued_as: EDAEBE0B7C, 122 ms
Jul 18 11:10:27 zcs807 postfix/smtp[12085]: C8881E0B7B: to=<archive-test@zcs807.us.DOMAIN.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.22, delays=0.09/0/0/0.12, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as EDAEBE0B7C)
Jul 18 11:10:28 zcs807 postfix/lmtp[12088]: E7236E05EA: to=<archive-test-manual@zcs807.us.DOMAIN.com.archive>, relay=zcs807.us.DOMAIN.com[10.137.27.38]:7025, delay=0.15, delays=0.02/0.01/0/0.12, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)
Jul 18 11:10:28 zcs807 postfix/lmtp[12090]: EDAEBE0B7C: to=<archive-test@zcs807.us.DOMAIN.com>, relay=zcs807.us.DOMAIN.com[10.137.27.38]:7025, delay=0.21, delays=0.01/0.01/0/0.19, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)
Jul 18 11:10:28 zcs807 postfix/smtp[12093]: 1C4ADE05EA: to=<archive-test-manual2@zcs807.us.DOMAIN.com.archive>, relay=127.0.0.1[127.0.0.1]:10030, delay=0.13, delays=0.05/0.01/0.01/0.06, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 2B480E0B9F)
Jul 18 11:10:28 zcs807 postfix/smtp[12096]: 2B480E0B9F: to=<archive-test-manual2@zcs807.us.DOMAIN.com.archive>, relay=127.0.0.1[127.0.0.1]:10025, delay=0.09, delays=0.06/0.01/0/0.02, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3B6C6E05EA)
Jul 18 11:10:28 zcs807 postfix/lmtp[12088]: 3B6C6E05EA: to=<archive-test-manual2@zcs807.us.DOMAIN.com.archive>, relay=zcs807.us.DOMAIN.com[10.137.27.38]:7025, delay=0.15, delays=0.02/0/0/0.13, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)

Let's Confirm That All Three Accounts Show A New Message
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test-manual@zcs807.us.DOMAIN.com.archive gaf | grep Inbox                                                                         2  mess           1           1  /Inbox
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test-manual2@zcs807.us.DOMAIN.com.archive gaf | grep Inbox
  2  mess           1           1  /Inbox
[zimbra@zcs807 ~]$ zmmailbox -z -m archive-test@zcs807.us.DOMAIN.com gaf | grep Inbox
  2  mess           1           1  /Inbox

[zimbra@zcs807 ~]$ zmmboxsearch -m archive-test@zcs807.us.DOMAIN.com,archive-test-manual@zcs807.us.DOMAIN.com.archive,archive-test-manual2@zcs807.us.DOMAIN.com.archive -q "Test Message"
1)
ID: 12d3b4cf-61b8-4ba7-805f-be1d9ab6c0c2:283
Subject: Test message
Address:
 [f]  <admin@zcs807.us.DOMAIN.com>
Date: 1405703428000
Size: 1041
Conv: -283
Flags: u
Folder: 2
Fragment: test

2)
ID: 0b283721-857e-4bdc-967a-c5f9e7ec7db2:257
Subject: Test message
Address:
 [f]  <admin@zcs807.us.DOMAIN.com>
Date: 1405703428000
Size: 1269
Conv: -257
Flags: u
Folder: 2
Fragment: test

3)
ID: 3cb67670-1ad9-48c0-8f9b-372adaa2fe3f:258
Subject: Intercepted message for archive-test@zcs807.us.DOMAIN.com: Test message
Address:
 [f] Postmaster <postmaster@zcs807.us.DOMAIN.com>
Date: 1405703428000
Size: 2769
Conv: -258
Flags: au
Folder: 2
Fragment: Intercepted message for archive-test@zcs807.us.DOMAIN.com. Operation=add message, folder=Inbox, folder ID=2.
Using Another Archive Account Against the Primary Archive Account

To Do

Domain Admin Searches For ZCS6

For setting up domain admin rights, please see the following : User:Vladimir-DomainAdminSetup-v6

And you'll see about half way down a screen shot of the "Rights" panel view -- the screen shot shows the ACL right called :

adminConsoleCrossMailboxSearchRights --- Admin Console Cross Mailbox Search Rights

You'll also need to make sure domain admins have the following ACL right :

AdminLoginAs

service.UNKNOWN_DOCUMENT Error When Trying Search

The service.UNKNOWN_DOCUMENT error generally means that there is no handler for specified document. Try redeploying the zimlet, restarting the mailboxd service and let us know how it goes. The xmbxsearch zimlet is located in /opt/zimbra/zimlets-network directory.

 su - zimbra
 cd /opt/zimbra/zimlets-network
 zmzimletctl undeploy zimbra_xmbxsearch.zip
 zmzimletctl deploy zimbra_xmbxsearch.zip
 zmmailboxdctl restart

How To Turn Off / Disable ALL A&D Processing From Admin Web Console

From a "server" level, you would uncheck the "Archiving and Discovery" box in the admin web console under:

Configurations > Servers > [MTA's] > right pane > Services tab

This would stop the mta's from splitting the emails for archive.

How To Turn Off / Disable A&D For An Account

Disabling A&D at a user level, requires it to be done via the CLI:

zmarchiveconfig disable user@domainname

What Accounts Are Set For Archive And Checking Against License Usuage

Note - in regards to closing the parent account but leaving the "archive" accounts or multiple archive accounts enabled, the actual archive account doesn't count against the license - either the normal or archive limit. It's consumed based upon the variables and status of the parent email address. See :

This example below is done on a ZCS 8.6 server. The license usage is based upon the 'parent' account having amavisArchiveQuarantineTo set to something.  :

$ zmprov -l gaa
admin@ldap2.zimbra.DOMAIN.com
spam.gktt7hym36@ldap2.zimbra.DOMAIN.com
ham.0zrc899s@ldap2.zimbra.DOMAIN.com
virus-quarantine.o944yi8wwl@ldap2.zimbra.DOMAIN.com
galsync.cs_37n5wp@ldap2.zimbra.DOMAIN.com
user1@ldap2.zimbra.DOMAIN.com
user1-archive1@ldap2.zimbra.DOMAIN.com.archive
user1-archive2@ldap2.zimbra.DOMAIN.com.archive
galsync@test2.zimbra.DOMAIN.com
testuser2@test2.zimbra.DOMAIN.com

$ zmprov -l sa "amavisArchiveQuarantineTo=*"
user1@ldap2.zimbra.DOMAIN.com

$ zmprov ga user1@`zmhostname` | egrep -i "zimbraArchiveEnabled|amavisArchiveQuarantineTo|\
zimbraArchiveAccount:|zimbraIsSystemResource"

amavisArchiveQuarantineTo: user1-archive1@ldap2.zimbra.DOMAIN.com.archive, user1-archive2@ldap2.zimbra.DOMAIN.com.archive
zimbraArchiveAccount: user1-archive1@ldap2.zimbra.DOMAIN.com.archive
zimbraArchiveAccount: user1-archive2@ldap2.zimbra.DOMAIN.com.archive
zimbraArchiveEnabled: TRUE
zimbraIsSystemResource: FALSE

$ zmprov -l sa "zimbraIsSystemResource=TRUE"
galsync.cs_37n5wp@ldap2.zimbra.DOMAIN.com
galsync@test2.zimbra.DOMAIN.com
ham.0zrc899s@ldap2.zimbra.DOMAIN.com
spam.gktt7hym36@ldap2.zimbra.DOMAIN.com
user1-archive1@ldap2.zimbra.DOMAIN.com.archive
user1-archive2@ldap2.zimbra.DOMAIN.com.archive
virus-quarantine.o944yi8wwl@ldap2.zimbra.DOMAIN.com

$ zmprov -l sa "zimbraIsSystemResource=FALSE"
user1@ldap2.zimbra.DOMAIN.com

$ zmprov fc -a all ; zmsoap -z GetLicenseRequest | egrep 'TotalAccounts|ArchivingAccounts'
    <attr name="ArchivingAccountsLimit">10000</attr>
    <attr name="TotalAccounts">3</attr>
    <attr name="ArchivingAccounts">1</attr>

Need To Find A&D Accounts On Wrong MailStore To Move Them

Searching For Accounts On A Particular Mailstore

To do ldapsearch for the account, and see if there are any related entries in ldap.

su - zimbra
source ~/bin/zmshutil
zmsetvars
ldapsearch -x -H $ldap_master_url -D $zimbra_ldap_userdn -w $zimbra_ldap_password "zimbraMailHost=YOURMAILSTORE.COM" | grep "archive.domain.com"

Renaming Production Domain And Want To Also Rename Archive Domain

This was tested against ZCS 608p1.

There is no 'automatic' process to rename the associated targeted archive email addresses of the user or the archive domain when changing/renaming the domain.

  1. Get all the account details from the production users in regards to the archive acct they are using
    • zimbraMailDeliveryAddress & amavisArchiveQuarantineTo
    • Example via CLI. My initial production domain was primary.DOMAIN.com and the archive domain was primary.DOMAIN.com.archive :
      • $ zmprov ga arch-prod@primary.DOMAIN.com zimbraArchiveAccount
        • [Returns] zimbraArchiveAccount: arch-prod@primary.DOMAIN.com.archive
      • $ zmprov ga arch-prod@primary.DOMAIN.com amavisArchiveQuarantineTo
        • [Returns] amavisArchiveQuarantineTo : arch-prod@primary.DOMAIN.archive
  2. Prepare a script that will redo those variables, you'll run it after the domain renames.
    • Example via CLI. My initial archive domain was primary.zimbra.homeunix.com.archive :
      • $ zmprov ma arch-prod@primary71.DOMAIN.com zimbraArchiveAccount arch-prod@primary71.DOMAIN.com.archive
      • $ zmprov ma arch-prod@primary71.DOMAIN.com amavisArchiveQuarantineTo arch-prod@primary71.DOMAIN.archive
    • Since this is ran after the domain renames, both references in the command about a domain will use the 'new' domainnames.
    • Ref: Bulk_Provisioning
  3. Put domains into maintenance mode during a schedule downtime window
  4. Rename/forward the production domain
  5. Rename/forward the archive domain
  6. Run the script you had prepared earlier that will reset the user variable to their new archive domain.
  7. Put domains into active mode:
    • Example [notice I have the 'new' domainname here] :
      • $ zmprov md primary71.DOMAIN.com zimbraDomainStatus active
      • $ zmprov md primary71.DOMAIN.com.archive zimbraDomainStatus active
  8. Send a test message to a prod address and you can see/confirm the transaction in the /var/log/zimbra.log on the mta .


Confirmation of things working [examples]:

### From /var/log/zimbra.log on the MTA ###
Nov 17 14:42:27 mail71 amavis[7210]: (07210-01) SEND via SMTP: <> -> <arch-prod@primary71.DOMAIN.com.archive>,
  ENVID=AM.BYPyb4z8Cl0N.20101117T204227Z@mail71.DOMAIN.com BODY=7BIT 250 2.0.0 Ok, id=07210-01, 
  from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as C54F623E0E
Nov 17 14:42:27 mail71 postfix/smtpd[7446]: DDA5323E10: client=localhost[127.0.0.1]
Nov 17 14:42:27 mail71 postfix/cleanup[7262]: DDA5323E10: 
 message-id=<201011172042.oAHKgKG1024723@mail3.zimbra.homeunix.com>
Nov 17 14:42:27 mail71 postfix/qmgr[7530]: DDA5323E10: from=<root@mail3.DOMAIN.com>, 
 size=1644, nrcpt=1 (queue active)
Nov 17 14:42:27 mail71 amavis[7210]: (07210-01) FWD via SMTP: <root@mail3.DOMAIN.com> -> 
 <arch-prod@primary71.DOMAIN.com>,BODY=7BIT 250 2.0.0 Ok, id=07210-01, 
 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as DDA5323E10

You can also use the CLI to confirm delivery into the archives & production accounts Inbox. For example:

$ zmmailbox -z -m arch-prod@primary71.DOMAIN.com gaf | grep Inbox
         2  mess           3           3  /Inbox

$ zmmailbox -z -m arch-prod@primary71.DOMAIN.com.archive gaf | grep Inbox
         2  mess           3           3  /Inbox

On Why You Have To Change The User Variables


I confirmed in my test that you do have to reset the user variables rather than just relying on the archive domain having a global forwarding. This is what shows up in /var/log/zimbra.log if you just use the domain rename/forwarding and don't reconfigure the user variable.

 
Nov 17 14:27:05 mail71 postfix/error[26043]: 8E5DD23E0E: to=<arch-prod@primary.DOMAIN.com.archive>, 
 relay=none, delay=0.04, delays=0/0/0/0.03, dsn=5.0.0, status=bounced (User unknown in virtual alias table)

sending directly to archive account, works:

Nov 17 14:37:28 mail71 amavis[7209]: (07209-01) FWD via SMTP: <root@mail3.DOMAIN.com> -> 
 <arch-prod@primary71.DOMAIN.com.archive>,BODY=7BIT 250 2.0.0 Ok, id=07209-01, 
from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 1FCA523E0E
Verified Against: Zimbra Collaboration 8.0, 7.0 Date Created: 04/16/2014
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-Server-Topics Date Modified: 06/21/2016



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »




Ajcody HSM Or Hierarchical Storage Management

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual HSM Or Hierarchical Storage Management Homepage

Please see Ajcody-HSM-Notes

General Q&A

What's It Look Like - Big Picture

HSM requires a new "volume" on the mailstore(s), i.e. the mailbox server. The Zimbra mailbox server(s) starts with dedicated volumes for the [Default paths listed]:

Reference is Zimbra Mailbox Server

  • Message Store [/opt/zimbra/store]
    • All email messages reside, including the message body and any file attachments.
      • Messages are stored in MIME format.
    • Each mailbox has a dedicated directory named after its internal Zimbra mailbox ID.
      • Note: Mailbox IDs are unique per server, not system-wide.
    • HSM Message Store (optional) [there is no default path, you use whatever partition you make for it]
      • Hierarchical Storage Management (HSM) allows you to configure storage volumes for older messages.
      • To manage your email storage resources, you can implement a different HSM policy for each message server.
        • Messages and attachments are moved from a primary volume to the current secondary volume based on the age of the message.
        • The messages are still accessible.
    • Single-Copy Message Storage
      • Single copy storage allows messages with multiple recipients to be stored only once in the file system.
  • Index Store [/opt/zimbra/index]
  • Data (MySQL) Store [/opt/zimbra/db]
  • Backup [/opt/zimbra/backup]
  • Log files [/opt/zimbra/log].

Backup And HSM

Please see Bugs/RFE:

HSM Impact With Backups

Zimbra mailbox servers cannot see, read, or write to another Zimbra server. The HSM store data is integrated into the mailbox servers normal backup process - they are NOT separate processes. If you find the HSM disks are having an impact on your backup times and you need to get the backup times shorter please look at the following:

HSM Impact To Server Performance

HSM currently iterates all mailboxes without pausing. This can result in a big disk/CPU hit. Please see below for more details.

HSM Running During ZCS Restarts

I created this RFE:

Customer reported that mailboxd was manually restart during their hsm operation and it resulted in an extended downtime during the zimbra start processes because the hsm activity was in the redologs and had to be processed that way before mailboxd was fully running.

How Does HSM Determine When To Move Message?

Taken from an internal thread within bugzilla.

Question is:

What date/timestamp does HSM use to determine when to move the message? The time a message is injected or the date/time in the Date: header?

Answer is:

HSM uses the date that's stored in the database. This is either the time that the message was added or the value specified in the X-Zimbra-Received header.

HSM And Attachments - Any Options?

If you would like to remove attachments (to another type of storage), please see the RFE/bug below. Comment #9 says:

Today most customers use our built-in HSM to allow for very large mailboxes but
use cheaper storage. We don't have a way to strip attachments but are looking
at some options of providing a way to move large attachments optionally to
either online or offline storage.

Please see the RFE/bug below. Vote on this if you like it.

Aging Policy Options For HSM Data

This is needed otherwise your HSM volume would grow indefinitely.

Please see the following RFE and vote on it.

What Doesn't Get HSM'd?

It's basically messages that get HSM'd. Here's some RFE/bug's I've found for missing items.

Wiki Items

RFE filed, please see:

Document & Wiki Version Items

Please see:

Briefcase Items

RFE filed, please see:

Does The Mailbox Go Into Maintenance Mode?

This was fixed in 5.0.3. Please see the following bug.

HSM Logging

I found this RFE, it might prove useful.

More Than One HSM Volume (Secondary Message Store)

There is a RFE for this, please see the following:

HSM/Secondary Volume for Spam & Junk

I'm not sure exactly what the details and dependencies are with this bug. I added a comment for clarity.

Please see the follow:

Consistency Checking Tool For HSM

This is available with zmblobchk, which checks messages in general.

Please see the RFE that it was built for for more information:

What If HSM Volume Becomes Full?

Q: What would happen if the HSM volume filled up while the HSM process was moving messages from the primary store to HSM store? Would it detect the full volume and abort the transaction(s) or would it keep trying? Is it possible that any mail would be lost if the HSM store filled up during an HSM run?

A. It's transactional, so it will fail gracefully. More specifically, if anything goes wrong during the file copying process, we delete any copied files and abort. The volume id of messages processed before the failure remains the same. HSM runs one mailbox at a time, so the rollback only happens for the last mailbox.

Restoring HSM Volumes - RFE

Please see:

A How-To Example - CLI

Introduction

This is a testing example. You should adjust these steps to use a REAL PARTITION and NOT A DIRECTORY in the steps listed below.

Create The HSM Volume

Normally you would have the HSM volume as a separate partition on the server - the lower performance disks when compared to the partition the mailstore is using.

To do a "dry" test, I did the following.

As root.

[root@mail3 ~]mkdir /opt/zimbra/hsm
[root@mail3 ~]chown zimbra:zimbra /opt/zimbra/hsm

Then switch to zimbra.

 [zimbra@mail3 ~]su - zimbra
 [zimbra@mail3 ~]zmvolume -a -n hsm-volume -t secondaryMessage -p /opt/zimbra/hsm
 [zimbra@mail3 ~]zmvolume -l
   Volume id: 2
        name: index1
        type: index
        path: /opt/zimbra/index
  compressed: false
     current: true

   Volume id: 1
        name: message1
        type: primaryMessage
        path: /opt/zimbra/store
  compressed: false
     current: true

   Volume id: 3
        name: hsm-volume
        type: secondaryMessage
        path: /opt/zimbra/hsm
  compressed: false
     current: false
Set HSM Volume To Current

Now let's set the hsm-volume to "current". Otherwise, if you try to run zmhsm you'll get a error of "invalid request: None of the secondary message volumes are marked as current."

 [zimbra@mail3 ~]$zmvolume -sc -id 3
 [zimbra@mail3 ~]$zmvolume -l
   Volume id: 2
        name: index1
        type: index
        path: /opt/zimbra/index
  compressed: false
     current: true

   Volume id: 1
        name: message1
        type: primaryMessage
        path: /opt/zimbra/store
  compressed: false
     current: true

   Volume id: 3
        name: hsm-volume
        type: secondaryMessage
        path: /opt/zimbra/hsm
  compressed: false
     current: true
Starting HSM For First Time

This is example is on a test server of mine. I don't have any messages older than 30 days. The default global configuration for HSM Age is 30 days.

[zimbra@mail3 ~]$ ls /opt/zimbra/hsm/
[zimbra@mail3 ~]$ crontab -l | grep -i hsm
[zimbra@mail3 ~]$ zmhsm -t
HSM process started.
[zimbra@mail3 ~]$ zmhsm -u
Last HSM Session Stats
----------------------
Start time: Fri Aug 15 15:48:58 EDT 2008
End time:   Fri Aug 15 15:48:58 EDT 2008
Not currently running.
Moved 0 blobs dated earlier than Wed Jul 16 15:48:58 EDT 2008
  to volume 3.
Mailboxes processed: 7 out of 7.
[zimbra@mail3 ~]$ ls /opt/zimbra/hsm/
[zimbra@mail3 ~]$ zmprov gacf | grep zimbraHsmAge
zimbraHsmAge: 30d

So, it worked but didn't have anything to Age.

Adjusting the zimbraHsmPolicy variable - ZCS 6+

Default policy [ZCS 8.6] :

$ zmprov gacf zimbraHsmPolicy
zimbraHsmPolicy: message,document:before:-30days
$ zmprov desc -a zimbraHsmPolicy
zimbraHsmPolicy
    The policy that determines which mail items get moved to secondary
    storage during HSM. Each value specifies a comma-separated list of
    item types and the search query used to select items to move. See the
    spec for <SearchRequest> for the complete list of item types and
    query.txt for the search query spec.

               type : string
              value :
           callback :
          immutable : false
        cardinality : multi
         requiredIn :
         optionalIn : globalConfig,server
              flags : serverInherited
           defaults : message,document:before:-30days
                min :
                max :
                 id : 1024
    requiresRestart :
              since : 6.0.0_BETA2
    deprecatedSince :
Adjusting the zimbraHsmAge variable - Deprecated since: 6.0.0_BETA2.
$ zmprov desc -a zimbraHsmAge
zimbraHsmAge
    Deprecated since: 6.0.0_BETA2. deprecated in favor for
    zimbraHsmPolicy. Orig desc: Minimum age of mail items whose filesystem
    data will be moved to secondary storage.. Must be in valid duration
    format: {digits}{time-unit}. digits: 0-9, time-unit: [hmsd]|ms. h -
    hours, m - minutes, s - seconds, d - days, ms - milliseconds. If time
    unit is not specified, the default is s(seconds).

               type : duration
              value :
           callback :
          immutable : false
        cardinality : single
         requiredIn :
         optionalIn : globalConfig,server
              flags : serverInherited
           defaults : 30d
                min : 0
                max :
                 id : 8
    requiresRestart :
              since :
    deprecatedSince : 6.0.0_BETA2


zimbraHsmAge must be a valid duration of: nnn[hsmd]

[zimbra@mail3 ~]$ zmprov mcf zimbraHsmAge 30d
### example initially had to reproduce issue for my RFE - please don't use 1d ###
###  [zimbra@mail3 ~]$ zmprov mcf zimbraHsmAge 1d ###
[zimbra@mail3 ~]$ zmprov gacf | grep zimbraHsmAge
zimbraHsmAge: 1
[zimbra@mail3 ~]$ zmhsm -t
HSM process started.
[zimbra@mail3 ~]$ zmhsm -u
Last HSM Session Stats
----------------------
Start time: Fri Aug 15 15:56:39 EDT 2008
End time:   Fri Aug 15 15:56:40 EDT 2008
Not currently running.
Moved 63 blobs dated earlier than Fri Aug 15 15:56:38 EDT 2008
  to volume 3.
Mailboxes processed: 7 out of 7.
[zimbra@mail3 ~]$ ls /opt/zimbra/hsm/
0
[zimbra@mail3 ~]$ ls /opt/zimbra/hsm/0/
1  14  15  3

The above commands modified the zimbraHsmAge as a global setting. You can also modify it on a server basis.

[zimbra@mail3 ~]$ zmprov gs mail3.internal.homeunix.com | grep zimbraHsmAge
zimbraHsmAge: 1d
[zimbra@mail3 ~]$ zmprov gacf | grep zimbraHsmAge
zimbraHsmAge: 1d
[zimbra@mail3 ~]$ zmprov ms mail3.internal.homeunix.com zimbraHsmAge 30d
[zimbra@mail3 ~]$ zmprov gs mail3.internal.homeunix.com | grep zimbraHsmAge
zimbraHsmAge: 30d
[zimbra@mail3 ~]$ zmprov gacf | grep zimbraHsmAge
zimbraHsmAge: 1d
Moving zimbraHsmAge Back To A Lower Number

Continuing after the above steps, let's see what happens if we now run zmhsm.

[zimbra@mail3 ~]$ zmhsm -t
HSM process started.
[zimbra@mail3 ~]$ zmhsm -u
Last HSM Session Stats
----------------------
Start time: Fri Aug 15 16:09:05 EDT 2008
End time:   Fri Aug 15 16:09:05 EDT 2008
Not currently running.
Moved 0 blobs dated earlier than Fri Aug 15 16:08:35 EDT 2008
  to volume 3.
Mailboxes processed: 7 out of 7.

Did the message files get moved back?

 [zimbra@mail3 ~]$ find /opt/zimbra/store/0/15 -name *.msg -print
 [zimbra@mail3 ~]$ find /opt/zimbra/hsm/0/15 -name *.msg -print
 /opt/zimbra/hsm/0/15/msg/0/269-21.msg
 /opt/zimbra/hsm/0/15/msg/0/263-10.msg
 /opt/zimbra/hsm/0/15/msg/0/268-14.msg
 /opt/zimbra/hsm/0/15/msg/0/261-8.msg
 /opt/zimbra/hsm/0/15/msg/0/266-13.msg
 /opt/zimbra/hsm/0/15/msg/0/259-4.msg
 /opt/zimbra/hsm/0/15/msg/0/265-12.msg
 /opt/zimbra/hsm/0/15/msg/0/257-2.msg

Nope. I'm not sure what else to add here. Don't know if there's actually a way to move them back.

RFE - To Move Msg's Back To Primary Store

Please see:

It is possible to move blobs between volumes using the zmsoap command for ZCS 6 and above. Please read the source documents on this on your ZCS server in /opt/zimbra/docs - the two files are soap-admin.txt and soap.txt . The reference your looking for is MoveBlobsRequest, in the soap-admin.txt guide. To build the proper query, you'll also want to consult the soap.txt guide. As of ZCS 8, it reads as:

<MoveBlobsRequest types="{types}" sourceVolumeIds="{volume-ids}" destVolumeId="{volume-id}" [maxBytes="{n}"]>
  [<query>{search-query}</query>]
</MoveBlobsRequest>

<MoveBlobsResponse numBlobsMoved="{n}" numBytesMoved="{n}" totalMailboxes="{n}"/>

Moves blobs between volumes.  Unlike HsmRequest, this request is synchronous,
and reads parameters from the request attributes instead of zimbraHsmPolicy.

types: a comma-separated list of item types, or "all" for all types.  See the spec for
  <SearchRequest> for details.
volume-ids: a comma-separated list of volume ids.
query: if specified, only items that match this query will be moved.
maxBytes: Limit for the total number of bytes of data to move.  Blob move will abort
  if this threshold is exceeded.

Some examples are listed below, please check your volume id's with zmvolume -l - you will NOT want to run these examples without updating the volume id's. The HSM policy and MoveBlobsRequest are search based, so you can add a query like this:

zmsoap -z MoveBlobsRequest @types=all @sourceVolumeIds=3 @destVolumeId=4 query=is:anywhere

An "is:anywhere" query will look in all folders, including /Trash for messages to move.


A query just in junk would be like the following below. This will move every blob for every mailbox located in volume 1 to volume 3 that is under the junk folder.

zmsoap -z MoveBlobsRequest @sourceVolumeIds=1 @destVolumeId=3 query=in:junk


Or you can specify a date:

zmsoap -z MoveBlobsRequest @sourceVolumeIds=1 @destVolumeId=3 query=before:1/1/2012


MoveBlobsRequest will move the blob and update mysql mail_item table accordingly.


