EMC Documentum

Content Server
Version 7.2

Installation Guide

EMC Corporation
Corporate Headquarters:
Hopkinton, MA 01748-9103
1-508-435-1000
www.EMC.com
Legal Notice
Copyright 19942016 EMC Corporation. All Rights Reserved.
EMC believes the information in this publication is accurate as of its publication date. The information is subject to change
without notice.
THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS
OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY
DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Use, copying, and distribution of any EMC software described in this publication requires an applicable software license.
For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Adobe and Adobe PDF
Library are trademarks or registered trademarks of Adobe Systems Inc. in the U.S. and other countries. All other trademarks
used herein are the property of their respective owners.
Documentation Feedback
Your opinion matters. We want to hear from you regarding our product documentation. If you have feedback
about how we can make our documentation better or easier to use, please send us your feedback directly at
[email protected]
 Table of Contents

Preface ................................................................................................................................ 11
Chapter 1 Installation Overview ................................................................................... 13
Content Server architecture ............................................................................... 13
Content Server and repository ....................................................................... 13
Connection broker ........................................................................................ 14
Global registry ............................................................................................. 15
Global registry user .................................................................................. 15
Content Server installation models .................................................................... 15
Basic installation model ................................................................................ 16
Planning the installation ................................................................................... 17
Location of the content storage area (data directory) ....................................... 17
Ports to reserve for Content Server ................................................................. 17
Connection modes to connect to connection broker and repository .................. 18
Content Server optional modules ................................................................... 18

Chapter 2 Pre-Installation Requirements and Tasks .................................................... 21

System requirements ........................................................................................ 21
Hardware requirements ................................................................................ 21
Software requirements .................................................................................. 22
General database requirements.................................................................. 22
Requirements for Microsoft SQL Server ..................................................... 23
Requirements for Oracle database.............................................................. 24
Requirements for DB2 database ................................................................. 25
Requirements for DB2 performance wizard ............................................ 26
Setting up required user accounts ...................................................................... 26
Installation owner account ............................................................................ 26
Installation owner account naming requirements ........................................ 27
Required rights for the installation owner account ...................................... 27
Installation owners email account and SMTP server information ................ 27
Repository owner account ............................................................................. 28
Repository user accounts .............................................................................. 29
Pre-installation tasks on Windows ..................................................................... 29
Pre-installation tasks on UNIX and Linux........................................................... 30
Performing pre-installation tasks for SUSE Enterprise Linux ........................... 30
Performing pre-installation tasks for Red Hat Enterprise Linux 7.0 .................. 30
Setting required environment variables .......................................................... 30
Setting up the services file ............................................................................. 32
Installing the JCE policy files ......................................................................... 33
Enabling random generator on Linux............................................................. 33
Preparing relational database management system (RDBMS) .............................. 33
Preparing Microsoft SQL Server .................................................................... 33
Creating an ODBC data source for SQL Server............................................ 33
Configuring Oracle database ......................................................................... 34
Configuring the tnsnames.ora file .............................................................. 34

3
Table of Contents

Performing additional Oracle database configuration tasks ......................... 34

Configuring DB2 database ............................................................................ 35
General guidelines .................................................................................... 35
Configuring DB2 from Control Center ....................................................... 35
Configuring DB2 database from command line .......................................... 36
Tuning DB2 database ................................................................................ 37
Running multiple Content Servers on DB2 host .......................................... 38
DB2 repository sizes ................................................................................. 39
Configuring internationalization settings ........................................................... 39
Installing MailApp DAR ................................................................................... 40
Preparing for remote key management .............................................................. 40
DPM overview ............................................................................................. 41
DPM limitations ....................................................................................... 41
Identities, identity groups, and key classes ................................................. 41
Identities .............................................................................................. 42
Identity groups..................................................................................... 42
Key classes ............................................................................................... 43
Acquiring certificates .................................................................................... 43
Preparing DPM for remote key management .................................................. 44
Information required to configure repository.................................................. 46
Preparing installation package........................................................................... 46
Configuring for Certificate-based SSL communication ........................................ 47
Connection modes ........................................................................................ 47
Prerequisites ................................................................................................ 48
Certificates ............................................................................................... 48
Building a Keystore .................................................................................. 48
Preparing Keystore password .................................................................... 49
Building a Trust Store ............................................................................... 49
Location of the keystore file, keystore password file, and trust
store file ................................................................................................... 49
Configuration ............................................................................................... 50
Configuring connection broker .................................................................. 50
Configuring Server ................................................................................... 51
Configuring DFC ...................................................................................... 51
Installer support ........................................................................................... 52
Compatibility ............................................................................................... 52
Constraints and limitations ....................................................................... 52

Chapter 3 Installing Content Server ............................................................................. 53

Content Server Installation workflow ................................................................. 53
Installing Content Server ................................................................................... 54
Installing Content Server program files .......................................................... 54
Creating a connection broker ......................................................................... 55
Creating a repository .................................................................................... 57
Completing the installation ............................................................................... 61
Reviewing Content Server installation and configuration logs ......................... 61
Adding Java to the PATH environment variable (Windows) ............................ 62
Enabling the purge audit job ......................................................................... 62

Chapter 4 Post-Installation Tasks ................................................................................ 63

Configuring JBoss application server for SSL ...................................................... 63
Supported communication configurations ...................................................... 64
Changing the connection mode from native to secure ......................................... 65
Backing up keystore files ................................................................................... 66

4
 Table of Contents

Changing the default passphrase ....................................................................... 66

Binding Content Server to a network card .......................................................... 67
Installing Content Server client .......................................................................... 67
Installing Content Server using an existing database account ............................... 67
Enabling xPlore search for new emails ............................................................... 68
Getting Started with Content Server................................................................... 68
Starting/stopping Content Server on Windows ............................................... 68
Starting/stopping Content Server on UNIX and Linux ..................................... 69

Chapter 5 Installing Content Server and Java Method Server (JMS) for
High-Availability (HA) .................................................................................. 71
Content Server and JMS HA overview ............................................................... 71
Content Server HA configuration ...................................................................... 72
Configuring Content Servers for HA .................................................................. 73
JMS HA configurations ..................................................................................... 75
Content Server and JMS on a single host ........................................................ 76
Content Server and JMS on two hosts............................................................. 76
Content Server and JMS on multiple hosts ...................................................... 76
Content Server and JMS HA considerations........................................................ 76
Planning the system size ............................................................................... 77
Installing and configuring Java Method Server in HA mode ................................ 77
Installing and configuring JMS for HA on a single host ................................... 77
Installing and configuring JMS for HA on multiple hosts ................................ 79
Synchronizing time between remote JMS hosts and Content Server hosts ............. 81
Viewing and modifying JMS instances ............................................................... 81
Using Documentum Administrator ............................................................... 81
Using Apply methods ................................................................................... 81
Best Practices for configuring connection brokers and JMS for HA ....................... 82

Chapter 6 Installing Content Server with Microsoft Cluster Services .......................... 83

Microsoft Cluster Services overview .................................................................. 83
Choosing a configuration .................................................................................. 84
Pre-installation requirements ............................................................................ 84
Configuring an active/passive cluster ................................................................. 85
Creating the cluster resource group ............................................................... 85
Installing Content Server software on the nodes ............................................. 85
Configuring Content Server........................................................................... 86
Configuring the connection brokers ............................................................... 87
Creating additional cluster resources on Microsoft Cluster Services ................. 87
Verifying failover .......................................................................................... 89
Configuring an active/active cluster ................................................................... 89
Creating the first cluster resource group ......................................................... 89
Installing Content Server software on the hosts............................................... 90
Configuring Content Server on the first and second nodes............................... 90
Configuring the second cluster resource group ............................................... 90
Modifying server.ini and dfc.properties ......................................................... 90
Configuring the connection broker and repository for failover ......................... 90
Verifying failover .......................................................................................... 91

Chapter 7 Uninstalling Content Server ........................................................................ 93

Uninstalling components .................................................................................. 93

5
Table of Contents

Deleting a repository ........................................................................................ 93

Deleting a connection broker ............................................................................. 94
Uninstalling the Content Server software ........................................................... 94

Chapter 8 Troubleshooting .......................................................................................... 97

Identifying the problem and resolution .............................................................. 97
While installing on Linux, Installer hangs when the number of
mount points exceeds 4000 .......................................................................... 100
Recovering from a failed repository configuration or upgrade ........................... 101
Recovering from a stalled Content Server upgrade............................................ 101
Identifying issues for Certificate-based SSL communication .............................. 102
Connection broker startup fails.................................................................... 103
Server startup fails ...................................................................................... 103
Server not able to connect to connection broker ............................................ 104
Clients are unable to connect to the connection broker .................................. 104
Clients are unable to connect to the Server.................................................... 105
Miscellaneous............................................................................................. 105
Content Server error messages and causes .................................................... 105
Recovering from a failed filestore configuration ................................................ 109

Appendix A Installation Checklist ................................................................................. 111

Appendix B Content Server Installation Directories and Repository
Configuration Scripts ................................................................................ 115
Content Server installation file structure........................................................... 115
uninstall..................................................................................................... 116
data ........................................................................................................... 116
dba ............................................................................................................ 117
fulltext ....................................................................................................... 117
product ...................................................................................................... 117
server_uninstall .......................................................................................... 117
share.......................................................................................................... 117
Additional directories ................................................................................. 118
Scripts run during installation or upgrade .................................................... 120
Configuration objects .................................................................................. 124

Appendix C Object Type Categories for Oracle Database Storage ............................... 125
Type categories for tablespace specifications ..................................................... 125
Type categories for extent allocation ................................................................ 126
Object types categorized as large ................................................................. 126
Object types categorized as small ................................................................. 126
Object types categorized as default .............................................................. 127

Appendix D Defining Oracle or DB2 Database Parameters for Repository

Tables ........................................................................................................ 129
Defining the tablespace ................................................................................... 130
FUNCTION_SPECIFIC_STORAGE ............................................................. 130
TYPE_SPECIFIC_STORAGE ................................................................... 130
Defining the Oracle extent sizes ................................................................... 131
Changing storage parameters for individual object types on Oracle ............... 132
Changing storage parameters for categories of types on Oracle ...................... 133
User-defined object types ............................................................................ 133

