PMX spam filter server and recieve emails for multiple domains in your exchange server

Recently, we receive alert from ISP about mail latency. Check Exchange server logs and everything looks fine. Compare logs. The process time between PMX and Exchange is quite short. In this case, either spam filter or routing is the source of the problem. Double check and no one has made any changes to the router.

Check the PMX server. The load and iostat is high. Looks like the bottleneck is on the local disk. Increase memory does not really help. The only other option is to take the database out and migrate it to another server. However, we don't have enough space in the rack since we plan to retire one more rack. We get an appliance from Sophos ES4000. Very easy to setup. Once installed, no more performace issue.

We only config inbound email pt to the appliance. Outbound email will bypass the appliance. Basically make sure routing is setup correctly (point to your exchange server). If you are config to receive emails for multiple domain, make sure include those domain in the PMX config. No more sendmail.mc, pmx.conf modification and recompile. Other than routing setup on the appliance, make sure you have MX record setup correctly on your DNS server and ISP. Also, make sure your recipient policy in your Exchange server include the other domains you are going to receive emails in your Exchange server.

For example, your company has a domain called first.com. Your Exchange server is config to receive email sent to first.com. However, you register another domain for your other product called second.com. You can receive emails sent to second.com on your Exchange server. First, contact your isp to add a MX record (may take 1 to 24 hrs to replicate). Then go to your DNS server (most likely ur DC and add the MX record) . Basically, point the MX record for second.com to your exchange server for first.com (for example, mail.first.com). Add second.com to the accepting mail domain in your PMX appliance. Lastly, goto your Exchange server default recipient policy, add SMTP for second.com. Force update the recipient policy so you can receive emails immediately for your second.com.

Timeout on HBA

If you see Event ID 129 for your HBA as well as path connection drops by failover software,

The description for Event ID ( 129 ) in Source ( elxstor ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\RaidPort1.

Check your HBA driver, switch firmware and failover software. Also, make sure the SAN controller firmware is in support matrix. Sometimes, you may need to check the HBA settings to make sure those are supported by vendor. There are chance you may need to reapply firmware on HBA. Compare switch logs to see if GBIC requires replacement.

Storport vs SCSIport

If you use some older HBA, you will see there are two sets of drivers; storport and SCSIport. Bascially, Storport provides better I/O performance and widely used for new HBA.

For old HBA, you can try to use Storport. However, SCSIport is more stable.

Here is the Microsoft article
http://download.microsoft.com/download/5/6/6/5664b85a-ad06-45ec-979e-ec4887d715eb/Storport.doc

Security Configuration Wizard for Windows 2003 SP1

Security Configuration Wizard for Windows 2003 SP1 is a very handy tool to config security on Windows 2003 server with at least SP1 installed. I find out a lot of ppl don't know about this tool. Search the internet and find an introductory article about SCW.

The tool helps you config firewall, audting and services......

http://www.windowsecurity.com/articles/Security-Configuration-Wizard-Windows-Server-2003-SP1.html

Registry fix for Windows 2000 server

It happened more than a month ago. We had a Windows 2000 server which would be retired. It crashed in the weekend. Most of the important roles were migrated. However, our diesel backup power generator connected to this domain controller. So, I have to get it back up and running because my manager cannot locate the monitoring software for the backup power generator.

I tried all the startup mode such as safe mode and it refused to boot with a bluescreen. Checked the backup logs over the weekend. Seems like the disk was bad. Eventually, I try the registry fix for Windows 2000. There is a warning some of the data may be lost when using the tool. However, we don't have any critical info. So we goto the following site to download the tool.

http://support.microsoft.com/kb/830570

We get it back up in 30 min.

Iphone with Exchange

We got 3 iphone from States for testing. Currently, it is not available in Canada yet. So, have them unlocked and try to have it talk to the Exchange. One of the users install itune 7.4......result is iphone being locked. So, we are warned by the cellphone tech to use itune 7.3 or below. Setup Exchange side following Wilson's blog

http://blog.monkeykit.com/2007/08/31/how-to-setup-imap4-exchange-2003-email-to-sync-with-your-iphone/

I have to contact ISP to open up only the secure IMAP port. I got the receiving part working. However, sending is still an issue. Eventually, I am using my phone carrier smtp server. One thing I found out: iphone sucks a lot more bandwidth than Blackberry. Hopefully, it will support OMA soon. I still have trouble sending if I use webmail.mycompany.com as the outgoing smtp. The other thing I don't like is power consumption. I will go back to my blackberry for sure. Will play with the new toy for one more week then return it to my manager. I always drop cellphone on the ground by accident. So, iphone is definitely not my device.

Sharepoint

Port Server becomes more and more popular. Well, it is easy to setup and save a lot of work. Our company uses the free Microsoft SharePoint Service. Suppose it should save a lot of time. However, be very cautious with update. Everytime we install major service pack on our SharePoint Server, some of the function fail. The reason is the third party addon. It resets some of the permission and causes some of the pages won't display.

I check permission of each portals and they are set correctly. Eventually, we have to uninstall and reinstall the addon back. Everything is back to normal. Test first before install Service Pack for SharePoint. This is second time already. Future plan....put an identical virtual machine in VM to test ServicePack first.

Cannot run exe file in 2003 server

Try to run driver update on the SQL servers connected to the SAN this weekend. However, I keep receiving error message "Windows cannot access the specified device, path, or file. You may not have the appropriate permission to access the item."

It is caused by one of the Windows security update. You need to unblock it. Basically goto Properties of the exe file. Then click Unblock. You will have no trouble after that. Same thing applies to file such as chm file download from internet and email. Check MS article KB902225.

VLAN with NIC teaming on Blade server

We have 2 c-class blade servers with 4 NIC. On the c-class enclosure, there are only two ethernet switch. Currently, NIC teaming is config on the blade server. It is running ESX 3.0. One of the VM will be put on DMZ. The easiest way is to buy two more ethernet switch and install them on the c-class blade enclosure. Then config another NIC teaming just for DMZ.

Another way is to enable VLAN on the VMs. Then enable VLAN tagging on the switch. On the blade server is easy. Just open switch management GUI, enable VLAN tagging on the NIC ports where the ESX servers connect to and make sure the crossVLAN ports are configure on the same VLAN as the NIC. For the external switch, (in our case, our blade enclosure connects to a Nortel switch) our Nortel 8300 can definitely handle it. Need to contact Nortel to find out though.

Fixing VCB on my EVA4000

My datastore is residing on the EVA4000. I find out VCB is not working and complains about path not found and SCSI error. So I go through the guide and find out the LUN number has to be the same for both ESX server and VCB proxy (which is my backup and Virtual Centre Server).

To assign the same number on EVA4000 for the ESX host and VCS is easy.

1) Open up CommandView.
2) Goto Virtual disk properties
3) Present the luns using Assign Lun function. Then assign the same lun number to ESX hosts and VCS.
4) Don't forget to save the changes.
5) Go back to the VCB proxy (again, it is my VCS server and backup server). Goto MPIO and use NLB on the luns that holds the vmfs datastore.
6) This will turn off multipath and use dedicated path unless the path fails.