Old Note Below


The desperate, could review the following. This would be an unsupported procedure. I'll try to engage developers on this and get some feedback though:

Now What? Place In Cron

You will have to manually put in the zimbra crontab file a line to run the zmhsm command.

Something like the following at the end of the crontab [ su - zimbra ; crontab -e ] :

# HSM
0 6 * * * /opt/zimbra/bin/zmhsm -t

This will run every morning at 0600. The question of each administrator is what is the right time to run this. I'm initial thought is to try and kick it off after your backups. One might want to have two entries for the zmhsm command, one after your daily incremental and another time frame for you full backup days.

Checking For The HSM Zimlet

In the Admin web console, you'll see the reference to the HSM zimlets in this path:

Configuration > Admin Extensions > com_zimbra_hsm

Deploying The HSM Zimlet

To deploy the zimlet for HSM

su - zimbra
zmzimletctl deploy /opt/zimbra/zimlets-network/com_zimbra_hsm.zip

Log into the admin web console - fresh session.

What Can I Do For HSM In The Admin Web Console?

Confirm the HSM zimlet is installed first.

Setup The HSM Volume

Configuration > Servers > [Server For HSM Volume]

Then select the Volumes tab on the right-hand section.

Clicking on "Add", you'll be given a drop down chooser for "Volume Type". For HSM, you would select "Secondary Message".

The "Assign Current Volumes" section will show you what volume is in use for what function.

You will also see "HSM" on this page to set the zimbraHsmAge variable for the SERVER - rather than globally.

Adjust The zimbraHsmAge Date

Per Server

Configuration > Servers > [Server For HSM Volume]

Then select the Volumes tab on the right-hand section.

You will see "HSM" on this page to set the zimbraHsmAge variable for the SERVER - rather than globally.

Global

Configuration > Global Settings

The select the HSM tab on the right-hand section.

This will set the global (default) message age for HSM.

Starting & Stopping HSM (zmhsm)

Configurations > Servers > [Server With HSM Volume]

The on the right-hand section, above the details area for the server you'll see a button/tab HSM. Click on this and you'll be given the option to Start HSM Session. It will output progress details.


References From Official Documentation

zmhsm - command for HSM

Please see:

CLI_zmhsm_Network_Edition_only

zmvolume - command for volumes

Please see:

http://wiki.zimbra.com/index.php?title=CLI_zmvolume

Global HSM Session Setting

Reference: http://www.zimbra.com/docs/ne/latest/administration_guide/Managing_ZCS.10.1.html#1111022

Global Settings HSM (Hierarchical Storage Management) sets the default message age threshold to 30 days. The HSM global setting is the default unless you change the schedule in the Server configuration. See “Scheduling HSM Sessions” .

Scheduling HSM Sessions

Reference: http://www.zimbra.com/docs/ne/latest/administration_guide/Managing_ZCS.10.1.html#1111045

HSM can be configured for secondary storage volumes for older messages. Messages and attachments are moved from a primary volume to the current secondary volume based on the age of the message. Users are not aware of any change and do not see any noticeable difference when opening an older message that has been moved.

To manage your email storage resources, you can implement a different HSM policy for each mailbox server. The message age threshold for HSM is set globally on the HSM tab or for individual servers from the Server Volume tab. The default is 30 days. The thresholds configured on individual servers override the threshold configured as the global setting. Sessions to move messages to the secondary volume are scheduled in your cron table. From the administration console, when you select a server, you can manually start a session, monitor sessions, and abort sessions that are in progress from the Volumes tab.

When you abort a session and then restart the process, the HSM session looks for entries in the primary store that meet the HSM age criteria. Any entries that were moved in the previous run would be excluded, as they would no longer exist in the primary store.


Verified Against: Zimbra Collaboration 8.0, 7.0 Date Created: 08/15/2008
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-Server-Topics Date Modified: 06/21/2016



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »





Attention.png - This article is NOT official Zimbra documentation. It is a user contribution and may include unsupported customizations, references, suggestions, or information.

A Proxy On You!

Actual Proxy Notes Homepage

Please see Ajcody-Proxy-Notes

Very Rough Draft For Proxy Trouble Shooting Script - More of steam of consciousness really

Do the following on one of your ZCS servers:

$ su - zimbra
$ touch /tmp/proxy_support.sh
$ chmod +x /tmp/proxy_support.sh

Now just vi /tmp/proxy_support.sh again and cut and paste the contents below and save the file. Make sure your not getting odd line wrapping. If you do, try clicking on the view source option at the top of the wiki page and see if that allows your paste into your shell/vi to work better. Note - I removed the leading spaces one would normally use to make the script an easier read since it causes a paste to be a horrible format.

To Do Items: Have a table formatted output, like "Variable Name | Global | ServerA | ServerB | Server C | Server D | Server E | Description of Var | Recommendations" and to include a * next to a variable if we know it should be set to something else when compared to other vars in the environment.

#!/bin/bash

printf "\nProxy Trouble Shooting Script For ZCS 8+ Servers\n\n"
printf "\n\n Reference: https://wiki.zimbra.com/wiki/Ajcody-Proxy-Notes#Very_Rough_Draft_For_Proxy_Trouble_Shooting_Script_-_More_of_steam_of_consciousness_really.\n\n"
### Global Configurations

printf "\n\n## Getting Some Global Variables ##\n\n"
printf "## GARPU [getAllReverseProxyURLs] - Used to publish into nginx.conf what servers should be used for reverse proxy lookup.\n"
printf "## Output from zmprov garpu ##\n\n `zmprov garpu` \n\n"
printf "## GARPB [getAllReverseProxyBackends]  - no description at this time.\n"
printf "## Output from zmprov garpb ##\n\n `zmprov garpb` \n\n"
printf "## GARPD [getAllReverseProxyDomains] - no description at this time.\n"
printf "Output from zmprov -l garpd ##\n\n `zmprov -l garpd` \n\n"
printf "## GAMCS [getAllMemcachedServers] - Used to list memcached servers (for nginix use).\n"
printf "Ouput from zmprov gamcs ##\n\n `zmprov gamcs` \n\n" ;
printf "## Some Global Configs from the following command: ##\n"
printf "## [zimbra@]$ zmprov gcf | egrep 'zimbraWebClientLogoutURL|zimbraWebClientLoginURL|zimbraMailURL|zimbraMailReferMode|zimbraReverseProxySSLToUpstreamEnabled|zimbraMailProxyReconnectTimeout|zimbraMailProxyMaxFails' \n\n"
zmprov gacf | egrep 'zimbraWebClientLogoutURL|zimbraWebClientLoginURL|zimbraMailURL|zimbraMailReferMode|zimbraReverseProxySSLToUpstreamEnabled|zimbraMailProxyReconnectTimeout|zimbraMailProxyMaxFails'
printf "## [For ZCS8+] If zimbraReverseProxySSLToUpstreamEnabled is set to TRUE then zimbraMailMode on the server should NOT be set to http. It should be either https or both. \n\n"
printf "## For details on zimbraMailProxyReconnectTimeout & zimbraMailProxyMaxFails , see https://bugzilla.zimbra.com/show_bug.cgi?id=80135 . Recommendation [ZCS8+] is to set to 0 , when encountering 502/504 timeout errors. \n\n"
printf "\n\n Continuing To The Specific Server Variables...\n\n"
zmlicense -p

### Server Configuration

for server_hostname in `zmprov gas`
do printf "## Need IP Information For Server $server_hostname . Using /etc/resolv.conf on local server to resolve.##\n\n"
printf "`host $server_hostname` \n\n"
printf "## Checking Enabled Services For Server $server_hostname ##\n\n"
zmprov gs $server_hostname | grep ServiceEnabled
printf "\n## Checking Running Services For $server_hostname ##\n\n"
zmcontrol -H $server_hostname status
printf "\n\n## Checking for Some Proxy Variables On $server_hostname ##\n\n"
zmprov gs $server_hostname | egrep 'zimbraReverseProxyHttpEnabled|zimbraReverseProxyMailEnabled|zimbraMailReferMode|zimbraMailMode|zimbraReverseProxySSLToUpstreamEnabled|zimbraMailProxyReconnectTimeout|zimbraMailProxyMaxFails'
printf "## [For ZCS8+] If zimbraReverseProxySSLToUpstreamEnabled is set to TRUE then zimbraMailMode on the server should NOT be set to http. It should be either https or both. \n\n"
printf "## For details on zimbraMailProxyReconnectTimeout & zimbraMailProxyMaxFails , see https://bugzilla.zimbra.com/show_bug.cgi?id=80135 . Recommendation [ZCS8+] is to set to 0 , when encountering 502/504 timeout errors. \n\n"
printf "\n\n## Checking for Some Proxy Port Variables On $server_hostname ##\n\n"
zmprov gs $server_hostname | grep Port
printf "\n\n## Checking for zimbraReverseProxyLookupTarget ; if TRUE then you should be able to telnet to port 7072 on that server. ##\n"
printf "## telnet $server_hostname:7072 \n"
printf "## If $server_hostname shouldn't be a part of the lookup pool. You can remove it by doing:\n"
printf "## [zimbra@]$ zmprov ms $server_hostname zimbraReverseProxyLookupTarget FALSE \n"
printf "## Then check the output of zmprov garpu:\n"
printf "## [zimbra@]$ zmprov garpu \n"
printf "## Then rebuild the configs on all the PROXIES and restart (one at a time is fine):\n"
printf "## [zimbra@]$ zmnginxctl restart \n"
printf "## After doing this, check that $server_hostname is no longer listed in any proxy configs on all proxies:\n"
printf "## [zimbra@]$ grep $server_hostname /opt/zimbra/conf/nginx/includes/*\n"
printf "## $server_hostname Currently has zimbraReverseProxyLookupTarget set to:\n\n"
zmprov gs $server_hostname | grep zimbraReverseProxyLookupTarget
printf "\n\n Finished Getting Variables for $server_hostname.\n\n"
done

### Domain Configuration

for domain in `zmprov gad`
do printf "## Getting Some Domain Information.##\n\n"
printf "Getting Information for $domain \n\n"
printf "## Getting zimbraVirtualHostName And zimbraVirtualIPAddress Information for $domain ##\n\n"
zmprov gd $domain | grep zimbraVirtual
printf "## Getting zimbraPublicServiceHostname, zimbraPublicServicePort And zimbraPublicServiceProtocol for $domain ##\n\n"
zmprov gd $domain | grep zimbraPublicService
printf "\n\n Finished Getting Variables for $domain.\n\n"
done
printf "\n\n Script Complete.\n\n"

Not Finished Part

Not Finished - Need to now adjust how to handle non-zcs commands to be executed on remote hosts . I would like to be able to add to this script but can't with a default multi-server ZCS environment.

Notes on limitations:

  • The below isn't effective for what we need because of the limitation noted after it.
    • ssh -i .ssh/zimbra_identity -o strictHostKeyChecking=no zimbra@server.domain.com -p 22
  • cat /opt/zimbra/.ssh/authorized_keys will give you something like:
    • command="/opt/zimbra/libexec/zmrcd" ssh-dss AAAAB3NzaC1kc3MAA [cut] A== zcs806.us.zimbralab.com
  • zmrcd restricts what commands can be ran, cat /opt/zimbra/libexec/zmrcd to see.
## cut - ifconfig output instead of using host $server_hostname
for server_hostname in `zmprov gas`
do printf "## Need IP Information For Server $server_hostname ##\n\n"
printf "`ifconfig -a` \n\n"
## cut
printf "\n\n## Checking for Some Proxy Port Variables On $server_hostname ##\n\n"
zmprov gs $server_hostname | grep Port
printf "\n\n## Confirmig Ports Are Available ## \n\n"
ZCSPXYPORTS=\'`zmprov gs $server_hostname | grep Port | cut -d':' -f2 | tr '\n' '|' | tr -d ' ' | xargs echo`\'
netstat -plnt | egrep `echo $ZCSPXYPORTS`
## cut

UPDATE PLEASE SEE THESE FIRST

No Route To Host

[working draft]

If your getting "No route to host" errors in /opt/zimbra/log/nginx.log files on the proxy servers, you should check:

  1. The resolution [DNS] to the host from the proxy servers is correct and working. This might happen more when you've deployed a new ZCS server in your environment.
  2. Following step one, you also have to confirm there is port level access to between proxy servers and the server it's trying to reach. memcache port is 11211 .
  3. The server/s are too busy to serve the request.
  4. You have a server in the list that shouldn't be in the lookup pool or you should remove the trouble server from the pool to avoid any more customer issues to deescalate the situation.

50X Errors

  • 500 Internal Server Error
    • A generic error message, given when an unexpected condition was encountered and no more specific message is suitable.
  • 502 Bad Gateway
    • The server was acting as a gateway or proxy and received an invalid response from the upstream server.
  • 503 Service Unavailable
    • The server is currently unavailable (because it is overloaded or down for maintenance). Generally, this is a temporary state. Sometimes, this can be permanent as well on test servers.
  • 504 Gateway Timeout
    • The server was acting as a gateway or proxy and did not receive a timely response from the upstream server.


These following configuration changes for an upstream mailbox server can improve proxy behavior related to timeouts:

  • This will configure proxy to immediately reconnect to all mailbox server on any failure
    • $ zmprov mcf zimbraMailProxyReconnectTimeout 0 
    • If necessary, for each mailbox server
      • $ zmprov ms <mailbox server hostname> zimbraMailProxyReconnectTimeout 0 
  • This will configure proxy to ignore failures in regards to disconnects to all mailbox servers
    • $ zmprov mcf zimbraMailProxyMaxFails 0 
    • If necessary, for each mailbox server
      • $ zmprov ms <mailbox server hostname> zimbraMailProxyMaxFails 0 
  • Then, restart all the proxies to regenerate the nginx config files with the updated values for 'fail_timeout' & 'max_fails':
  •  $ zmproxyctl restart 


See the following bug for more details on this recommendation:

Admin Guide Update

Our Administration Guide now has everything you should need to setup your proxy server.

Please see:

How To Enable Proxy

And Also Another More Current How-To Enable Proxy here:

My Own Proxy How-To For Setup

Note: We are working on improving the official documentation. I haven't seen the document yet for the 5.0.11 release, but I've been told it will have many improvements.

Here's my attempt at writing something better in the meantime.

High Level Overview

One Package

First, there's only ONE package or rpm in the installer for "proxy".

Where Does It Get Installed?

It can be installed with any of your Zimbra servers (a complete ZCS install, ZCS MTA, ZCS LDAP, ZCS Mailstore) or on its own server. ( Reference )

Other proxy documentation might give the impression it needs to go onto a zimbra server that is running some other function - mta, ldap, or mailstore.

Three Components To The Package

This package, can be broken down into THREE components.

Nginx

Nginx is a high performance IMAP/POP3 proxy server which handles all incoming POP/IMAP requests. In addition to this, it is also able to reverse proxy HTTP requests to the right backend (mailstore) server. This helps to hide the hostnames of the backend mailbox servers from end users. The steps involved in this lookup are described in more detail under the Flow_Process_For_Proxy_Target_Lookups below.

Memcached

Memcached is a high performance, distributed memory object caching system (an open source distributed in-memory hashtable). Route information is cached for further use in order to increase performance.

Memcache does not have authentication and security features so the servers should have a firewall set up appropriately. The default port is 11211 and is controlled by zimbraMemcacheBindPort conf setting in zimbraserver.

Note: Memcached will be split into its own service in the future. Meaning, for example, that you'll be able to configure a server to solely perform this function of providing the cache results. This will give more flexibility in managing performance issues, as related to the proxy environment. Rather than the same server having to share cpu/memory resources with nginx. It will also allow you to configure your different servers running nginx to quiry against a "shared" cached table of memcached. Currently, each nginx will have unique results in their memcached tables.

What is being cached, are the prior results of pop and imap lookups of users and their corresponding mailbox server they should be routed to. The process is described below in Flow_Process_For_Proxy_Target_Lookups.

Zimbra Proxy Route Lookup Handler

Zimbra Proxy Route Lookup Handler is a servlet located on the ZCS mailbox servers. This servlet handles queries for the user account route information (the server and port number where the user account resides). This is more about a difference in functionality when the proxy package is being used rather than a "new" software package being installed. The functionality difference is coming from the "software" related to nginx and memcached. The process is described in more detail in Flow_Process_For_Proxy_Target_Lookups.

NOTE - Again, don't let the reference to "mailbox server" confuse you. The mailbox servers don't need the proxy package installed on them directly to see this effect. The proxy server (whatever one you install it on, will make configuration changes global to handle this function. The referenced servlet is already on a base mailbox server install. This is referring to how the proxy package components will or can interact with that pre-existing servlet on the mailbox server.
Flow Process For Proxy Target Lookups

Here's the flow of the process for pop and imap lookups:

  1. Nginx will query the LOCAL memcached service first to see if the lookup result has a cached result. [FYI - Memcache runs over port 11211]
    • Note: when memcached is allowed to run on another server besides the one where nginx is at, you'll need to account for this port 11211 access between the servers. For now, it's all occurring locally to the server. If you can't access this memcache process, confirm you don't have any firewall/port level blocking occur for the local machine communicating over port 11211.
  2. If the initial lookups by nginx against the LOCAL memcached service have no results, nginx will then proceed to query against the "Zimbra Proxy Route Lookup Handler" services.
    • By default, all mailbox servers participate in this lookup process via the "Zimbra Proxy Route Lookup Handler".
      • This "where" to lookup is determined by the zimbraReverseProxyLookupTarget server attribute on servers running the mailbox service.
    • The lookups are performed in a round-robin fashion across configured mailbox servers.
    • Now that there is a successful lookup, the results are then cached in LOCAL memcached service and future lookups will bypass the "Zimbra Proxy Route Lookup Handler" steps for that specific lookup.
      • Meaning, the lookups will solely operate between nginx and LOCAL memcached service and no longer involve the "Zimbra Proxy Route Lookup Handler"/mailbox stores.

Here's the flow of the process for reverse proxy http lookups:

  1. Nginx will query against the "Zimbra Proxy Route Lookup Handler" services.
    • By default, all mailbox servers participate in this lookup process via the "Zimbra Proxy Route Lookup Handler".
      • This "where" to lookup is determined by the zimbraReverseProxyLookupTarget server attribute on servers running the mailbox service.
    • The lookups are performed in a round-robin fashion across configured mailbox servers.
    • Ngninx will perform this lookup for every http request, it does not involve the memcached server for cache results.
Three Functions That Can Be Done With Proxy Package

There are THREE functions or options within Zimbra that relate to "proxy".

IMAP - POP Proxy

IMAP/POP Proxy is about the use of an IMAP/POP proxy server routes users of these services to the Zimbra mailbox server on which their mailbox resides.

For example, proxying allows users to enter imap.example.com as their IMAP server. The proxy running on imap.example.com inspects their IMAP traffic, does a lookup to determine which backend mailbox server a user’s mailbox lives on (mbs1.example.com, for example), and transparently proxies the connection from user’s IMAP client to the correct mailbox server.

Flow Of The Login Process: When an IMAP or POP3 client logs in through the proxy, the following takes place:

  1. The proxy analyzes the login sequence
  2. Extracts the user name of the user trying to login
  3. Does a HTTP lookup on a mailbox server to find out which server the mailbox of the user attempting to login lives on
    • This lookup service runs on mailbox servers on port 7072, and this port on mailbox servers should be available from all proxy servers.
      • Which mailbox servers participate in this lookup is determined by the zimbraReverseProxyLookupTarget server attribute on servers running the mailbox service.
        • By default all mailbox servers participate in this lookup.
      • Lookup is performed round-robin across configured mailbox servers.
      • The result of the login name to mailbox server lookup are cached in memcached (an open source distributed in-memory hashtable).
        • The memcached process is run alongside all IMAP/POP proxy services (nginx). Meaning wherever the proxy package was install and is configured to run.
  4. Also see Flow_Process_For_Proxy_Target_Lookups, if you have not.

Port Changes For IMAP/POP Proxying: When the proxy server is configured, the service ports on backend Zimbra mailbox server are changed to alternate ports. The proxy now services the standard ports for these protocols. This change is applied even if the proxy services are run on their own independent hosts, in order to distinguish and avoid confusion between the services.

  1. Here's the changes that will be made on the mailbox servers and what ports will now be handled by the proxy server(s).
    • Note: If you have any other services running on these ports, turn them off.
      • Standard Ports now server or handled by Proxy server(s)
        • IMAP proxy port 143
        • IMAP SSL proxy port 993
        • POP proxy port 110
        • POP proxy port 995
      • Mailbox Servers will now work on these alternate ports
        • IMAP port 7072
        • IMAP SSL port 7143
        • POP port 7110
        • POP SSL port 7995
        • Route Lookup Handler (new port) 7072
        • This was described above in regards to the "Flow Of The Login Process".
Reverse HTTP Proxy
  1. Reverse HTTP Proxy
    • Using an nginx-based reverse proxy for HTTP helps to hide names of backend mailbox servers from end users. For example, users can always use their web browser to visit the proxy server at http://mail.example.com. The connection from users whose mailbox lives on mbs1. example.com will be proxied to mbs1.example.com by the proxy running on the mail.example.com server. In addition to the ZCS web interface, clients such as REST and CalDAV clients, Zimbra Connector for Outlook and Zimbra Mobile Sync devices are also supported by the proxy.
      • HTTP reverse proxy routes requests as follows:
        1. If the request has an auth token cookie (ZM_AUTH_TOKEN), the request is routed to the backend mailbox server of the authenticated user.
        2. If the requesting URL can be examined to determine the user name, then the request is routed to the backend mailbox server of the user in the URL. REST, Ca lDAV, and Zimbra Mobile Sync are supported through this mechanism.
        3. If the above methods do not work, the IP hash method is used to load balance the requests across the backend mailbox servers which are able to handle the request or do any necessary internal proxying.
Virtual Hosting

Please see Ajcody-Server-Misc-Topics#Proxy_.5BNGINX.5D_Virtual_Hosting

Proxy References

NGINX Open-Source Project Homepage

Proxy documentation BUG/RFE's:

From Install Guide':

From Wiki:

zmproxyinit Help Output [Oct 16, 2008 - From 5.0.9 I believe]:

[zimbra@mail2 libexec]$ ./zmproxyinit 
Usage: ./zmproxyinit [-h] [-o] [-m] [-w] [-d [-r] [-s] [-a w1:w2:w3:w4] [-i p1:p2:p3:p4] [-p p1:p2:p3:p4] [-x mailmode]] 
[-e [-a w1:w2:w3:w4] [-i p1:p2:p3:p4] [-p p1:p2:p3:p4] [-x mailmode]] [-f] -H hostname
        -h: display this help message
        -H: Hostname of server on which enable/disable proxy functionality.
        -a: Colon separated list of Web ports to use. Format: HTTP-STORE:HTTP-PROXY:HTTPS-STORE:HTTPS-PROXY (Ex: 8080:80:
8443:443)
        -d: disable proxy
        -e: enable proxy
        -f: Full reset on memcached port and search queries and POP/IMAP throttling.
        -i: Colon separated list of IMAP ports to use. Format: IMAP-STORE:IMAP-PROXY:IMAPS-STORE:IMAPS-PROXY (Ex: 7143:14
3:7993:993)
        -m: Toggle mail proxy portions
        -o: Override enabled checks
        -p: Colon separated list of POP ports to use. Format: POP-STORE:POP-PROXY:POPS-STORE:POPS-PROXY (Ex: 7110:110:799
5:995)
        -r: Disable reverse proxy lookup target for store server.  Only valid with -d.  Be sure that you intend for all p
roxy function for the server to be disabled
        -s: Set cleartext to FALSE (secure mode) on disable
        -w: Toggle Web proxy portions
        -x: zimbraMailMode to use on disable (Default: http)
hostname is the value of the zimbra_server_hostname LC key for the server being modified.
Required options are -f by itself, or -f with -d or -e.
Note that -d or -e require one or both of -m and -w.
Note that -i or -p require -m.
Note that -a requires -w.
Note that -x requires -w and -d for store.
Note that -x requires -w for proxy.
The following are the defaults for -a, -i, -p, and -x if they are not supplied as options.
-a default on enable: 8080:80:8443:443
-a default on disable: 80:0:443:0
-i default on enable: 7143:143:7993:993
-i default on disable: 143:7143:993:7993
-p default on enable: 7110:110:7995:995
-p default on disable: 110:7110:995:7995
-x default on store disable: http
-x default on proxy enable/disable: http

What's Wrong?

Did you check in /opt/zimbra/log/nginx.log ?

Notable Proxy Bugs

Unresolved At This Time (Sept 25, 2008)

Unsorted

  • "ZCS Mailbox Server Proxy"
    • See: http://bugzilla.zimbra.com/show_bug.cgi?id=9469
    • From release notes, "HTTP proxy is supported (Beta). This includes REST sharing, Caldav, and Zimbra mobile. For Zimbra Mobile, ZCS redirect/forwards to the correct host. (Bug 9469)"
      • Please note, that ZCS HTTP Proxy (http reverse proxy) is Beta, first released in 5.0.6.
    • Though, as of 5.0.8,""For activesync connection to go thru the proxy, they'll have to configure reversed proxy. However, there're already a few known bugs about sharing broken with reversed proxy enabled. They're better off waiting for 5.0.9 than to try to configure reversed proxy now."
  • "need to support multi-server (proxy) for mobile clients"

Resolved In 5.0.9

Those That Are Sort Of Client Side Impacting
Configuration / Initial Setup Issues

Resolved in 5.0.7

Resolved in 5.0.6

Public Service Hostname

Resolved in 5.0.5

  • Nginx: http proxy does not work with REST
    • Note, this isn't "completely" resolved, as you'll notice by other targeted bugs with 5.0.5+ releases.
    • See: Nginx: http proxy does not work with REST

Single ZCS Server

Need To Disable Pop/Imap Proxy And Use POP/IMAP Normally

Sometimes, people install/setup proxy services on their single ZCS server and they don't need them. Here's how you would disable the proxy stuff and get imap/pop working over the default ports.

do a zmprov -l gs `zmhostname` | grep -i port

get the ports, then set variables to port 0:

zmprov ms `zmhostname` zimbraImapProxyBindPort 0
zmprov ms `zmhostname` zimbraImapSSLProxyBindPort 0
zmprov ms `zmhostname` zimbraPop3ProxyBindPort 0
zmprov ms `zmhostname` zimbraPop3SSLProxyBindPort 0

then, set the non "Proxy" ports to the desired standard ports

zmprov ms `zmhostname` zimbraImapBindPort 143
zmprov ms `zmhostname` zimbraImapSSLBindPort 993
zmprov ms `zmhostname` zimbraPop3BindPort 110
zmprov ms `zmhostname` zimbraPop3SSLBindPort 995

once complete:

zmprov ms `zmhostname` -zimbraServiceEnabled memcached
zmprov ms `zmhostname` -zimbraServiceEnabled imapproxy

zmproxyctl stop
zmmemcachedctl stop
zmmailboxdctl stop
zmmailboxdctl start 

Proxy Guide Rewrite Scratch Pad

Intro

Moved to Ajcody-Proxy-Guide-Rewrite-Project



Clustering Topics

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual Clustering Topics Homepage


Please see Ajcody-Clustering

My Other Clustering Pages


RFE I made based upon the experience above:

Clustering For ZCS 8 And Above


ZCS 8 Specifics

From the ZCS 8.0.5 Release Notes:

Red Hat Cluster Suite is not available with ZCS 8.0 To streamline support efforts, we will only test and certify in house availability solutions. Today VMware offers clustering failover and automated recovery through VMware HA. Zimbra integrates with the VMware HA cluster infrastructure to heartbeat Zimbra application services and provide automated recover in the event of a service failure. (Bugs 72215/72216)

If you use Zimbra Clustering

Zimbra Clustering is no longer available for ZCS 8.0. VMware provides integrated high availability between Zimbra and VMware HA for automated recovery of critical Zimbra application services and server components in the event of an application or infrastructure failure. Third party solutions such as network load balancers, storage mirroring, or OS clustering solutions like Red Hat Cluster Suite may be used in your deployment, but are not specifically tested or certified by VMware. (Bug75821)

Statement On Zimbra Support And "Clustering" For ZCS 8+ [In My Own Words - Ajcody]

I've sent this off to our PM team to review and to provide formal comments and documentation updates on it. - Ajcody

Official and Full support are NOT terms Zimbra Support applies to Redhat RHCS or Vmware's Clustering options since our team does not support either of those two options directly. We do not support customers in configuring or trouble-shooting the clustering components for Redhat's RHCS or Vmware's Clustering.