Appendix E SSL Tools .................................................................................................. 135

6
 Table of Contents

OpenSSL ........................................................................................................ 135

Keytool .......................................................................................................... 135

7
Table of Contents

List of Figures

Figure 1. Content Server and repository ............................................................................... 13

Figure 2. Basic installation model ........................................................................................ 16
Figure 3. Single host Content Servers and multiple repositories ............................................. 42
Figure 4. Multiple Content Servers on separate hosts for one repository ................................. 42
Figure 5. Multiple Content Servers on one host for one repository ......................................... 42
Figure 6. Content Server installation workflow ..................................................................... 53
Figure 7. Content Server HA configuration .......................................................................... 72
Figure 8. Load balancing configuration ................................................................................ 73
Figure 9. Content Server and JMS HA on a single host .......................................................... 76
Figure 10. Content Server and JMS HA on two hosts .............................................................. 76
Figure 11. Content Server and JMS HA on multiple hosts ....................................................... 76
Figure 12. Installing and configuring JMS for HA on a single host ........................................... 77
Figure 13. JMS instances configured for HA on two hosts ....................................................... 79
Figure 14. JMS instances configured for HA on multiple hosts ................................................ 79
Figure 15. Active/passive cluster ........................................................................................... 84
Figure 16. Active/active cluster.............................................................................................. 84

8
 Table of Contents

List of Tables

Table 1. DBK key class settings .......................................................................................... 45

Table 2. PPK key class settings ........................................................................................... 46
Table 3. Troubleshooting checklist ...................................................................................... 97
Table 4. Content Server error messages and causes ............................................................ 105
Table 5. Installation checklist ........................................................................................... 111
Table 6. Subdirectories created during installation ............................................................ 118
Table 7. Repository configuration scripts .......................................................................... 121

9
Table of Contents

10
 Preface

Intended audience
This document is intended for system administrators responsible for installing and configuring
Content Server. The EMC Documentum System Upgrade and Migration Guide contains the instructions
on upgrading Content Server.
To use this document, you need the following:
Administrative privileges on the computer where you are installing Content Server
Working knowledge of Microsoft Windows or UNIX and Linux, depending on which platform
you choose for your Content Server installation

Related documentation
For more information, see the following resources:
EMC Documentum Environment and System Requirements Guide
EMC Documentum System Upgrade and Migration Guide
EMC Documentum Content Server Distributed Content Configuration Guide
EMC Documentum Content Server Administration and Configuration Guide
EMC Documentum Content Server Fundamentals Guide

Conventions
The following conventions are used in this document:

Typographic conventions

Font type Meaning

boldface Graphical user interface elements associated with an action, or terms defined
in text or the glossary
italic Book titles, emphasis, or placeholder variables for which you supply particular
values
monospace Commands within a paragraph, URLs, code in examples, text that appears on the
screen, or text that you enter

11
Preface

Path conventions

Environment Meaning
variable
$DOCUMENTUM The Content Server root installation directory.
$DM_HOME The product version subdirectory in the Content Server root installation
directory: $DOCUMENTUM/product/version_number, where
version_number is the version of Content Server.

Revision history
Revision date Description
November 2016 Corrected the name of the SGA_TARGET parameter in the Requirements
for Oracle database, page 24 section.
September 2016 Added a note in the section, Starting/stopping Content Server on UNIX and
Linux, page 69.
May 2016 Updated the note in the section, Setting required environment variables,
page 30.
December 2015 Updated the sections, Requirements for Microsoft SQL Server, page 23 and
Requirements for Oracle database, page 24.
August 2015 Added a section Performing pre-installation tasks for Red Hat Enterprise
Linux 7.0, page 30.
May 2015 Added a section Performing pre-installation tasks for SUSE Enterprise
Linux, page 30.
April 2015 Added a note in the section General database requirements, page 22.

Updated the note on selecting an ODBC data source in the section

Creating an ODBC data source for SQL Server, page 33.
February 2015 Initial publication.

12
 Chapter 1
Installation Overview

Before installing Content Server, you need to have a basic understanding of the Content Server
architecture and the various components you are going to install as a part of the installation process.
You also need to plan for the installation based on your business needs.
This chapter covers the following topics:
Content Server architecture, page 13
Content Server installation models, page 15
Planning the installation, page 17

Content Server architecture

This section provides basic information about the Content Server architecture and the components
that will be installed as a part of the installation process. The EMC Documentum Content Server
Fundamentals Guide contains more information.

Content Server and repository

EMC Documentum Content Server is a powerful, robust, and scalable enterprise content management
system that provides advanced content management and process management functions that let you
organize, control, and access all your information assets in your organization.
Content Server manages content stored in object-based repositories. A repository consists of two main
components: a storage that stores native content files, and a relational database management system
(RDBMS) that stores properties of these content files called metadata, such as document owner,
version, and creation date. Metadata describes the content object and its relationship between other
objects in repository, and is used to manage and search for content.

Figure 1. Content Server and repository

Content Server itself consists of several distinct processes and components that are mostly transparent
to the user during installation:
Application server

13
Installation Overview

Content Server uses a private embedded application server as a container for Java Method Server
(JMS), Accelerated Content Server (ACS), and other components.
Java Method Server (JMS)
Java Method Server (JMS) is a customized version of JBoss that executes Content Server Java
methods. One Java Method Server is installed with each Content Server installation.
Accelerated Content Services (ACS) server
Accelerated Content Services (ACS) Server is a lightweight server that is automatically created
during Content Server installation. The ACS server reads and writes content for web-based client
applications using HTTP and HTTPS protocols. ACS servers do not modify object metadata
but write content to storage areas.
Documentum Foundation Classes (DFC)
Documentum Foundation Classes (DFC) provides the programming interface that client
applications use to communicate with Content Server.

Connection broker
Content Server clients connect to Content Server through connection brokers. A connection broker is a
process that provides client sessions with Content Server connection information, such as their IP
addresses and port numbers, as well as proximity values of their network locations.
The connection brokers that handle a client connection request are defined in the dfc.properties
file of the client. When a user or application requests a repository connection, the request goes to a
connection broker identified in the client dfc.properties file. The connection broker returns the
connection information for the repository or a particular server identified in the request.
Connection brokers do not request information from Content Servers, but rely on the servers
to regularly broadcast their connection information to them. When Content Server starts, it
automatically broadcasts information about itself to one or more connection brokers. Each connection
broker that receives the broadcast adds the Content Server to its list of available servers. The
information on connection broker is configured in the server config object (dm_server_config) of
the server.
Each Content Server installation must have at least one connection broker. The first connection
broker is started as part of the installation process.
When a client application wants to connect to a repository, the following occurs:
1. The client contacts the connection broker and requests the information it needs to connect with a
Content Server for the requested repository.
2. The connection broker sends back the IP address for the host on which the Content Server resides
and the port number that the Content Server is using.
3. The client application uses that information to open a connection to Content Server.

14
 Installation Overview

Global registry
When a Content Server installation includes multiple repositories, certain installation-wide elements
are shared among all repositories. For example, a distributed configuration uses objects called network
locations which Content Server uses to determine which storage areas are physically close to which
client applications. All repositories share the same network location objects. Another example is
usage tracking. When a user logs in to Content Server, or in to an application that connects to Content
Server, a record is stored of the user, login time, and application used.
To manage these installation-wide elements, each Content Server installation has a central repository
called the global registry. You must designate a repository as a global registry, even if you plan to
install one repository. The global registry is a repository like any other repository, except that all
other repositories connect to it when they need an installation-wide element. A global registry must
be configured before you can connect to the repository with any client applications. When you
install a repository, either identify it as the global registry or designate how to connect to another
global registry repository.
If you have a one-repository implementation, that repository is both a content repository and a global
registry. If you have a Content Server implementation larger than a departmental one, consider
creating a separate repository and designate that repository to be the global registry only.

Global registry user

A global registry user is created in all repositories, regardless of whether the repository is configured as
a global registry.
If you configure a repository as a global registry, you provide the username and password for the
global registry user and the user state is set to Active.
If you do not configure a repository as a global registry, a global registry user is created with the
default username dm_bof_registry and the user state is set to Inactive. This user has read access to
objects in a few folders in the System cabinet of the repository only.
If you are installing a single production repository, designate it as a global registry. If the site has
multiple production repositories, designate only one repository as a global registry.

Content Server installation models

Content Server and repositories can be installed and configured in many different ways to meet
various content management requirements. Content Server installation supports the following
types of configurations:
Basic
In this basic model, Content Server, repository (including an RDBMS and a content storage), and
connection broker are all installed on a single host. This is the simplest and most straightforward
way of implementing Content Server, and is typically used in development and test environments.
High-availability (HA)

15
Installation Overview

In this model, multiple redundant Content Server instances and components are installed on a
single host or multiple hosts and configured to eliminate single-point-of failure and achieve
high-availability.
Distributed
In the distributed model, one or more repositories span multiple hosts and are configured to be
accessed from multiple sites.
This document focuses on the basic installation model to describe the Content Server installation
process.
Chapter 5, Installing Content Server and Java Method Server (JMS) for High-Availability (HA)
provides detailed instruction on installing Content Server for high-availability.
The EMC Documentum Content Server Distributed Content Configuration Guide contains the detailed
information on the distributed installation model.

Basic installation model

In the basic installation model, Content Server, repository (including an RDBMS and a content
storage), and connection broker are all installed on a single host. This is the simplest and most
straightforward way of implementing Content Server, and is typically used in development and test
environments. In production environments, Content Server and RDBMS are almost always installed
on different hosts for better performance.
Figure 2, page 16 shows the key interrelated components in the basic installation model and the order
in which they are installed. Components that are installed as a part of the Content Server installation
process covered in this document are highlighted in yellow. Dotted lines indicate connections that
are not persistent.

