AXIGEN Mail Server - WebMail First Impression

Once installation and basic configuration are done, I went ahead to test Axigen WebMail.

There are 2 WebMail interfaces to choose from - AJAX or Standard.

AJAX Interface

Standard Interface

Did you notice the logo in the AJAX interface?

Yes - "Technology Preview", it is still being developed. Currently, the Calendar and PIM features are not integrated yet. :)

If you choose to use this interface and click on Calendar, a pop-up window will redirect you to the Standard interface. I hate pop-up!

Integrated Email & Calendar in Standard Interface

For the moment, I'll stick to the Standard interface. Good enough for me.

What's next do I usually look for in WebMail?

Almost without fail, I'll look out for Filters (see Say goodbye to Yahoo Mail) and Auto-Responder.

I found an interesting feature - Temporary Email.

Users can request a one or more random temporary aliases for use when subscribing to public sites, in order to avoid spam; temporary email addresses expire after the time period defined by the administrator.

Technically, this is nothing but aliases.

But from end-users' perspective, this "user-self-service" feature is intuitive. And it saves them the hassle to apply temporary email addresses via Administrators, which takes days at times.

This proves again great feature does not have to be complex.

AXIGEN Mail Server - Installation & Configuration

Installation of AXIGEN Mail Server for standalone deployment is fairly simple. It took 12 steps!

Yes, that's it. As simple as that.

(If you need screenshots of the installation steps, email me at cheechong @ azlabs.sg)

After installation, the next most important step is to configure Security & Filtering. This is almost a must these days.

The default installation of AXIGEN comes with a number of built-in AntiVirus and AntiSpam softwares, including a free 1-month trial of Commtouch Real-Time Antispam Protection.

The beauty of the AntiVirus and AntiSpam feature is the ability to dictate the order in which you want each component to be executed.

Now, what if you want to integrate commercial products like TrendMicro InterScan™ Messaging Security Suite (IMSS) with AXIGEN?

Not too difficult. You can always create a detour (Axigen calls it the Sandwich Architecture).

Basically, when emails arrive at the SMTP-Incoming:

• A detour is made to deliver the emails to the AntiVirus/AntiSpam server (it can resides on the same machine or a remote machine)
• The AntiVirus/AntiSpam server will scan the emails and perform actions based on predefined rules
• A detour is again made to deliver the "safe" emails back to the Message Store

See here for detailed implementation.

AXIGEN Mail Server

I just downloaded a copy of Mobile Office Edition 7.3.2 from AXIGEN and managed to get license key for the software.

FYI, the Mobile Office Edition offers Push Email and PIM Synchronization.

As per my normal practice, I usually begin with the Architectural Diagram of any product which I intend to evaluate.

To me, selling is about convincing buyers with a diagram. It's best to illustrate visually and the story has to be simple. If it takes time to explain what your product is capable of, then it's difficult for buyers to make decision.

Mobility support is crucial these days with dynamic workforce. The list of supported mobile devices is pretty comprehensive. See here.

Do note the following:

• Microsoft® Exchange ActiveSync® - compatible handsets such as Nokia Symbian / Apple iPhone / all Windows Mobile devices (Smartphone, PocketPC, HTC etc)
  
  
• BlackBerry® handsets (through the AstraSync™ or the NotifySync™ client)

I think most vendors are pretty good in providing ActiveSync® solution. I'm a BlackBerry user though, so I'll be testing AstraSync™ instead.

For a detailed features listing, you should read the PDF file from here.

Mobile Sync with Sun Calendar Server - Part III

Few days back, I came across an Open-Source Java program (GCALDaemon) that offers two-way synchronization between Google Calendar and various iCalendar compatible calendar applications.

Suddenly, an idea struck my mind!

There is now a cheaper way to implement mobile sync to Sun Calendar Server 6.

GCALDaemon is an OS-independent Java program that offers two-way synchronization between Google Calendar and various iCalendar compatible calendar applications. GCALDaemon is primarily designed as a calendar synchronizer but it can also be used as a Gmail notifier, Address Book importer, Gmail terminal and RSS feed converter.