Will and can RHCS and Vmware's Clustering work with ZCS, yes. Does our team offer support in configuring, trouble-shooting, or diagnosing the clustering component of the setup - no. You would need to contact Redhat if you went with RHEL and RHCS or Vmware and your Linux OS distribution support channel if you went with Vmware Clustering.

Note - The zimbra clustering zimlets are completely removed with ZCS 8.6 . The Vmware clustering monitoring scripts are a separate issues that falls outside of general clustering support.

Future Releases After ZCS 8

Please see the following blog about our Always ON, Carrier Grade Architecture HA features we are hoping to have in future releases:

Vmware Virtualization and Clustering


Overview

From the ZCS 8.0.5 Release Notes:

Red Hat Cluster Suite is not available with ZCS 8.0 To streamline support efforts, we will only test and certify in house availability solutions. Today VMware offers clustering failover and automated recovery through VMware HA. Zimbra integrates with the VMware HA cluster infrastructure to heartbeat Zimbra application services and provide automated recover in the event of a service failure. (Bugs 72215/72216)

VMware Heartbeat Service

ZCS utilizes the VMware application programming interface that allows software providers to deploy application monitoring components inside a VMware guest OS and inform VMware HA when problems arise. The VMware-heartbeat service provides information to the VMware HA components on the health and availability of the ZCS. If you have VMware HA components installed, the VMware HA service is shown as enabled on the Server>Services page.

General Description of VMware HA

VMware HA provides a simple, reliable way to increase the availability of virtual machines hosting critical applications. VMware HA is a visualization- based distributed infrastructure service of VMware vSphere 4.1+, which monitors the health of virtual machines and the VMware ESX® hosts upon which they reside. If a fault is detected, the virtual machine is automatically restarted on another ESX host with adequate capacity to host it. VMware HA is included in all vSphere editions and can be enabled on a VMware cluster with a single check box. As VMware HA utilizes the storage and network connectivity already in place to support vMotion, enabling high availability is as simple as ensuring you have adequate server capacity to handle failure of one or more ESX hosts.

ZCS Scripts For Vmware-HA

The three scripts for vmware-ha are:

  • /opt/zimbra/bin/zmhactl
  • /opt/zimbra/libexec/vmware-heartbeat
  • /opt/zimbra/libexec/vmware-appmonitor

We have an open documentation RFE to better explain these :

Some older bugs describing a little more about the vmware-heartbeat check:

Enable Vmware-HA Service

To confirm the service is available to enable:

[As the zimbra user]

zmprov gs `zmhostname` zimbraServiceInstalled | grep vmware-ha
zimbraServiceInstalled: vmware-ha

To enable vmware-ha on a server:

[As the zimbra user]

su - zimbra
zmprov ms `zmhostname` +zimbraServiceEnabled vmware-ha
zmhactl start

Vmware Performance Recommendations For Vmware Clustering

See

VMware Host Based Replication (HBR)

Questions should be addressed to Vmware Support. This feature happens outside of Zimbra and is not QA tested by us.

Private Bug [Referenced here in case it's later made public]:


Other References

See also:

Webinar On Virtualizing Zimbra with VMware vSphere and NetApp NFS

Learn how the combination of VMware vSphere and NetApp file-based storage provides full support for virtualization and all of vSphere's advanced features (vMotion, Storage vMotion, DRS), simplifies high availability through the use of VMware HA and server consolidation.

View Webinar Now (Duration: 45 minutes)

Critical Bugs/RFE's - False Restarts And So Forth

Log Rotation Causes Cluster Failover

See:

Recommendations to work around bug until fix is released - 2 methods:

  • First Method - disable log rotation
    • Remove the zmmtaconfigctl restart from the /etc/logrotate.d/zimbra file so that it will not attempt to restart the service that is being detected as down. We can remove the line that reads:
su - zimbra -c "/opt/zimbra/bin/zmmtaconfigctl restart"
    • That will stop these failures, but will affect the logging for zmmtaconfigctl, probably causing it to write to a nonexistent file. We haven't seen problems in zmmtaconfig for a long time, so this is a pretty low risk workaround.
  • Second Method - disable software monitoring in general

Software Monitoring Causes Problems

  • To Disable software monitoring.
    • This will prevent failover if zmcluctl finds a service down. It will not prevent failover if there is a hardware fault detected by the cluster software.
      • $zmcluctl mode hardware
      • or
      • $zmlocalconfig -e zimbra_cluster_mode=hardware
      • Note from bug/rfe - Added switch for software or hardware only based fail-over implemented as a lc zimbra_cluster_mode attribute. default mode is software meaning any non-zero exit status from zmcontrol status will trigger a failover. hardware mode means that zmcluctl status will always return a zero exit status and will not consult zmcontrol status for the state.
    • To also increase the chance of getting more information in the log on what might be going on:
      • In /opt/zimbra-cluster/bin/zmcluctl you should see a line like:
        • my @output = `su - zimbra -c 'zmcontrol status'`;
      • Change that to:
        • my @output = `su - zimbra -c 'date >> /opt/zimbra/log/zmcluster-status.log ; zmcontrol status >> /opt/zimbra/log/zmcluster-status.log 2>> /opt/zimbra/log/zmcluster-status.log'`;
      • That should give us more logging. I believe zmcluctl is read every time from disk when it does the check, so no restart of services should be needed.

RHEL 5 Clusters And Cisco Switches

Please see the following:

Mysql Related Items Impacting Cluster

Please see:

Other Misc Bug/RFEs

Other bugs/rfe's you might be interested in looking at:

Failover Occurring Prior To Mysql Shutting Down - RHCS

Here is the summary of the situation that was sent for a case on the matter.

Regarding RHCS desired configuration -
In particular, it looks like mysqld can at times take quite a long time to shutdown, especially in situations when write IO is limited on the mysql db partition, and mysqld must write cache data to disk safely before shutting down. We believe this should be reflected in the "rc=1" output from "zmcontrol stop" - if mysqld does not stop within the 60 seconds via /opt/zimbra/bin/zmcontrol (via /opt/zimbra/bin/mysql.server), and then what appears to be happening is that RHCS either tries to unmount the filesystem and/or just kill -KILL the running process, which in turns causes mysqld to die ungracefully and cause the mysqld startup on the other box to go through a long log replay. The net result is one of two scenarios:
(a) mysqld takes longer to startup than it would have taken to shutdown (normal shutdown can take 0-10 minutes if mysqld has to flush a bunch of data to write out)
(b) mysqld is still running when RHCS tries to unmount the filesystem, which then fails, and therefore the failover fails
What we'd like to be able to recommend is a more robust failover logic, such as:
1. Run zmcontrol stop, check output
2. If failed, wait X seconds (e.g., 120 seconds)
3. Run zmcontrol stop again
4. If failed, wait X seconds
5. Run zmcontrol third time
6. If failed third time, try a kill -KILL and force unmount
If RHCS can be configured to do this, it would be the best way to handle this situation. The problem with modifying zmcontrol to have this logic internally is that it should not be granted the decision to wait indefinitely, in the case that mysqld is having a critical problem and is not shutting down. Having an external process manage this logic allows for additional triangulation on the determination of the situation, and allows additional capabilities such as monitoring the files in /opt/zimbra/db/data to confirm that files are changing. For example, if mysqld is still running and no files have changed in /opt/zimbra/db/data for a significant amount of time, it may indicate that mysqld is locked up, and other steps may be required. zmcontrol would not be able to handle all of this logic internally due to the needs for additional external monitoring outside of the zmcontrol process, including return code from the script.

RFE that was made about Zimbra adjusting the our script and the wait time:

Good Summary For RHEL Clustering


This is a good solid summary about RHEL clustering:

http://www.linuxjournal.com/article/9759

Active-Active Clustering


There is a bug(rfe) for active-active configuration. Please see:

http://bugzilla.zimbra.com/show_bug.cgi?id=19700

Non-San Based Fail Over HA/Cluster Type Configuration


This RFE covers issues when your wanting a "copy" of the data to reside on an independent server - LAN/WAN.

Please see:

RFE's/Bug Related To Supporting Clustering Options


Other Clustering RFE's And Bugs


HA-Linux (Heartbeat)



HA-Linux How-To For Testing And Educational Use

References:


Actual HA-Linux How-To For Testing And Educational Use Homepage

Please see Ajcody-Notes-HA-Linux-How-To

Motive Behind How-To

I hope this gives an easy way to setup through some clustering concepts for an administrator to gain some real-world experience when they currently have none. I plan on walking through each "function" that is behind clustering rather than jumping to an end setup (Linux-HA, Shared Storage, And Zimbra).

The structure will be:

  • Setup two machines (physical or virtual)
    • Emphasis physical hostname / ip vs. the hostname and ip address that will be for HA.
  • Setup virtual hostname and ip address for HA.
    • Explain and do ip failover between the two machines.
  • Setup a disk mount, we'll use probably use a nfs export from a third machine.
    • This will give us an example of expanding the HA conf files to move beyond the ip address failover.
    • Adjust HA conf's to now export via nfs a local directory from each server. This will not be a shared physical disk of course.
  • Setup a shared disk between the two servers and include it in the HA conf files.
    • Can use drbd or maybe figure out a way to share a virtual disk between the two vm's.
  • Setup a very simple application to include between the two machines. Something like apache or cups.
  • Go back and now readjust all variables between monitoring type (automatic) failover and simple manually initiated.



Virtualization Issues

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.



Actual Virutalization Issues Homepage


Please see Ajcody-Virtualization

Vmware - ESX - Performance & Support Resources

Internal Resources:


External Resources:

Vmware And Clustering

Please see Ajcody-Clustering#Vmware_Virtualization_and_Clustering

Introduction To Using VMWare ESX For ZCS Test Servers

References

References I ended up consulting to resolve and develope my notes below. There appears to be many alterations on how to do this depending on the version of the Vmware software you are using.

Introduction To Notes

I just did this and I plan on going through it and improving it once I have time.

  • I believe the hard coded reference to the volumes could use the sym-link for the path:
    • /vmfs/volumes/Storage vs. /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af
  • Setup /etc/hosts file on first vmimage to have entries for other machines
  • Configure first vmimage to use ESX server for DNS [/etc/resolv.conf] , NTP , and other network services
  • Configure vm configuration files, *.vmx , to use manual set MAC addresses and had last number matched number used in hostname.
  • Configure ESX server to act as DNS & DHCP server using to auto-allocate ip address and hostnames and set each hostname to have proper A, PTR, and MX records using hostname of image equally domainname for mail.
    • for example:
    • I would create three groups of images, if possible:
      • host.dev.DOMAIN.com
        • DEV is for pure testing
      • host.qa.DOMAIN.com
        • QA is for testing of changes prior to roll out to production
      • host.prod.DOMAIN.com
        • PROD would be replica's of production and used to test against production issues
    • Images configured as:
      • image hostname = centos5-30.dev.DOMAIN.com
      • server centos5-31.dev.DOMAIN.com has ip address of 192.168.0.31 - set A and PTR record
      • MX equals centos5-31.dev.DOMAIN.com / 192.168.0.31
    • Use more expansive descriptions in hostnames for standards and predictability.
      • Note, underscores ARE NOT vaild DNS hostnames per RFC 1034 - http://www.ietf.org/rfc/rfc1034.txt
      • Add the DEV - QA - PROD if your using that as well.
      • Primary Domain = example.com
        • LDAP Master hostname = ldap-1.DOMAIN.com
        • LDAP Replica hostnames = ldap-2.DOMAIN.com , ldap-3.DOMAIN.com , etc.
        • First MTA hostname = mta-1.DOMAIN.com
        • Other MTA hostnames = mta-2.DOMAIN.com , mta-3.DOMAIN.com , etc.
        • First Mailstore hostname = mailstore-1.DOMAIN.com
        • Other Mailstore hostnames = mailstore-2.DOMAIN.com , mailstore-3.DOMAIN.com , etc.
      • On proxy server hostname =
        • Proxy on MTA's: mta-1.DOMAIN.com , mta-2.DOMAIN.com , etc.
          • Though the proxy package can be installed on other servers, usually it is installed on the mta's or on it's own.
        • Proxy on it's own: proxy-1.DOMAIN.com , proxy-2.DOMAIN.com , etc.
      • On archive [A&D] hostname:
        • First Archive hostname = archive-1.DOMAIN.com
        • Other Archive hostnames = archive-2.DOMAIN.com , archive-3.DOMAIN.com , etc.
  • Configure proxy/firewall to be route point for primary domain and then pass to appropriate server for subdomain mail.
    • All external requess for *.zimbra.DOMAIN.com and zimbra.DOMAIN.com route to ESX server which in turns routes to appropriate vm server for subdomain.
  • Ports open on firewalls to allow vsphere connection to esx server:
  • Add post-clone script to the "gold image" to reconfigure the cloned image for things like hostname & network information. [Thanks Tony for the idea]

How-To Setup ESX For ZCS Test Servers

Creating Initial x64 VM

Initial Setup Of Guest Image In vSphere
  1. Right Click on ESX server name in left column listing in vSphere Client.
    1. Select "New Virtual Machine"
      1. Select "Typical"
      2. Name - ex. "Centos5-x64-30"
        1. Format being - Distro & Distro Version - platform x32 or x64 - last octet of ip address
      3. Datastore - your local esx data storage you'll be using
      4. Guest OS > Linux > RHEL5 64bit - RHEL for Centos [using my example]
      5. Create a disk
        1. Defaults to 8GB, but this isn't enough for ZCS because ZCS requires at least 5GB's free. The OS will take about 4-6+GB's between the swap partition, /boot , and /. Using installer defaults that is.
        2. I make the root image for 12GB. This will be enough to get a basic ZCS install done. One can add more later if needed.
          1. For a 'test' environment, I would recommend leaving the other options UNCHECKED.
            1. Leave UNCHECKED - Allocate and commit space on demand
            2. Leave UNCHECKED - Support clustering features such as Fault Tolerance.
      6. Ready to Complete - Check the box that says:
        1. check - "Edit the virtual machine settings before completion"
          1. Memory > Adjust Memory to be 1024 MB or 1 GB
          2. CD/DVD Drive 1 >
            1. Check "Connected at power on"
            2. Check "Datastore ISO File" and select the iso image for your OS - ex. CentOS-5.4-x86_64-bin-DVD.iso.
              1. Centos default disk partitioning will do:
              2. Also, see - need wiki section - about how to prep your server to host iso images via the datastore.
          3. The rest can be left as the defaults for now.
Initial Setup Of Guest Image Operating System - CentOS/RHEL Example
  1. In the vSphere Client and right click on Guest image, ex. "Centos5-x64-30", and select power on.
    1. Prep our 'base image' prior to cloning it.
    2. The image should give you your Distro's installer screen. Go through the OS installation.
      1. Note about CentOS example
        1. First stage of installer
          1. The partitioning example if using the defaults will give you:
            • /dev/sda1  /boot       ext3      101 MB
            • /dev/sdb2  VolGroup00  LVM PV  12182 MB
              • LogVol00  /  ext3  10144 MB
              • LovVol01     swap   2016 MB
          2. The Network Devices
            1. Network Devices > click on edit
              1. Leave CHECKED - "Enabled IPv4 support"
              2. UNCHECKED "Enable IPv6 support"
          3. Package Selection
            1. Check the "Server" option and then click "Next"
              1. Installer will now finish the first stage of the installation and reboot.
        2. Second state of installation.
          1. Firewall > Disable firewall.
          2. SELinux > Disable SELinux
          3. Date and Time
            1. Network Time Protocol - Enable NTP if you'll be able to reach the NTP servers.
              1. Check the "Synchronize system clock before starting service"
          4. Create User > No need to create additional users for ZCS purposes.
          5. Finish installation.
        3. Post-Installation
          1. Note - Ctrl+Alt allows you to switch the focus of the mouse in and out of the VM guest image showing in vSphere's client.
          2. Note - The client 'screen' is under the "Console" tab.
          3. Install VMwareTools
            1. In the vSphere Client and right click on Guest image, ex. "Centos5-x64-30", and select Guest > Install\Upgrade VMware Tools.
            2. Double click on the VMwareTools rpm or install it via CLI.
            3. You can also run the vmware-tool configuration script
            4. vmware-config-tools.pl
            5. Allows you to adjust the screen resolution and cut-n-paste between workstation and the guest vm.
          4. Launch a terminal. Applications > Accessories > Terminal
            1. Disable sendmail from being used. Note - CentOS/RHEL uses sendmail as default, for another distro you might need to disable postfix from being used.
              1. In terminal, paste [if you installed vmware tools] or type the following command.
              2.  chkconfig sendmail off ; /etc/init.d/sendmail stop
            2. Install some prereq packages that you might not already have installed - CentOS example:
              1. yum install compat-libstdc++-33 compat-libstdc++-296 sysstat
            3. Umount the vmware-tools mount - example
              1.  umount /media/VMware\ Tools/ 
              2. confirm with df -h
            4. Reboot server now - the guest OS image.
          5. See also Ajcody-Virtualization#RHEL_or_CentOS for adding 'disk/partitions' to an image.

Manual Cloning of x32 Setup

My Version of Vmware ESX does not have a cloning option - I was actually given the ESX box rebuilt. So here's what I did to 'clone' an image the manual way. See Ajcody-Virtualization-Named-DNS about setting up BIND/DNS for this example.

# Vmware ESX 4.0.0 Build 208167
# vSphere Client 4.0.0. Build 208111
#
# Copy some iso files to the server, here's is what I used. 
# Please note the vmx files below in my examples to my iso name for the centos dvd.
#   [ /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/iso/CentOS/CentOS-5.4-i386-bin-DVD.iso ]
# Create your first VM - I called my Centos5-30 and that standard and naming convention is used throughout.
# I left the hostname just to use the localhost and installed the vmware tools.
# I then shutdown the image and did a snapshot of it.

pwd
  /vmfs/volumes

ls -la
  total 1024
  drwxr-xr-x 1 root root  512 Apr  9 23:59 .
  drwxrwxrwt 1 root root  512 Apr  9 00:39 ..
  drwxr-xr-t 1 root root 4200 Apr  9 23:20 4bbaf57f-6230127f-d432-00101849e4af
  lrwxr-xr-x 1 root root   35 Apr  9 23:59 Storage1 -> 4bbaf57f-6230127f-d432-00101849e4af

cd Storage1/

ls
  Centos5-30/      esxconsole-4bbb574e-eae0-2eb3-9d5b-00101849e4af/ 	iso/

# Download and copy the various OS iso's you'll want and copy them underneath your storage volume, 
# I made an iso directory for them all.
# Also, I used Firefox and the add-on DownThemAll and went to the Zimbra download pages
# http://www.zimbra.com/downloads/ne-downloads.html
# http://www.zimbra.com/downloads/ne-downloads-previous.html
# And downloaded all the versions of ZCS that I wanted to test against. I then used K3B under Linux
# to make iso files of the tar balls. Copy the iso files to your ESX server under the iso directory
# you made. If you want to mount them remotely to confirm they are ok to or to review what they have:
# ex.  mount -t iso9660 ./zcs-x32-installs.iso /mnt/cdrom -o ro,loop
# Having the Zimbra iso files like that will allow your images to easily install Zimbra .

ls -R iso/
  CentOS/  openSUSE/  SLES/  Ubuntu/  ZCS/
  ./CentOS:
    CentOS-5.4-i386-bin-DVD.iso  CentOS-5.4-x86_64-bin-DVD.iso
  ./openSUSE:
    openSUSE-11.2-Addon-NonOss-BiArch-i586-x86_64.iso  openSUSE-11.2-DVD-i586.iso  
    openSUSE-11.2-DVD-x86_64.iso
  ./SLES:
    SLES-10-SP3-DVD-i386-GM-DVD1.iso  SLES-10-SP3-DVD-x86_64-GM-DVD1.iso  SLES-11-DVD-i586-GM-DVD1.iso
    SLES-10-SP3-DVD-i386-GM-DVD2.iso  SLES-10-SP3-DVD-x86_64-GM-DVD2.iso  SLES-11-DVD-i586-GM-DVD2.iso
  ./Ubuntu:
    ubuntu-8.04.4-desktop-amd64.iso  ubuntu-8.04.4-desktop-i386.iso  
    ubuntu-8.04.4-server-amd64.iso  ubuntu-8.04.4-server-i386.iso
  ./ZCS:
    zcs-x32-606-02_5023-018.iso  zcs-x64-5018-23.iso  zcs-x64-603-06.iso

vmware-cmd -l
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-30/Centos5-30.vmx

pwd
  /vmfs/volumes/Storage1

# Make more directories for you to copy the initial image vitrual disks to

mkdir Centos5-{31..49}

# Now you'll do a copy operation of your first image to the new directories you made

pwd
  /vmfs/volumes/Storage1

vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-31/Centos5-31.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-32/Centos5-32.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-33/Centos5-33.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-34/Centos5-34.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-35/Centos5-35.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-36/Centos5-36.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-37/Centos5-37.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-39/Centos5-39.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-39/Centos5-39.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-40/Centos5-40.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-41/Centos5-41.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-42/Centos5-42.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-43/Centos5-43.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-44/Centos5-44.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-45/Centos5-45.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-46/Centos5-46.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-47/Centos5-47.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-48/Centos5-48.vmdk
vmkfstools -i ./Centos5-30/Centos5-30.vmdk ./Centos5-49/Centos5-49.vmdk

pwd
  /vmfs/volumes/Storage1

# Now you'll copy the inital images configuration file to the directory above the image directories 
# so we can modify it and make it a template file

cp Centos5-30/Centos5-30.vmx ./Centos5-31.vmx

vi Centos5-31.vmx
  change variables to be more generic

cat Centos5-31.vmx 
  #!/usr/bin/vmware
  .encoding = "UTF-8"
  config.version = "8"
  virtualHW.version = "7"
  pciBridge0.present = "TRUE"
  pciBridge4.present = "TRUE"
  pciBridge4.virtualDev = "pcieRootPort"
  pciBridge4.functions = "8"
  pciBridge5.present = "TRUE"
  pciBridge5.virtualDev = "pcieRootPort"
  pciBridge5.functions = "8"
  pciBridge6.present = "TRUE"
  pciBridge6.virtualDev = "pcieRootPort"
  pciBridge6.functions = "8"
  pciBridge7.present = "TRUE"
  pciBridge7.virtualDev = "pcieRootPort"
  pciBridge7.functions = "8"
  vmci0.present = "TRUE"
  nvram = "Centos5-31.nvram"
  deploymentPlatform = "windows"
  virtualHW.productCompatibility = "hosted"
  unity.customColor = "|23C0C0C0"
  tools.upgrade.policy = "useGlobal"
  powerType.powerOff = "soft"
  powerType.powerOn = "default"
  powerType.suspend = "hard"
  powerType.reset = "soft"
  displayName = "Centos5-31"
  extendedConfigFile = "Centos5-31.vmxf"
  floppy0.present = "TRUE"
  scsi0.present = "TRUE"
  scsi0.sharedBus = "none"
  scsi0.virtualDev = "lsilogic"
  memsize = "1024"
  scsi0:0.present = "TRUE"
  scsi0:0.fileName = "Centos5-31.vmdk"
  scsi0:0.deviceType = "scsi-hardDisk"
  ide1:0.present = "TRUE"
  ide1:0.clientDevice = "FALSE"
  ide1:0.deviceType = "cdrom-image"
  ide1:0.startConnected = "TRUE"
  floppy0.startConnected = "FALSE"
  floppy0.clientDevice = "TRUE"
  ethernet0.present = "TRUE"
  ethernet0.networkName = "VM Network"
  ethernet0.addressType = "generated"
  guestOSAltName = "Red Hat Enterprise Linux 5 (32-bit)"
  guestOS = "rhel5"
  uuid.location = "56 4d 41 ed 87 cc a2 03-77 97 48 8c 65 16 7e ed"
  uuid.bios = "56 4d 41 ed 87 cc a2 03-77 97 48 8c 65 16 7e ed"
  vc.uuid = "52 9e a1 5c 02 25 0f c2-20 03 f8 bb 21 93 74 c7"
  ethernet0.generatedAddress = ""
  tools.syncTime = "FALSE"
  cleanShutdown = "TRUE"
  replay.supported = "FALSE"
  sched.swap.derivedName = "/vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-31/Centos5-31-d6823091.vswp"
  scsi0:0.redo = ""
  vmotion.checkpointFBSize = "4194304"
  pciBridge0.pciSlotNumber = "17"
  pciBridge4.pciSlotNumber = "21"
  pciBridge5.pciSlotNumber = "22"
  pciBridge6.pciSlotNumber = "23"
  pciBridge7.pciSlotNumber = "24"
  scsi0.pciSlotNumber = "16"
  ethernet0.pciSlotNumber = "32"
  vmci0.pciSlotNumber = "33"
  ethernet0.generatedAddressOffset = "0"
  vmci0.id = "-876333085"
  hostCPUID.0 = "0000000b756e65476c65746e49656e69"
  hostCPUID.1 = "000106a500100800009ce3bdbfebfbff"
  hostCPUID.80000001 = "00000000000000000000000128100800"
  guestCPUID.0 = "0000000b756e65476c65746e49656e69"
  guestCPUID.1 = "000106a500010800809822010febfbff"
  guestCPUID.80000001 = "00000000000000000000000128100800"
  userCPUID.0 = "0000000b756e65476c65746e49656e69"
  userCPUID.1 = "000106a500100800009822010febfbff"
  userCPUID.80000001 = "00000000000000000000000128100800"
  evcCompatibilityMode = "FALSE"
  ide1:0.fileName = "/vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/iso/CentOS/CentOS-5.4-i386-bin-DVD.iso"
  floppy0.fileName = "/dev/fd0"
  debugStub.linuxOffsets = "0xa356145,0xffffffff,0xfc052084,0xffffffff,0x0,0x0,0xa356150,0x0,0xa35616f,0x0,0xfc052088,0xffffffff,0x0,0x0"
  tools.remindInstall = "TRUE"
  sched.cpu.affinity = "all"
  sched.swap.hostLocal = "disabled"