Figure 2. Basic installation model

1. Relational database management system (RDBMS), Microsoft SQL Server, DB2 or Oracle
Databasewhich stores content metadata
This is a part of the repository and a prerequisite software component that must be installed
prior to Content Server installation.
2. Content Server, which manages content stored in the repository
3. Connection broker, which provides connection information to client applications
4. Content storage, which stores native content files
5. Content Server client application, which provides a user interface for accessing Content Server
functionalities and managing repositories
Documentum Administrator is the primary web-based administrative client tool for configuring
and administrating Content Server and repositories.
You install client application as a post-installation task.

16
 Installation Overview

Planning the installation

This section describes the installation decisions you should make before installing Content Server.
These decisions will determine what prerequisite tasks you should perform, what choices to make
and what information to provide during the installation process. Planning ahead helps facilitate
the installation process.
Use the Content Server installation checklist to record your decisions and planned information. See
Appendix A, Installation Checklist.

Location of the content storage area (data directory)

Content Server installation creates the default content storage area called the data directory for storing
content files. After the initial installation, you can add additional storage areas and the business rules
for distributing content among them by using Documentum Administrator.
The data directory can be one of the following:
A local directory on the Content Server host
A directory on a remote host accessible by the Content Server
A SAN or NAS location
A location on other storage devices including retention type stores, such as EMC Centera and
Network Appliance SnapLock
Prepare a location for the initial content storage area or the data directory that best suits your business
needs. Ensure that the location you choose for the storage area has sufficient free space for the
content files that will be added to it.

Ports to reserve for Content Server

Content Server and other components use a number of ports on the host:
The application server listens on a port (9080 by default) for standard administration connections,
and starting at this port, a total of 20 consecutive ports must be reserved for use by the application
server.
The connection broker requires two consecutive ports (1489 and 1490 by default) on which to
listen: one for native connections and the other for secure connections (SSL).
On UNIX and Linux, the port numbers can be any unused port numbers greater than 1024. UNIX and
Linux reserves port numbers up to 1024 for system use.
Identify available ports to be used by Content Server and its components. Make sure none of the
reserved ports are being used for other purposes.

17
Installation Overview

Connection modes to connect to connection broker

and repository
There are three options you can choose from for the Content Server client to connect to the connection
broker and the repository:
Native: The client connects through a non-TLS/SSL port.
Secure: The client connects through a secure TLS/SSL port. The client and the connection broker
or repository do not use TLS/SSL authentication to authenticate each other. However, the
information exchanged between them is encrypted.
Native and Secure: The connection broker or repository accepts both native and secure connection
requests.
Determine which connection mode you want to use for the connection broker and the repository
respectively.

Content Server optional modules

Content Server has a number optional modules or extended features that require separate licenses.
You activate a module by entering its license key in the Content Server configuration program. Once
activated, you can enable the extended feature for a repository when you configure the repository.
Identify which optional modules to activate during Content Server installation and configuration and
obtain license keys for those modules.

Caution: If you plan to use remote key management for your repository, you must activate
the Trusted Content Services (TCS) module before you configure Content Server. If the TCS
license is not present, you cannot create a repository that uses remote key management, and
you cannot enable it at a later time.

Some of these optional modules, once activated, apply to all Content Server instances in an
installation so that all the repositories can access the extended features; the others are individually
activated for Content Server instances, which means extended features can only be enabled for
repositories managed by the Content Server instance with the corresponding modules activated.
The following modules are activated for Content Server instances in an installation across the board:
High-Volume Server
High-Volume Server is an extension of Content Server that supports features implemented to
solve common problems with large content stores. The three broad areas of enhancements that
make up High-Volume Server are:
Lightweight system objects
Batch operations and currency scoping
Database Partitioning
Note: Database partitioning option is not available while creating new repository during
the Content Server installation. The EMC Documentum Content Server Administration and

18
 Installation Overview

Configuration Guide and EMC Documentum High-Volume Server Development Guide contains
more information.
Trusted Content Services
Trusted Content Services provides additional security features, such as encrypted file stores, in
which content files are encrypted, and remote key management.
XML Store
XML Store gives Content Server extended capabilities to store and process XML data in the
repository by integrating it with Documentum xDB, a highly scalable, native XML database.
Content Services for SnapLock
SnapLock is a feature of Filer, a NAS storage system from Network Appliance. A Network
Appliance SnapLock (NetApp SnapLock) store stores large amounts of unchanging data such as
email archives. SnapLock provides storage level retention capability through the creation of Write
Once Read Many (WORM) volumes on Network Appliance storage systems. You can create a
SnapLock volume in one of two modes: Enterprise and Compliance. The difference between the
two modes is that on the Compliance SnapLock volume, a default (and minimum) retention of
30 years is applied to the content files created in that volume.
The following modules are activated for Content Server instances individually:
Content Storage Services (CSS)
Content Storage Services enables you to define business rules to govern where content files are
stored.
Retention Policy Services (RPS)
Retention Policy Services is a compliance-oriented module that gives you control over how long
and under what circumstances documents and other objects are retained in a repository.
Once you activate this module, you can use the event-based retention capabilities out of the box.
However, if you want to use this module to manage retained data stored on a Centera device,
you need another license to use the event-based retention capabilities and hold capabilities on
that device.
Federation Records Services
Records Manager
Records Manager provides archiving options for business records.
The EMC Documentum Content Server Fundamentals Guide and EMC Documentum Content Server
Administration and Configuration Guide contains more information on modules and instructions on
how to configure and use them.
The EMC Documentum XML Store Deployment and Administration Guide contains the instructions
on deploying and administrating XML Store.

19
Installation Overview

20
 Chapter 2
Pre-Installation Requirements and
Tasks

Make sure your system meets the system requirements and perform prerequisite tasks based on your
installation plan before installing Content Server.
This chapter covers the following topics:
System requirements, page 21
Setting up required user accounts, page 26
Pre-installation tasks on Windows, page 29
Pre-installation tasks on UNIX and Linux, page 30
Preparing relational database management system (RDBMS), page 33
Configuring internationalization settings, page 39
Installing MailApp DAR, page 40
Preparing for remote key management, page 40
Preparing installation package, page 46
Configuring for Certificate-based SSL communication, page 47

System requirements
The EMC Documentum Environment and System Requirements Guide contains the detailed system
hardware and software requirements, including supported operating system and database
combinations. Ensure that your system meets the requirements before you install Content Server.
In addition, ensure that your system also meets the hardware and software requirements described in
this section.

Hardware requirements
Hardware requirements as described in the EMC Documentum Environment and System Requirements
Guide.

21
Pre-Installation Requirements and Tasks

Software requirements
Software requirements as described in the EMC Documentum Environment and System Requirements
Guide.
RSA Data Protection Manager (Optional)
If you want to create a repository to use remote key management, you must install RSA Data
Protection Manager before installing Content Server.
UNIX and Linux hosts:
XWindows
XWindows must be installed on the UNIX and Linux hosts to run the graphical installation
program. The xterm program may be installed in various locations depending on the operating
system and software packages installed.

General database requirements

A relational database management system (Microsoft SQL Server, Oracle database, or DB2 database)
is a prerequisite to installing Content Server. The database stores metadata of content objects in the
Content Server repository.
The Microsoft SQL Server, Oracle, or DB2 database documentation contains more information on
installing and configuring the RDBMS.
Ensure the RDBMS meets the following general requirements:
Database location
You can install the relational database either locally on the Content Server host or remotely on
a separate host running any operating system supported by the database vendor. For example,
you can install Content Server on a Windows host and use a database installed on a UNIX and
Linux host.
In a production environment, the database is almost always installed on a different host than the
Content Server host for better performance.
Database client
If you install the database on a separate host, also install the database client software on the
Content Server host.
For remote database installations, verify that you can connect to the database by using a
database client from the system where you want to install Content Server.
For local database installations on a UNIX and Linux host, verify that the system path includes
the installation directory for the database.
On a Windows host, the installer updates the system path automatically.
Database code page
For new repositories, install the database by using the Unicode code page, which can accurately
store characters from all supported languages.
For new SQL Server repositories, Content Server uses only nvarchar and nchar types, which
automatically use Unicode. If you need to determine the settings of an existing SQL Server

22
 Pre-Installation Requirements and Tasks

database, use the system stored procedure sp_helpsort or view the properties of the particular
database in Enterprise Manager.
On Oracle and DB2, use UTF8 (this includes AL32UTF8 and AL16UTF8).
Note: Oracle has deprecated AL16UTF16. AL16UTF16 is supported for now, but it is
recommended to migrate to AL32UTF8 or AL16UTF8 code page.
Database locales
Typically, Content Server is installed on the English version of database. However, Content Server
installation is also supported on localized databases if the database fulfills the following criteria:
Database supports internationalization of locales (I18N)
Database adheres to I18N standards
Content Server installation is performed with UTF8 and case sensitive (SQL)
Database administrator account
Regardless of the database you use with Content Server, obtain the database administrators
username and password. You will need this information while configuring the repository.
Database service (Windows)
If Content Server and the database are located on the same Windows host, ensure that the
database service is set to start automatically. Content Server installation sometimes requires
a restart of the computer. After the restart, installation does not proceed correctly unless the
database starts automatically.

Requirements for Microsoft SQL Server

If you use Microsoft SQL server with Content Server, ensure it meets the following requirements:
Use a full SQL Server installation on the host where SQL Server is installed. Install the SQL Server
Management Studio and SQL Server client on the Content Server host, regardless of whether the
database is local or remote. You need to install the required client packages from SQL Server
installation for Content Server to work remotely with the SQL Server database.
Use the Custom installation option so that you can set the database code page, case-sensitivity,
and other options.
Install the SQL Server instance in SQL Server or Windows Authentication mode.
Install SQL Server for internationalization. The SQL Server documentation and Microsoft MSDN
website contains more details.
Ensure that the SQL Server sort order is set to Dictionary.
Ensure that you configure the SQL Server with the following settings:
PARAMETRERIZATION=FORCED
Max Degree of Parallelism = 1

23
Pre-Installation Requirements and Tasks

Allow Snapshot Isolation = ON

READ_COMMITTED_SNAPSHOT = ON
Ensure that the database statistics are up to date and optimal. Configure the database based on
the results after profiling the database usage.

Caution: Install the database in case-sensitive mode with row-level locking enabled. If you
installed SQL Server in case-insensitive mode, you need to reconfigure the database before you
install or upgrade Content Server.

