System Administration

• The Settings realm contains pages that allow a Server Administrator to modify the Server kernel and module settings.
• The Users realm contains pages that allow a Server Administrator to create and remove Domains and Accounts, and to modify the Domain and Account settings.
• The Monitors realm contains pages that allow a Server Administrator to monitor server and module queues, communication channels and their states, to browse the Server Logs, and to view Server statistics.
  If a user is granted an access right to the Monitors realm, additional Monitor Access rights can be granted, too (rights to release and reject module queues, reconfigure the Log Manager, etc.)
• The Directory realm contains pages that allow a Server Administrator to configure the CommuniGate Pro Directory services.
• The Master realm contains the pages that allow a Server Administrator to grant and revoke Server Administrator access rights, and to modify the Server License Keys.

Note: If an Account is granted the Master access right, the Account user can access all realms.

Note: These Server Administration access rights can be granted to the Main Domain Accounts only. Accounts in secondary Domains can be granted Domain Administration rights only.

When a Server is installed for the first time, it creates the postmaster Account in the Main Domain, and it grants the Master access right to that Account.

When the CommuniGate Pro Server is installed for the first time, and the postmaster Account is created, the Basic WebAdmin Interface Type is set for that Account. You can change the Interface Type by opening the WebAdmin Preferences pages.

Note: This documentation shows the WebAdmin pages and settings as they are displayed in the Expert mode.

Main Domain Name

In this field you should enter the name that the CommuniGate Pro Server will interpret as its own Main Domain Name. All mail addressed to that domain will be treated as local, and (in the simplest case) that mail will be stored in local account mailboxes. Initially, this field contains the server computer name that CommuniGate Pro retrieves from the OS. If this names looks like host12345hh.company.com, you should change it to the name of the domain this Server should process.

Note: unless you create additional Domains ONLY the E-mail Messages and Signals directed to addresses in the Main Domain will be processed as local. If the Main Domain Name is entered as company.com, then Messages to mail.company.com or Signals to sip.company.com will not be processed as local, and if such a Message or Signal is received, the Server will try to deliver it to the mail.company.com or the sip.company.com system over the network.
If the DNS record for mail.company.com or sip.company.com points to the same Server computer, the mail loop or signal loop error will be detected, and the Message or Signal will be rejected.

If your Server should serve several domain names, enter the additional domain names as Main Domain Aliases (if those domain names should be mapped to the Main Domain), or create additional Secondary Domains.

Sample configuration:

Your Server should serve the company.com and client1.com domains. These domain names have their DNS MX-records and SIP SRV-records pointing to server.company.com and server.client1.com A-records, and these A-records point to IP address(es) assigned to your CommuniGate Pro Server system.

• set company.com as the Main Domain Name.
• open the Domains page, find the company.com record and click on its Settings link to open the company.com Domain Settings page. Scroll it down to find the Domain Aliases fields.
• enter server.company.com into an empty Aliases field, and click the Update button.
• open the Domains page. Enter client1.com into the text field and click the Create Domain button.
• the client1.com record should appear in the list; click its Settings link to open the client1.com Domain Settings page. Scroll it down to find the Domain Aliases fields.
• enter server.client1.com into an empty Aliases field, and click the Update button.

System Internals Log

Use this setting to specify what kind of information the Server kernel module should put in the Server Log. Usually you should use the Major (message transfer reports) level. But when you experience problems with the server kernel, you may want to set the Log Level setting to Low-Level or All Info: in this case low-level details will be recorded in the System Log as well. When the problem is solved, set the Log Level setting to its regular value, otherwise your System Log files will grow in size very quickly.
The kernel records in the System Log are marked with the SYSTEM tag.

Kernel problems are very unlikely to happen. If you see any problem with the Server, try to detect which component is causing it, and change the Log setting of that component (Router, SMTP, POP, etc.) to get more information.

Crash Recovery

If this option is enabled, the CommuniGate Pro Server uses special recovery techniques to proceed after various failures (including the crashing bugs in the Server software itself).

If you see "exception raised" messages in your CommuniGate Pro Log and/or in the OS system.log or mail.log, you may want to disable this option and force the Server to stop when an exception is raised again, and to produce a core dump file.
Core dump files can be uploaded to the CommuniGate Systems ftp site for examination.