# Now we'll copy this template to the other image directories

cp Centos5-31.vmx Centos5-31/Centos5-31.vmx
cp Centos5-31.vmx Centos5-32/Centos5-32.vmx
cp Centos5-31.vmx Centos5-33/Centos5-33.vmx
cp Centos5-31.vmx Centos5-34/Centos5-34.vmx
cp Centos5-31.vmx Centos5-35/Centos5-35.vmx
cp Centos5-31.vmx Centos5-36/Centos5-36.vmx
cp Centos5-31.vmx Centos5-37/Centos5-37.vmx
cp Centos5-31.vmx Centos5-38/Centos5-38.vmx
cp Centos5-31.vmx Centos5-39/Centos5-39.vmx
cp Centos5-31.vmx Centos5-40/Centos5-40.vmx
cp Centos5-31.vmx Centos5-41/Centos5-41.vmx
cp Centos5-31.vmx Centos5-42/Centos5-42.vmx
cp Centos5-31.vmx Centos5-43/Centos5-43.vmx
cp Centos5-31.vmx Centos5-44/Centos5-44.vmx
cp Centos5-31.vmx Centos5-45/Centos5-45.vmx
cp Centos5-31.vmx Centos5-46/Centos5-46.vmx
cp Centos5-31.vmx Centos5-47/Centos5-47.vmx
cp Centos5-31.vmx Centos5-48/Centos5-48.vmx
cp Centos5-31.vmx Centos5-49/Centos5-49.vmx

# You'll want to swap the references of the initial image name [ Centos5-30 ] to be the directories image name 

vi Centos5-31/Centos5-31.vmx 
vi Centos5-32/Centos5-32.vmx 
vi Centos5-33/Centos5-33.vmx 
vi Centos5-34/Centos5-34.vmx 
vi Centos5-35/Centos5-35.vmx 
vi Centos5-36/Centos5-36.vmx 
vi Centos5-37/Centos5-37.vmx 
vi Centos5-38/Centos5-38.vmx 
vi Centos5-39/Centos5-39.vmx 
vi Centos5-40/Centos5-40.vmx 
vi Centos5-41/Centos5-41.vmx 
vi Centos5-42/Centos5-42.vmx 
vi Centos5-43/Centos5-43.vmx 
vi Centos5-43/Centos5-43.vmx 
vi Centos5-44/Centos5-44.vmx 
vi Centos5-45/Centos5-45.vmx 
vi Centos5-46/Centos5-46.vmx
vi Centos5-47/Centos5-47.vmx
vi Centos5-48/Centos5-48.vmx
vi Centos5-49/Centos5-49.vmx

# Now we can register those new images and they'll show up in your vSphere Client

vmware-cmd Centos5-31/Centos5-31.vmx register
vmware-cmd Centos5-32/Centos5-32.vmx register
vmware-cmd Centos5-33/Centos5-33.vmx register
vmware-cmd Centos5-34/Centos5-34.vmx register
vmware-cmd Centos5-35/Centos5-35.vmx register
vmware-cmd Centos5-36/Centos5-36.vmx register
vmware-cmd Centos5-37/Centos5-37.vmx register
vmware-cmd Centos5-38/Centos5-38.vmx register
vmware-cmd Centos5-39/Centos5-39.vmx register
vmware-cmd Centos5-40/Centos5-40.vmx register
vmware-cmd Centos5-41/Centos5-41.vmx register
vmware-cmd Centos5-42/Centos5-42.vmx register
vmware-cmd Centos5-43/Centos5-43.vmx register
vmware-cmd Centos5-44/Centos5-44.vmx register
vmware-cmd Centos5-45/Centos5-45.vmx register
vmware-cmd Centos5-46/Centos5-46.vmx register
vmware-cmd Centos5-47/Centos5-47.vmx register
vmware-cmd Centos5-48/Centos5-48.vmx register
vmware-cmd Centos5-49/Centos5-49.vmx register

# Confirm they all are registered

vmware-cmd -l | sort
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-30/Centos5-30.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-31/Centos5-31.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-32/Centos5-32.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-33/Centos5-33.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-34/Centos5-34.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-35/Centos5-35.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-36/Centos5-36.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-37/Centos5-37.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-38/Centos5-38.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-39/Centos5-39.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-40/Centos5-40.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-41/Centos5-41.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-42/Centos5-42.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-43/Centos5-43.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-44/Centos5-44.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-45/Centos5-45.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-46/Centos5-46.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-47/Centos5-47.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-48/Centos5-48.vmx
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af/Centos5-49/Centos5-49.vmx

# You'll see your images now in your vSphere Client. 
# When you first start them, do a console view of it because you'll see in that view 
# you need to select an option before it will start up.
# Choose :  "I copied it"
# Once image is running, login as root and within a shell confirm your network interface has
# an unique IP address as well as a unique MAC address for the interface
# You then might want to suspend the image at this point.

Manual Cloning of x64 Setup

If you can to x64 with your VMware, here's the additions steps for that [cut-n-paste]

Make a new image for x64 rhel5 called Centos5-x64-50 and once it's all done, shutdown and halt it.

Short and sweet update for ESXi 5.5

[ Working Dir is /vmfs/volumes/datastore1 ]

# ls -la /vmfs/volumes/ | grep data
lrwxr-xr-x    1 root     root            35 Aug 24 21:35 datastore1 -> 53f864a6-1d3302c1-1b97-00101849e4af

# mkdir linuxsrv

# vmkfstools -i Centos\ 6.5\ Base/Centos\ 6.5\ Base.vmdk linuxsrv/linuxsrv.vmdk

# cp Centos\ 6.5\ Base/Centos\ 6.5\ Base.vmx linuxsrv/linuxsrv.vmx

# vi linuxsrv/linuxsrv.vmx
   ESC Key
   :%s/Centos 6.5 Base/linuxsrv/g
   ESC Key
  # make the following variables blank , ethernet0.generatedAddress = "00:0c:29:44:16:8d"
   ethernet0.generatedAddress = ""
   :wq!

# Note - if you have snapshots against your source image, you might need to adjust this var
# scsi0:0.fileName = "850-Wapp2-0000104.vmdk" , for example. The numbers after the hostname get removed.
# 

# vim-cmd solo/registervm /vmfs/volumes/datastore1/linuxsrv/linuxsrv.vmx
10

For ESX 4


pwd
  /vmfs/volumes/4bbaf57f-6230127f-d432-00101849e4af

mkdir Centos5-x64-{51..69}

vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-51/Centos5-x64-51.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-52/Centos5-x64-52.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-53/Centos5-x64-53.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-54/Centos5-x64-54.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-55/Centos5-x64-55.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-56/Centos5-x64-56.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-57/Centos5-x64-57.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-58/Centos5-x64-58.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-59/Centos5-x64-59.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-60/Centos5-x64-60.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-61/Centos5-x64-61.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-62/Centos5-x64-62.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-63/Centos5-x64-63.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-64/Centos5-x64-64.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-65/Centos5-x64-65.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-66/Centos5-x64-66.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-67/Centos5-x64-67.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-68/Centos5-x64-68.vmdk
vmkfstools -i Centos5-x64-50/Centos5-x64-50.vmdk Centos5-x64-69/Centos5-x64-69.vmdk

# Setup the vmx file like a template like you did for the 32bit ones and then copy to the other x64 directories.

cp Centos5-x64-50/Centos5-x64-50.vmx ./
cp Centos5-x64-50/Centos5-x64-50.vmx ./Centos5-x64-60.vmx

# make this like be empty quoted - ethernet0.generatedAddress = ""

vi Centos5-x64-50.vmx

# Edit this for the ethernet and change to 50 to 60 -- make for editing easier for the 60 dir's

vi Centos5-x64-60.vmx

# copy to other directories.

cp Centos5-x64-50.vmx Centos5-x64-51/Centos5-x64-51.vmx
cp Centos5-x64-50.vmx Centos5-x64-52/Centos5-x64-52.vmx
cp Centos5-x64-50.vmx Centos5-x64-53/Centos5-x64-53.vmx
cp Centos5-x64-50.vmx Centos5-x64-54/Centos5-x64-54.vmx
cp Centos5-x64-50.vmx Centos5-x64-55/Centos5-x64-55.vmx
cp Centos5-x64-50.vmx Centos5-x64-56/Centos5-x64-56.vmx
cp Centos5-x64-50.vmx Centos5-x64-57/Centos5-x64-57.vmx
cp Centos5-x64-50.vmx Centos5-x64-58/Centos5-x64-58.vmx
cp Centos5-x64-50.vmx Centos5-x64-59/Centos5-x64-59.vmx

cp Centos5-x64-60.vmx Centos5-x64-60/Centos5-x64-60.vmx
cp Centos5-x64-60.vmx Centos5-x64-61/Centos5-x64-61.vmx
cp Centos5-x64-60.vmx Centos5-x64-62/Centos5-x64-62.vmx
cp Centos5-x64-60.vmx Centos5-x64-63/Centos5-x64-63.vmx
cp Centos5-x64-60.vmx Centos5-x64-64/Centos5-x64-64.vmx
cp Centos5-x64-60.vmx Centos5-x64-65/Centos5-x64-65.vmx
cp Centos5-x64-60.vmx Centos5-x64-66/Centos5-x64-66.vmx
cp Centos5-x64-60.vmx Centos5-x64-67/Centos5-x64-67.vmx
cp Centos5-x64-60.vmx Centos5-x64-68/Centos5-x64-68.vmx
cp Centos5-x64-60.vmx Centos5-x64-69/Centos5-x64-69.vmx

# Now edit them, replacing the 50 in the hostname reference to match the ## of the directory.

vi Centos5-x64-51/Centos5-x64-51.vmx
vi Centos5-x64-52/Centos5-x64-52.vmx
vi Centos5-x64-53/Centos5-x64-53.vmx
vi Centos5-x64-54/Centos5-x64-54.vmx
vi Centos5-x64-55/Centos5-x64-55.vmx
vi Centos5-x64-56/Centos5-x64-56.vmx
vi Centos5-x64-57/Centos5-x64-57.vmx
vi Centos5-x64-58/Centos5-x64-58.vmx
vi Centos5-x64-59/Centos5-x64-59.vmx

# Now edit them, replacing the 60 in the hostname reference to match the ## of the directory.

vi Centos5-x64-61/Centos5-x64-61.vmx
vi Centos5-x64-62/Centos5-x64-62.vmx
vi Centos5-x64-63/Centos5-x64-63.vmx
vi Centos5-x64-64/Centos5-x64-64.vmx
vi Centos5-x64-65/Centos5-x64-65.vmx
vi Centos5-x64-66/Centos5-x64-66.vmx
vi Centos5-x64-67/Centos5-x64-67.vmx
vi Centos5-x64-68/Centos5-x64-68.vmx
vi Centos5-x64-69/Centos5-x64-69.vmx

# Register the x64 images

vmware-cmd Centos5-x64-51/Centos5-x64-51.vmx register
vmware-cmd Centos5-x64-52/Centos5-x64-52.vmx register
vmware-cmd Centos5-x64-53/Centos5-x64-53.vmx register
vmware-cmd Centos5-x64-54/Centos5-x64-54.vmx register
vmware-cmd Centos5-x64-55/Centos5-x64-55.vmx register
vmware-cmd Centos5-x64-56/Centos5-x64-56.vmx register
vmware-cmd Centos5-x64-57/Centos5-x64-57.vmx register
vmware-cmd Centos5-x64-58/Centos5-x64-58.vmx register
vmware-cmd Centos5-x64-59/Centos5-x64-59.vmx register

vmware-cmd Centos5-x64-60/Centos5-x64-60.vmx register
vmware-cmd Centos5-x64-61/Centos5-x64-61.vmx register
vmware-cmd Centos5-x64-62/Centos5-x64-62.vmx register
vmware-cmd Centos5-x64-63/Centos5-x64-63.vmx register
vmware-cmd Centos5-x64-64/Centos5-x64-64.vmx register
vmware-cmd Centos5-x64-65/Centos5-x64-65.vmx register
vmware-cmd Centos5-x64-66/Centos5-x64-66.vmx register
vmware-cmd Centos5-x64-67/Centos5-x64-67.vmx register
vmware-cmd Centos5-x64-68/Centos5-x64-68.vmx register
vmware-cmd Centos5-x64-69/Centos5-x64-69.vmx register

# You'll see your images now in your vSphere Client. 
# When you first start them, do a console view of it because you'll see in that view 
# you need to select an option before it will start up.
# Choose :  "I copied it"
# Once image is running, login as root and within a shell confirm your network interface has
# an unique IP address as well as a unique MAC address for the interface
# You then might want to suspend the image at this point.

Other Useful Steps To Get Zimbra Installed And Running

RHEL or CentOS
chkconfig sendmail off
/etc/init.d/sendmail stop

Some prereq packages that you might not already have installed:

yum install compat-libstdc++-33 compat-libstdc++-296 sysstat
Adding Additional Storage

Adding additional storage for Zimbra installation requirement

  • Add new virtual disk - requires at least 5GB's of free space on available partition
  • Power Off VM And then create a new disk giving it at least 5GB's of space
  • Power On the VM
  • You can then run this to see/confirm the new "disk"
    •  fdisk -l
    • In my example here, my new disk is /dev/sdb
      • Partition the new disk
        •  fdisk /dev/sdb 
        • Select "n" for new partition
        • Select "p" for primary partition
        • Select "1" for partition number
        • Select default of "1" for first cylinder
        • Select default, which should be the highest number given in range. This will change based upon the size of the virtual disk you made.
        • You new disk is now partition.
        • Hit "p" to print out the partition table to confirm.
        • Hit "w" to write table to disk and exit fdisk.
      • Create new filesystem for the new disk/partition
        • This example uses ext3 and the example partition path of /dev/sdb1
        •  mkfs.ext3 /dev/sdb1 
      • Setup /etc/fstab to mount the new partition for zimbra use
        •  mkdir /opt/zimbra 
        •  vi /etc/fstab 
        • And now add a line like the following:
        • /dev/sdb1       /opt/zimbra        ext3   defaults  1 1
Moving Zimbra To New Partitions For zimbra and backups

Adding additional storage for Zimbra installation requirement

  • Disable zimbra from starting via init.d - how this is done depends on your distro.
  • Power Off VM And then create two new virtual disks. Spacing is based upon your current usage and what you expect you'll need going forward. Recommend the disk is allocated now vs allowing it to dynamically grow.
  • Power On the VM
  • Confirm zimbra isn't running, stop it if it is running:
    •  su - zimbra ; zmcontrol stop 
  • You should now confirm the new "disks" exist
    •  fdisk -l
    • In my example here, my new disks are /dev/sdb and /dev/sdc
      • Partition the new sdb disk
        •  fdisk /dev/sdb 
        • Select "n" for new partition
        • Select "p" for primary partition
        • Select "1" for partition number
        • Select default of "1" for first cylinder
        • Select default, which should be the highest number given in range. This will change based upon the size of the virtual disk you made.
        • You new disk is now partition.
        • Hit "p" to print out the partition table to confirm.
        • Hit "w" to write table to disk and exit fdisk.
      • Partition the new sdc disk
        •  fdisk /dev/sdc 
        • Select "n" for new partition
        • Select "p" for primary partition
        • Select "1" for partition number
        • Select default of "1" for first cylinder
        • Select default, which should be the highest number given in range. This will change based upon the size of the virtual disk you made.
        • You new disk is now partition.
        • Hit "p" to print out the partition table to confirm.
        • Hit "w" to write table to disk and exit fdisk.
      • Create new filesystem for the new disks/partitions
        • This example uses ext3 and the example partition path of /dev/sdb1 and /dev/sdc1
        •  mkfs.ext3 /dev/sdb1 
        •  mkfs.ext3 /dev/sdc1 
      • Move zimbra data to a temporary location
        • as root
        •  mv /opt/zimbra /opt/zimbra_old 
      • Setup /etc/fstab to mount the new partition for zimbra use
        •  vi /etc/fstab 
        • And now add a line like the following, they must be below the entry for your / partition:
        • /dev/sdb1       /opt/zimbra        ext3   defaults  1 1
        • /dev/sdc1       /opt/zimbra/backup ext3   defaults  1 1
        • Save the file.
        • We first need to get /opt/zimbra mounted before the backup partition.
        •  mkdir /opt/zimbra 
        •  mount /opt/zimbra 
        • Now we can do the backup one.
        •  mkdir /opt/zimbra/backup 
        •  chown zimbra:zimbra /opt/zimbra/backup 
        •  mount /opt/zimbra/backup 
      • Now we sync the data over onto our new partitions.
        •  rsync -avzHS --progress /opt/zimbra_old/ /opt/zimbra 
        • Once you confirm your rsync is done and is correct, you could remove the old data.
        •  rm -rf /opt/zimbra_old 
      • You should now be able to start zimbra.
        • su - zimbra ; zmcontrol start
      • Remember to re-enable zimbra to start from init.d now also if you disabled it at the beginning.

Final Look

Comment About Hyper-threading And CPU Performance

TheE5520 has 4 cores, which do show up in vSphere as 4 available proc's but the cpuinfo just shows the one. Difference comes when Intel VT [vmx flag in cpuinfo] or AMD-V [svm flag in cpuinfo] is enabled while hyperthreading [ht flag in cpuinfo] is turned off. Turning on HT in the bios I think would show 8 proc in vm and report 4 cores in the cpuinfo output from base OS [don't want to reboot and reconfigure at the moment to double check]. Note, cpuinfo will show HT if the cpu's support it - not just if it's enabled. You still need to enable it and confirm APCI is enabled in the BIOS if your not seeing the 'virtual cpu's'. VT is about seeing the physical cores and individual cpu's. HT is about virtualizing each cpu or core into 2 virtual cpu's.

Spec

ESX Server

[root@vmware-server ~]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 26
model name : Intel(R) Xeon(R) CPU E5520 @ 2.27GHz
stepping : 5
cpu MHz : 2266.688
cache size : 8192 KB
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi
 mmx fxsr sse sse2 ss ht tm syscall nx rdtscp lm constant_tsc ida nonstop_tsc pni monitor ds_cpl 
 vmx est tm2 cx16 xtpr popcnt lahf_lm
bogomips : 4535.95
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

[root@vmware-server ~]# cat /proc/meminfo
MemTotal: 356684 kB
MemFree: 30392 kB
Buffers: 9068 kB
Cached: 127804 kB
SwapCached: 14180 kB
Active: 264444 kB
Inactive: 41320 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 356684 kB
LowFree: 30392 kB
SwapTotal: 730916 kB
SwapFree: 671960 kB
Dirty: 208 kB
Writeback: 0 kB
AnonPages: 168356 kB
Mapped: 36188 kB
Slab: 12448 kB
PageTables: 3160 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 909256 kB
Committed_AS: 533636 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 25036 kB
VmallocChunk: 34359705099 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
Hugepagesize: 2048 kB
MachineMem: 12580415 kB

[root@vmware-server ~]# uname -a
Linux vmware-server.zimbra.homunix.com 2.6.18-128.ESX #1 
 Thu Oct 15 16:11:16 PDT 2009 x86_64 x86_64 x86_64 GNU/Linux

[root@vmware-server ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.1 (Tikanga)

[root@vmware-server ~]# fdisk -l

Disk /dev/sda: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 * 1 140 1124518+ 83 Linux
/dev/sda2 141 154 112455 fc VMware VMKCORE
/dev/sda3 155 91201 731335027+ 5 Extended
/dev/sda5 155 91201 731334996 fb VMware VMFS

Disk /dev/sdb: 8095 MB, 8095006720 bytes
255 heads, 63 sectors/track, 984 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 91 730926 82 Linux swap / Solaris
/dev/sdb2 92 346 2048287+ 83 Linux
/dev/sdb3 347 984 5124735 5 Extended
/dev/sdb5 347 984 5124703+ 83 Linux


I've setup the vm's to have 1 cpu and 1024MB RAM. I have 9 running right now. Here's one of my 64bit image details:

[root@mail59 ~]# cat /proc/meminfo
MemTotal: 1026932 kB
MemFree: 85816 kB
Buffers: 14884 kB
Cached: 87132 kB
SwapCached: 117444 kB
Active: 705916 kB
Inactive: 143664 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 1026932 kB
LowFree: 85816 kB
SwapTotal: 2064376 kB
SwapFree: 1453736 kB
Dirty: 644 kB
Writeback: 0 kB
AnonPages: 734740 kB
Mapped: 34284 kB
Slab: 38884 kB
PageTables: 33304 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 2577840 kB
Committed_AS: 3257840 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 263932 kB
VmallocChunk: 34359473927 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
Hugepagesize: 2048 kB
[root@mail59 ~]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 26
model name : Intel(R) Xeon(R) CPU E5520 @ 2.27GHz
stepping : 5
cpu MHz : 2266.631
cache size : 8192 KB
fpu : yes
fpu_exception : yes
cpuid level : 11
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 
 clflush dts acpi mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_tsc up ida 
 nonstop_tsc pni cx16 popcnt lahf_lm
bogomips : 4533.26
clflush size : 64
cache_alignment : 64
address sizes : 40 bits physical, 48 bits virtual
power management: [8]

[root@mail59 ~]# uname -a
Linux mail59.zimbra.homeunix.com 2.6.18-164.el5 #1 SMP Thu 
 Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux

[root@mail59 ~]# cat /etc/redhat-release
CentOS release 5.4 (Final)

[root@mail59 ~]# fdisk -l

Disk /dev/sda: 10.7 GB, 10737418240 bytes
255 heads, 63 sectors/track, 1305 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 * 1 13 104391 83 Linux
/dev/sda2 14 1305 10377990 8e Linux LVM

Disk /dev/sdb: 8589 MB, 8589934592 bytes
255 heads, 63 sectors/track, 1044 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 1044 8385898+ 83 Linux

[root@mail59 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
7.7G 3.5G 3.9G 48% /
/dev/sda1 99M 13M 82M 14% /boot
tmpfs 502M 0 502M 0% /dev/shm
/dev/hdc 6.8G 6.8G 0 100% /media/zcs-x64-603-06
/dev/sdb1 7.9G 1.8G 5.8G 24% /opt/zimbra

Here's my esxtop output, which is ran on the base os of your ESX server. You'll see the running vm's I mentioned.

[root@vmware-server ~]# esxtop

 9:20:07pm up 32 days 20:43, 139 worlds; CPU load average: 0.14, 0.15, 0.16
PCPU USED(%):   7.7   7.3   6.8   6.8 AVG:   7.1
PCPU UTIL(%):  10.6  10.4  10.0   9.9 AVG:  10.2
CCPU(%):   0 us,   2 sy,  98 id,   0 wa ;       cs/sec:    229

     ID    GID NAME             NWLD   %USED    %RUN    %SYS   %WAIT    %RDY   %IDLE  %OVRLP   %CSTP  %MLMTD  %SWPWT
      1      1 idle                4  367.57  370.04    0.00    0.00   34.02    0.00    0.00    0.00    0.00    0.00
      2      2 system              6    0.01    0.01    0.00  600.00    0.00    0.00    0.00    0.00    0.00    0.00
      6      6 helper             58    0.01    0.01    0.00 5800.00    0.00    0.00    0.00    0.00    0.00    0.00
      7      7 drivers             9    0.00    0.00    0.00  900.00    0.00    0.00    0.00    0.00    0.00    0.00
      8      8 vmotion             4    0.00    0.00    0.00  400.00    0.00    0.00    0.00    0.00    0.00    0.00
     10     10 console             2    1.93    1.89    0.01  200.00    0.08   99.04    0.03    0.00    0.00    0.00
     15     15 vmkapimod           9    0.00    0.00    0.00  900.00    0.00    0.00    0.00    0.00    0.00    0.00
     17     17 FT                  1    0.00    0.00    0.00  100.00    0.00    0.00    0.00    0.00    0.00    0.00
     18     18 vobd.4231           8    0.00    0.00    0.00  800.00    0.00    0.00    0.00    0.00    0.00    0.00
     19     19 net-cdp.4239        1    0.00    0.00    0.00  100.00    0.00    0.00    0.00    0.00    0.00    0.00
     20     20 vmware-vmkauthd     1    0.00    0.00    0.00  100.00    0.00    0.00    0.00    0.00    0.00    0.00
    114    114 Centos5-x64-59      4    4.43    5.17    0.01  398.60    0.29   95.33    0.29    0.00    0.00    0.00
    125    125 Centos5-x64-50      4    2.64    3.49    0.00  400.00    0.30   97.30    0.27    0.00    0.00    0.00
    126    126 Centos5-x64-51      4    2.38    3.13    0.00  400.00    0.31   97.63    0.28    0.00    0.00    0.00
    127    127 Centos5-x64-52      4    2.70    3.54    0.00  400.00    0.31   97.21    0.28    0.00    0.00    0.00
    128    128 Centos5-x64-53      4    2.65    3.50    0.00  400.00    0.32   97.25    0.28    0.00    0.00    0.00
    139    139 Centos5-x64-54      4    2.36    3.12    0.00  400.00    0.29   97.63    0.27    0.00    0.00    0.00
    140    140 Centos5-x64-55      4    2.36    3.13    0.00  400.00    0.28   97.65    0.29    0.00    0.00    0.00
    141    141 Centos5-x64-56      4    2.37    3.11    0.00  400.00    0.29   97.66    0.27    0.00    0.00    0.00
    142    142 Centos5-x64-57      4    2.44    3.21    0.00  400.00    0.29   97.57    0.29    0.00    0.00    0.00
Screenshot

Esx-screenshot.jpg

Optional Setups To Enhance Your Test Environment

Using RINETD To Redirect To Your Various VM For External HTTP Access

RINETD Setup

rinetd redirects TCP connections from one IP address and port to another. rinetd is a single-process server which handles any number of connections to the address/port pairs specified in the file /etc/rinetd.conf.


Here's an example /etc/rinetd.conf on an internal server [192.168.0.16] that will redirect to the various vm's to port 80. The 'firewall', a cheap one like I have, only allows me to do very basic port redirection to an ip address -- NOT an internal ip address AND a different port. So my cheap firewall is setup to redirect port 80## to the rinetd server - 192.168.0.16 and then that server redirects to the vm and the right port - 80.


If your using a DynDNS service this works out very well. As I can now use the DynDNS domain name and simply add a port number to get redirected to the various ZCS servers. For example:

  • http://EXTERNAL-DOMAIN:8059 would get redirected to my vm server that is using 192.168.0.59 and to port 80 for the http ZWC login page.