Requirements for Oracle database

If you use Oracle database with Content Server, ensure it meets the following requirements:
If Content Server resides on a host different from the Oracle database, you need to install the
Oracle Database Client package on the Content Server host.
On UNIX and Linux, ensure that these environment variables are set in the installation owners
environment:
ORACLE_HOME
TNS_ADMIN
ORACLE_SID
This environment variable points to the location of the tnsnames.ora file. Content Server
installer looks first for TNS_ADMIN, then for ORACLE_HOME, in order to locate the
tnsnames.ora file.
For Windows, UNIX, and Linux hosts, install the 64-bit Oracle Client package on the Content
Server host and update the value of the shared library path environment variable (LIBPATH for
AIX or LD_LIBRARY_PATH for Linux and Solaris) to include the library directory.
Ensure that you configure the following settings:
Cursor_sharing=Force
Automatic memory management is enabled.
Increase the size of the REDO log files from the default value of 50 MB and/or increase the number
of REDO log files if the database runs into heavy updates.
Ensure that the database statistics are up to date and optimal. Configure the database based on
the results after profiling the database usage and by monitoring database reports such as AWR
report, Oracle Alert log, Query execution plans, and so on. The following parameters can also
impact the performance:
Session_cached_cursors
Processes
MEMORY_TARGET
MEMORY_MAX_TARGET
Pga_aggregate_target

24
 Pre-Installation Requirements and Tasks

SGA_TARGET
SGA_MAX_SIZE

Requirements for DB2 database

The DB2 configuration requirements apply if DB2 and Content Server are running on AIX.
If you use DB2 database with Content Server, ensure it meets the following requirements:
On AIX, ensure that the following DB2 environment variables are set in the installation owners
environment:
DB2_BASE
This must point to /DB2_installation_dir/home/instance_name/sqllib.
DB2INSTANCE
This must point to the name of the default DB2 instance.
Ensure that the LIBPATH environment variable includes $DB2_BASE/lib.
To support audit trail functionality, DB2 requires 8K-page capability. During the installation
of version 6.5, the installer automatically creates 8K pages. To find out whether you have 8K
temporary tablespace before an installation or upgrade, run the following command:
db2 LIST TABLESPACES SHOW DETAIL

If the page size parameter is 4096, you have 4K page size, if it is 8192, you have 8K page size.
To create an 8K temporary tablespace, run the following command:
db2 CREATE TEMPORARY TABLESPACE TEMPSPACE2 PAGESIZE = 8192

Before you create a database for use by Content Server, disable the DB2CODEPAGE environment
variable from the command line:
db2set DB2CODEPAGE =

After you create the database, start the DB2 command line. From the command line, set the
DB2CODEPAGE environment variable to 1208:
db2set DB2CODEPAGE=1208

Ensure that the DB2 clients are installed on the Content Server host.
If you install DB2 on the same host as the Content Server, the clients are installed automatically.
If you install DB2 on a different host from the Content Server, you need to manually install
the DB2 clients on the Content Server host.
Set the code page to UTF-8.
Note: Do not set the environment variable DB2OPTIONS. If set to T, the DB2 command-line processor
uses a semicolon (;) as the statement termination character. Content Server does not install properly
on AIX with DB2 when DB2OPTIONS is set.

25
Pre-Installation Requirements and Tasks

Requirements for DB2 performance wizard

Using the DB2 performance wizard has the following requirements:

Set the server memory target value.
If DB2 is installed on the Content Server host and you are installing DB2 Enterprise Edition, set
the target memory to 40%.
If DB2 is installed on a different host from Content Server and you are installing DB2
Enterprise Edition, set the target memory to 80%.
Ensure that the buffpage value is at least 6000.

Setting up required user accounts

Before installing Content Server, set up required user accounts in the host operating system and
RDBMS.

Installation owner account

The installation owner account is an operating system account with appropriate permissions to install
Content Server and create repositories. The installation owner account may be a local account on
the Content Server host or a domain account in the domain where Content Server is installed. The
account must be a member of the Administrators group on the local host.
Content Server runs under the installation owner account. The installation owner can perform all
administrative and maintenance tasks associated with Content Server and repositories.
For security reasons:
On Windows, it is recommended that the installation owner account is not the same account as
the Windows Administrator.
On UNIX and Linux, it is recommended not to use the root account as the installation owner
account.
You can create an operating system account to use exclusively for Content Server installation and
repository configuration. You can use a single operating system account as installation owner for
multiple Content Server installations on the network.
If you use Windows authentication for SQL Server, the Content Server installation owner must have
the System Administrator privileges in SQL Server.
Note:
After installation, the installation owner account cannot be changed.
The database user specified in the server.ini file as database_owner should have an account
with the database.

26
 Pre-Installation Requirements and Tasks

The installation owner account should have full access to AEK.KEY and DBPASSWD.TXT.
In a multi-user account AIX system, resources created or owned by a user account may not be
available for modification to another user account due to access restrictions. This might lead to
error such as DM_CRYPTO_E_SHM_CREATE_FAILED if the shared memory is locked by another
user account. Ensure that a proper user account planning is done to avoid these conflicts. Also,
sometimes a system reboot may be necessary to clean up all the resources of the process such as
shared memory.

Installation owner account naming requirements

The installation owner username must consist of letters, numbers, dashes (-) or underscores (_). The
first character must be a letter. All characters must be ASCII characters.
The installation owner password consist of letters, numbers, dashes, underscores, or periods.

Required rights for the installation owner account

The installation owner account must have the following user rights on the host operating system:
Act as part of the operating system
Create a token object
Increase quotas
Log in as a service
Log in locally
Replace a process-level token
On Windows, these rights are automatically inherited with membership in the local Administrators
group. Installer checks for these rights and grants them if necessary.
The installation owner must have Full Control permission on the directories into which Content
Server is being installed, including data and share directories. The installation owner must also have
write permission on the directory from which installer is run.
On UNIX and Linux, the installation owner must have read, write, and execute permission on the
/tmp directory.
To support external password validation, set up a group account whose members are the installation
owner, any other Content Server administrators, and repository owners. This will be the group that
owns the external password validation program.

Installation owners email account and SMTP server information

Content Server requires the installation owners email address and SMTP server information to send
mail notifications to the installation owner. During installation or upgrade, you need to provide this

27
Pre-Installation Requirements and Tasks

information and installer will attempt to connect to the SMTP server. The SMTP server can be located
on the Content Server host or another computer on the network.
Set up an email account for the installation owner and obtain the host name or IP address of the
computer hosting the SMTP server Content Server can connect to.

Repository owner account

The repository owner account is a database user account that Content Server uses to connect to the
database. This account owns all objects in the database and gives Content Server access to the
database tables underlying the repository. Each repository must have a unique repository owner.
You can create the repository owner (database user) account in one of these two ways:
Have Content Server automatically create the repository owner account in the database when you
create the repository during the installation process.
If you allow the Content Server configuration program to create the repository owner account for
you, the configuration program automatically grants the account proper privileges.
Manually create the repository owner account in the database prior to installing Content Server.
If you manually create the repository owner account in the database, ensure the account has
appropriate privileges to perform the following tasks:
Connect to the database
Create tables, views, and indexes in the database
Insert records (rows) into the tables
Drop tables, views, and indexes
Note the following requirements for different RDBMS:
Microsoft SQL Server
On all supported SQL Server versions, the repository owner must be able to access tempdb,
and if the account is created before installer is run, the user must own all tables and views.
Ensure that the repository owner has the Create Any Database privilege.
On Windows, if you use Windows authentication for SQL Server, the repository owner
(database user) must have a Windows account. Set up a Windows account for the repository
owner.
Oracle database
On Oracle database, if you create the account before Content Server installation, provide a
value for the select_catalog_role parameter.
On Oracle database, the repository owner must have Connect and Resource privileges. The
Resource privilege encompasses creating and maintaining database objects. The repository
owner also must have permission to create any view, resource, and unlimited tablespace.
The tablespace created by the repository owner for tables or indexes must be designated the
default, while the standard Oracle temporary tablespace must be the default for any temporary
tables that the repository owner creates. The name of the temporary tablespace needs to be
valid for the Oracle configuration used. The default name is either temporary_data or temp,
depending on which Oracle version is used.

28
 Pre-Installation Requirements and Tasks

The repository must also have the Select Catalog Role privilege.
DB2 database
Grant use of tablespaces, list tablespace, and connect to database privileges.
The repository owner does not have an account. The repository owner is created when you
grant the required privileges to an existing operating system account.
To use Microsoft Cluster Services, the repository owner must have an account in the domain in
which you install the repository.

Repository user accounts

Repository users are the end users in the repository. These users may own documents or other objects
that are stored in a repository, but they have no particular responsibilities for the maintenance of
either the repository or the installation.
On Windows, if the default user authentication is used, each user must have a Windows account
in the domain where Content Server is installed. If LDAP authentication or inline password
authentication is used, this is not a requirement.
On UNIX and Linux, if the default user authentication is used, each user must have an operating
system account in the domain where Content Server is installed. If LDAP authentication or inline
password authentication is used, this is not a requirement.

Pre-installation tasks on Windows

Perform the following pre-installation tasks on Windows:
Set the date and time formats to a four-digit year (yyyy) date in the Windows regional settings.
Disable the user access control (UAC).
Disable the Windows Update service.
Enable the Computer Browser service (optional).
Disable the IP Helper service from the Windows Services console and restart the machine. This
method disables the Teredo Tunneling Pseudo-Interface.
In non-English operating systems, install the latest version of Microsoft Visual C++ 2008
Redistributable (64-bit) before creating a repository. This will provide the correct operating
system runtime libraries for the Content Server and other utilities.
Install the Microsoft security updates released in June, 2014 onwards to avoid vulnerabilities on
the Windows hosts.