CommuniGate Systems recommends you to disable this option if you are running any beta-version of the CommuniGate Pro software.

Separate WebAdmin Realms

If this option is disabled, WebAdmin realms are addressed using the /Master/realmName/page URLs, with /Master/ as the authentication realm. The Server Administrator can access all WebAdmin pages by entering the password only once, but the Server Administrator Account must have the Master access right.

If this option is enabled, WebAdmin realms are addressed using the /realmName/page URLs, with /realmName/ as the authentication realm. The Server Administrator needs to enter a password to open each realm, but the Server Administrator needs the access right for that realm only.

Enable this option if some of your Server Administrators do not have the Master access right.

Information fields

Information fields on the General Settings page display

• the name of the Server Operating System
• the Server hardware platform (CPU type)
• the CommuniGate Pro Server version
• the Server Local Time and Time Zone (this information is useful for Server Administrators that have to examine Logs from remote locations, as all time stamps in the System Logs are specified in the Server local time)
• the MAPI Connector server part version
• the flag indicating IPv6 support
• the Domain Name Server network address(es)
• the Server network addresses. Each address is accompanied with a link to the Domain it is assigned to, or the address is marked as un-assigned.

Refresh

This button can be used after the Server OS local IP Addresses have been changed or the DNS settings for CommuniGate Pro Domains have been modified. When you click this button:

• the Server re-reads the list of Local IP Addresses from the OS
• the Server re-reads the Domain Name Server addresses from the OS settings
• the Server updates the "Assigned IP Addresses" for all Domains. If some Domains have IP Addresses specified "Using DNS A/MX Records", the new addresses are retrieved from the DNS system
• the Server re-loads the MAPI Connector server part (so you can upgrade the MAPI Connector server part without restarting the Server)

Drop Root

This button is available on certain Unix platforms. It allows the System Administrator to tell the server to drop the "superuser" privileges. Certain functions (such as OS Authentication, Execute Rules operations, etc.) may become unavailable.
If the Server succeeds to drop the "superuser" privileges, the button title changes to Restore Root. Click the Restore Root button to restore the "superuser" privileges.

• The Settings directory. This directory contains files with module and kernel component settings.
• The Queue directory. This directory contains Temporary and Message files. The Message files contain messages submitted to the Server, but still undelivered to all their recipients.
• BadFiles directory. This directory contains Message files the Enqueuer kernel component failed to parse. This directory should be empty.
• Accounts directory. This directory contains account files for the Main Server Domain.
• Domains directory. This directory contains directories for all other Domains.
• Submitted directory. This drop-in directory is used to submit messages to Server via the PIPE module.
• SystemLogs directory. This directory contains Server Logs.
• ProcessID file. This file exists only when the Server is running and contains the numeric identifier of the Server process in the OS.
• Directory file. This file contains or describes the Server Central Directory.

For more information about the Account and Domain files and directories, see the Account Data section.

You can use symbolic links to move some of these directories to other locations (and other disks).

--CGateBase directory
or
--Base directory

The next parameter string specifies the location of the CommuniGate Pro base directory.

--LogToConsole

This option tells the Server to duplicate all its System Log records to the stdout (standard output). This option can be used for troubleshooting when the Web interface to System Logs is not available.

--LogAll

This option tells the Server to ignore all current Log Level settings and record all possible Log records.

--Daemon

This option can be specified on Unix platforms only. It tells the server to fork and operate in the background, with stdin, stdout, and stderr redirected to /dev/null.

--CGateApplication directory

The next parameter string specifies the location of the CommuniGate Pro application directory. You can use this option when the application itself cannot properly detect its own location, or if the CommuniGate Pro Server application file is not placed in the same location as other application directory files and subdirectories. For example, on OS/400 CommuniGate Pro Server is located in an OS/400 library, and this parameter is used to tell the server where the Unix-style directory with WebUser, WebAdmin, WebGuide, and other files is located.

--noLockFile

This option tells the Server not to create the ProcessID lock file. This option can be used if the file system hosting the base directory does not support file locks.

