Adminp Advanced Topics
Total Page:16
File Type:pdf, Size:1020Kb
® IBM Software Group AdminP Advanced Topics Susan Bulloch - IBM ISV Technical Enablement Engineer © 2003 IBM Corporation IBM Software Group | Lotus software Agenda … AdminP history AdminP processing and operations Tuning AdminP Monitoring AdminP Defining best practices Implementing tips and tricks What’s coming in Domino 8 Wrap-up 2 1 IBM Software Group | Lotus software What Was AdminP Designed to Do? AdminP is a server task (adminp) that automates many administrative tasks You initiate the tasks, and the Administration Process completes them for you It was introduced in R4 to manage name changes There were 19 requests when introduced in R4 And now? AdminP is a required server task and an integral part of the Domino system It’s taking on more work with each release 180+ requests in Domino 8 With each release, it’s becoming more efficient, too! 3 IBM Software Group | Lotus software What Does AdminP Do? AdminP automates things that can be done over time Moving files Deleting files Changing names Creating replicas on remote servers It automates things that need to be exact Server build numbers Server port names Client builds If the data needs to be exact, AdminP can often do it 4 2 IBM Software Group | Lotus software What Else Can AdminP Do? Help manage user mail access Allows the user to be set down to Editor Performs various functions that formerly required manager access Sets Out-of-Office status, mail & calendar delegation Manage registration and recertification using the CA process Allows Web-based user registration Allows ID management with no user actions Allows more secure administration Integrates with many 3rd party tools 5 IBM Software Group | Lotus software AdminP is Self-Configuring! If you leave it alone, AdminP configures itself! A database replica stub is created on each new server The ADMIN4.NSF database is created upon startup of each new server The replica ID of Admin4.nsf is based on the Directory Replica ID – So is unique to each environment Replication must be allowed from admin hub to spokes – Either directly or through other hubs If you interfere, it can cause problems Attempts to change Replica ID will usually fail! The replica ID needs to be set as designed 6 3 IBM Software Group | Lotus software AdminP Requirements The AdminP server task must be running on the server Load adminp at startup using servertasks= in the ini file It’s there by default Best practice is to leave it this way There must be an Administration Requests database (ADMIN4.NSF) on each server Users and Admins need appropriate access to this database The databases must be well maintained and replicating properly More details later … 7 IBM Software Group | Lotus software AdminP Requirements (cont.) An Administration server must be set for the Domino Directory as well as ADMIN4.NSF The setting “Do not modify Names fields” for Domino Directory and ADMIN4.NSF is required A copy of CERTLOG.NSF must exist on your administration server You can have copies elsewhere too if you wish An administration server set in the ACL of databases Any database that you want AdminP to maintain You probably want them all maintained There’s a command to know if all databases are set properly – Details in a few minutes 8 4 IBM Software Group | Lotus software Where AdminP Works On the administration server of a database Changes are made on this copy of a database This minimizes chance of replication conflicts On the administration server of the Directory Often the “main” server of a system “All Servers” or * Every server in the domain For example, name changes are processed by all servers “Named” server A specific server to perform a request For example, the move replica request works on the “target” server for the move, but no others 9 IBM Software Group | Lotus software Processing Requests Most processes are timed Sequential actions trigger the next action Process continues until all steps are complete The shortest interval is one minute (immediate requests) Something starts the process Usually an Administrator Examples of admin-initiated processes are user renames, deletions, replica creation A response is expected by Domino Example: User authenticates with home server, replica stub created on target server The next step is started Example: Unread marks change, group entries change 10 5 IBM Software Group | Lotus software Processing Requests (cont.) The processes continue Some can continue for a week But you can speed this up – There’s even more control in Domino 8 Some processes can stay active for more than a week Mail moves Name change requests – These are monitored and controlled in Person Documents – You do NOT need to keep documents 21 days in ADMIN4.NSF – Any processes that need to continue will re-start based on the person documents 11 IBM Software Group | Lotus software Automated Processing — Almost Interim steps sometimes require human touch Anything affecting Directory documents or database files Also name change reversions! Anything that must be approved along the way by someone with rights to the document or file In other words, an Administrator: – This allows delegation to less experienced employees – Protects Directory data from employees in groups who are not Notes Admins – Security teams often perform renames – They often have limited Domino training – This tiered approval process protects your system 12 6 IBM Software Group | Lotus software Examples of AdminP Tasks Delegate mail files Set end-user agents to run Manage CA administration Manage roaming users Create and rename rooms and resources Find users Manage policies Change HTTP password Create new mail files in the background 13 IBM Software Group | Lotus software Examples of AdminP Tasks (cont.) Add/remove servers in cluster Change user password in Domino Directory Add Internet Certificate to Person Record Configure Domain Catalog Enable server’s SSL ports in Domino Directory Move mail files Rename groups But this isn’t all … 14 7 IBM Software Group | Lotus software AdminP Operations Every hour, by default, AdminP checks for work This is a tuneable parameter Only requests that are “new” are processed on a server On AdminP start-up, task requests with no response document (log) or entry in a hidden ID table are flagged to be processed When AdminP is already running, new entries (based on time/date stamp) to the ADMIN4 database are flagged This can cause problems if “old” data is replicated back into newer databases – This must be prevented – We’ll tell you how 15 IBM Software Group | Lotus software AdminP Operations (cont.) Immediate requests are performed within a minute of posting to the ADMIN4 database No option exists to change the immediate request interval (1 minute) Typically these requests should be processed quickly: Create replica Change user password in Domino Directory Update client information in Person Record Change HTTP password in Domino Directory Immediate requests are denoted in ADMIN4 with a “bolt” icon 16 8 IBM Software Group | Lotus software AdminP Batched Requests These were introduced in 6.0 to increase efficiency They perform certain modifications for many users at once The database is accessed once Several user changes can be made Example: Four user names can be changed in the Access Control List (ACL) Pre-batch methods caused 4 accesses Currently 18 requests are batched Interval times should be long enough to accumulate multiple batch types Interval should be short on the admin hub, longer on spokes If the interval is too long, the server won’t have time to accumulate similar requests. 17 IBM Software Group | Lotus software List of Batched Requests Rename in ACL Delete in Person Documents Delete in ACL Delete in Reader/Author fields Rename in Person Documents Rename in Reader/Author fields Rename Group in ACL Rename Group in Reader/Author fields Rename Person in Unread List 18 9 IBM Software Group | Lotus software List of Batched Requests (cont.) Rename Web User in ACL Rename Web User in Person Documents Rename Web User in Reader/Author fields Rename Web User in Unread List Delete Person in Unread List Rename in Design Elements Delete in Design Elements Rename Web User in Design Elements Rename Group in Design Elements 19 IBM Software Group | Lotus software AdminP — The Database (ADMIN4.NSF) Contains processing action requests AdminP requests Contains processing action results Known as AdminP response (log) Administration approval requests are there also Examples: Confirm database deletion Certification requests for change hierarchy Provides views to help with troubleshooting Use Domino Domain Monitoring (DDM) to monitor the database in Domino 7! Finds stalled requests 20 10 IBM Software Group | Lotus software AdminP – The Database (ADMIN4.NSF) (cont.) AdminP is designed to be managed Workflow requires attention/approval The database will grow in size if ignored Sufficient access is needed Default is Author with Create for users Can be No Access in ND6 and later – Requests from users are mailed to the database – Default mail-in database is called Administration Requests Can use wildcard if Default needs to be No Access Administrators need Author, minimum Editor access to approve requests 21 IBM Software Group | Lotus software AdminP – The Database (Admin4.nsf) (cont.) Proper replication is required Admin4.nsf should replicate as often as Directory The size can grow unacceptably if it doesn’t Replication retention should be standardized The default