29
Pre-Installation Requirements and Tasks

Pre-installation tasks on UNIX and Linux

Performing pre-installation tasks for SUSE Enterprise

Linux
Before installing the content server, ensure that you have done the following configuration:
To ensure that the dmdb test does not fail during the loading of the shared libraries of
libssl.so.10, while configuring the repository, perform the following steps:
root:~ # cd /lib64
root:/lib64 # ln -s libcrypto.so.1.0.0 libcrypto.so.10
root:/ # cd /usr/lib64
root:/usr/lib64 # ln -s libsasl2.so.3 libsasl2.so.2
root:/usr/lib64 # ln -s libssl3.so libssl.so.10
The repository might crash if the netegrity plug in does not work. Hence ensure that you copy
libstdc+.so.5 from the older version of SUSE and save it at /usr/lib/ in SUSE Enterprise
Linux 12 environment.

Performing pre-installation tasks for Red Hat Enterprise

Linux 7.0
Before installing the content server, ensure that you have done the following configuration:
To ensure that the repository configuration does not fail with "libsasl2.so.2: cannot open shared
object file error on Red Hat Enterprise Linux 7.0, log into the root account and run the following
command:
ln -s /usr/lib64/libsasl2.so.3.0.0 /usr/lib64/libsasl2.so.2

Setting required environment variables

In the installation owners environment, set environment variables that identify the directories
into which Content Server will be installed. The variables must be set in the installation owners
environment.
You can create the Content Server installation directory before installing the server, or you can allow
installer to create the directory for you during installation. If you allow Content Server installer to
create the directory, ensure that the directory name you provide during the installation matches
the one specified in the environment variable.
Symbolic links (symlinks) are not supported. Do not use them in the installation directory or any
other environment variable used by Content Server. This restriction also applies to environment
variables used to specify the database location. For example, if you use Oracle, the ORACLE_HOME
environment variable cannot use a symbolic link.
Environment variables and the installation directory must contain only ASCII characters. The name
of the installation directory must not contain spaces.

30
 Pre-Installation Requirements and Tasks

On UNIX and Linux, you need to set certain environment variables in the installation owners
environment.
You must set the $DOCUMENTUM variable first for installer to run successfully.
$DOCUMENTUM
The Content Server installation directory. The installation owner must have read, write, and
execute permission on the $DOCUMENTUM directory and its subdirectories. There is no default
installation directory on UNIX and Linux, and $DOCUMENTUM cannot be mounted with the
nosuid option.
The Content Server configuration program (dm_launch_server_config_program.sh)
automatically sets all required environment variables except for those required by each database. If
you do not use the Content Server configuration program, you need to manually set all environment
variables.
You can set all of the following variables, except LC_ALL and DISPLAY, by sourcing
$DOCUMENTUM/product/version_number/bin/dm_set_server_env.sh or
$DOCUMENTUM/product/version_number/bin/dm_set_server_env.csh. Set the variables
LC_ALL and DISPLAY in the installation owners .cshrc file (C shell) or .profile file (Bourne or
Korn shells). Alternatively, set the variables in a file called by the .cshrc file or .profile file or
in other ways permitted by UNIX and Linux.
$DM_HOME
Must be $DOCUMENTUM/product/version_number, where version_number is the version of
Content Server.
LIBPATH (AIX) and LD_LIBRARY_PATH (Linux and Solaris)
Add the directory containing the client library to the appropriate environment variable of the
installation owner. You must set this environment variable before configuring or starting Content
Server, as well as running IAPI or IDQL.
DISPLAY
Controls the display. Set the value to <host/ip>:0.0.
LC_ALL
Set the value to C.

Caution: If this value is not set correctly, the Java Method Server will fail.
Note:
On AIX, depending on the environment and the customizations, Content Server could exceed the
default process memory size limit that is set by the AIX operating system. This default in 64-bit
process is 256 MB on AIX. While configuring Content Server, do some analysis on the number of
sessions, users, operations and set the LDR_CNTRL environment variable appropriately. The
recommended value is 2 GB which is LDR_CNTRL=MAXDATA=0x7000000.
If the load of the Content Server is not known in advance and the LDR_CNTRL environment
variable is not set properly, Content Server could throw a Segmentation Violation error
with message "Error: dm_bear_trap: Unexpected exception, (SIGSEGV:
segmentation violation: (11) at (Connection Failure))".

31
Pre-Installation Requirements and Tasks

When this error occurs, modify the docbase startup script $DOCUMENTUM/dba/dm_start_
<docbase>.sh and add the below setting before launching the Content Server and then restart
the Content Server:
For example:
LDR_CNTRL=MAXDATA=0x7000000
export LDR_CNTRL
./documentum -docbase_name <docbaseName>
-security acl -init_file /path/to/server.ini $@ >> $logfile 2>&1 &

On a AIX with DB2 combination, depending on the number of processes that need to be run,
you should change the user process.
Command to check the user process:
lsattr -E -l sys0 -a maxuproc

Command to increase the user process:

chdev -l sys0 -a maxuproc= 256 (or more)

On a AIX with DB2 combination, when you install or upgrade Content Server 7.1 and later, set the
file descriptor limit to any 5-digit value (for example, 65535) and do not use unlimited.

Setting up the services file

The services file must contain two entries for each repository running on a host. Manually create the
service name entries in the services file before you install the Content Server.
The repository does not have default service names or default port numbers. The service name you
put in the services file must be the same name you will provide during repository configuration,
which is then used to create the server.ini file. The service name for the repository can be the
same as the repository name, but this is not required.
The services file must include entries that designate two consecutive port numbers: one for native
connections, and the other for secure (SSL) connections. Append _s to the name of the repository
service for the secure connections.
Create two network service entries in the systems service table using the following format:
service_name port_number/tcp #Put comments here
service_name_s port_number/tcp #Put comments here

In the following repository service entries example, repository service is named repo1.
dm_repo1 47625/tcp # <version_number> Repository native connection
dm_repo1_s 47626/tcp # <version_number> Repository secure connection

Note: Even if you are not using secure (SSL) connections, two consecutive port numbers are still
required by Content Server.
If correct services file entries are not present during installation, the installation will fail.
If you have multiple repositories on a single host, create a services file entry for each repository.
Ensure that the repositories use different names and port numbers.

32
 Pre-Installation Requirements and Tasks

Installing the JCE policy files

To use all ciphers on a Oracle Java environment, download the Unrestricted SDK JCE policy
files from the Oracle website. The downloaded files include the local_policy.jar and
US_export_policy.jar policy files. Take a copy of existing policy files from the Java
home directory and save it in another directory. Copy the downloaded policy files in the
<Java_Home>/jre/lib/security directory for both the Content Server and the client machines.
Note: To use all ciphers on a AIX with Oracle combination, download the Unrestricted SDK JCE
policy files from the IBM website.

Enabling random generator on Linux

A connection request through SSL waits for a random number to be created and a delay is noticed.
To avoid the delay, you can enable or disable the random generator on the Linux machine. Perform
the following boot safe (inittab) on all Content Server machines:
Start the random generator as root:
/sbin/rngd -b -r /dev/urandom -o /dev/random

Preparing relational database management

system (RDBMS)
This section contains the information to configure RDBMS for your Content Server installation.

Preparing Microsoft SQL Server

Creating an ODBC data source for SQL Server

On the Content Server host, create an ODBC data source for SQL Server:
1. From the Windows Start menu, select Administrative Tools > Data Sources (ODBC).
Note: Ensure that you select a 64-bit ODBC data source using only the SQL Server driver.
2. In ODBC Data Source Administrator, navigate to the System DSN tab and click Add.
Note: You can also use User DSN tab.
3. In the Create New Data Source window, double-click SQL Server.
4. In the Create a New Data Source to SQL Server window, enter a name for the data source and
select the SQL Server you want to connect to.
Click Next.

33
Pre-Installation Requirements and Tasks

5. Choose a SQL Server authentication method:

With Windows NT authentication using the network login ID: If you choose this option,
the Content Server installation owner must have the System Administrator privileges in SQL
Server and the repository owner (database user) must have a Windows account.
With SQL Server authentication using a login ID and password entered by the user: If you
choose this option, enter the SQL Server administrator login ID and password. The repository
owner (database user) does not need to have a Windows account.
Click Next.
6. Follow the instructions on the screen to complete the rest of the setup process.

Configuring Oracle database

Configuring the tnsnames.ora file

Oracle database aliases (TNS aliases) are defined by entries in the tnsnames.ora file. You cannot
connect to an Oracle database without an alias. Configure the tnsnames.ora file on the Content
Server host. Use the Oracle SQL*Net configuration tool to create a database alias referring to the
database instance you plan to use for Content Server. After you create the alias, test the alias by
connecting to the Oracle database.
Entries in the tnsnames.ora file for the Oracle HTTP service and data expo service do not contain
parameters for HOST, SID, and SERVICE. If the first entry in the tnsnames.ora file is for one
of these services, Content Server installer is unable to parse the tnsnames.ora file and cannot
connect to the database. Ensure that the first entry in the tnsnames.ora file is not for the Oracle
HTTP service or data expo service.
The database_conn key in the server.ini file must match the database entry in the tnsnames.ora
file. If it does not, this error appears:
Error - Failed to obtain database connection information
corresponding to the repository from the server.ini file.
String index out of range: -1
Please read error log /tmp/installation_owner_name.ServerInstaller.log
for more information.

If you see this error, modify the database_conn key in the server.ini file and continue with the
installation or upgrade.

Performing additional Oracle database configuration tasks

Perform the following Oracle database configuration tasks before installing Content Server:
Set up networking parameters.
Ensure that the Oracle listener is running on the Oracle host.
If you want to configure the database for improved performance, do this before installing Content
Server.

34
 Pre-Installation Requirements and Tasks

Optionally, migrate an existing Oracle instance to AL32UTF8 or AL16UTF8 code page.

When installing Oracle 12c, ensure that the Create as container database option is not selected.

Configuring DB2 database

You can configure a DB2 database by using one of the following methods:
Configure DB2 from the Control Center
Configure DB2 from the command line
Optionally, you can use the performance wizard to fine-tune DB2 performance after installing and
configuring the database. You can use the performance wizard at a later time, but if you do so, ensure
that the parameter values required by Content Server are not changed.