Here's the /etc/rinetd.conf I have setup:

192.168.0.16 8030 192.168.0.30 80                               
192.168.0.16 8031 192.168.0.31 80                               
192.168.0.16 8032 192.168.0.32 80                               
192.168.0.16 8033 192.168.0.33 80                               
192.168.0.16 8034 192.168.0.34 80
192.168.0.16 8035 192.168.0.35 80
192.168.0.16 8036 192.168.0.36 80
192.168.0.16 8037 192.168.0.37 80
192.168.0.16 8038 192.168.0.38 80
192.168.0.16 8039 192.168.0.39 80
192.168.0.16 8040 192.168.0.40 80
192.168.0.16 8041 192.168.0.41 80
192.168.0.16 8042 192.168.0.42 80
192.168.0.16 8043 192.168.0.43 80
192.168.0.16 8044 192.168.0.44 80
192.168.0.16 8045 192.168.0.45 80
192.168.0.16 8046 192.168.0.46 80
192.168.0.16 8047 192.168.0.47 80
192.168.0.16 8048 192.168.0.48 80
192.168.0.16 8049 192.168.0.49 80
192.168.0.16 8050 192.168.0.50 80
192.168.0.16 8051 192.168.0.51 80
192.168.0.16 8052 192.168.0.52 80
192.168.0.16 8053 192.168.0.53 80
192.168.0.16 8054 192.168.0.54 80
192.168.0.16 8055 192.168.0.55 80
192.168.0.16 8056 192.168.0.56 80
192.168.0.16 8057 192.168.0.57 80
192.168.0.16 8058 192.168.0.58 80
192.168.0.16 8059 192.168.0.59 80
192.168.0.16 8060 192.168.0.60 80
192.168.0.16 8061 192.168.0.61 80
192.168.0.16 8062 192.168.0.62 80
192.168.0.16 8063 192.168.0.63 80
192.168.0.16 8064 192.168.0.64 80
192.168.0.16 8065 192.168.0.65 80
192.168.0.16 8066 192.168.0.66 80
192.168.0.16 8067 192.168.0.67 80
192.168.0.16 8068 192.168.0.68 80
192.168.0.16 8069 192.168.0.69 80
logcommon
logfile /var/log/rinetd.log
Setting Up A Mailhub

Continuing with the example of using 192.168.0.16 with a hostname of mail3.[SUB].[DOMAIN].com as my mail hub which the firewall routes all smtp traffic to and also is running rinetd. This assumes you've setup DNS like I outlined in Ajcody-Virtualization-Named-DNS which I mentioned at the top of this wiki page.


Install postfix [centos5 example]

yum install postfix
rpm -q postfix
 postfix-2.3.3-2.1.el5_2

Configure /etc/postfix/main.cf

/etc/init.d/postfix stop
cd /etc/postfix/
mv main.cf main.cf-backup

Now paste in the contents:

## paste the below into file and adjust for your setup the following variables
## myhostname & mydomain with my example of mail3.[SUB].[DOMAIN].com
## might need to also adjust : mynetworks = 192.168.0.0/24
## You might want to compare our default main.cf below and adjust for different paths, etc
## that your distro or postfix version might be setup to use
## and then save -- :wq!

vi main.cf

queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix

myhostname = mail3.[SUB].[DOMAIN].com
mydomain = mail3.[SUB].[DOMAIN].com
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mynetworks = 192.168.0.0/24, 127.0.0.0/8
relay_domains = $mydestination, $mynetworks, hash:/etc/postfix/relay-domains

transport_maps = hash:/etc/postfix/transport
local_transport = local

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases.postfix
mailq_path = /usr/bin/mailq.postfix
setgid_group = postdrop
html_directory = no
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.3.3/samples
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES

You might need to make the aliases db. Path is referenced in the main.cf above. This command below will end up creating /etc/aliases.db

postmap /etc/aliases

Now we'll setup the relay-domains file. Adjust my example for your domain using substitution in vi [ ESC key and then :%s/SUB.DOMAIN/With Your Domain Details/g hit return key].

vi /etc/postfix/relay-domains

mail30.SUB.DOMAIN.com OK                     
mail31.SUB.DOMAIN.com OK
mail32.SUB.DOMAIN.com OK
mail33.SUB.DOMAIN.com OK
mail34.SUB.DOMAIN.com OK
mail35.SUB.DOMAIN.com OK
mail36.SUB.DOMAIN.com OK
mail37.SUB.DOMAIN.com OK
mail38.SUB.DOMAIN.com OK
mail39.SUB.DOMAIN.com OK
mail40.SUB.DOMAIN.com OK
mail41.SUB.DOMAIN.com OK
mail42.SUB.DOMAIN.com OK
mail43.SUB.DOMAIN.com OK
mail44.SUB.DOMAIN.com OK
mail45.SUB.DOMAIN.com OK
mail46.SUB.DOMAIN.com OK
mail47.SUB.DOMAIN.com OK
mail48.SUB.DOMAIN.com OK
mail49.SUB.DOMAIN.com OK
mail50.SUB.DOMAIN.com OK
mail51.SUB.DOMAIN.com OK
mail52.SUB.DOMAIN.com OK
mail53.SUB.DOMAIN.com OK
mail54.SUB.DOMAIN.com OK
mail55.SUB.DOMAIN.com OK
mail56.SUB.DOMAIN.com OK
mail57.SUB.DOMAIN.com OK
mail58.SUB.DOMAIN.com OK
mail59.SUB.DOMAIN.com OK
mail61.SUB.DOMAIN.com OK
mail62.SUB.DOMAIN.com OK
mail63.SUB.DOMAIN.com OK
mail64.SUB.DOMAIN.com OK
mail65.SUB.DOMAIN.com OK
mail66.SUB.DOMAIN.com OK
mail67.SUB.DOMAIN.com OK
mail68.SUB.DOMAIN.com OK
mail69.SUB.DOMAIN.com OK

Now build the db, the command will end up creating /etc/postfix/relay-domains.db

postmap /etc/postfix/relay-domains

Now we'll create a transport map for each domain. Adjust my example for your domain using substitution in vi [ ESC key and then :%s/SUB.DOMAIN/With Your Domain Details/g hit return key].

vi /etc/postfix/transport

mail30.SUB.DOMAIN.com      smtp:mail30.SUB.DOMAIN.com
mail31.SUB.DOMAIN.com      smtp:mail31.SUB.DOMAIN.com
mail32.SUB.DOMAIN.com      smtp:mail32.SUB.DOMAIN.com
mail33.SUB.DOMAIN.com      smtp:mail33.SUB.DOMAIN.com
mail34.SUB.DOMAIN.com      smtp:mail34.SUB.DOMAIN.com
mail35.SUB.DOMAIN.com      smtp:mail35.SUB.DOMAIN.com
mail36.SUB.DOMAIN.com      smtp:mail36.SUB.DOMAIN.com
mail37.SUB.DOMAIN.com      smtp:mail37.SUB.DOMAIN.com
mail38.SUB.DOMAIN.com      smtp:mail38.SUB.DOMAIN.com
mail39.SUB.DOMAIN.com      smtp:mail39.SUB.DOMAIN.com
mail40.SUB.DOMAIN.com      smtp:mail40.SUB.DOMAIN.com
mail41.SUB.DOMAIN.com      smtp:mail41.SUB.DOMAIN.com
mail42.SUB.DOMAIN.com      smtp:mail42.SUB.DOMAIN.com
mail43.SUB.DOMAIN.com      smtp:mail43.SUB.DOMAIN.com
mail44.SUB.DOMAIN.com      smtp:mail44.SUB.DOMAIN.com
mail45.SUB.DOMAIN.com      smtp:mail45.SUB.DOMAIN.com
mail46.SUB.DOMAIN.com      smtp:mail46.SUB.DOMAIN.com
mail47.SUB.DOMAIN.com      smtp:mail47.SUB.DOMAIN.com
mail48.SUB.DOMAIN.com      smtp:mail48.SUB.DOMAIN.com
mail49.SUB.DOMAIN.com      smtp:mail49.SUB.DOMAIN.com
mail50.SUB.DOMAIN.com      smtp:mail50.SUB.DOMAIN.com
mail51.SUB.DOMAIN.com      smtp:mail51.SUB.DOMAIN.com
mail52.SUB.DOMAIN.com      smtp:mail52.SUB.DOMAIN.com
mail53.SUB.DOMAIN.com      smtp:mail53.SUB.DOMAIN.com
mail54.SUB.DOMAIN.com      smtp:mail54.SUB.DOMAIN.com
mail55.SUB.DOMAIN.com      smtp:mail55.SUB.DOMAIN.com
mail56.SUB.DOMAIN.com      smtp:mail56.SUB.DOMAIN.com
mail57.SUB.DOMAIN.com      smtp:mail57.SUB.DOMAIN.com
mail58.SUB.DOMAIN.com      smtp:mail58.SUB.DOMAIN.com
mail59.SUB.DOMAIN.com      smtp:mail59.SUB.DOMAIN.com
mail60.SUB.DOMAIN.com      smtp:mail60.SUB.DOMAIN.com
mail61.SUB.DOMAIN.com      smtp:mail61.SUB.DOMAIN.com
mail62.SUB.DOMAIN.com      smtp:mail62.SUB.DOMAIN.com
mail63.SUB.DOMAIN.com      smtp:mail63.SUB.DOMAIN.com
mail64.SUB.DOMAIN.com      smtp:mail64.SUB.DOMAIN.com
mail65.SUB.DOMAIN.com      smtp:mail65.SUB.DOMAIN.com
mail66.SUB.DOMAIN.com      smtp:mail66.SUB.DOMAIN.com
mail67.SUB.DOMAIN.com      smtp:mail67.SUB.DOMAIN.com
mail68.SUB.DOMAIN.com      smtp:mail68.SUB.DOMAIN.com
mail69.SUB.DOMAIN.com      smtp:mail69.SUB.DOMAIN.com

Now build the db, the command will end up creating /etc/postfix/transport.db

postmap /etc/postfix/transport

We should be all set now. Start postfix and monitor the log file as you do your testing.

/etc/init.d/postfix start
tail -f /var/log/maillog
Configuring Your ZCS VM's To Use The Mailhub

Note, another 'trick' you might need to do on your vm's to get them working in this type of situation from the outside is to setup one server [I used my 192.168.0.16 machine] to redirect and send emails from the other zcs servers. This is assuming your using a DynDNS setup where you can wildcard for a base domain and also wildcard it for MX requests as well. This is also necessary when your firewall device can only route all port 25 requests to a single ip address internally to your server. This setup assumes that server is running a mta that can then do MX lookups internally for the domainname being used for routing information. The adjustments below setup the ZCS vm's to accept the mail relay from that internal server.


Adjust in the Configuration > Global Settings > MTA tab and under Configuration > Servers > Your server > MTA tab on the other ZCS servers to use the one server for:

  • Web mail MTA Port 25
  • Relay MTA for external delivery
  • Inbound SMTP Host name
  • zmcontrol stop and then zmcontrol start on the server/s




Ajcody Backup & Restore Issues

   KB 2494        Last updated on 06/21/2016  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


Actual Backup & Restore Issues Homepage

Please see Ajcody-Backup-Restore-Issues

Update - May, 2017

I'll be updating this page after the ZCS 8.8 release is done to only reflect what is true in that version and future versions. It will also include information about the Zimbra_Suite_Plus modules where appropriate. If you currently are using the backup module for ZSP, please see Zimbra_Suite_Plus/Zimbra_Backup_Plus for now.

Backup-Restore Training Material Rough Drafts I Wrote

Bug/RFE's I Filed Against ZCS 8.6

Miscellaneous Bugs & RFE's

For those that address other specific issues described on this page:

RFE For Live DR Restore Option
Backups And Upgrades And Prior Versions

Information To Provide When Submitting A Support Case For Backup Issues

Basic Backup Information To Submit To Support

Disk Space Usage Issues
Trend Data

If there is concerns about disks/partitions getting full, this command would be helpful for trending data on your server. Send support the resulting df.tar file . Note - adjust the tail command if you want more than 20 day's worth of trending data, the -n 20 option.

[zimbra@zcs806 tmp]$ /tmp

[zimbra@zcs806 tmp]$ tar cvf /tmp/df.tar `find /opt/zimbra/zmstat -name df.cs\* | sort | tail -n 20`
tar: Removing leading `/' from member names
/opt/zimbra/zmstat/2014-03-10/df.csv.gz
/opt/zimbra/zmstat/2014-03-11/df.csv.gz
 [cut - Ajcody]
/opt/zimbra/zmstat/2014-03-27/df.csv.gz
/opt/zimbra/zmstat/2014-03-28/df.csv.gz
/opt/zimbra/zmstat/df.csv

[zimbra@zcs806 tmp]$ ls -lah /tmp/df.tar
-rw-r----- 1 zimbra zimbra 80K Mar 29 06:44 /tmp/df.tar

[zimbra@zcs806 tmp]$ tar tvf /tmp/df.tar
-rw-r----- zimbra/zimbra  2566 2014-03-11 00:00 opt/zimbra/zmstat/2014-03-10/df.csv.gz
-rw-r----- zimbra/zimbra  2553 2014-03-12 00:00 opt/zimbra/zmstat/2014-03-11/df.csv.gz
 [cut - Ajcody]
-rw-r----- zimbra/zimbra  2513 2014-03-28 00:00 opt/zimbra/zmstat/2014-03-27/df.csv.gz
-rw-r----- zimbra/zimbra  2531 2014-03-29 00:00 opt/zimbra/zmstat/2014-03-28/df.csv.gz
-rw-r----- zimbra/zimbra  8013 2014-03-29 06:40 opt/zimbra/zmstat/df.csv
Directory Sizes In /opt/zimbra

Please see the following and provide the output to support. Note, even though this method is faster than doing a du it still can take awhile.

* Ajcody-Server-Misc-Topics#Faster_Way_To_Get_Directory_Size_On_Filesytem_-_find_vs_du
Adjusting The Disk Alert Threshold

Note - zmlocalconfig smtp_notify must return yes if you want to receive the notifications.

If you just need to adjust the disk alert threshold, then see the following:

See current values:

 zmlocalconfig | grep zmdisklog

Example adjustment:

 su - zimbra
 zmlocalconfig -e zmdisklog_critical_threshold=98
 zmlocalconfig -e zmdisklog_warn_threshold=95
 zmstatctl

To exclude a partition from the checks [example of two being excluded]:

 su - zimbra
 zmlocalconfig -e zmstat_df_excludes="/mount/point:/mount/point2"
 zmstatctl

They might be a bug on this, where you'll keep getting email until a logrotate happens [zimbra.log?].

Some things to do to confirm and share with support or in bug. As zimbra

su - zimbra

ls -la /var/log/zimbra.log

df -h
 /dev/mapper/vg_rhel664-lv_root
                      5.5G  3.5G  1.7G  68% /
 tmpfs                 939M     0  939M   0% /dev/shm
 /dev/sda1             485M   79M  381M  18% /boot
 /dev/sdb1              30G  6.2G   23G  22% /opt

date

zmlocalconfig | grep zmdisklog
 zmdisklog_critical_threshold = 80
 zmdisklog_warn_threshold = 85  

zmlocalconfig -e zmdisklog_critical_threshold=95

zmlocalconfig -e zmdisklog_warn_threshold=90

zmlocalconfig | grep zmdisklog
 zmdisklog_critical_threshold = 95
 zmdisklog_warn_threshold = 90

zmstatctl restart

date

ps -eaf | grep zmstat-df

ls -la /var/log/zimbra.log

date ; grep "Disk warning" /var/log/zimbra* ; zmmailbox -z -m admin@`zmhostname` s -l 100 -t message "Subject: Disk and after:yesterday"

##Note - Emails by default go out every 10 minutes - for example:

[zimbra@zcs803 ~]$ date ; grep "Disk warning" /var/log/zimbra* ; zmmailbox -z -m admin@`zmhostname` s -l 100 -t message "Subject: Disk and after:yesterday"
Thu May 22 09:40:08 PDT 2014
/var/log/zimbra.log:May 22 08:30:00 zcs803 zimbramon[18826]: 18826:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
/var/log/zimbra.log:May 22 08:40:00 zcs803 zimbramon[22970]: 22970:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
/var/log/zimbra.log:May 22 08:50:00 zcs803 zimbramon[22970]: 22970:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
/var/log/zimbra.log:May 22 09:00:00 zcs803 zimbramon[22970]: 22970:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
  ## Note - I had readjusted the variable to not warn during this time segment ##
/var/log/zimbra.log:May 22 09:20:00 zcs803 zimbramon[8322]: 8322:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
/var/log/zimbra.log:May 22 09:30:00 zcs803 zimbramon[8322]: 8322:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
/var/log/zimbra.log:May 22 09:40:00 zcs803 zimbramon[8322]: 8322:err: Disk warning: zcs803.DOMAIN.com: / on device /dev/mapper/vg_rhel664-lv_root at 82%
num: 7, more: false

     Id  Type   From                  Subject                                             Date
   ----  ----   --------------------  --------------------------------------------------  --------------
1.  328  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 09:40
2.  327  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 09:30
3.  326  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 09:20
  ## Note - I had readjusted the variable to not warn during this time segment ##
4.  325  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 09:00
5.  324  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 08:50
6.  323  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 08:40
7.  320  mess   admin                 Disk / at 82% on zcs803.DOMAIN.com:           05/22/14 08:31

Continue to monitor your zmmailbox search results for an hour.

The Basic Information Support Needs

as root:

  • cat /etc/fstab
    • Shows us what is mounted upon boot
  • cat /proc/mounts
    • Shows us what is currently mounted and its status - you can see if a mount is read-only here.
  • df -hT
    • Lists current mounts using human-readable size information and also notes the filesystem type.

as zimbra:

  • zmprov -l gs `zmhostname` | egrep 'Back|Redo'
    • Will show us a number of variables related to backup and redologs. Also tell us if your using auto-group or the default method.
  • du -sh /opt/zimbra/redolog
    • Will might notice your redolog logs aren't rolling over, causing a possible issue.
  • ls -latr /opt/zimbra/backup
    • This is the default backup target, please adjust this path here and below if you are using a different zimbraBackupTarget value.
    • zmprov gs `zmhostname` zimbraBackupTarget
    • We'll be able to confirm permissions are right.
  • ls -latr /opt/zimbra/backup/tmp
    • This will show us if you have failed backup jobs and confirm tmp is being cleaned appropriately after the backup is done.
  • ls -latr /opt/zimbra/backup/sessions
    • This will show us what backup sessions are available and confirm permissions are correct.
    • Adjust path if your zimbraBackupTarget value is not the default path.
      • su - zimbra
      • zmjava com.zimbra.cs.backup.util.GetVersion
      • cd /opt/zimbra/backup/sessions/full-[YOUR MOST RECENT FULL]/
      • head -n6 session.xml
      • cd /opt/zimbra/backup/sessions/incr-[YOUR MOST RECENT INCREMENTAL]/
      • head -n6 session.xml
  • Some directory sizes in the backup directory:
    • Default path first
      • du -sh `find /opt/zimbra/backup -maxdepth 2 -type d`
    • If your using a different backup target, check that directory also. Replace /opt/zimbra/backup above with your backup path.
  • zmbackupquery
    • This should match what's in the sessions directory and it will also tell us if status of each backup and how many accts were done.
  • crontab -l | grep -i back
    • This will show use when backups are support to run and with what options they are running with.
  • zmlocalconfig | grep -i back
    • This is useful to see a number of backup options not exposed in the crontab, things related to the zip options.
  • zmvolume -l
    • This is useful to see how many volumes are being used, if HSM is being used, and if compression is being done at the volume level.
Additional Log Files Support Might Need

And send the following logs:

  • /var/log/messages
    • Filesystem issues often times are noted here and also in syslog. This might explain an interruption in the backup process. Server restarts, filesystem going full, filesystem going read-only, etc.
  • /var/log/syslog
  • /opt/zimbra/log/mailbox.log
    • The backup activity is logged here.
    • And any other mailbox.log file that would cover the event

Additional Checks For Performance Specific Issues

If Your Using a SAN or NFS For Your Backup Target - Please Check Your IOWait

Ideally, you would compare iowait and performance data from the target backup host as well as the stats available on the ZCS servers. To get graphs and stats on this from ZCS, please see Ajcody-Testing-Debugging#zmstat_and_zmstat-chart . You should submit this data and iowait conclusions if you still need to submit a support case about backup performance issues.

Is HSM Running During Your Backup Window
Are You Using --zipStore

--zipStore zips the blobs vs. keeping the blobs as individual files. --zipStore does not use compression either. For most circumstances, this will give the best performance, especially with NFS. This should be the default behavior of the backups, the following RFE is when it became the default [ZCS6+] :

To see if zip's are being used for backups for example, in the backup/session directory you'll know if it is by seeing .zip files:

mail:~/backup/sessions/full-20080820.160003.770/accounts/115/988/11598896-a89b-4b9d-bedb-1ed1afcb6c87/blobs 
zimbra$ ls blobs-1.zip    blobs-2.zip    blobs-3.zip    blobs-4.zip

To see if the zip file is using compression [-Z option for unzip will indicate whether or not the archive is actually compressed] :

unzip -Z blobs-4.zip
293 files, 5982984 bytes uncompressed, 5982984 bytes compressed:  0.0%

Also, if your zmvolume has compression enabled the blobs will remain compressed within the zip also upon backup. The point being, they are uncompressed to be then put into a zip file when the backup is using --zipStore.

Restore Compatibility Between ZCS Versions

Please see the following for details. In summary, user level restores should work against older ZCS backup data.

Other related bug/rfe's:

NFS Use For Backups

Please see this RFE:

This is the proposed statement to be included in the release notes following the RFE:

ZCS & NFS:
Zimbra will support customers that store backups (e.g. /opt/zimbra/backup) on an NFS-mounted partition. Please note that this does not relieve the customer from the responsibility of providing a storage system with a performance level appropriate to their desired backup and restore times. In our experience, network-based storage access is more likely to encounter latency or disconnects than is equivalent storage attached by fiber channel or direct SCSI.
Zimbra continues to view NFS storage of other parts of the system as unsupported. Our testing has shown poor read and write performance for small files over NFS implementations, and as such we view it unlikely that this policy will change for the index and database stores. We will continue to evaluate support for NFS for the message store as customer demand warrants.
When working with Zimbra Support on related issues, the customer must please disclose that the backup storage used is NFS.

Things To Check

  • Check the /var/log/messages on both the zimbra server and the nfs server for nfs related errors during the time frame of your backup.
  • Check /opt/zimbra/log/mailbox.log for error messages about folders/files not being able to be written or missing directory errors.
  • Is root_squash configured on the nfs server? If it's changed to no_root_squash , does the behavior of the backup change?
  • Is the */backup directory owned by zimbra:zimbra with at least 750 or 755 permissions?
    • This parent directory as given in:
      • zmprov gs `zmhostname` zimbraBackupTarget
  • Does zimbraBackupTarget have at least the subdirectories of : sessions and tmp  : and are owned by zimbra:zimbra with 750 or 755 permissions?
    • If not, try manually creating them and then running a test backup.
  • IF USING A NAS - MAKE SURE YOUR NOT USING EXTENDED ACLS OR THAT YOU HAVE THEM CONFIGURED PROPERLY
    • If your backup session directory shows something like : drwxrwx---+ 2 zimbra zimbra 4096 Sep 14 00:00 TO_DELETE-full-XXXXXX , that + sign indicated extended acls are in use.

Debugging Example

Steps I wrote for one customer, where saving out the information as you walk through all the commands would give enough information [hopefully] to submit a good rfe/bug:

 1. make a test partition on nfs server - /nfs-test

 2. mount on zimbra server
 2A. mkdir /nfs-test
 2B. chmod 755 /nfs-test
 2C. mount nfs-server:/nfs-test /nfs-test
 2D. ls -la /nfs-test
 2E. mkdir /nfs-test/backup
 2F. chown zimbra:zimbra /nfs-test/backup
 2G. chmod 755 /nfs-test/backup
 2H. su - zimbra ; touch /nfs-test/backup/testfile 
 2I. ls -laR /nfs-test/
 2J. rm /nfs-test/backup/testfile

 3. Set zimbraBackupTarget
 3A. zmprov ms `zmhostname` zimbraBackupTarget /nfs-test/backup

 4. Run a full backup against one account
 4A. ex. zmbackup -f -a user@domain.com

 5. ls -laR /nfs-test/

 6. If you again, run into the same problem. You could also repeat the backup after increasing the backup 
    logging variable for the account your trying to backup. If you didn't run into the same problem, it might 
    had to do with the initial setup of the nfs mount and permissions being used during the directory creation.
 6A. zmprov aal user@domain.com zimbra.backup debug
 6B. logging will show up in /opt/zimbra/log/mailbox.log
 6C. Remove account logging when your done.  zmprov ral user@domain.com zimbra.backup

 8. Change zimbraBackupTarget back to your production path.

Setup A Fast Test NOT Using NFS

A way to "avoid" the NFS issues for testing purposes would be to setup a new zimbraBackupTarget to try doing a full backup of a couple of user accounts. I DON'T recommend this if your using auto-group for zimbraBackupMode [ zmprov gs `zmhostname` zimbraBackupMode ] , only if your using Standard mode.

[as root]
** adjust your new "backup" directory path as needed - mine is just an example**
mkdir /mnt/usb1/backup-test
chown zimbra:zimbra /mnt/usb1/backup-test
chmod 750 /mnt/usb1/backup-test
su - zimbra
**confirm backup mode as standard**
zmprov gs `zmhostname` zimbraBackupMode
**if not stand, please stop**
zmprov ms `zmhostname` zimbraBackupTarget /mnt/usb1/backup-test
**Find a couple of test accounts to do a full for. Make sure you'll have space to do the backup regards to need free space.**
zmbackup -f -a user1@domain.com user2@domain.com user3@domain.com
**Watch and confirm status of backup you just started.**
zmbackupquery
**Confirm files were backed up in right location**
ls /mnt/usb1/backup-test/sessions/
**Failed backups would most likely results in left over directory in tmp directory**
ls /mnt/usb1/backup-test/tmp/

Restore For Disaster Recovery

For Full Single ZCS Server DR Restores

Please see Network_Edition_Disaster_Recovery

Some additional notes I have on it - Ajcody-Disaster-Recovery-Specific-Notes

For Multi-Server DR Restore Specifics

Along with the above references, please see Ajcody-Notes-Multi-Server-Restore-DR

To Restore Just The LDAP Date

Let's say your ldap data was 'lost/destoyed' but everything else was intact, you should look at the zmrestoreldap command.

This section should have more precaution and background information to handle this section.

The basics:

  • To find the LDAP session labels type -lbs.
    • zmrestoreldap -lbs
  • Restore the complete LDAP directory server
    • zmrestoreldap -lb full20061130135236
  • Restore LDAP data for specific accounts
    • zmrestoreldap -lb full20061130135236 -a tac@DOMAIN.com jane@DOMAIN.com

To Restore Just The Mysql DB

Option available from the following RFE work:

  • "Allow backup of only primary message volume"
    • https://bugzilla.zimbra.com/show_bug.cgi?id=35278
      • Options to exclude types of data as described in the 6.0.6 Admin Guide:
        • Search index : If you do not restore the search index data, the mailbox will have to be reindexed after the restore.
          • zmrestore <all or account> --exclude-search-index
        • Blobs : This is a useful option when all blobs for the mailbox being restored already exists.
          • zmrestore <all or account>|--exclude-blobs
        • HSM-blobs : This is useful when all HSM blobs for the mailbox being restored already exists.
          • zmrestore <all or account> --exclude-hsm-blobs

Let's say your mysql data was 'lost/destoyed' but everything else was intact. This might be the solution for the situation:

The steps below are to REPRODUCE A DR situation to test.