What we need is to use the file-based synchronizer feature in GCALDaemon.

Bingo!

Slightly troublesome. However, it saves cost and is elegant enough. Personally, I'm using this architecture to sync my BlackBerry calendar with my Sun Calendar Server in the backend.

Mobile Sync with Sun Calendar Server - Part II

If you have followed my previous posting, you'll realize that Sun Calendar Server 7 is seldom used in the real world.

Why?

Simple reason: No one will use a Calendar Server that cannot integrate with WebMail.

Efficiency has become the norm today. Everyone wants a integrated, tightly-coupled office productivity tool to work with.

At present moment, most Sun Java Communications Suite 7 deployment will still be using Sun Calendar Server 6, until Sun Calendar Server 7 is developed to interface with Sun Convergence Server (WebMail).

Because of the same reason, if customers require mobile sync feature, they'll need to deploy Sun Java Mobile Communications Server - an additional component with separate licensing model.

This is costly. :)

Mobile Sync with Sun Calendar Server

The latest Sun Java Communications Suite 7 comes with 2 versions of Sun Calendar Servers - Calendar Server 7 and Calendar Server 6.3.

Why are there 2 versions of Calendar Servers?

• Calendar Server 7 is the new CalDAV-based calendar server that interoperates with all leading CalDAV-compliant clients, including mobile CalDAV clients.

• Calendar Server 6.3 is the calendar server that Sun has been deploying for years. However, if you need to sync the Calendar on your mobile phones with Sun Calendar Server 6.3, you need an additional component - Sun Mobile Communications Server.

Architecturally, both Calendar Servers are totally different. Calendar Server 7 is not an upgrade version of Calendar Server 6.

• Calendar Server 6 has an internal HTTP daemon ("Calendar Express") that bridges between the WebMail (Sun Convergence or Communications Express UWC) and Calendar Server front-end. The Calendar Server front-end interacts with Calendar Server back-end subsequently.
• The Calendar data is stored in Berkeley database.

• Calendar Server 7 is developed as a Java web-application. It sits on top of an Java Application Server.
• The Calendar data is stored in MySQL database.
• Currently, there is no bridge between WebMail and Calendar Server 7.

Mobile Sync from Axigen

Just came back from Perth for a family holiday. Relaxing place, except the hot summer weather.

I was clearing my mailbox when I saw that there is a Free Mobile Sync from Axigen.

It seems Mobile Sync is a definite must for any messaging solution these days.

PS: So you think it's free? Come on, nothing is free in this world. Valid until 31st March 2010. :)

Sun Products download on Oracle E-Delivery Site

I met up with a long-time customer today. We were talking about a potential collaboration for a China project.

We used to customize Oracle E-Business Suite (CRM) for a government agency few years back. He lead his consultancy team; we beefed up his team with our Java Architects.

Anyway, as part of the collaboration requirement, we need to download Oracle E-Business Suite. He told me to go to Oracle E-Delivery Site.

So I went ahead to the site ... and to my surprise, I found Sun Products download as well!

However, Sun Products on Linux x86 and Microsoft Windows (32-bit) only.

Strange! Why no Solaris platform?

Email Forwarding Tracking for Administrator

There is a nice feature in OpenMail.SG that is worthed mentioning - Email Forwarding Tracking for Administrator.

Some of our corporate customers asked for this feature. We thought over it and asked ourselves "Why Not?".

This is a feature that allows administrators to track the forwarded email addresses.

Note that only privileged users (usually the HR or Security teams or the Business Owners) will be allowed this feature.

There are some corporate rules that disallow employees to forward their emails to external parties. Thus this feature allows the administrators to quickly identify employees who might have accidentally forwarded to non-intended parties.

Weird IPMP Output - Part II

A telco in the Philippines engaged us to troubleshoot a IPMP (IP Multipathing) issue on one of their Solaris box.

The customer is using Probe-based detection, not Link-based detection.

They always encounter the following 2 problems when IPMP is configured on this particular Solaris box:

1. The standby interface (e1000g2) on the node will always fail whenever it is configured for IPMP
2. Otherwise, when e1000g2 is the active interface, it will never fail-back to the primary interface (e1000g0)

Discovery:
1. OS version is Solaris 10 U7
2. The Patch Level is 141445-09.