General guidelines

You can create the database and set the parameters from the DB2 command line or from the Control
Center. Use the Control Center to run the performance wizard. You can run the Control Center
on AIX, or you can run performance wizard from a Windows system to tune performance for the
instance on AIX.
Use the following general guidelines to install and configure DB2:
1. Install DB2.
2. Optionally, use the performance wizard to fine-tune DB2 performance.
You can use the performance wizard at a later time (after you complete configuring DB2), but if
you do so, ensure that the parameter values required by Content Server are not changed.
3. Configure DB2.

Configuring DB2 from Control Center

Use the following procedure to configure a DB2 database from the Control Center:

1. Start the Control Center.

2. Right-click the database and choose Configure from the context menu.
3. Click the Performance tab.
a. Set the sort heap.
If you are configuring DB2 Enterprise Edition, set the sort heap to 1138.
b. Set the application heap size to 1024.
c. Set the application control heap size to 256.
d. Set the log buffer size.

35
Pre-Installation Requirements and Tasks

If you are configuring DB2 Enterprise Edition, set the log buffer size to 128.
e. Set the lock list size.
If you are configuring DB2 Enterprise Edition, set the lock list size to a minimum of 2048.
4. Click the Applications tab and set the maximum number of locks to 80.
5. Click the Logs tab.
a. Set the log file size to 1024.
b. Set the number of primary logs to 18.
c. Set the log second size.
If you are configuring DB2 Enterprise Edition, set the size to 10.
Click OK and close the dialog box.
6. When the Control Center is displayed, click the database for your repository and right-click
Buffer Pools.
7. Choose Alter. The Alter Buffer Pool dialog box displays.
8. Check Use default bufferpool size, and click OK.
9. From the command line, restart the DB2 server:
db2stop force
db2start

Configuring DB2 database from command line

Use the following procedure to configure a DB2 database from the command line:

1. Start the DB2 command line.

2. Set the application heap size to 1024 or greater, where <dbname> is the name of the database you
created for use by the repository:
update db cfg for <dbname> using applheapsz 1024

3. Set the application control heap size to 256 or greater

updatedb cfg for <dbname> using APP_CTL_HEAP_SZ 256

4. Set the transaction file sizes.

If you are configuring DB2 Enterprise Edition:
update db cfg for <dbname> using LOGFILSIZ 1024
update db cfg for <dbname> using LOGPRIMARY 18
update db cfg for <dbname> using logbufsz 128
update db cfg for <dbname> using logsecond 10

5. Set the maximum number of locks:

update db cfg for <dbname> using maxlocks 80

6. Set the lock list size.

On the DB2 Enterprise Edition, set it to a minimum of 2048:
update db cfg for <dbname> using locklist 2048

36
 Pre-Installation Requirements and Tasks

7. Set the sort heap and buffer page sizes. Ensure that the buffer page size (buffpagesize) is set to
a minimum of 6000.
If you are configuring DB2 Enterprise Edition:
update db cfg for <dbname> using sortheap 1138
update db cfg for <dbname> using buffpage buffpagesize
If the repository and the DB2 server are on the same machine and you are configuring DB2
Enterprise Edition, set buffpagesize to 40% of the available physical memory divided by the
page size of your tablespace.
If the repository and the DB2 server are on different machines, set buffpagesize to 80% of the
available physical memory divided by the page size of your tablespace.
Note: If you are running more than one repository and database on the same DB2 server, the
percentage recommended for buffer pool is for the sum of all databases. In all cases, ensure that
the buffer page size is a minimum of 6000.
8. If you see the SQL1482W error message The BUFFPAGE parameter will only be used
if one of the buffer pools is defined with a size of -1, change the buffer
pool size:
ALTER BUFFERPOOL buffpoolname SIZE -1

9. Set the SQL statement heap size to automatic:

update db cfg for <dbname> using STMTHEAP 12288 AUTOMATIC

10. From the command line, restart DB2:

db2stop force
db2start

11. Update the database configuration for the database to 200 using the following command:
MAXAPPLS 200 AUTOMATIC MAXLOCKS 80 AUTOMATIC

12. If DB2 is installed remotely, use the DB2 Client Configuration Assistant after database creation to
add the database alias to the list of available databases.

Tuning DB2 database

This section describes how to do performance tuning of a DB2 database using the Performance
Wizard.
You can skip this step now and do performance tuning later. If you are doing performance tuning at a
later time, verify that the parameters described in the Configuring DB2 database, page 35 section
of this document are set to the correct values.
If your DB2 instance runs on AIX, run the Performance Wizard from a Windows system to tune
performance of the instance on AIX.
To tune DB2 performance follow these steps:

1. Start the Control Center.

2. Right-click the database you created for the repository.

37
Pre-Installation Requirements and Tasks

3. On the context menu, choose Configure Performance Using Wizard. The name of the production
database dialog box is displayed.
Click Next. The server memory dialog box is displayed.
4. Set the server memory target value.
If DB2 is installed on the Content Server host and you are installing DB2
Enterprise Edition, set the target memory to 40%.
If DB2 is installed on a different machine from Content Server and you are installing Enterprise
Edition, set the target memory to 80%.
5. Ensure that the buffpage value is at least 6000.
Click Next. The workload type dialog box is displayed.
6. Click Mixed, then click Next. The typical database transaction dialog box is displayed.
7. Indicate the allowable number of SQL statements and transactions.
If you are installing DB2 Enterprise Edition, click More than 10 SQL statements and 60
transactions per minute, then click Next.
The database administration priority dialog box is displayed.
8. Click Faster transaction performance (slower recovery), then click Next.
The database data population dialog box is displayed.
9. Click No, then click Next.
After the repository is in use and the database contains more data, you can run the Performance
Wizard again and change this parameter. The number of connected applications dialog box is
displayed.
10. Provide the average number of local and remote connections.
If you are installing DB2 Enterprise Edition, type in four average local connections and 20 average
remote applications and click Next.
These numbers can be larger depending on the number of clients connecting to your repository.
A production repository can have many more client applications connecting.
The isolation level dialog box is displayed.
11. Click Cursor stability (many locks of short duration) and click Next. The Performance Wizard
displays values it recommends based on the information you provided and choices you made.
12. Check Apply these recommendations immediately, then click Finish.
13. From the command line, restart the DB2 server:
db2stop force
db2start

Running multiple Content Servers on DB2 host

If you run multiple Content Servers on the DB2 host, you might see a DB2 SQL1224N error. This
can occur with multiple repositories on the host or with multiple servers that run against a single
repository. To work around this, change the following parameters:
On AIX, set EXTSHM to ON in the environment of the DB2 instance owner. You can do this in the
.cshrc file or the corresponding system file for the different shells.

38
 Pre-Installation Requirements and Tasks

setenv EXTSHM ON

In the DB2 environment, type this command:

db2set DB2ENVLIST=EXTSHM

DB2 repository sizes

DB2 repositories have the following size and configuration considerations:

In a small repository on DB2, a single tablespace contains the data and indexes, and you cannot
change an index tablespace.
A small DB2 repository has an initial datafile size of 200 MB.
In a medium or large repository on DB2, one tablespace contains the data and another tablespace
contains the indexes, and you can change an index tablespace.
A medium DB2 repository has an initial datafile size of 400 MB and an initial index file size
of 200 MB.
A large DB2 repository has an initial datafile size of 800 MB and an initial index file size of 300 MB.

Configuring internationalization settings

Content Server runs in the UTF-8 code page. Perform the following tasks before Content Server
installation:
Install the server host code page.
Set the code page in the database.
Set the server host locale.
The server host locale and the server code page need not be same. For example, if the host code
page is set to ISO-8859_1, the host locale would typically be set to a European language (English,
French, German, Italian, Portuguese, or Spanish). If the host locale is set to French, a client that
connects to the Content Server without specifying a client locale is served French data dictionary
labels.
If the host locale is one of the languages supported by EMC Documentum, the data dictionary
information for that locale is loaded. Otherwise, the server defaults to loading the English data
dictionary information. You can load additional sets of data dictionary information by modifying
the data_dictionary.ini file. Installing additional data dictionary information can affect

39
Pre-Installation Requirements and Tasks

server performance, and EMC Documentum only supports the languages that are shipped with
Content Server.
On Windows hosts, the host locale is set in the Regional Settings dialog box.
On UNIX and Linux hosts, the host locale is set with the LANG environment variable.
Content Server can be installed on computers that run the following operating system code pages:
For U.S. and Western European sites, ISO-8859_1 (Latin-1)
For Korean sites, EUC-KR
For Japanese sites that use UNIX and Linux, EUC-JP
For Japanese sites that use Windows, Shift_JIS
For Chinese sites with locale zh, ms936
For Russian with locale ru, Windows-1251
The EMC Documentum Content Server Administration and Configuration Guide contains the complete
information on locale-based configuration settings for the data dictionary files installed with Content
Server.

Installing MailApp DAR

You need to install the MailApp DAR file on Content Server 7.2 for any clients to use the changed
email management features introduced in Webtop 6.8.

Preparing for remote key management

If you plan to use remote key management (RKM), you must set up the RSA Data Protection
Manager before you create your repository, and you can only enable remote key management when
you create your repository. You cannot later change a repository from local key management
to remote, or from remote to local.
When you create a repository, you can choose to manage the repository encryption keys locally, or
to manage them with a remote key management server. For local key management, the encryption
keys are encrypted and stored in the database used for the repository metadata. In releases prior to
7.0, all repositories used local key management.
For remote key management, the encryption keys are stored in a remote key management server.
Beginning with release 7.0, customers with a Trusted Content Services license have the option of
creating repositories that store the encryption keys in RSA Data Protection Manager.
Starting with the 7.2 release, the remote key management can be enabled for all the repositories
during the installation or post-installation. You can also enable the remote key management for 6.7 or
later repositories as part of upgrade or post-upgrade tasks. The EMC Documentum System Upgrade and
Migration Guide contains detailed information. If you plan to use remote key management, the crypto
policy key on RKM must match the key created for Content Server.

40
 Pre-Installation Requirements and Tasks

This chapter contains the information on configuring the RSA Data Protection Manager (DPM) in
preparation for creating a repository that uses remote key management. The DPM documentation
contains the details on installing or supporting DPM.