  1. zmcontrol stop
  2. Caution - step to reproduce DR situation to test against
    1. mv ~/db/data ~/db/data.OLD
  3. Getting old mysql passwords
    • zmlocalconfig -s mysql_root_password
    • zmlocalconfig -s zimbra_mysql_password
  4. [as zimbra] /opt/zimbra/libexec/zmmyinit
  5. ldap start
  6. zmconvertctl start
  7. mysql is already running per the zmmyinit - mysql.server status - to check.
  8. zmrestoreoffline -a all -br --systemData --excludeSearchIndex --excludeBlobs --excludeHsmBlobs
    • Note - you most likely will want to use the -br or -rf option for this situation.
      • -br,--backedupRedologsOnly : Replays the redo logs in backup only, which excludes archived and current redo logs of the system
      • -rf,--restoreFullBackupOnly : Restores to last full backup only, which excludes incremental backups.
    • -sys,--systemData : Restores global tables and local config.
    • Note the use of -a all , you could also do this for one account first to confirm operation is successful for your circumstances.
  9. If you used -rf or -br with your zmestoreoffline, you might also need to use zmplayredo to finish it up to get the most complete restore.

Performance Issues And Time To Complete

Please see Ajcody-Notes-BackupPlans#What_About_Backups.3F_I_Need_A_Plan

Also created an RFE for increase backup performance:

Understanding Option Flags For zmbackup & zmrestore

First, they don't make sense if your just reading from the help output - I will not argue this point at all.

The biggest problem with the options I point out below is that you can often include them in the command and they do nothing or you include them for a particular situation and they don't apply. Why is this a problem? Because they are silent and give no output telling you that it's not necessary, it's redundant, or it will actually cause your intended results to fail simply because you included the option.

zmrestore Options

Problems mostly revolve around these options.

To Times In The Past (If -lb Isn't Used, Implies Your Using Times/Incr/RedoSeq AFTER Last Full)
  • -restoreToIncrLabel
    • <arg> Replay redo logs up to and including this incremental backup
      • Requires: --label or -lb
  • -restoreToTime
    • <arg> Replay rodo logs until this time
      • Requires: --label or -lb
  • -restoreToRedoSeq
    • <arg> Replay up to and including this redo log sequence
Redolog Variables
  • --backedupRedologs or -br
    • Replays the redo logs in backup only, which excludes archived and current redo logs of the system
      • Only useful when restoring against latest full backup (NOT using the -lb option).
      • Will restore using incremental backup data after the last full backup as well but NOT including any redolog activity.
  • --restorefullBackup or -rf
    • Restores to the full backup only, not any incremental backups since that backup.
      • The default behavior of zmrestore in general is to always play from a "full" and "incrementals" that are associated with it UNLESS you state otherwise.
        • If you do:
          zmrestore -a user@domain.com -lb full6monthsago
        • It will playback the incremental data associated with that full from 6 months ago.
        • If you do:
          zmrestore -a user@domain.com -lb full6monthsago -rf
        • It will ONLY playback the data in the full from 6 months ago.
      • Will not progress past the data that's in the last full backup, no incremental backups after it in other words.
      • Implies NO redolog play, so there's no need to use -br.
Targets And Labels
  • --label or -lb
    • <arg> The label of the full backup to restore. Restores to the latest full backup if this is omitted.
  • --target or -t
    • <arg> Specifies the backup target location. The default is <zimbra_home>/backup.
Impact Of AutoGroup Option Being Used

Place for notes about how autogroup backup option might impact or limit command options.

zmbackup Options

Problems mostly revolve around these options:

  • --target or -t
    • <arg> Specifies the target backup location. The default is <zimbra_home>/backup.
  • --zip or -z
    • Zips email blobs in backup - using compression
  • --zipStore
    • Zips email blobs in backup - does NOT use compression
Deleting Old Backups -del

Caution You want to delete from the oldest label to newest. The -del option will automatically purge all older sessions prior to the label you used. To find out the label names, use zmbackupquery.

Format example:

zmbackup -del <oldest_backup_label>
Impact Of AutoGroup Option Being Used

Place for notes about how autogroup backup option might impact or limit command options.

Changing Default Backup Target

To find out what the current backup target is, do:

 zmprov gacf | grep zimbraBackupTarget
 zimbraBackupTarget: /opt/zimbra/backup

This is also configurable at the "server" level:

 zmprov gs `zmhostname` | grep zimbraBackupTarget
 zimbraBackupTarget: /opt/zimbra/backup

For example:

 zmprov ms `zmhostname` zimbraBackupTarget /san/mount/backup

Issues of changing the default path in regards to the admin web console. Please see:

Another way to change the backup path is described at Changing_Backup_directory_and_General_Information. I recommend reviewing it as well.

See Change Location For Backup Or Restore Source Data for non-default adjustments to CLI commands in regards to a non-default path for backups.

RFE & Bugs Concerning Option Flags For Restore And Backup

Setting Account Status After Restore Is Done

I filed an RFE for this:

Use DL COS Status To Generate User List Of Accounts

I filed an RFE for this:

An Overview Of Some Backup/Restore Items

Shared Blobs (messages)

I believe we are a little light on describing the shared blobs situation. Shared blobs can cause different corrections to a problem as compared to a normal message issue that isn't shared. I'll start some notes on this here.

From Backup and Restore

  • "When backing up shared messages, the backup process looks to see whether a Binary Large Object file (BLOB) representing a message already exists in the backup. If it does, it simply flags this object as such and does not copy its content again."
  • "Keeping the same backup target saves disk space, because shared binary large object files (BLOB) and other files do not have to be duplicated every time the backup process runs.

Bugs/RFE's

Remote copies of backup data for DR use

You will want to copy over /opt/zimbra/redolog/archive/* and /opt/zimbra/redolog/redo.log frequently in order to stay current. The redo.log file being open is not a problem since the crash recovery step can work with redo.log file in any state.

The redolog/archive/ contains logs that have not yet been backed up by an incremental (or by a full in auto-grouped mode)

The redo.log rolls over when it reaches zimbraRedoLogRolloverFileSizeKB (by default 100MB prior to ZCS 5.0.11 and 1GB after). When ZCS restarts after a crash, it seems to work through the current redo.log ok regardless of its state, if the current log really must be copied."

My Initial Thoughts On This

Start of process:

  • Weekend full on prod
  • rsync full-xxx on prod > remote sessions/
  • rsync redolog/* > remote redolog/
    • through non-full and incremental times every x about of minutes
  • weekday nights 10pm incre-xxx on prod
  • rsync incr-xxx on prod > remote sessions/
  • rsync redlog/* > remote redolog/

Created three separate rsync cron rules.

  • Full - once a week
    • Confirms full is done and then looks for latest full-xxxx and rsyncs that specific directory
  • Incre - once a night except for full schedule night
    • Confirms incre is done and then looks for latest incr-xxx and rsyncs that specific directory
  • Redolog/ - every x amount of minutes (outside of full and incr backups sessions)
    • Soes full rsync of redolog/ - probably want delete/remove option?
    • lsof will report /opt/zimbra/redolog/redo.log is open.

Somewhere we need to account for accounts.xml in this process. And also confirm what else might be missing. Also, steps on the actually restore process depending on when/where the DR event took place.

What's Needed For Later Restores

In regards to what is moved and what is needed for later restores, you must remember this "flow" of the backups:

  • Full backup files that contains all the information needed to restore mailboxes (to that point in time)
  • Incremental backup files that contains the LDAP directory server files and all the redo log transactions written since the last backup (to that point in time)
  • Redo logs that contains current and archived transactions processed by the Zimbra server since the last incremental backup (to that point in time - more about this topic is above)

Variables to be aware of in regards to backup/restore [ viewed with - zmprov gs [server-name] | grep Backup ]:

  • This is that gui path option - note, it doesn't change default to redo file path [see below]
zimbraBackupTarget

zimbraBackupMode
zimbraBackupAutoGroupedInterval
zimbraBackupAutoGroupedNumGroups
zimbraBackupAutoGroupedThrottled

zimbraBackupReportEmailSubjectPrefix
zimbraBackupReportEmailSender
zimbraBackupReportEmailRecipients
  • Variables to be aware of in regards to redo files [ viewed with - zmprov gs [server-name] | grep Redo ]:
zimbraRedoLogArchiveDir
zimbraRedoLogDeleteOnRollover
zimbraRedoLogEnabled
zimbraRedoLogFsyncIntervalslMS
zimbraRedoLogLogPath
zimbraRedoLogRolloverFileSizeKB

Mysql Table That References Most Recent Backup Session Of Users (AutoGroup Backup Mode)

During the backup we update the zimbra.mailbox table for each mailbox to record the most recent backup time. This is in the "last_backup_at" column within Mysql.

This data is used by auto-grouped backup to figure out which mailboxes to backup.

Creating A List Of Last Backup Of Users

Remove the , | head , below to get a full listing of all your accounts. Note, this reports on the users that exist on the mailstore your running the command.

[zimbra@zcs806 tmp]$ mysql zimbra -NBe 'select from_unixtime(last_backup_at), comment from mailbox' | sort | head
2014-06-05 01:00:24     dluser558@zcs806.DOMAIN.com
2014-06-05 01:00:26     dluser557@zcs806.DOMAIN.com
2014-06-05 01:00:28     dluser556@zcs806.DOMAIN.com
2014-06-05 01:00:30     dluser555@zcs806.DOMAIN.com
2014-06-05 01:00:31     dluser554@zcs806.DOMAIN.com
2014-06-05 01:00:32     dluser551@zcs806.DOMAIN.com
2014-06-05 01:00:32     dluser552@zcs806.DOMAIN.com
2014-06-05 01:00:32     dluser553@zcs806.DOMAIN.com
2014-06-05 01:00:33     dluser550@zcs806.DOMAIN.com
2014-06-05 01:00:34     dluser549@zcs806.DOMAIN.com

I include also below the results from the zmbackupquery for the first user:

[zimbra@zcs806 tmp]$ date ; zmbackupquery -a dluser558@zcs806.DOMAIN.com
Wed Jun 11 14:29:48 PDT 2014
Account: dluser558@zcs806.DOMAIN.com

    Label:   full-20140605.080023.296
    Type:    full
    Started: Thu, 2014/06/05 01:00:23.296 PDT
    Ended:   Thu, 2014/06/05 01:02:37.739 PDT
    Acct ID: 85d3c8f4-eea8-4cf2-8a84-8f1fcc87d555

    Label:   full-20140529.080016.546
    Type:    full
    Started: Thu, 2014/05/29 01:00:16.546 PDT
    Ended:   Thu, 2014/05/29 01:02:51.556 PDT
    Acct ID: 85d3c8f4-eea8-4cf2-8a84-8f1fcc87d555

    Label:   full-20140522.080015.818
    Type:    full
    Started: Thu, 2014/05/22 01:00:15.818 PDT
    Ended:   Thu, 2014/05/22 01:02:42.126 PDT
    Acct ID: 85d3c8f4-eea8-4cf2-8a84-8f1fcc87d555

    Label:   full-20140515.080016.160
    Type:    full
    Started: Thu, 2014/05/15 01:00:16.160 PDT
    Ended:   Thu, 2014/05/15 01:02:34.204 PDT
    Acct ID: 85d3c8f4-eea8-4cf2-8a84-8f1fcc87d555
Possible Issue That A Failed Or Interrupted Backup Causes

An interrupted backup can cause an issue because the table currently gets updated right off the bat rather than waiting for backup to be successfully completed.

Possible RFE: To update zimbra.mailbox.last_backup_at column for successfully backed-up mailboxes to the very end of the backup process, to either just before or just after renaming the /opt/zimbra/backup/tmp/<backup label> directory to /opt/zimbra/backup/sessions/<backup label>.

Setting To Null To Cause A New Backup For User

To undo what was done by an interrupted backup for example, you need to clear this column (set it to null) for the affected mailboxes. By clearing the column, you're forcing the next AG backup to choose these mailboxes because they look like they have never been backed up. If you don't clear this column, you have to wait until the next cycle. (7 days)

Example syntax to view:

mysql zimbra -e "select last_backup_at from mailbox where id=27"

Example syntax to change data of the last_backup_at to NULL"

mysql zimbra -e "UPDATE mailbox SET last_backup_at = NULL WHERE id = 27"
Related Bugs RFE's

Restore Requires accounts.xml File

Also, see:

Change "Location" For Backup Or Restore Source Data

Remember that zmbackup and zmrestore can take flags as well in regards to the location of items.

  • zmrestore & zmbackup can both take : -t,--target (default <zimbra_home/backup)

You can't state a different location with redo logs though. There's a command called zmplayredo [for newer versions of ZCS] and it has a variable to point to the redologs to play from [ --logfiles ]. It will replay into the default redolog directory or redolog file. The mailbox has to be stop to run zmplayredo . This is a command to manual kick off a replay of a redo log. This is normally done with the zmrestore when options about to a specific time aren't included.

Manual Removal Of Older Backup Sessions

General Situation:

  • Keep in mind every restore requires starting with data from a full backup.
  • For each account on the server, there must be at least 1 full backup after the deletion is complete.
  • You should also make sure all incremental backups made after the oldest of the remaining backups are retained.
    • This basically gets reduced to deleting only those backups that are old enough, based on your full/incremental schedule.

More Specific Issues:

  • Does the accounts.xml dependency cause issues with this?
    • No. Just don't delete it.
  • What about the contents of the backup/tmp/ data or shared blobs type references?
    • Don't touch this directory either. It is used during backup and restore. You don't want to change its content while an operation is going on, so best to leave it alone.
  • What if a zimbra server is running some type of restore of backup command while the manual removal is running on the nfs server?
    • You shouldn't remove the backups that are being used in a restore currently underway. You are responsible for avoiding the race condition.
      • Please understand you are responsible for avoiding the race condition. Make sure no backup or restore is happening at the moment, then rename the directories that will be deleted, preferably move them to another subdirectory, e.g. /opt/zimbra/backup/sessions_to_delete. Then delete.

LDAP Backup Related Items

Backup Schedule On LDAP Only Server [non-Mailstore]

If you look at the code in /opt/zimbra/bin/zmschedulebackup  :

if ($BACKUP_MODE eq 'Standard') {
    # default schedule: full backup 1am every sunday, incr backup 1am every weekday
    # deletes backups older than a month at 12am everyday
  if (isLdapOnly()) {
      @default = ("0 1 * * 6 /opt/zimbra/bin/zmbackup $target\n",
            "0 0 * * * /opt/zimbra/bin/zmbackup -del 1m\n"); 
  } else { 
      @default = ("0 1 * * 6 /opt/zimbra/bin/zmbackup -f $account $target $compress \n",
          "0 1 * * 0-5 /opt/zimbra/bin/zmbackup -i $compress\n",
            "0 0 * * * /opt/zimbra/bin/zmbackup -del 1m\n");
  }
    %commandmap = ("f", "/opt/zimbra/bin/zmbackup -f $target $compress $account",
                   "i", "/opt/zimbra/bin/zmbackup -i $compress",
                   "d", "/opt/zimbra/bin/zmbackup -del");
} else {  # Auto-Grouped mode
    # default schedule: full backup 1am everyday, no incr backup
    # deletes backups older than a month at 12am everyday
    @default = ("0 1 * * 0-6 /opt/zimbra/bin/zmbackup -f $target $compress\n",
                "0 0 * * * /opt/zimbra/bin/zmbackup -del 1m\n");
    %commandmap = ("f", "/opt/zimbra/bin/zmbackup -f $target $compress",
                   "i", "/opt/zimbra/bin/zmbackup -i $compress",
                   "d", "/opt/zimbra/bin/zmbackup -del");
}

Notice the specific check and then format for ldapOnly:

  if (isLdapOnly()) {
      @default = ("0 1 * * 6 /opt/zimbra/bin/zmbackup $target\n",
            "0 0 * * * /opt/zimbra/bin/zmbackup -del 1m\n"); 

Related Bugs To LDAP Backups

Some bugs to be aware of - most are resolved/fixed:

A Way To Verify Backup Integrity

I filed an RFE for this:

Negative Seek Offset Error & RFE

Explanation of negative seek offset error during a restore attempt and manual fixes are located here:

Auto-Group Backups Rather Than Default Method Topics

General Description And Official References

Having trouble completing that entire full backup during off-hours? Enter the hybrid auto-grouped mode, which combines the concept of full and incremental backup functions - you’re completely backing up a target number of accounts daily rather than running incrementals.

Auto-grouped mode automatically pulls in the redologs since the last run so you get incremental backups of the remaining accounts; although the incremental accounts captured via the redologs are not listed specifically in the backup account list. This still allows you to do a point in time restore for any account.

Administrative manual page:

http://www.zimbra.com/docs/ne/latest/administration_guide/10_Backup_Restore.17.01.html

Compare the sections called "Standard Backup Method" & "Auto-Grouped Backup Method"

http://www.zimbra.com/docs/ne/latest/administration_guide/10_Backup_Restore.17.02.html

Configuration details are here on that page:

http://www.zimbra.com/docs/ne/latest/administration_guide/10_Backup_Restore.17.08.html

Good explanation:

http://www.zimbrablog.com/blog/archives/2008/08/recent-admin-tidbits-part-1.html

Simply divide your total accounts by the number of groups you choose (zimbraBackupAutoGroupedNumGroups is 7 by default) and that’s how many will get a full backup session each night. Newly provisioned accounts, and accounts whose last backup is a specified number of days older are picked first. (zimbraBackupAutoGroupedInterval is defaulted to 1d)

Think of auto-grouped mode as a full backup for the scheduled group as well as an incremental (via redologs) for the all other accounts at the same time.

Bugs - RFE's To Review For Auto-Group

Please see:

Enabling Auto-Group For Backups - Schedule In Crontab

  • You'll need to make the variable changes as listed in the administrative guide and then the following for set the crontab correctly.
  • Run zmschedulebackup --help to see a list of options.
  • Run zmschedulebackup -D , which will now set a new default schedule (crontab) that uses auto-group settings now that your variable are set for it.
  • Incremental backups aren't performed as they were.
    • You'll see there's no longer the -i option in cron.
    • Incrementals are performed, in a manner, but the redologs are just copied into the full backup session

Two bugs to look at as well:

Standard Mode Default Cron Setup
  • Here is a schedule without auto-grouped backups enabled:
    • The Default Schedule For Normal Backups [ zmschedulebackup --help ]:
 f    0 1 * * 6
 i    0 1 * * 0-5
 d 1m 0 0 * * *
    • To set the backup to standard mode and use the default schedule one would:
      • zmprov mcf zimbraBackupMode Standard
      • zmschedulebackup -D
    • The crontab would look like:
 0 1 * * 6 /opt/zimbra/bin/zmbackup -f -a all   
 0 1 * * 0-5 /opt/zimbra/bin/zmbackup -i -a all
 0 0 * * * /opt/zimbra/bin/zmbackup -del 1m
Auto-Group Mode Cron Setup
  • Here is a schedule with auto-grouped enabled:
    • The Default Schedule For Auto-Group Backups [ zmschedulebackup --help ]:
f 0 1 * * 0-6
d 1m 0 0 * * *
    • To set the backup to auto-group mode and use the default schedule one would:
      • zmprov mcf zimbraBackupMode Auto-Grouped
      • zmschedulebackup -D
    • The crontab would look like:
0 1 * * 0-6 /opt/zimbra/bin/zmbackup -f  
0 0 * * * /opt/zimbra/bin/zmbackup -del 1m

Some Variables For Auto-Group

The below might not be complete or the defaults, I just wanted to save this before I forget them. Try to get more complete details on these later.

zmprov gacf | grep Backup
zimbraBackupAutoGroupedInterval: 1d
zimbraBackupAutoGroupedNumGroups: 7
zimbraBackupAutoGroupedThrottled: FALSE
zimbraBackupMode: Auto-Grouped

Auto-group And Redologs

Please see Ajcody-Backup-Restore-Issues#Redologs_And_Auto-group_In_Regards_To_Backups

Problems Switching To Auto-Groups Because It Wants To Run A Full Against All Accounts

Please see the following bug/rfe made about problems switching over to Auto-group when the first backup run of it tries to backup ALL of he accounts. I have the full how-to within the bug. It basically manipulates the last_backup_at for each account.

Backup And Deletion Schedule - zmschedulebackup

How To Adjust The Deletion Schedule

For my example below, I first set the backup to the "default" schedule. And I then adjust that "default" to have backups delete with a 14 day interval rather than 1 month.

[zimbra@mail3 ~]$ zmschedulebackup -D
Default schedule set

Current Schedule:

        f 0 1 * * 6 -a all
        i 0 1 * * 0-5
        d 1m 0 0 * * *

[zimbra@mail3 ~]$ zmschedulebackup -q
Current Schedule:

        f 0 1 * * 6 -a all
        i 0 1 * * 0-5
        d 1m 0 0 * * *

[zimbra@mail3 ~]$ zmschedulebackup -R f "0 1 * * 6" i "0 1 * * 0-5" d 14d "0 0 * * *"
Schedule replaced

Current Schedule:

        f 0 1 * * 6 -a all
        i 0 1 * * 0-5
        d 14d 0 0 * * *

[zimbra@mail3 ~]$ zmschedulebackup -q
Current Schedule:

        f 0 1 * * 6 -a all
        i 0 1 * * 0-5
        d 14d 0 0 * * *

[zimbra@mail3 ~]$ crontab -l | grep backup
0 1 * * 6 /opt/zimbra/bin/zmbackup -f   -a all
0 1 * * 0-5 /opt/zimbra/bin/zmbackup -i  
0 0 * * * /opt/zimbra/bin/zmbackup -del 14d

The Zip - Compression Option For Backups

Using the zip option will compress all those thousands of single files that exist under a user's backup, decreasing performance issues that arise from writing out thousands of small files as compared to large ones. This is often seen when one is :

  • Using nfs for the backup directory
  • Copying/rsyncing backups to a remote server
  • Are using some third party backup software (to tape) to archive/backup the zimbra backup sessions.

Optional Tweaks To The Zip Options

Please see this comment and those underneath it within this RFE:

  • "Use zip files for shared blobs of a full backup made with --zip option"
    • http://bugzilla.zimbra.com/show_bug.cgi?id=26624#c6
      • Use zmlocalconfig. To set:
        • $ zmlocalconfig -e key=val
      • To unset:
        • $ zmlocalconfig -u key
      • Once you set the key you will be able to view it.
        • $ zmlocalconfig
      • backup_zip_copier_private_blob_zips
        • How many zip files to distribute a mailbox's private (unshared) blobs over; default 4 (blobs-1.zip through blobs-4.zip); range 1 to 10,000
      • backup_zip_copier_copy_buffer_size
        • File copy buffer size; default 16384 (16KB); range 4KB to 1MB
      • backup_zip_copier_queue_capacity
        • Each zip file gets a queue of files to add. This key sets the queue size. Default is 10. Range is 1 to 10,000.
      • backup_zip_copier_deflate_level
        • Compression level. Default is -1. (same as in java.util.zip.ZipOutputStream). -1 is same as level 6. This behavior comes from zlib library which the JVM uses to implement zip. Other than the special default value, the level can range from 0 to 9. 0 means no compression. 1 means fastest compression and 9 means best compression.
      • backup_disable_shared_blobs
        • This one isn't limited to zip backups. When this is set to true, all blobs are backed up as private backups. Default is false.
      • backup_debug_use_old_zip_format
        • If true, backup will behave like ZCS 5.0.4 and earlier. Shared blobs are never zipped, and private blobs are added to a single blobs.zip file in zip backup. Default is false.

Need To Write Fewer Files - Add The Zip Option To Your Backup Commands

RFE to make zip option the default for backups:

There is very little details in the official documentation on this option unfortunately. This does have a really good explanation though:

http://www.zimbrablog.com/blog/archives/2008/08/recent-admin-tidbits-part-1.html

From the administrative manual on the Backup section:

http://www.zimbra.com/docs/ne/latest/administration_guide/10_Backup_Restore.15.1.html

It says,

"-zip can be added to the command line to zip the message files during backup. Zipping these can save backup storage space."

It's implied that instead of having all the individual message files in the backup that it will bunch them all together into zip files. The body of a shared blob is added once to a shared-blobs zip file, then a small pointer-only entry is added to a mailbox's zip file. Same effect as in non-zipped case. This will be useful when the number of message files is causing disk i/o issues. Maybe your trying to rsync the backup session directories off to another server or your running a third party backup on it to save to tape. The default use of -zip will use compression, if this also causes overhead that you need to avoid you can use the -zipStore option.

Note about -zipStore:

"when used with the -zip option, it allows the backup to write fewer files (-zip), but not incur the compression overhead as well"

The zip options effect backups that are in blob formats (full's). Incremental backups are bascially redologs, not the full message store of the user. In summary, the zip option will not impact the increment type backups. Auto-group backups are a mixture of both fulls and incrementals.

How To Use As A Default Option?

You'll add the options to the zimbra crontab file. This can be done with the zmschedulebackup command.

Run zmschedulebackup with help option:

zmschedulebackup --help

You'll see:

-z: compress - compress email blobs with zip

It appears that you'll need to manually add the options about -zipStore , if you want it, to the crontab file.

See bug :

http://bugzilla.zimbra.com/show_bug.cgi?id=30981

What Does It Look Like When I Use Zip?

Shared blobs are zipped and blobs (messages) are zipped per root store directory.

mail:~/backup/sessions/full-20080820.160003.770/accounts/115/988/11598896-a89b-4b9d-bedb-1ed1afcb6c87/blobs 
zimbra$ ls blobs-1.zip    blobs-2.zip    blobs-3.zip    blobs-4.zip

General Backup & Restore Debugging

You'll be monitoring the /opt/zimbra/log/mailbox.log file

Include the -d / --debug option on the CLI for either zmrestore or zmbackup .

To increasing logging for backup/restore-related logs - /opt/zimbra/log/mailbox.log . Enable DEBUG log level for "zimbra.backup" logger in :

  • /opt/zimbra/conf/log4j.properties for "temporary" change - until next restart. This could take a couple of minutes before jetty "sees" the changes.
  • /opt/zimbra/conf/log4.properties.in for "permament" change that will stick after restart. A restart of jetty/mailbox would be required for this change - zmmailboxctl restart .
   log4j.logger.zimbra.backup=DEBUG


For incremental backups, this should log each redolog being copied to the backup and also log which ones will be deleted out of archive directory. Those not deleted are kept because they are newer than 1 hour (default). The kept logs are deleted (but not copied again) during the next incremental backup.

Redolog Files


Redologs Copied To Backup Session And When Deleted

Archived logs that are less than an hour old at the time of incremental backup are copied to the backup but aren't deleted to support post-crash waitset reinitialization mechanism. The interval is set in localconfig key backup_archived_redolog_keep_time, which is in seconds, default=3600.