--dropRoot

This option can be specified on Unix platforms only (this does not include Linux). It tells the Server to drop the root privilege permanently. The server drops the privilege aproximately 60 seconds after the end of its kernel initiatialization process, so all listenening sockets can be opened when the server is still running as the root. The root privilege cannot be restored later. See the Server Root Privilege section for more details.

--ThreadsScope scope

This option can be specified on platforms supporting p-threads (OS/400 and most Unix flavors). The next parameter string can be either "system" or "process". See your OS manual to learn how these "scheduling scopes" work. If this option is not specified, the default OS scheduling mode is used.

--BatchLogon

This option can be specified on Microsoft Windows platforms only.
The option tells the Server to use 'batch logon' instead of the 'network logon' when an account password is verified using the Windows OS password system.

--SharedFiles

This option can be specified on Microsoft Windows and IBM OS/2 platforms only.
The option tells the Server to open all files with the FILE_SHARE_READ sharing attribute making it possible for other programs (such as backup daemons) read the CommuniGate Pro base directory files when the server is running. This option is enabled by default on the Microsoft Windows NT/XP/200x platforms.

--NoSharedFiles

This option can be specified on Microsoft Windows and IBM OS/2 platforms only.
The option tells the Server to open all files without the FILE_SHARE_READ sharing attribute if the Server does not need to read the file from several threads. This option is enabled by default on the Microsoft Windows 9x/ME and IBM OS/2 platform.

--useNonBlockingSockets

This option tells the Server to set its TCP and UDP sockets in the non-blocking mode. This option can improve the Server performance on some platforms.

--useBlockingSockets

This option tells the Server to set its TCP and UDP sockets in the blocking mode.

--closeStuckSockets

This option tells the Server to maintain a list of open communication sockets and check if some socket operations did not complete in time and due to the kernel bugs the OS failed to interrupt the operation in time. It is recommended to use this option on heavly-loaded Solaris systems.

--LocalIPBuffer size_value

This option tells the Server to use a buffer of the specified size when it retrieves a list of the Server Local IP addresses from the OS. On some platforms (such as Linux and Unixware) the default buffer size is set to a relatively small value, because some versions of these OSes have problems processing large buffers. If your Server system has many IP addresses (more than a thousand) and your CommuniGate Pro Server does not recognize all of them, you may want to use this parameter to specify a larger buffer size. The default size is 16K or 128K, you may want to specify larger values (204800 or 200K).

--NoThreadPriority

This option tells the Server to skip all attempts to increase individual thread priority. Use this option if bugs in OS cause an application to crash when a thread priority is increased ("non-global zones" in Solaris 10).

--DefaultStackSize size_value

This option modifies the default stack size (in bytes) for the process threads.

--CreateTempFilesDirectly pool_size

This option modifies the way the Temporary Files Manager creates its files. With the default value of 0, a special thread is used to keep a pool of pre-created files ready for consumption by any component. If this option is set to a non-zero value, and the amount of pre-created Temporary Files in the pool is below this value, new Temporary Files are created with the requesting threads themselves.
You may want to specify a non-zero value for this option on heavily-loaded systems with low file creation performance (such as OpenVMS).

--IPv6 [ YES | NO]

See the Network section for the details.

Specifying Command Line Options under Windows NT/200x/XP/Vista

Customizing Unix Startup Scripts

Customizing OpenVMS Startup Procedures

You can also use the shutdown CLI API command to stop the server.

When the Server receives a shutdown request, it closes all the connections, commits or rolls back mailbox modifications, and performs other shutdown tasks. Usually these tasks take 5-15 seconds, but sometimes (depending on the OS network subsystem) they can take more time. Always allow the Server to shut down completely, and do not interrupt the shutdown process.

The CommuniGate Pro server can store as much as several megabytes of Log data per minute (depending on the Log Level settings of its modules and components), and it can search and selectively retrieve records from the log. To provide the required speed and functionality, the Server maintains its own multithreaded Log system.

• when it starts up;
• when it shuts down;
• when it detects its own memory leaks;
• when it detects its own program error;
• when a program error exception (signal) is raised.