DPM overview
When used by Content Server for remote key management, RSA Data Protection Manager manages
the encryption keys for a repository. When a repository needs a key, it requests it from DPM and
DPM passes it to the repository. DPM uses an X.509 certificate to verify the identity of the Content
Server and repository requesting the key. In the DPM administration application, a repository that is
using remote key management appears in the list of DPM clients.

DPM limitations

When you are planning to use DPM for remote key management, consider the following constraints:
Remote key management can only be configured when the repository is created, and cannot be
changed after creation. In releases prior to 7.0, all repositories used local key management and
cannot be upgraded to use remote key management.
All the Content Servers for a repository must use the same DPM server.
Use a low-latency connection from Content Servers to the DPM server. High-latency connections
will cause performance problems and may cause timeouts.
A repository that uses DPM cannot be a member of a federation (or use replication).
Dump and load of encrypted file stores is not supported for repositories that use remote key
management.
Only Active key states are supported. Setting key states in DPM to Deactivated, Destroyed,
or Compromised is not supported.
The DPM server must be running and available to the Content Server host before starting. If you
attempt to start a remote key management Content server, and the DPM server is not available,
Content Server will fail to start.
None of the Content Servers for a repository can be a remote content server (proximity must be
less than 9000).
You cannot use global login tickets with a repository that uses remote key management.

Identities, identity groups, and key classes

You will set up DPM to support remote key management for a repository by specifying DPM
identities, an identity group, and key classes. Identities represent Content Server instances, an
identity group represents a repository, and key classes represent the repository keys.

41
Pre-Installation Requirements and Tasks

Identities

DPM uses the concept of an identity. In the context of Content Server, every Content Server instance
(process) is a separate identity. In order to use remote key management, you need to configure
identities in DPM and create or obtain a unique certificate for each identity. The certificate is used to
authenticate a request for keys from a Content Server instance.
For example, one common scenario is to have Content Servers on a single host controlling multiple
repositories. In Figure 3, page 42, ContentServerA is one identity, and ContentServerB is a second,
separate identity. If both repositories use DPM, both Content Servers must have a unique certificate.

Figure 3. Single host Content Servers and multiple repositories

Another common scenario is two Content Servers on two different hosts serving a common
repository. In Figure 4, page 42, ContentServerC1 and ContentServerC2 are both serving RepositoryC.
ContentServerC1 and ContentServerC2 are two separate identities. Separate, unique certificates
are used to authenticate requests for keys from ContentServerC1 and from ContentServerC2, even
though DPM returns the same RepositoryC keys for either request.

Figure 4. Multiple Content Servers on separate hosts for one repository

Another scenario, is to have multiple Content Servers on one host serving a common repository. In
Figure 5, page 42, ContentServerD1 and ContentServerD2 are serving RepositoryD. Again, each
Content Server is a separate identity. ContentServerD1 requires a unique certificate for its identity,
and ContentServerD2 requires a unique certificate for its identity.

Figure 5. Multiple Content Servers on one host for one repository

Identity groups

In the context of DPM, identity groups are a way of grouping related identities together. For remote
key management using DPM, we use identity groups to keep all the identities used for a repository
together. For this reason, we recommend that you name the identity group with the name of the
repository it represents.
From the examples, we put the identities for ContentServerC1 and ContentServerC2 into an identity
group. Well call that identity group RepositoryC so we know it contains all the identities used for
RepositoryC. We also put the identities ContentServerD1 and ContentServerD2 into the identity
group RepositoryD. It contains all the identities for RepositoryD.

42
 Pre-Installation Requirements and Tasks

Key classes

In the context of remote key management for Content Server, the DPM key classes contain the keys
for the repository. Each repository has its own set of keys managed by DPM. When keys are created,
they are associated with an identity group and any identities in that identity group can access the
keys. That is why we create an identity group for each repository, and why we associate the identities
for each Content Server that serves that repository with that identity group. In that way, any Content
Server that serves that repository can get the repository keys.
In the earlier examples, the key classes for RepositoryC are associated with identity group
RepositoryC. The identities for ContentServerC1 and ContentServerC2 are also associated with
identity group RepositoryC. Both Content Servers can access the keys for RepositoryC. In the same
way, the key classes for RepositoryD are associated with identity group RepositoryD, and the two
Content Server identities, for ContentServerD1 and ContentServerD2, are associated with identity
group RepositoryD. Both ContentServerD1 and ContentServerD2 can access the keys for RepositoryD.
You will create four key classes for each repository to hold these four keys:
DBK-repository key
LTK-login ticket key
FSK-file store key
PPK-private/public key
There is one other key used by Content Server, the Administration Encryption key (AEK). It is the
master key for Content Server. DPM does not manage the AEK. It is used to access all the other keys.
The names of the key classes in DPM must be unique, so we recommend that you name them for the
repository that uses them. Never use the same key class name for different repositories.

Acquiring certificates
Each identity requires its own certificate. Before you configure a repository for remote key
management, you must obtain a certificate for all the identities you need for your particular
installation. You will supply the certificate when you create an identity in DPM, and supply that same
certificate when you configure a Content Server that corresponds to that identity.
You will also need the root certificate for the certificate authority of the identity certificate when
you configure Content Server.
Obtain the certificate from your preferred certificate authority. Generally, you will get versions of
your certificate in a few different formats from the vendor. Each format uses a different file extension.
When you create the DPM identity, you will use the certificate with the .cer file extension. When you
configure Content Server, you will use the certificate with the .p12 extension.

43
Pre-Installation Requirements and Tasks

Preparing DPM for remote key management

Before you begin preparing RSA Data Protection Manager to support remote key management,
decide how many identities (Content Servers) you need to create for your repository (as described in
DPM overview, page 41), and get digital certificates for each identity.
We strongly recommend using our naming convention to manage the DPM entries:
Identity Groupname of the repository
Identity-concatenate the repository name and Content Server name
Key Class-concatenate the repository name with the key name

Creating the identity group, identities, and key classes

In the following steps, substitute the repository name for repository and Content Server name for
content_server.
1. Create the identity group for the repository.
a. From the DPM Administration application, select Identity Groups > Create.
b. Enter repository for Name.
c. Select Save.
2. Create the identities for each Content Server for the repository.
a. Select Identities > Create.
b. Enter repository_content_server for Name.
c. Select the one identity group named repository created earlier for Identity Groups.
d. For Roles, select Operational User.
e. For Identity Certificate, select Browse... to navigate to the .cer file for this certificate, select
it, then select Open.
f. Select Save.
Repeat the steps (a to f) to create any additional identities needed for this repository.
3. Create the DBK key class for the repository.
a. Select Key Classes > Create.
b. Enter repository_DBK for Name.
c. Select the identity group named repository created earlier for Identity Group.
d. For Key Duration, select Activated Keys Have Duration, but deselect Get Duration From A
Crypto Policy.
e. Select Next.
f. For Key Details > Cipher select Algorithm: AES, Key Size: 128, and Mode: CBC.
g. For Key Details > Duration select Duration: Infinite.
h. For Key Details > Get Key Behavior select Type New Key Each Time.
i. Select Next.

44
 Pre-Installation Requirements and Tasks

j. For Class Attributes, select Next (do not set any class attributes).
k. For Attribute Specifications, select Next (do not set any attribute specifications).
l. Review the new key class values in the following table, then select Finish.

Table 1. DBK key class settings

Name Value
Name repository_DBK
Identity Group repository
Use Crypto Policy False
Algorithm AES
Key Size 128
Mode CBC
Duration Infinite
Get Key Behavior New Key Each Time
Class Attributes None
Attribute Specifications None

4. Create the FSK and LTK key class.

Use the procedure in the previous step to create two more key classes, one named repository_FSK,
and one named repository_LTK. Set all the other values for these two key classes the same as
in the previous step.
5. Create the PPK key class.
a. Select Key Classes > Create
b. Enter repository_PPK for Name.
c. Select the identity group named repository created earlier for Identity Group.
d. For Key Duration, select Activated Keys Have Duration, but deselect Get Duration From A
Crypto Policy.
e. Select Next.
f. For Key Details > Cipher select Algorithm: RSA and Key Size: 1024 (you cannot select
a Mode).
g. For Key Details > Duration select Duration: Infinite.
h. For Key Details > Get Key Behavior select Type New Key Each Time.
i. Select Next.
j. For Class Attributes, select Next (do not set any class attributes).
k. For Attribute Specifications, select Next (do not set any attribute specifications).
l. Review the new key class values in the following table, then select Finish.

45
Pre-Installation Requirements and Tasks

Table 2. PPK key class settings

Name Value
Name repository_PPK
Identity Group repository
Use Crypto Policy False
Algorithm RSA
Key Size 1024
Mode -
Duration Infinite
Get Key Behavior New Key Each Time
Class Attributes None
Attribute Specifications None

Information required to configure repository

After you have created the identity group, the identities, and the key classes, DPM is ready to support
remote key management for a repository. During repository configuration, if you have installed a
TCS license, you will have the option of providing the information required for the repository to
use remote key management. You will need to have the following information during repository
configuration:
DPM hostname or IP address
DPM port number
identity certificate for Content Server (.p12 format of the certificate)
password for that identity certificate
a root certificate for the Certificate Authority (CA) of your identity certificate
the names of the four key classes you created for the repository

Preparing installation package

Download the Content Server software for your operating system and database.
You can find the location of the software and instructions for downloading it in the EMC Documentum
Content Server Release Notes or in the instructions you received through email on how to download
products from the EMC download site.
On Windows, expand the compressed archive by double-clicking the file.
On UNIX and Linux, expand the compressed archive by typing:
% tar -xvf filename

46
 Pre-Installation Requirements and Tasks

Ensure that you have execute permission on the serverSetup.bin file. If not, add execute
permission to the file by running this command:
chmod +x serverSetup.bin

Configuring for Certificate-based SSL

communication
This section describes the information on Certificate-based SSL communication.

Connection modes
Documentum Content Server and connection broker support the following connectivity modes:

Mode Description
Native Connections are in the raw RPC format without any encryption
Secure SSL mode is:
used with anonymous ciphers (ADH:DEFAULT)

used with certificates

Dual (Native & Secure) Connections are both in the raw RPC format without any
encryption and SSL mode is used with anonymous ciphers
(ADH:DEFAULT) and certificates.