An Outline Of The Step
  1. /opt/zimbra/redolog/redo.log (starts and then grows to zimbraRedoLogRolloverFileSizeKB size - default 100MB)
  2. This flushes to /opt/zimbra/redolog/archive/[file] upon hitting the zimbraRedoLogRolloverFileSizeKB.
  3. 1 & 2 keep repeating when zimbraRedoLogRolloverFileSizeKB is hit.
  4. When a backup is done, the archive/* files are copied. The redo.log file is not moved.
    1. When the backup processes archive/* logs, it first figures out the last sequence copied to backup. All newer logs are copied to the current backup. Then, all logs are deleted except those that are too new, determined by localconfig parameter backup_archived_redolog_keep_time, which defaults to 1 hour. (This is part of the waitset feature.)
      • In standard backup mode, only incremental backups move the redologs.
      • In auto-grouped mode, every backup is a hybrid of full and incremental and thus redologs are moved.
Redologs And Auto-group In Regards To Backups

http://www.zimbra.com/forums/administrators/21360-auto-grouped-backups.html

Think of auto-grouped mode as a full backup for the scheduled group as well as an incremental (via redologs) for the all other accounts at the same time. Auto-grouped mode automatically pulls in the redologs since the last run, so you get incremental backups of the remaining accounts. Although the incremental accounts captured via the redologs are not listed specifically in the backup account list. This still allows you to do a point in time restore for any account.
If You Have Older Redologs Not Being Deleted

According to the code, only archived logs newer than 1 hour old (default for backup_archived_redolog_keep_time) should remain after an incremental backup. It is a bug if you are seeing older logs sticking around. If so, look at mailbox.log and see if any error was logged. If you enable DEBUG logging for "zimbra.backup" logger in log4j.properties you will see log statements for each copy and deletion.

The zimbraRedoLogDeleteOnRollover variable

zimbraRedoLogDeleteOnRollover shouldn't have an effect on "If you have older redologs not being deleted". By default it's FALSE and affects whether or not stuff makes it into /opt/zimbra/redolog/archive at all. With it set to TRUE there's just /opt/zimbra/redolog/redo.log and it's deleted/not rolled over into archive. As discussed above old redologs are deleted after the incremental; thus if you don't take incremental backups you should set this value to TRUE or periodically script manual deletion of /opt/zimbra/redolog/archive. (And with zimbraRedoLogEnabled FALSE there's no redo.log at all.)

If You Don't Run Incremental Backups Or Don't Need Archive Redologs

You would set zimbraRedoLogDeleteOnRollover to TRUE.

(Auto-Grouped backups you can still leave this to the default of FALSE.)

Redolog Sequence And The Backup Session

Redologs will exist in the incremental backup sessions. The zmbackupquery command will reference the redologs associated with the backup. For example"

[zimbra@mail3 ~]$ ls /opt/zimbra/backup/sessions/incr-20080925.224528.230/redologs/
redo-20080925.213136.165-seq53.log  redo-20080925.220726.521-seq55.log  redo-20080925.224209.287-seq57.log
redo-20080925.215516.450-seq54.log  redo-20080925.221749.133-seq56.log

[zimbra@mail3 ~]$ zmbackupquery -lb incr-20080925.224528.230
Label:   incr-20080925.224528.230
Type:    incremental
Status:  completed
Started: Thu, 2008/09/25 18:45:28.230 EDT
Ended:   Thu, 2008/09/25 18:45:39.099 EDT
Redo log sequence range: 53 .. 57
Number of accounts: 2

In the above example, we see the sequence range of "53 .. 57" is referring to the files in the backup session directory called redologs.


RedoLog Variables

Changing Redolog File Size And Location

The /opt/zimbra/redolog/redo.log rolls over when it reaches zimbraRedoLogRolloverFileSizeKB (by default 100mb).

The "roll overs" then goto /opt/zimbra/redolog/archive/

zmprov gacf | grep Redo
zimbraRedoLogArchiveDir: redolog/archive
zimbraRedoLogDeleteOnRollover: FALSE
zimbraRedoLogEnabled: TRUE
zimbraRedoLogFsyncIntervalMS: 10
zimbraRedoLogLogPath: redolog/redo.log
zimbraRedoLogRolloverFileSizeKB: 102400
Need To Move Redologs Because Partition Getting Full

Let's say you have a partition getting full and you need to move the redolog to another partition or nfs mount temporary to deal with the potential crisis that will happen when the partition becomes full. You'll need to reallocate the complete redolog/ directory and the archive subdirectory to the same partition because the roll over from redo.log to the archive directory happens with a rename function within the java code. This will require downtime since you'll need to move the actual redo.log file and zimbra can't be running while you do this. You can use a symlink to your new partition path. For example:

su - zimbra
zmcontrol stop
su -
 ** as root
mkdir /data/redolog
chown zimbra:zimbra /data/redolog
mount /dev/sdb1 /data/redolog
mv /opt/zimbra/redolog/* /data/redolog/
 ** or use rsync
rmdir /opt/zimbra/redolog
ln -s /opt/zimbra/redolog /data/redolog
ls -laR /data/redolog
** confirm ownership is with zimbra and double check zimbra can write in this directory
su - zimbra
touch /data/redolog/testfile
rm /data/redolog/testfile
zmcontrol start
Automatic Deleting Of Redo Logs On Rollover

This variable (zimbraRedoLogDeleteOnRollover) is set TRUE or FALSE.

zmprov gacf | grep zimbraRedoLogDeleteOnRollover

To modify it

zmprov mcf zimbraRedoLogDeleteOnRollover TRUE

Want To See What's In Redolog Files

This is for older versions of ZCS - newer versions should use zmredodump if it's available.

If you suspect there's too much redolog activity during a time window or have another need to inspect the contents of the redolog, dump it and examine it:

$ zmjava com.zimbra.cs.redolog.util.RedoLogVerify /opt/zimbra/redolog/redo.log > out.file

Pick the right redolog file, either redo.log or one of the files under archive/, based on timestamp.

zmplayredo And zmredodump

zmplayredo - Replaying Content From Any Redolog File

zmplayredo is a newer command, first introduced in 5.0.5 I believe. The mailbox has to be stop to run zmplayredo.

The help output from 6.0.8:

$ zmplayredo --help
usage: zmplayredo <options>
    --fromSeq <arg>         Replay from this redolog sequence (inclusive)
    --fromTime <arg>        Replay from this time (inclusive)
 -h,--help                  Show help (this output)
    --logfiles <arg>        Replay these logfiles, in order
    --mailboxId <arg>       Replay for this mailbox only
    --queueCapacity <arg>   Queue capacity per player thread; default=100
    --stopOnError           Stop replay on any error
    --threads <arg>         Number of parallel redo threads; default=50
    --toSeq <arg>           Replay to this redolog sequence (inclusive)
    --toTime <arg>          Replay to this time (inclusive)

Specify date/time in one of these formats:

    2010/11/19 13:55:08
    2010/11/19 13:55:08 802
    2010/11/19 13:55:08.802
    2010/11/19-13:55:08-802
    2010/11/19-13:55:08
    20101119.135508.802
    20101119.135508
    20101119135508802
    20101119135508

Specify year, month, date, hour, minute, second, and optionally millisecond.
Month/date/hour/minute/second are 0-padded to 2 digits, millisecond to 3 digits.
Hour must be specified in 24-hour format, and time is in local time zone.
zmredodump - Replaying Content From Any Redolog File

zmredodump is a newer command and very useful. It does not require mailboxd to be stopped like zmplayredo does.

The help output from 6.0.8:

$ zmredodump --help
usage: zmredodump [options] <redolog file/directory> [...]
where [options] are:

 -h,--help        show this output
    --m <arg>     one or more mailbox ids separated by comma or white
                  space.  The entire list must be quoted if using space as separator.  If
                  this option is given, only redo ops for the specified mailboxes are
                  dumped.  Omit this option to dump redo ops for all mailboxes.
    --no-offset   don't show file offsets and size for each redo op
 -q,--quiet       quiet mode.  Only print the log filename and any errors.
                  This option can be used to verify the integrity of redologs with minimal
                  output.
    --show-blob   show blob content.  Item's blob is printed, surrounded
                  by <START OF BLOB> and <END OF BLOB> markers.  The last newline before end
                  marker is not part of the blob.

Multiple log files/directories can be specified.  For each directory, all
redolog files directly under it are processed, sorted in ascending redolog
sequence order.
Using zmredodump To Get Message Blobs To Inject With zmlmtpinject - RFE

Please see:

Expand Ability To Parse Redologs - RFE

Please see:

Getting A Sequence or Time Variable For Restore Or Replay

You can see the changes within the redo logs with the command below. You can point it to any redolog.

zmjava com.zimbra.cs.redolog.util.RedoLogVerify /opt/zimbra/redolog/redo.log > out.file

You'll get output like this:

VERIFYING: redo.log
HEADER
------
sequence: 59
open: 1
filesize: 512
serverId: d5c5d6a7-b82f-4c29-b0cd-91818057196b
firstOpTstamp: 1222385426273
lastOpTstamp:  1222385426273
version: 1.22

------
txn 1222383600.1 [PurgeOldMessages] ver=1.22, tstamp=1222385426273, change=20200, mailbox=1
txn 1222383600.1 [CommitTxn] ver=1.22, tstamp=1222385426329, mailbox=1, txnType=PurgeOldMessages
txn 1222383600.2 [PurgeOldMessages] ver=1.22, tstamp=1222385486337, change=13500, mailbox=3
txn 1222383600.2 [CommitTxn] ver=1.22, tstamp=1222385486351, mailbox=3, txnType=PurgeOldMessages
txn 1222383600.3 [PurgeOldMessages] ver=1.22, tstamp=1222385546357, change=20201, mailbox=1
txn 1222383600.3 [CommitTxn] ver=1.22, tstamp=1222385546383, mailbox=1, txnType=PurgeOldMessages
txn 1222383600.4 [PurgeOldMessages] ver=1.22, tstamp=1222385606391, change=13501, mailbox=3
txn 1222383600.4 [CommitTxn] ver=1.22, tstamp=1222385606404, mailbox=3, txnType=PurgeOldMessages
txn 1222383600.5 [PurgeOldMessages] ver=1.22, tstamp=1222385666416, change=20202, mailbox=1
txn 1222383600.5 [CommitTxn] ver=1.22, tstamp=1222385666428, mailbox=1, txnType=PurgeOldMessages
txn 1222383600.6 [PurgeOldMessages] ver=1.22, tstamp=1222385726435, change=13502, mailbox=3
txn 1222383600.6 [CommitTxn] ver=1.22, tstamp=1222385726459, mailbox=3, txnType=PurgeOldMessages
txn 1222383600.7 [PurgeOldMessages] ver=1.22, tstamp=1222385786476, change=20203, mailbox=1
txn 1222383600.7 [CommitTxn] ver=1.22, tstamp=1222385786486, mailbox=1, txnType=PurgeOldMessages
txn 1222383600.8 [PurgeOldMessages] ver=1.22, tstamp=1222385846493, change=13503, mailbox=3
txn 1222383600.8 [CommitTxn] ver=1.22, tstamp=1222385846506, mailbox=3, txnType=PurgeOldMessages
txn 1222383600.9 [PurgeOldMessages] ver=1.22, tstamp=1222385906739, change=20204, mailbox=1
txn 1222383600.9 [CommitTxn] ver=1.22, tstamp=1222385906775, mailbox=1, txnType=PurgeOldMessages
txn 1222383600.10 [PurgeOldMessages] ver=1.22, tstamp=1222385966944, change=13504, mailbox=3
txn 1222383600.10 [CommitTxn] ver=1.22, tstamp=1222385966963, mailbox=3, txnType=PurgeOldMessages
txn 1222383600.11 [PurgeOldMessages] ver=1.22, tstamp=1222386026972, change=20205, mailbox=1
txn 1222383600.11 [CommitTxn] ver=1.22, tstamp=1222386026990, mailbox=1, txnType=PurgeOldMessages
...

How Do I Figure Out Which Sequence or Time Variable To Use For Restore Or Replay

In 5.0.10+ we'll have a CLI wrapper (zmredodump) with a slightly different command line syntax, but the below long syntax works in earlier versions.

To locate the correct restore-to time, you have to start with an approximate time the message was added/deleted. Look at the redolog files. The filename contains the GMT time when the file was rolled over, which is roughly the tstamp of the last operation in the file. If your time data is accurate you can find the specific file. Or you have a range of files to examine.

Use the redolog verify tool to dump the contents into text form, the -m / --message option to show message body data:

zmjava com.zimbra.cs.redolog.util.RedoLogVerify -m <filename or directory> ... > out.file

If the message was deleted and you don't know the id, you must go by some other clue such as the subject. Search the file to locate your message. You can cut/paste the message and lmtp-inject it to recover the message. No need to go through with a restore if this is all you needed.

Are You Messages Really Gone - Things To Check If zmplayredo Isn't Doing What You Expect

Here's something I found out testing zmplayredo for a customer case. Testing on a ZCS 6.0.8 single ZCS server.

Created a test account and sent it one message that is in the Inbox. I delete the msg in zwc but don't purge the Trash - msg is in Trash now.

Log events of above action:

2010-10-27 15:07:13,375 INFO [btpool0-3://192.168.0.71/service/soap/ConvActionRequest] 
[name=ajcody@mail71.DOMAIN.com;mid=17;ip=192.168.0.17;ua=ZimbraWebClient 
- FF3.0 (Linux)/6.0.8_GA_2661;] mailop - Moving VirtualConversation (id=-257) to 
Folder Trash (id=3). Affected message ids: 257.

Stop mailboxd so I can use zmplayredo and then start mailboxd back up after zmplayredo is finished :

 zmmailboxdctl stop
 zmplayredo --mailboxId 17 --logfiles /opt/zimbra/redolog/archive/* --fromTime 20101027090000 --toTime 20101027140000
 zmmailboxdctl start

Log event for above:

2010-10-27 15:07:50,383 INFO [main] [] mailop - Adding Message: id=257, Message-ID=
<1604937630.920784.1288201208382.JavaMail.root@corp.zimbra.com>, parentId=-1, folderId=2, folderName=Inbox.
2010-10-27 15:07:50,404 INFO [main] [] RedoableOp - Message 257 is already in mailbox 17

Log into ZWC with the test account. The msg is not in the Inbox, but it's still in Trash folder. I purge it from Trash.

Log event for deletion.

2010-10-27 15:09:38,761 INFO [btpool0-2://192.168.0.71/service/soap/ConvActionRequest]
[name=ajcody@mail71.DOMAIN.com;mid=17;ip=192.168.0.17;ua=ZimbraWebClient 
- FF3.0 (Linux)/6.0.8_GA_2661;] mailop - Deleting Message (id=257).

Then I redo the stop/start of mailboxd and zmplayredo again.

 zmmailboxdctl stop 
 zmplayredo --mailboxId 17 --logfiles /opt/zimbra/redolog/archive/* --fromTime 20101027090000 --toTime 20101027140000 
 zmmailboxdctl start 

Log event for the above:

2010-10-27 15:10:29,192 INFO [main] [] mailop - Adding Message: id=257, Message-ID=
<1604937630.920784.1288201208382.JavaMail.root@corp.zimbra.com>, parentId=-1, 
folderId=2, folderName=Inbox.

Log back into ZWC with test account and now I can confirm that the msg is not in Trash and it is now showing in Inbox.

Gap In Redo Log

The error message from either a backup or restore command:

"Error occurred: Found gap in redo log sequence; missing 5965 through 6149;
To avoid future restore problems, discard all existing backups and take a
full backup of all accounts; If this error occurred during restore,
try the --ignoreRedoErrors option"

The output is pretty accurate in how to handle the situation.

If you get the error during a backup, the recommendation is to move your old backups out. The directories in /opt/zimbra/backup/sessions/* . You'll want to keep them around just in case and then proceed to do a full backup.

If you get the error during a restore, you would add the flag --ignoreRedoErrors to your restore command.

Another possible related issue is if your /tmp or /opt/zimbra/redolog/ is filling up.

Error Executing redoOp

Errors with restores that involve the message 'error executing redoOp' will not show up in the admin console but will when you attempt the restore from CLI. This can also be the cause when you use the RestoreToTime option from the admin console and it doesn't seem to work correctly - the restore stopping prematurely from the specified date/time.

I created the following RFE in regards to the admin console issue:

  • "Include --ignoreRedoErrors option and error feedback in Admin Console for restore"
    • http://bugzilla.zimbra.com/show_bug.cgi?id=52358
      • This could explain why your restore to time isn't working in the Admin Console but does from CLI when you see an error about redologs and then reattempt restore with the --ignoreRedoErrors and it works.

Another RFE that was made but marked as 'WONTFIX' that gives a background story to the issue is:

When you hit this error with your backup data during restore attempts, there's basically only a couple of options to handle this that are recommended by support:

  1. Try to get full backups of your accounts or the accounts in question and then test against them and the preceding incrementals after the full.
  2. Attempt restores via the CLI using the additional option of : --ignoreRedoErrors
  3. Do your restore against the latest full backup of the account in question and then use the zmplayredo command against the redologs in the incrementals and/or the /opt/zimbra/redologs/* directory . This will give you more control to walk the restored account up to the point in time you want it at. One should really read through the whole section above, Ajcody-Backup-Restore-Issues#Redolog_Files , to understand the whole concept of redologs and then the use of zmplayredo.

Generally, "fixing" the redolog itself is not an option.

Why Do My Fulls Not Report All Accounts?

Are you sure it was a full backup that was ran or just a full session that was generated from your incremental backup job? When an incremental is ran, it will create a "full" session for any new accounts it discovers after the last actual full backup job.

For example, here's a full session that was created by an incremental backup job:

Label: full-20081010.060126.559
Type: full
Status: completed
Started: Fri, 2008/10/10 01:01:26.559 CDT
Ended: Fri, 2008/10/10 01:01:28.988 CDT
Redo log sequence range: 705 .. 705
Number of accounts: 1

Label: incr-20081010.060009.420
Type: incremental
Status: completed
Started: Fri, 2008/10/10 01:00:09.420 CDT
Ended: Fri, 2008/10/10 01:01:26.413 CDT
Redo log sequence range: 700 .. 704
Number of accounts: 392


[zimbra@servername ~]$ du -sh /opt/zimbra/backup/sessions/full-20081010.060126.559
1.2M /opt/zimbra/backup/sessions/full-20081010.060126.559
[zimbra@servername ~]$ du -sh /opt/zimbra/backup/sessions/incr-20081003.060010.622
452M /opt/zimbra/backup/sessions/incr-20081003.060010.622

Notice the Start and End times, this will show that the full is related to the incremental job.

You'll want to run zmbackupquery against your full labels to see your "main" full backup session - assuming you can't simply guess based upon the cron entry for it [ su - zimbra ; crontab -l | grep backup ]. For example, to see all your fulls from today's date back to October 01, 2008 and the accounts within each session - you would do:

zmbackupquery -v --from 20081001.000000 --type full

The -v flag outputs the accounts, the --from uses YearMonthDay.HourMinuteSecond , and the --type can be full or incremental. To just see one particular sessions date, you would use the lb [label] flag:

zmbackupquery -v -lb [your full label, ex. full-20081001.000000]

Issues After /opt/zimbra/backup Became Full

Bugs/RFE's on this issue:

See alsoAjcody-Backup-Restore-Issues#Possible_Issue_That_A_Failed_Or_Interrupted_Backup_Causes and the Bugs & RFE's under that section.

You can run into numerous issues if you allow your backup directory to become full.

Confirm your /opt/zimbra/backup/accounts.xml is being updated after a backup. You might see that the newer account.xml* file is accounts.xml.new . This is a sign of problems.

Confirm that the files in /opt/zimbra/backup/tmp/* don't have 0 byte lengths. There might be files like 1.xml and 3.xml in there. If they show 0 bytes, you need to remove them. The backup/restore commands if the file exist and they are empty. Your errors might look like this:

[zimbra@mailb ~]$ zmrestore -a USER@DOMAIN -ca -pre restore_
Error occurred: system failure: Unable to parse XML file /opt/zimbra/backup/tmp/restore/shared_blobs/1.xml

If you tried doing restores (redirected -ca -pre) before to clear up the above issues, you might find you can't do a successful restore AND you can't delete the account afterwards.

If you get errors like :

zmprov da restore3_tester3@XXXXXX.edu
ERROR: service.FAILURE (system failure: writing new mailbox row for account 89e7d9f4-013e-4cf1-a352-7b2f0a00d5af)

zmprov gmi restored_USER
ERROR: service.FAILURE (system failure: writing new mailbox row for account 56a7f654-f85b-45cc-931a-81d9bb9076bf)

You'll need to delete the account via a ldapdelete command.

Query And Stopping A Backup or Restore In Progress

Please see the url below for Backup In Progress - topic name "Aborting Full Backup In Progress":

  • A matter of using zmbackupquery & zmbackupabort .

Please see url below for Restore In Progress - topic name "Stopping a Restore Process" :

A -del Delete In Progress

Please see the bug / rfe's I filed

zmbackupabort syntax

From ZCS 6.0.8

$ zmbackupabort -h
usage: zmbackupabort <options>
 -d,--debug          Display diagnostics for debugging purposes.
 -h,--help           Displays this help message.
 -lb,--label <arg>   Label of full backup set to abort.
 -r,--restore        Abort the restore in progress.
 -s,--server <arg>   Mail server hostname. Default is localhost.
 -t,--target <arg>   Backup target location (default
                     <zimbra_home>/backup).

zmbackupquery syntax

From ZCS 6.0.8

$ zmbackupquery -h
usage: zmbackupquery <options>
 -a,--account <arg>   Account email addresses seperated by white space or
                      "all" for all accounts.
 -d,--debug           Display diagnostics for debugging purposes.
    --from <arg>      List backups whose start date/time is at or after
                      this date/time.
 -h,--help            Displays this help message.
 -lb,--label <arg>    The label of full backup to query.
 -s,--server <arg>    Mail server hostname. Default is localhost.
 -t,--target <arg>    Backup target location (default
                      <zimbra_home>/backup).
    --to <arg>        List backups whose start date/time is at or before
                      this date/time.
    --type <arg>      Backup set type to query.  "full" or "incremental";
                      both if unspecified.
 -v,--verbose         Show account list in each backup.

Specify date/time in one of these formats:

    2010/11/19 14:06:22
    2010/11/19 14:06:22 923
    2010/11/19 14:06:22.923
    2010/11/19-14:06:22-923
    2010/11/19-14:06:22
    20101119.140622.923
    20101119.140622
    20101119140622923
    20101119140622

Specify year, month, date, hour, minute, second, and optionally millisecond.
Month/date/hour/minute/second are 0-padded to 2 digits, millisecond to 3 digits.
Hour must be specified in 24-hour format, and time is in local time zone.

Restore To Time Problems

There's seems to be some syntax issues when using this variable. Please review the following to confirm your syntax.

http://wiki.zimbra.com/index.php?title=CLI_zmrestore_restoreToTime_Network_Edition_only

The gist, you MUST use the -lb full-200xxxxxx option when your trying to restore anything that ISN'T meant to include the latest information for the mailbox. The -lb argument should specify a full backup that took place prior to the time of the backup you wish to restore.

Find Out What Backup Session Labels You Need First

To find out what backups are associated with a particular account, you would do the following :

zmbackupquery -a user@domain

You'll want to note what is the first full that occurs before the point in time you want to restore. And then the incremental that follows right after your point in time.

Backup label (-lb) for fulls can be found by doing [include the -v option if you want to see a listing of the user accounts within the backups] :

zmbackupquery --type full

Backup labels (-restoreToIncrLabel) for incrementals can be found by:

zmbackupquery --type incremental

Command Syntax Example For Restores On The CLI

Example to full label and stop :

zmrestore -a USER@DOMAIN.com -lb full-20080726.050017.306 -rf -ca -pre restore_

Example to incremental label and stop :

zmrestore -a USER@DOMAIN.com -restoreToIncrLabel incr-20080731.060007.644 -lb full-20080726.050017.306 -br -ca -pre restore_

Example to specific time and stop :

zmrestore -a USER@DOMAIN.com -restoreToTime 20080801011800 -lb full-20080726.050017.306 -br -ca -pre restore_


Important Options You Might Want Or Need To Include

--ignoreRedoErrors : If you attempt a restore and you see an error about problems related to playing the redolog, you'll want to run the restore command again and include this option.


--skipDeletes : Please see http://bugzilla.zimbra.com/show_bug.cgi?id=31824#c5 for details on this.


-t /path/to/backup_dir : If you are restoring from another backup directory besides your current default path.


Variables that are asking for TIME rather than LABELS should follow this syntax (from zmrestore --help):

Specify date/time in one of these formats:

    2008/08/06 09:55:50
    2008/08/06 09:55:50 572
    2008/08/06 09:55:50.572
    2008/08/06-09:55:50-572
    2008/08/06-09:55:50
    20080806.095550.572
    20080806.095550
    20080806095550572
    20080806095550

Specify year, month, date, hour, minute, second, and optionally millisecond.
Month/date/hour/minute/second are 0-padded to 2 digits, millisecond to 3 digits.
Hour must be specified in 24-hour format, and time is in local time zone.

Bugs And RFE's To Review

Update - Bug/RFE's I Filed Against ZCS 8.6

Older Bug/RFE's

Restore An Individual Message

The zmrestore command is at a mailbox level.

An RFE was filed already to expand this. It is currently targeted for the Helix release.

A way around the current limitations would be to use lmtpinject. Please see the following for details on that:

The difficultly would be determining the message your trying to find within your backups that was "deleted" in prod.

User Deleted A Bunch Of Data And Notified You Hours Later Wanting It Restored

  1. To determine the time of the delete, use the zmredodump command.
    • You'll use this "time" for the restore command.
    • Example:
      • $ zmprov gmi USER@DOMAIN.com  ::: gives me mailboxid 17
      • $ zmredodump --show-blob --m 17 /opt/zimbra/redolog/ | grep Delete  ::: returns:
        • [0000f311 - 0000f350: 64 bytes; tstamp: 2010/11/19 11:21:30.852 CST] txn 1290033504.2544 [DeleteItem] ver=1.28, tstamp=1290187290852, change=3913, mailbox=17, ids=[304, 308], type=5
        • [0000f351 - 0000f382: 50 bytes; tstamp: 2010/11/19 11:21:30.869 CST] txn 1290033504.2544 [CommitTxn] ver=1.28, tstamp=1290187290869, mailbox=17, txnType=DeleteItem
  2. See Ajcody-Backup-Restore-Issues#Restore_To_Time_Problems about setting up the proper restore syntax.
    • You'll want to include the -ca -pre restore_ options since we'll first get the old data into a temporary account.
    • Remember to use zmbackupquery -a USER@DOMAIN.com --type full to find what full label will be needed for the restore.
    • Also, if you need/want the incremental label, do a zmbackupquery -a USER@DOMAIN.com --type incremental .
      • Example:
        • $ zmbackupquery -a USER@DOMAIN.com --type full  ::: shows the latest as being:
          • Label: full-20101119.070018.607
          • Type: full
          • Started: Fri, 2010/11/19 01:00:18.607 CST
          • Ended: Fri, 2010/11/19 01:00:29.751 CST
          • Acct ID: f33d6daf-8875-4496-8bee-6df345f295e7
    • Do the restore now with the proper information for the variable flags.
      • Note: You might need to include -br , -rf , or neither depending on the time frames involved.
      • Example:
        • $ zmrestore -a USER@DOMAIN.com -restoreToTime 20101119112000 -lb full-20101119.070018.607 -ca -pre restore_
      • It would be best to log into the restore_USER@DOMAIN.com account to confirm the data is as you expect it.
  3. Use zmmailbox with the getRestUrl option against the "restore_USER" account now to export the data.
    • Examples:
      • Export ALL the 'old' data from the restored account
        • $ /opt/zimbra/bin/zmmailbox -z -m restore_USER@DOMAIN.com getRestURL "//?fmt=tgz" > /var/tmp/user-export.tgz
      • You can also export SOME of the 'old' data from the restore account using other options. One option is with the before and after variables. NOTE - We have to set the query string as a variable to get around some of the shell issues.
      • For example:
        • $ query='before:11/20/2010 after:11/1/2010'
          • ZCS5 might require you to have a %20 rather than the actual space character.
        • $ /opt/zimbra/bin/zmmailbox -z -m restore_USER@DOMAIN.com getRestURL "//?fmt=tgz&query=$query" > /var/tmp/user-export.tgz
          • Note': the $query above will be the expansion of the variable you set prior in the shell, query='before:11/20/2010 after:11/1/2010 .
  4. Use zmmailbox with the postRestUrl option to IMPORT the RESTORE_USER account into the "USER" account now with appropriate options.
    • Examples:
      • $ /opt/zimbra/bin/zmmailbox -z -m USER@DOMAIN.com postRestURL “//?fmt=tgz&resolve=replace” /var/tmp/user-export.tgz
    • Note : A critical option in the above command is the &resolve=replace one. There are various ways you can handle the importing of data. Please review the following to determine what is best for you needs.