The system Log is:

• system.log or mail.log file on Unix systems
• Event Log on Windows systems

• No Listener port with number < 1024 can be opened. If you try to add a listener with the port number n (n < 1024), the port with the number 8000+n is opened instead.
• Remote applications started via Account-Level Rule EXECUTE command run in the current CommuniGate Pro Server environment (the effective UID and other OS-level process parameters are not changed).
• OS Passwords cannot be used.

If the root privilege was dropped in the "reversible" mode, the root privilege can be restored. For example, if you need to open a listener on the port 576, but the Server root privilege has been dropped, you should restore the root privilege first, then open the listener port, and then you can drop the Root privilege again.

To drop the root privilege permanently, use a special Command Line Option.

To drop the root privilege in the "reversible" mode, click the "Drop Root" button on the General page. The button should change to the "Restore Root" button - you can use it to restore the Server root privilege. This option is not available on those platforms that cannot drop the root privilege correctly (Linux).

If your Server has several Domains, you may want to grant some users in those Domains the Domain Administrator access right.

A Domain Administrator can control the Domain using the same WebAdmin port (see HTTP module description for the details), or using the Command Line Interface (API) commands. Domain Administrator access is limited to his Domain (and, optionally, to certain other domains), and to explicitly allowed Domain and Account settings and operatons.

When you grant the Domain Administrator access right to a user, you will see a list of specific access rights - the internal names of Domain and Account Settings.
Each option controls the settings this Domain Administrator can modify, and the operations this Domain Administrator can perform.

Domain Administrator access rights can be granted to users by a Server Administrator with the All Domains and Account Settings access right.

A System Administrator with the All Domains and Account Settings access right can perform all operations potentially available to a Domain Administrator in any Domain.

Domains Administrators in other Domains

When a customer has several Domains, you may want to let an Account in one Domain administer other Domains. You should grant such an Account the CanAdminSubDomains access right. Then you should open the Domain Settings page for the target Domain and specify the Administrator's Domain name in the Administrator Domain Name field.

Sample:

A customer has the company1.com, company2.com, company3.dom Domains on your Server. You may want to specify company1.com as the Admininstrator Domain Name in the company2.com and company3.com Domain Settings. Now, any Account in the company1.com Domain that has the CanAdminSubDomains Domain Administrator right can administer all three Domains.

Note: when a Domain Administrator connects to the Domain WebAdmin Interface, the browser displays the Login Dialog Box. If the Administrator Account is in a different Domain, the full account name (accountName@domainName) should be specified.

Domain Administrator Access Rights

The WebAdmin Interface uses the same Skins Interface as the WebUser Interface. By uploading custom admin* files to the default Domain Skin, the Domain WebAdmin Interface is modified.

The Server Administrator can also upload custom admin* files into the Server-wide and Cluster-wide Skins.

Note:The Server WebAdmin interface always uses the "stock" Skin files located in the WebSkins subdirectory of the application directory. If you modify the WebAdmin interface for the Main Domain, the modified pages will be used when a Domain Administrator of the Main Domain uses the WebAdmin Interface.
The Server Administrator will see the Server WebAdmin Interface (with the Settings, Domains, Directory, and Monitors realms) and the "stock" Skin files will be used to compose the Server WebAdmin Interface pages.

The CommuniGate Pro Server can use external programs to implement various operations - message scanning, user authentication, RADIUS login policies, etc. All these external programs are handled in the same way, and should support the simple Helper Interface.

To specify the External Helper program path and other parameters, open the General page in the Settings realm of the WebAdmin Interface and click the Helpers link:

The checkbox next to the Helper name tells the Server to start the specified program as a separate OS process.

Log

Use this setting to specify the type of information the Helper support module should put in the Server Log. Each Helper uses its own tag for its Log record.

Program Path

The file name (path) of the Helper program. If a relative path is specified, it shoud be relative to the CommuniGate Pro base directory.

Time-out

If the Helper program does not send a response within the specified period of time, the program is stopped.

Auto-Restart

If the Helper program stops, and this option is disabled, all pending requests are rejected. If the Helper program stops when this option is enabled, the Server waits for the specified period of time, restarts the Helper Program and re-sends the requests to it.