3. A check on SunSolve reveals the following fact:

Solaris 10 Kernel Patches 141444-09 (SPARC) and 141445-09 (x86) cause interface failure in IPMP when configured for probe based failure detection. This issue does not occur with a IPMP link based failure detection configuration. (Read here)

4. Resolution

This issue is addressed in the following releases:

SPARC Platform:
Solaris 10 with patch 142900-02 or later

x86 Platform:
Solaris 10 with patch 142901-02 or later

Compliance vs Operational Archival

In my conversations with IT managers, most are not able to differentiate between compliance and operational archival solutions. All they want is an archival solution. But when you ask more, they are mostly confusing.

Today, I was reading the Sun Java Communications Suite wiki and come across the section on Messaging Archival again.

There are two types of archiving, compliance and operational.

Compliance archiving is used when you have a legal obligation to maintain strict retrievable email record keeping. Selected email (selected by user(s), domain, channel, incoming, outgoing and so on) coming into the MTA is copied to the archive system before being delivered to the message store or the internet. Archiving can be set to occur either before or after spam and virus filtering.

Operational archiving is used for mail management purposes. For example:

• To reduce storage usage on the Messaging Server message store by moving less used (older) messages to an archiving system which uses lower cost storage.
• As an alternative for data backup.

Note that compliance and operational archiving are not exclusive. That is, you can set up your system so that it does both compliance and operational archiving.

Mail Filtering - Part II

I recently switched from Yahoo Mail to Gmail because of Yahoo's faulty mail filter. (See blog)

Architecturally, have you noticed any difference between Gmail and other mail servers?

Gmail does not have a Folder concept. It uses the Label concept. All emails, when filtered, are applied with a label. After filtering, they are still sent to the same INBOX.

Gmail's filtering is to attach a label to an email. After labeling, this email will "disappear" from the INBOX and "appear" when the label is clicked.

Ok, no big deal, I thought. So I went ahead to create my 1st filter.

I tried "Skip Inbox" so that this email will not appear in my INBOX. Then I applied "ADV" label. Simple!

After the filter was created, I could still receive emails from the above From-address in my BlackBerry. Strange.

I created my 2nd filter.

I tried "Skip Inbox" so that this email will not appear in my INBOX. Then I applied "ADV" label. Same as what I have previously done. But, in addition, I clicked on "Mark as read".

This does the trick! Emails that are read will not be pushed to BlackBerry or any PushMail handsets.

However, is this method good?

Personally, no. When I go back to my Gmail via a browser, I would still want to read those filtered emails. Ideally, their status should be unread so that I know I have not read them yet.

But with Gmail, this is not possible. Luckily, I do not use Gmail for business.

Mail Filtering

If you have a BlackBerry like me or any PushMail enabled phone, it's annoying to receive unimportant or non-targeted emails. It will be ideal to receive only qualified emails.

The way to achieve that is to configure Mail Filter. (See diagram below)

From my experience, I also find that the sequence when Mail Filter kicks in is also important. The most effective method is to filter emails before they reach the INBOX.

This will ensure that only important emails are being push to your BlackBerry or any PushMail enabled handsets.

Say goodbye to Yahoo Mail (for the time being)

I have always been using Yahoo Mail to send/receive my emails from Gmail. (See my previous posting)

However, I am switching to Gmail for the time being (or maybe forever depending on how Yahoo Mail develops). Why?

Simple: Yahoo Mail Filter (for All-New and Classic interfaces) is not working!

Mail Filter is really important for me, especially since I carry a blackberry. I only want important emails to appear in my INBOX, and nothing else.

Disk-Path Failure Handling

Disk-Path Failure Handling refers to the ability to automatically reboot a node if all its paths to shared disks have failed. Faster reaction in case of severe disk-path failure enables improved availability.

Note that this feature is only available on Sun Cluster 3.2 onwards.