Restore Deleted Items - skipDeletes Option - ZCS6+

From the RFE comment:

        Added new option --skipDeletes to zmrestore.  If specified, skip 
        over delete operations during redo replay.  Delete ops are:

        DeleteItem (hard delete)
        DeleteMailbox
        EmptyFolder
        MoveItem, if moving item to Trash folder
        PurgeImapDeleted
        PurgeOldMessages

        Skipping these deletes can lead to other problems later, such as 
        conflicting paths, but it is assumed the priority is recovering as 
        much data as possible when using this option.

Restore Account Not Yet In Backups

Please see:

How To Restore To Events Within The Same Day

Work in progress and investigation.

Users Trash Items

User Ability To Recover Trash Purge

Please see RFE:

Retention Policy About Purges

Please see Mailbox_Purge

Can't Restore Or Find An Account That Was Renamed

When an account is "renamed", the old account name will no longer be "found" is your "default" type restore or backup queries. This can cause some confusions when one needs to restore to a time frame of when the account was under it's older name.

Restoring From CLI

First, identify what sessions labels hold the differing account names:

zmbackupquery -a USER@DOMAIN
zmbackupquery -a USER-RENAMED@DOMAIN

You should know have what you need to do follow the steps in the Ajcody-Backup-Restore-Issues#Restore_To_Time_Problems section.

Restoring From Admin Console GUI

I'll give a detail explanation of the situation when working around restores of renamed accounts in the admin console [web GUI]:

  1. If you in the GUI goto the "Restore" button, it first asks for an account rather than giving an option for date/time/session. I think you already stated, that "renamed" accounts don't show up in this query window. Therefore, one wouldn't really progress to the next window that would allow you to change the backup session label.
  2. They way you get around this is, you actually double click on the full session listing that you see on the backup page in the admin UI. This will bring you to another page, that is specific to that session. In there, you should see the old account name prior to the rename. You can then highlight that account listing and click on the "Restore" button. This will bring up the restore dialog, which will now have the date/time/session label auto-filled out.

Quota Is Stopping A Redirected Restore

Update

Reasoning for need, maybe the msg files coming from the restore are no longer "shared message blobs" and therefore increase the mailbox to a size it wasn't in the past. Changes to HSM maybe?

I think I'll need to create a RFE about adding an option to the zmrestore command to also include an option to set the COS value on a created account. Until then... Create a new COS and set it up to NOT have any quota. Once you kick off the backup and you see the account is created you can then apply the COS to that account. Call the cos something like no-quota. Here's the steps below.

To copy your cos (assuming your quota cause is the default one, change default to match your production cos your using).

To see all cos's

zmprov gac

Copies cos called default to cos named no-quota

zmprov cpc default no-quota

To remove quota to the new cos no-quota

zmprov mc no-quota zimbraMailQuota 0

To confirm

zmprov gc no-quota | grep -i quota

Now you would start your redirected restore and once you see the account is created, run the below in a separate shell. (example)

zmrestore -a USER@DOMAIN.com -restoreToTime 20080801011800 -lb full-20080726.050017.306 -br -ca -pre restore-

Once restore has kicked off - To apply the no-quota cos to the restored account:

zmprov sac restore-USER@DOMAIN.com no-quota

Restore Of Non-Account Items - Example - COS DL Etc

Cos and DL's are ldap entries basically.

From Backup and Restore

  • zmrestoreldap. This command restores the complete LDAP directory server, including accounts, domains, servers, COS and other data."

You'll see in a DR process, Network_Edition_Disaster_Recovery , that the zmrestoreldap is done before the zmrestoreoffline .

  • zmrestoreldap doesn't have options that allow specific items to be restored (COS, DL's, etc.). It only has option for named accounts (-a). One could try a ldapadd with a ldif of the COS or DL details. One could also take the information on the COS or DL within the ldap file in the backup session to at least have all the variables to manually add it back (via the zmprov command). Your looking at the backups on the LDAP master if your in a multi-server configuration.
/opt/zimbra/backup/sessions/full-xxxxxx/ldap/ldap.bak

Start of ldap entry example to search for:

  • Cos example
    • dn: cn=default,cn=cos,cn=zimbra
  • DL example
    • dn: uid=dl-group,ou=people,dc=mail,dc=domain,dc=com

To compare a current DL with past details, just save out the ldap entry from the backup to a txt file. And then do:

zmprov gdl maillist@domain.com

Make the necessary changes after comparing the two.

Restoring A Calendar (ics)

There seems to be a bug or odd expectation on how this command is currently working. If the appointment exists in the Calendar and the time is different with the same appointment in the ics file your importing - the time of the appointment will not change to the imported ics one. If you delete the event first, then the imported appointment will reflect the correct time.

Here's what I did to reproduce this situation. It seems this has been true for sometime, customer was on 4.5.11 and I was on 5.0.8

Created test account and made two appointments on friday - 9am and 4pm.
 Did a full backup.
 Restored test account to restore_user
 Ran :
     zmmailbox -z -m user@domain.com gru /Calendar > /tmp/calendarA.ics
     zmmailbox -z -m restore_user@domain.com gru /Calendar > /tmp/calendarB.ics
 And then
     diff /tmp/calendarA.ics /tmp/calendarB.ics [no differences]

 Now some tests.
 As user, I deleted the two appointments and then:
     zmmailbox -z -m user@domain.com pru /Calendar /tmp/calendarB.ics
 Refreshed Calendar as User in webclient.
     9am and 4pm appointment shows up.
 I then moved in the webclient the 9am appointment to 11am
 Did another restore:
     zmmailbox -z -m user@domain.com pru /Calendar /tmp/calendarB.ics
 Refreshed Calendar as User in webclient.
     11am and 4pm appointment shows up.
     ** The restore did not move the 11am appointment back to the 9am slot as in /tmp/calendarB.ics
     ** Assumption, this process will not over-write an appointment if it's there - it does not look to the time.
        Let's do a diff of the state of the calendar
        zmmailbox -z -m user@domain.com gru /Calendar > /tmp/calendarC.ics
        diff /tmp/calendarB.ics /tmp/calendarC.ics
          The DTSTAMP and SEQUENCE shows the difference in the time.
 If I delete the 11am appointment and then do the calendarB.ics restore the appointment shows up again at 9am.

I see this same behavior if I also use the web interface to export/import the calendar between the restored account and user one. Even when I import it into a NEW calendar, it even changes the two appointments to reflect the new calendar rather than the default one.

One Fix

One fix, if the situation allows, is to purge the current Calendar and then import the full ics file. This would be done like this:

zmmailbox -z -v -m ajcody@mail3.internal.homeunix.com ef /Calendar
* ef is for emptyFolder  zmmailbox help folder
*webclient shows all events gone but Calendars are still listed.
zmmailbox -z -v -m ajcody@mail3.internal.homeunix.com pru /Calendar /tmp/calendarB.ics
*webclient show all events with times as expected.

Second Fix

Haven't tried yet, but someone said you should be able to adjust the SEQUENCE number in the appointment and the import process will use that data (data/time) of the newer sequence number appointment.

Archiving User Accounts Out Of Production Use In Zimbra

Backup - Restore Method

To "archive" the user data with the ability of Zimbra later restoring if needed, one would rely on the backup/restore tools.

For example:

zmbackup -f -a user@domain

If you want to make this more "intelligent" later, one could do this:

mkdir /nfs-mount/archived-users/[user-name]
zmbackup -f -a userA@domain -t /nfs-mount/archived-users/userA-domain/

This would give some "intelligent" information for recovery later. Confirms it was an archived account, shows the "real" username, the date of the full backup, and so forth.

ls /nfs-mount/archived-users/userA-domain/
  full-20081104.131643.006
ls /nfs-mount/archived-users/userA-domain/full-20081104.131643.006
  accounts/ session.xml shared_blobs sys

If one would need to "restore" the account later, it would consume a license if the account was "deleted".

zmrestore -a userA@domain -ca -pre restored- -t /nfs-mount/archived-users/userA-domain/ -lb full-20081104.131643.006
Setup A Secondary Zimbra Box For Restores Of Archive Accounts

Your Zimbra license can be installed on multiple machines. One idea that might prove useful in handling these "archive" accounts for those situations when you need to investigate something is to setup a "archive" Zimbra box. You'll want to isolate this box from any "production" use. It will need to be configured to have the "domains" of the archive accounts. You can then use this box to restore the "archive" account and then use the administration tools to investigate the user data.

Use Of REST And Other Tools For Specific User Data

The following page, User_Migration , will shows numerous examples of how to export different types of data from a user account into a neutral file format that one could use for "archive" purposes.

Use Of The REST Command To Export ALL User Data - Version Dependant, 5.0.9+ [I believe]

Example of the commend syntax:

 /opt/zimbra/bin/zmmailbox -z -m user@domain.com getRestURL “//?fmt=tgz” > /tmp/account.tgz

Backup And HSM

Please see Bugs/RFE:

Using zmprov -l gaa To Create User Listing for zmbackup & zmrestore -a option

For example, see below. Note the use of the egrep -v option below, this would remove any matches from the grep. Useful if you want to only backup certain domains for example.

[zimbra@ldap2 sessions]$ zmbackup -f -a `zmprov -l gaa | egrep -v "ham|spam|virus|admin|galsync"`
full-20150130.210821.124

[zimbra@ldap2 sessions]$ zmbackup -f -a `zmprov -l gaa`
full-20150130.210922.637

[zimbra@ldap2 sessions]$ zmbackupquery -lb full-20150130.210821.124 -v
Label:   full-20150130.210821.124
Type:    full
Status:  completed
Started: Fri, 2015/01/30 16:08:21.124 EST
Ended:   Fri, 2015/01/30 16:08:50.181 EST
Redo log sequence range: 23 .. 23
Number of accounts: 3 out of 3 completed
Accounts:
  archive-search-results@ldap2.zimbra.DOMAIN.com: completed
  user1-20150115@ldap2.zimbra.DOMAIN.com.archive: completed
  user1@ldap2.zimbra.DOMAIN.com: completed

Total space: 14020MB
 Free space: 5977MB

[zimbra@ldap2 sessions]$ zmbackupquery -lb full-20150130.210922.637 -v
Label:   full-20150130.210922.637
Type:    full
Status:  completed
Started: Fri, 2015/01/30 16:09:22.637 EST
Ended:   Fri, 2015/01/30 16:09:33.083 EST
Redo log sequence range: 23 .. 23
Number of accounts: 9 out of 9 completed
Accounts:
  admin-20150122@ldap2.zimbra.DOMAIN.com.archive: completed
  admin@ldap2.zimbra.DOMAIN.com: completed
  archive-search-results@ldap2.zimbra.DOMAIN.com: completed
  galsync.tfnapjb9@ldap2.zimbra.DOMAIN.com: completed
  ham.yeygcogdd2@ldap2.zimbra.DOMAIN.com: completed
  spam.dpxyqjnm6t@ldap2.zimbra.DOMAIN.com: completed
  user1-20150115@ldap2.zimbra.DOMAIN.com.archive: completed
  user1@ldap2.zimbra.DOMAIN.com: completed
  virus-quarantine.wfkd4vvm1g@ldap2.zimbra.DOMAIN.com: completed

Total space: 14020MB
 Free space: 5977MB

Scripting Out Individual Backups Of Accounts

If you want to do individual backups of accounts using a for-loop, for example, you might want to include the -sync option from zmbackup. zmbackup without this will normal give an error as it passing the next zmbackup command stating that there's a current backup in progress.

Example command in some for-loop script is [without the -sync option]:

sudo -u zimbra /opt/zimbra/bin/zmbackup --fullBackup --account "$acct" --server "$host" --target "$dest"

zmbackup --help shows:

--sync  -sync Runs full backup synchronously. 

The admin guide mentions:

"Full backup is usually run asynchronously. When you begin the full backup, the label of the ongoing backup process is immediately displayed. The backup continues in the background. You can use the zmbackupquery command to check the status of the running backup at any time."

I couldn't find any other indication beyond that to explain in more details the purpose of that flag. But from what is stated above, it does look like the -sync flag will resolve the issues of "backup in progress" when scripting out multiple zmbackup commands.

If not, you could query for "Status: in progress" from the zmbackupquery command.

You can give the zmbackupquery command flags for date/time, label, account, -t target, and so forth [Do a zmbackupquery --help to see the options format].

Finding Message Blob In Users Backup

Get the zimbraId of the user, this is what is used in the backup session directory layout:

$ zmprov ga admin@`zmhostname` zimbraId
# name admin@zcs806.DOMAIN.com
zimbraId: e46a828b-cdda-4635-98ab-31b8ac0129b6

Get the mailboxId, this is what is used in the zmvolume primary message volume directory layout:

$ zmprov gmi admin@`zmhostname`
mailboxId: 1
quotaUsed: 77794874

Finding a message in the primary message volume:

$ cd /opt/zimbra/store/0/1/msg/9/

$ ls -la 40511-49376.msg
-rw-r----- 1 zimbra zimbra 1372 Mar 16 02:01 40511-49376.msg

Finding the users directory in a full backup session directory layout:

$ find /opt/zimbra/backup/sessions/full-20140426.080019.153/ -name e46a828b-cdda-4635-98ab-31b8ac0129b6 -print
/opt/zimbra/backup/sessions/full-20140426.080019.153/accounts/e46/a82/e46a828b-cdda-4635-98ab-31b8ac0129b6

Locating the message in the backup session - this example is where the backups are using the zip option:

$ cd /opt/zimbra/backup/sessions/full-20140426.080019.153/accounts/e46/a82/e46a828b-cdda-4635-98ab-31b8ac0129b6/blobs/

$ ls
blobs-1.zip  blobs-2.zip  blobs-3.zip  blobs-4.zip

$ for i in `ls /opt/zimbra/backup/sessions/full-20140426.080019.153/accounts/e46/a82/e46a828b-cdda-4635-98ab-31b8ac0129b6/blobs/`; do echo $i ; unzip -l $i | grep 40511-49376.msg; done

blobs-1.zip
     1372  04-26-2014 01:00   1/9/sha256_bKH8aeWJSh9bhzv5zsXrweA7+jZ88NUllkfV+7m9cJo=_40511-49376.msg1

Backing Up Backups - 3rd Party Tools And Software - Dealing With Directories With Hard Links

Description Of Hard Links

Zimbra uses hard links and special attention needs to be given to this fact. See hard links if your not familiar with hard links and their difference to symbolic links. Not all 3rd party backup software will handle or respect hard links. Many unix commands will need special flags to maintain hard links. When hard links are respected and also "copied" to the new location you could find your data usage become a large multiplication of the original size.

An good thread I found on the topic of preserving hard links for copy/move/backup operations is here:

I'll be summarizing the comments and including additional information I find on the topic below, based upon the command or software being used.

Zimbra and Single Instance Storage - Hard Links

If hard links are possible, we use them. The message must be identical and on to users on the same mailstore and stored on zmvolumes where hard linking is possible. Hard links exist only on the same partition. Postfix has a veriable, default_destination_recipient_limit , which will cause large recipient emails to be delivered in a way where they aren't identical [ see Ajcody-Hardlinks-And-Postfix-default_destination_recipient_limit for more details ].

Mike gives a good description of it here:

Redoing Hard Links RFE

For 8.0.2+ , see this option - zmdedupe :

Easy Way To SEE Hard Links In Use

I sent a test email with 5 accounts listed in the To field, that is shown below with the inode listing of 2133394. the first column of the ls [because of the i option] is listing the inode number of the file. I included the -type f because the . and .. will show directories using the same inode as the 'name' of the directory as listed.

# pwd
   /opt/zimbra/store2

# find . -links +1 -type f -exec ls -lai '{}' \; | sort
2133387 -rw-r----- 2 zimbra zimbra 1600 May  7 05:30 ./0/13/msg/0/281-4320.msg
2133387 -rw-r----- 2 zimbra zimbra 1600 May  7 05:30 ./0/27/msg/0/261-3021.msg
2133394 -rw-r----- 5 zimbra zimbra 1789 May  7 05:53 ./0/13/msg/0/282-4322.msg
2133394 -rw-r----- 5 zimbra zimbra 1789 May  7 05:53 ./0/14/msg/0/412-8476.msg
2133394 -rw-r----- 5 zimbra zimbra 1789 May  7 05:53 ./0/15/msg/0/284-9052.msg
2133394 -rw-r----- 5 zimbra zimbra 1789 May  7 05:53 ./0/25/msg/0/260-4021.msg
2133394 -rw-r----- 5 zimbra zimbra 1789 May  7 05:53 ./0/27/msg/0/268-3033.msg
2133404 -rw-r----- 2 zimbra zimbra 1518 May  7 05:22 ./0/13/msg/0/280-4318.msg
2133404 -rw-r----- 2 zimbra zimbra 1518 May  7 05:22 ./0/27/msg/0/260-3018.msg
Why Does A Message Blob With The Same Message-ID Have Multiple Inodes

Most likely, the message has a large recipient list and because of a variable in postfix, default_destination_recipient_limit , causes multiple deliveries of the message to have slight differences between them - for example, the times in the headers.

Please see the following:

Hard Links Used Within Zimbra Backup Directory - Sessions

Note, this describes an example when zimbraBackupMode equals Standard rather than Auto-Grouped


In regards to the backup sesions, hard links are only used for data that is in the shared_blobs directories from the various full backup sessions you have.

If you goto [below is an example used throughout]:

cd /opt/zimbra/backup/sessions/full-[some full dir]/shared_blobs/[some path]/t9RRjTIdwAZ3k,iJSWo0DxFKCbs=/

Then do a:

ls -li blob.dat
3869621 -rw-r----- 2 zimbra zimbra 5419 Jul 15 01:00 blob.dat

The first number is the inode of the file, which will be the same for all other hard links in use.

cd /opt/zimbra/backup/sessions
find . -inum 3869621 -print
  /opt/zimbra/backup/sessions/full-[some full dir #1]/shared_blobs/[some path]/t9RRjTIdwAZ3k,iJSWo0DxFKCbs=/blob.dat
  /opt/zimbra/backup/sessions/full-[some full dir #2]/shared_blobs/[some path]/t9RRjTIdwAZ3k,iJSWo0DxFKCbs=/blob.dat

Notice also, that the directory path naming scheme is also used for the user backup paths. The directory name that the blob.dat is in, will also be used in the user paths.

For example:

/opt/zimbra/backup/sessions/full-[some full dir]/shared_blobs/[some path]/t9RRjTIdwAZ3k,iJSWo0DxFKCbs=/blob.dat

if I then goto and do:

cd /opt/zimbra/backup/sessions/full-[some full dir]/
find . -name t9RRjTIdwAZ3k* print

I'll see matches in various user backups, with:

full-[some full dir]/accounts/c2e/23b/[zimbra ID of user]/blobs/3/0/t9RRjTIdwAZ3k,iJSWo0DxFKCbs=260-2041.msg4

Note though, those "user" files are not links [hard or soft] and they are of zero length in size.

Reference To Bugs Tied To Backups And Links:

Bacis Unix Commands

cp

cp [copy] Man page:

  • http://linux.die.net/man/1/cp
    • -a, --archive : same as -dpR
      • -d : same as --no-dereference --preserve=link
      • -p : same as --preserve=mode,ownership,timestamps
      • -R, -r, --recursive : copy directories recursively
  • -l, --link : link files instead of copying
  • -L, --dereference : always follow symbolic links
  • -P, --no-dereference : never follow symbolic links
  • -p : same as --preserve=mode,ownership,timestamps
    • --preserve[=ATTR_LIST] : preserve the specified attributes (default: mode,ownership,timestamps) and security contexts, if possible additional attributes: links, all
    • --no-preserve=ATTR_LIST : don't preserve the specified attributes
  • -s, --symbolic-link : make symbolic links instead of copying

No explicit mention of "hard links".

Formats from blog url above [I'll test these later and confirm/deny]:

  • cp -rpv
  • cp -av --preserve=all . /mnt/new
  • Simple `cp -a` using cp (GNU coreutils) 5.97 on my debian does the job quite nicely, I just checked. No need for the --preserve=all option, -a implies --preserve=link. It didn't seem to take too long either, but I would be surprised if it was very much better than rsync. Much easier to remember though.
mv

mv [move] Man page:

tar

tar [tape archive] Man page:

  • http://linux.die.net/man/1/tar
    • --check-links : warn if number of hard links to the file on the filesystem mismatch the number of links recorded in the archive
    • -h, --dereference : don't dump symlinks; dump the files they point to
      • No explicit reference to "hard links".

Please see the following on hard-links and GNU/Tar:

dd

dd [copy and covert - cc was reserved for the C complier] Man page:

No explicit mention of "hard links" in Man page.

rsync and nice

rsync and nice Man page:

A reasonable syntax to use for rsync is [ taken from Ajcody-Notes-Server-Move#The_Actual_Steps ]:

nice +19 rsync -avzH -e ssh --progress /opt/zimbra/ root@NEWHOSTIP:/opt/zimbra

or

nice -20 rsync -avzH -e ssh --delete --progress /opt/zimbra/ root@NEWHOSTIP:/opt/zimbra 
Notice the use of --delete in the last one.
find And cpio

find and cpio Man pages:

Possible syntax use to try [recursive copy of current working directory] :

mkdir /path/to/dest
cd /path/to/DATA
find . -print | cpio -Bpdumv /path/to/dest

Issue to note: "...cpio didn't properly preserve timestamps on directories."

dump And restore

dump and restore Man pages:

ditto - For Mac

ditto Man page:

xfs_copy

xfs_copy Man page:

LVM Tricks
LVM Snapshots

See Back Up (And Restore) LVM Partitions With LVM Snapshots

SAN Snapshot

Possible note of caution I've seen from someone, "When implementing snapshots for ZCS, you should do the snapshot across all ZCS LUNs for a single host at the same time using a consistency group (for netapp, I believe this means cg-start/cg-commit)."

Please see:

Cloud Backups
Amazon S3 , Amazon EC2 , SecoBackup And/Or Tar

I've not used Amazon S3 or SecoBackup. I have no idea about the pricing structure of Amazon S3 and how differing solutions might cause price differences. What I think would be a reasonable approach:

  • Adjust zimbra cron to:
    • run zmbackup as normally scheduled but then include:
      • tar and gzip "new" backup that was made to a "staging" partition.
      • Setup Secobackup [CLI method for cron] to then copy this tar'd/gzip'd file to the Amazon S3 cloud.
      • Remove local tar'd/gzip'd file from staging partition.

I purpose the tar'd/gzip'd step because I doubt there's a way to avoid the hard link issue with SecoBackup/Amazon S3. Why pay multiple times for the same data?

Some information a customer reported to me:

S3 does not work as a normal filesystem and you cannot mount it; hence 
it wouldn't normally work.

However, there are various projects out there which let you use S3 as 
a local POSIX-compliant file system.

Possible options:

s3fs-fuse
jungle disk
subcloud
persistentfs
Amazon EBS

To cut a long story short, PersistentFS came out on tops - it worked 
extremely well - however did not work with Zimbra at all once I set it 
up as the store (/opt/zimbra/store)

The problem is that the filesystem while it is POSIX compliant does not 
have support for hard linking (Which is what Zimbra does with tmp incoming 
messages to the store).  -- [bug 43019 below]

So, overall it's not really possible to do it right now with S3.

They should have hard link support soon.

References:

3rd Party Backup Tools And Software - Generally Not Apart Of The Basis OS

Amanda And Zmanda

Zmanda Home Page:

Amanda Home Page - Advanced Maryland Automatic Network Disk Archiver:

Found this, "Hard links. Maintains the integrity of hard links during backup."

Arkeia

Arkeia Home Page:

Found this, "The Arkeia solution accommodates full and incremental backups, scheduled or on demand, and preserves directory structure, registry, symbolic links and special attributes."

Also, a customer supplied what Arkeia's support sent them to the question. Here is that response:

When Arkeia encounters a hard link (a regular file with more than one reference to it):
  • if it is the first time we see this link, we backup the file and keep the inode number and the path to the file in a memory hash table.
  • if we have already seen the file, we backup the fact that it is a hard link and the target of the link. The files data are not backed up again.

Backup Exec - Symantec / Veritas

Backup Exec Home Page:

Unable to find any reference about the Linux/Unix Agent and the Backup Exec server being able to handle or not symbolic and hard links.

Backup Exec "server" is only available on Windows. One might inquire with Symantec if you can "swap out" your current investment in "Backup Exec" and use their NetBackup product. This supports hard links and the "server" can run on Windows or other *nixes. See Ajcody-Backup-Restore-Issues#NetBackup_-_Veritas.2FSymantec

BackupPC
Bacula

Bacula Home Page:

Found this:

hardlinks=yes|no
When enabled (default), this directive will cause hard links to be backed up. However, the File daemon keeps track of hard linked files and will backup the data only once. The process of keeping track of the hard links can be quite expensive if you have lots of them (tens of thousands or more). This doesn't occur on normal Unix systems, but if you use a program like BackupPC, it can create hundreds of thousands, or even millions of hard links. Backups become very long and the File daemon will consume a lot of CPU power checking hard links. In such a case, set hardlinks=no and hard links will not be backed up. Note, using this option will most likely backup more data and on a restore the file system will not be restored identically to the original.

Source:

BRU - TOLIS Group

BRU Home Page:

Found this in one of their manuals, you should confirm with them based upon the product version you'll be using:

Special Files - BRU will save and restore all types of filesystems and files with their proper ownership, access attributes, creation dates, and modification dates. BRU can be used to move an entire directory hierarchy from one system to another, with all files, including directories, block special files, character special files, fifos, hard links, and symbolic links reproduced with all attributes intact.
Lone-Tar - Lone Star Software Corp.

Lone-Tar Home Page:

Found the following references, though it's not explicit in stating "hard links" :

BACKUP FEATURES - Backs up everything including device files, empty directories, links, symbolic links, Virtual Files and NFS mounted file systems.
RESTORE FEATURES - Fast Seek File restore of files, sym-links,