Sun Cluster vs Veritas Cluster

Last week, my colleague and I traveled to Kuala Lumpur to conduct a TOI (Transfer of Information) session to our customer, a telco solutions provider.

During the session, we were asked the differences between Sun Cluster and Veritas Cluster.

Fairly common question, I'hv been asked a few times before.

Sun Cluster

* Kernel-based - faster in failure-detection

* Only support Sun Solaris OS

* Cheaper overall - e.g. IPMP, MPxIO, UFS, SVM all free from Solaris OS

Veritas Cluster

* Software-based

* Support multiple platforms

* More expensive overall - e.g. VxFS requires extra license

A typical scenario to utilize Veritas Cluster is a mid-sized to large-sized company having multiple platforms (Solaris, HP-UX, AIX ...) in their data center. In order to standardize the clustering software (so as to reduce training and operation cost), Veritas Cluster will be the choice to use.

Sun Gathering Debug Data

When we deploy Sun Cluster and have an issue, we usually run Sun Explorer. The backend engineer will be able to digest and analyze what has gone wrong.

When we deploy Sun Software Suite, we will use Sun Gathering Debug Data (Sun GDD or GDD).

GDD tools provide the right approach to problem resolution by leveraging proactive actions and best practices to help you gather the required debug data needed for further analysis. For each product covered, GDD tools provide documentation and scripts which detail the relevant data the Sun Technical Support Center requires for analyzing your problem. The tools gather 90% of the debug data frequently requested by the Sun Technical Support Center - including data for more common critical situations including memory, start/stop, installation, hang, and crash issues. By collecting this data before you initiate a Service Request, you can substantially reduce the time needed to analyze and resolve the problem.

Fault Monitoring of resource

I'm still in Senegal busy with the Sun Cluster for Oracle HA UAT.

(Pictures below are Novotel Dakar. Very nice cozy hotel just besides the sea.)

Besides configuring Oracle database for HA, we are also responsible for monitoring customer's applications via Sun Cluster.

There are 2 ways to configure Fault Monitoring for Generic Data Service (GDS):

1. Port monitoring (default)

2. Probe command monitoring

Port monitoring is fairly straight-forward. It assumes your application is running on a particular port. If Sun Cluster detects that this port is down, it will assume that your application is faulted. It will then attempt to restart the resource automatically.

The application for this teleco here is pretty complicated. There are times when the port is still alive, but the application has hung. This is exactly what happened here!!

So Port monitoring is not reliable in this case, at least for this application per se.

We need to use Probe command monitoring instead. Probe command will require us to write shell script that return values like 0 (successful), 100 (complete failure) and 201 (immediate failover).

Now, there is an issue - port monitoring is turned on by default. If you have probe command monitoring added, port monitoring is still running. As such, even if probe command returns 100, but if the port is still alive, Sun Cluster still treats the resource to be alive.

This is no good. We need to disable port monitoring and rely totally on probe command monitoring.

How do we achieve that?

-x Network_aware=FALSE

LUN, Device Group and Mount Points are correlated

I have flown 30 hours to reach Senegal for a Sun Cluster for Oracle HA UAT. Customer is a teleco in Senegal.

The following is what I have implemented for them due to a constraint I encountered at the Storage level:

Oracle and App are now residing on the same node at the same time. Always.

Ideally, one would like to have Oracle active on 1 node; and App active on the 2nd node. That would be best in term of performance.

However, there is only 1 LUN being created by the storage engineer before the whole setup was shipped from China. No one here in Senegal knows how to reconfigure the LUN.

What's the implication of 1 LUN?

Now, if one is a Software person like the customer, it would be very hard to appreciate the issue. I need to explain in a more layman term.

Let's look at the table below:

A software person can only understand until column 3 ("Mount Point on Solaris OS"). Beyond that, it would be fairly difficult to grab the terms like Device Group, LUN, etc..

In order to understand, we need to read from right-to-left (yes, the ancient Chinese way of reading).

If there is 1 LUN, there can only be 1 Device Group. If we only have 1 Device Group, then all mount points have to be defined under this group.

As such, as all mount points have to be always together, it implies all applications (Oracle and App) have to be always together.

The ideal architecture will be the one shown below:

Oracle on 1 node; App on the other node

In order to have such a setup, we need to define at least 2 LUN at the Storage level.

Good customer service and post-sales service

I must admit customer service, especially post-sales service, is very lagging in many companies these days.

Axigen is one of the better that I have seen so far.

Ever since I downloaded a trial copy of the Axigen Mail Server for evaluation, I have been constantly engaged by their team with newsletters covering product updates and releases.

Axigen even bother to ask for feedbacks to help them improve.

Sun Cluster 3.1 Data Service for Oracle 11gR2 HA

A teleco in Brunei required our service to install and configure Sun Cluster Data Service for Oracle HA.

Fairly simple requirement ... only if all components are of the latest, I thought. But when I took a look at the BOM list, I was surprised that they are using a fairly old version of Sun Cluster 3.1. For Oracle database, they want the latest 11gR2 release though.

There isn't enough information on the Internet. Thus, we wrote in to Sun and below is the reply:

Oracle Server

8.1.6 32&64bit 8.1.7 32&64bit 9i 32&64bit SC 3.1 Solaris 8, 9
•Note thatOracle8.1.x have been desupported by Oracle. However, when the customer has continuing support for Oracle 8.1.x from Oracle,Sun will continue supporting the Sun Cluster HA Oracle agent with it.

9i R232 & 64bit 10G R1& R2 64bit Solaris 8, 9,10
•Both Standard and Enterprise Editions are supported

11g Solaris 9, 10
•Both Standard and Enterprise Editions are supported

Access Manager Slowness Issue

As I have mentioned in my previous post, I was in Bangkok last week to help in conducting a Performance Test for a Single Sign-On and Identity Management project for a local bank.

The user complained about slowness when trying to log into Access Manager. He noticed that, at times, it takes a user 4 minutes to login to Access Manager.

From our analysis, this only happens after a long period of inactivity on Access Manager. The technical explanation is due to the connections dropped by the Firewall that sits in-between Access Manager and Directory Server.

When a connection is dropped by the Firewall, the Access Manager is not aware. Thus when a user attempts to login to Access Manager after a long period of inactivity, he will need to wait around 4 minutes. This is the approximate time taken for the Access Manager to wait for TCP timeout and retry with a new connection to Directory Server.

The easiest and most commonly used technique to resolve this issue is to configure the Firewall not to drop any connection from Sun Access Manager to Sun Directory Manager. However, the customer has indicated that the Nokia Firewall cannot be configured as such.

The workaround is to set a parameter in Access Manager. This ensures that the connections from Access Manager are restarted even before the Firewall attempts to drop any inactive connection.

/**
* The following properties can be used when a Load Balancer/Firewall
* is in between the agents and the Directory Server and the persistent
* search connections are dropped by them when TCP idle timeout happens.
*
* These properties make sure that the persistent searches restart
* in such cases when the connections are dropped.
*
* The property 'com.sun.am.event.connection.idle.timeout' specifies
* timeout value in minutes after which the persistent searches will be
* restarted. Ideally, this value should be lower than the Load Balancer/
* Firewall TCP timeout, to make sure that the persistent searches are
* restarted before the connections are dropped. A value of '0' indicates
* that these searches will not be restarted. By default the value is '0'
* Note: only the connections that are timed out will be reset.
*/
com.sun.am.event.connection.idle.timeout=60

Enable HTTP log on Sun Application Server during Load Testing

I'm in Bangkok this week to help in conducting a Performance Test for a Single Sign-On and Identity Management project.

Before the Performance Test starts, I want to ensure that the load-balancer is configured properly to distribute load evenly to the 2 Sun Access Manager and the 2 Sun Identity Manager.

Both components are deployed on Sun Java System Application Servers. However, the server.log is not moving when we tried to access the index.html page.

We realized Sun Application Server, by default, does not track HTTP requests. In order to track HTTP requests, we need to execute the following steps:

1. Go to Logging -> Log Levels

2. Default is INFO. (Not good enough)

3. Set to FINEST.

4. Click SAVE. (You do not need to restart the Application Server)

Nice!