We strongly recommend you to configure Content Server, connection broker, and Documentum
Foundation Classes (DFC) to be in the Secure mode with Certificate-based SSL.
In addition to the existing connectivity options, a new connectivity mode is available. In this mode,
certifications are used to verify SSL servers.
Note: Certificate-based SSL and non-anonymous mode SSL are synonymous.
Documentum Foundation Classes (DFC) supports the following connectivity modes:

Mode Description
Native Connections are in the raw RPC format without any encryption
Secure SSL mode is used with anonymous ciphers (ADH:DEFAULT)
Try_native_first Native mode is attempted first, falling back to secure
Try_secure_first Secure mode is attempted first, falling back to native

In the OOTB setup, the secure mode will continue to use anonymous mode by default. In the
anonymous SSL mode, certificates are not used. In addition, both end parties are trusted and not
verified. You must configure Content Server, connection broker, and Documentum Foundation
Classes (DFC) to use Certificate-based SSL.

47
Pre-Installation Requirements and Tasks

Note the following details about Certificated-based SSL:

Clients verify the servers. For example, DFC verifies the Content Server during connection
handshake.
Clients will connect only to servers that are in the trust store of the SSL client.
Note: A trust store is a file containing certificates from trusted servers.
Only SSL server verification is supported. No verification is provided to the SSL clients.

Prerequisites
EMC does not provide any certificates. You must procure or generate your certificates and manually
configure the components to use the non-anonymous/Certificate-based SSL mode.

Certificates

You must purchase certificates from a Certificate Authority (CA).

Perform the following steps to procure a certificate:
1. Provide details of the certificate to the CA in the Certificate signing request (CSR) format. The CA
obtains CSR from user and signs it and provides the signed certificate to the user.
2. You will receive certificate signed by a CA and a private key with CA certificate chain.
3. Depending on the CA, the certificate and chain can be in the PKCS#12 or plain DER or PEM
format. PKCS#12 is widely-used specialized keystore format standardized by RSA.
PKCS#12 format is provided with a password
The private key is provided separately for PEM/DER certificates
You can also generate certificates using tools. Such certificates are known as self-signed certificates
and are generally used for testing.
There is no restriction or limitation on the certificate type, private key type/length, or certificate
chain length.

Building a Keystore

The keystore must be in the PKCS#12 format.

If certificates are in the PKCS#12 format no additional configuration is required. You can proceed to
the Configuration section.
If the certificate and private key are provided in PEM or DER format, you must use tools to import
to the PKCS#12 format and then perform the configuration. For more information about Tools,
see the SSL Tools.

48
 Pre-Installation Requirements and Tasks

Preparing Keystore password

The PKCS#12 keystore is provided with a password for security. If the CA has provided the
certificate in this format, the password will also be available.
Password formats:
The password can be provided in a plain text format.
The password can also be provided in an encrypted format using dm_encrypt_password utility
that is bundled along with Content Server installation. The dm_encrypt_password utility uses
aek.key in $DOCUMENTUM/dba/secure to encrypt the password.
Note: This is similar to how the Database password is stored on the Content Server machine.
If the password is encrypted, it will be specific to the Content Server where it was encrypted. It cannot
be copied to any other Content Serve that has a different aek.key.

Building a Trust Store

Considerations for building a trust store:

For Content Server, the trust store must be in the PKCS#7 binary format. PKCS#7 is a widely-used
specialized trust store format standardized by RSA.
For DFC, the trust store must be in the JKS format. JKS is a widely-used specialized keystore
format standardized by Java.
Note: The keystore is a file containing the certificate and private key.
The trust store contains all certificates that the SSL client can trust. The certificate list includes the
list of all root and intermediate CAs. It is optional to store the leaf certificates (connection broker
certificate) if you obtained it from CA. The certificate chain is adequate to validate the leaf certificate.
If the certificates are self-signed and do not include a certificate chain, then all the certificates must be
stored in the trust store. However, if the certificates are self-signed and include a certificate chain,
then all certificates, except the leaf certificate, must be stored in the trust store.
For more information about Tools, see the SSL Tools.

Location of the keystore file, keystore password file, and trust

store file

The connection broker keystore, connection broker keystore password file, Content Server keystore,
Content Server keystore password file, and the Content Server trust store must reside in the
$DOCUMENTUM/dba/secure directory.
The DFC trust store can be stored anywhere on the local machine which is accessible to DFC.

49
Pre-Installation Requirements and Tasks

Configuration
Configuration is a one-time activity. Subsequent Documentum patches/upgrades will not affect
the configuration.

Configuring connection broker

The connection broker works as a SSL server. It requires details of the keystore and the keystore
password.
Connection broker settings are stored in the docbroker.ini file as follows:

Parameter name Description

crypto_keyname = <CSaek> It is the AEK key name that is used to encrypt the password
in the broker.pwd file.
crypto_lockbox = <crypto_lockbox> It is used if lockbox is present.
keystore_file = <filename> Keystore containing the connection broker certificate and
private key
keystore_pwd_file = <filename> File containing the plain text or encrypted keystore
password
Cipherlist = <list> List of ciphers separated by ":. RSA library supports these
ciphers.

When DFC (client) and Content Server uses bundled Java:

AES128-SHA:EDH-RSA-AES256-GCM-SHA384:EDH-
RSA-AES256-SHA:AES256-GCM-SHA384:AES256-
SHA:EDH-RSA-AES128-GCM-SHA256:EDH-RSA-
AES128-SHA:AES128-GCM-SHA256:EDH-RSA-DES-
CBC3-SHA:DES-CBC3-SHA

When DFC (client) and Content Server uses different

Java: AES128-SHA:EDH-RSA-AES256-SHA:AES256-
SHA:EDH-RSA-AES128-SHA:EDH-RSA-DES-CBC3-
SHA:DES-CBC3-SHA

Note: The ciphers that work depends on the Java version and its capabilities.
Sample:
keystore_file=broker.p12
keystore_pwd_file=broker.pwd
cipherlist = aes128_sha
crypto_keyname = CSaek
crypto_lockbox = lockbox.lb

Note: For Content Server HA, you should use the same certificates for Content Server and connection
broker from Content Server 1. Copy the certificates from primary Content Server to secondary
Content Server.

50
 Pre-Installation Requirements and Tasks

Configuring Server

Content Server works both as an SSL server and an SSL client. It requires details about the keystore,
keystore password, and trust store.
Content Server settings are stored in the server.ini file as follows:

Parameter name Description

keystore_file = <filename> Keystore containing the connection broker certificate and
private key
keystore_pwd_file = <filename> File containing the plain text or encrypted keystore
password
truststore_file = <filename> File containing the trusted connection broker certificates
Cipherlist = <list> List of ciphers

Sample:
keystore_file=server.p12
keystore_pwd_file=server.pwd
truststore_file=server-trust.p7b
cipherlist = aes128_sha

Note: Ensure that the PKCS#12 certificate file is created using FIPS-compliant -descert: option.

Configuring DFC

DFC works as an SSL client. It requires details about the trust store.
DFC settings are stored in the dfc.properties file as follows:

Parameter name Description

dfc.security.ssl.use_existing_ To specify whether DFC uses the default Java trust store or
truststore = <boolean:on|off> a specified trust store

On/True: Use Javas trust store

Off/False: Use the provided trust store

dfc.security.ssl.truststore = <filename File containing trusted connection broker and Content
path> Server certificates
dfc.security.ssl.truststore_password To specify the plain text or encrypted trust store password
= <password>
Sample:
dfc.security.ssl.use_existing_truststore = FALSE
dfc.security.ssl.truststore = c\:/Documentum/dba/secure/dfc.keystore
dfc.security.ssl.truststore_password = password

51
Pre-Installation Requirements and Tasks

Installer support
During the configuration of connection broker and Content Server, the installer will prompt you for
Certificate details which will be used for configuration.

Compatibility
All the components in a setup must use a consistent secure mode. For example, the Content Server,
connection broker, and DFC must be in the anonymous (default) mode or all components must be in
the certificate mode.
A mixed mode where some components are in anonymous and some in Certificate-based is not
supported.
When a new component, for example, another connection broker or Content Server, is installed, the
new component will not have certificate settings. Therefore, you must bring all the other related
components to the anonymous mode before performing the installation.
Since legacy (prior to 7.1) clients and components will not be able to communicate in the
non-anonymous mode, you must use only the anonymous mode in the system that has legacy clients.

Constraints and limitations

RSA libraries are FIPS-compliant.

All files must be available in the $DOCUMENTUM/dba/secure directory. This is designed so that
access to this directory can be monitored or restricted for enhanced security.

52
 Chapter 3
Installing Content Server

This chapter covers the following topics:

Content Server Installation workflow, page 53
Installing Content Server, page 54
Completing the installation, page 61

Content Server Installation workflow

The Content Server installation process can be broken down into two main processes: You first
run Content Server installer to copy Content Server program files from the installation media into
appropriate directories on the host. You then create connection brokers and repositories in the
Content Server configuration program.
When the installer completes copying Content Server program files at the end of the first process, you
can either proceed by having the installer launch the configuration automatically, or exit the installer
and manually launch the configuration later to resume installation. If you choose the first option,
the configuration program automatically creates a connection broker using the default ports (1489
and 1490) while in the second option, you will need to set up a connection broker first using the
configuration program before creating a repository.
During installation, you have the option to enter license keys for optional modules you plan to
activate. If you do not activate them in the installer, you can always do so at a later time by using
the configuration program.
When a module is activated, the configuration program displays some additional module-specific
screens for enabling the extended feature when you configure a repository.

Caution: If you plan to use remote key management for your repository, you must activate
the Trusted Content Services (TCS) module before you configure Content Server. If the TCS
license is not present, you cannot create a repository that uses remote key management, and
you cannot enable it at a later time.

Figure 6, page 53 shows the basic Content Server installation workflow.

Figure 6. Content Server installation workflow

53
Installing Content Server

Installing Content Server

Use the detailed instructions in this section to install Content Server.

Installing Content Server program files

1. Log on to the computer where you want to install Content Server as the installation owner.
2. Run serverSetup.exe (Windows) or serverSetup.bin (UNIX and Linux) to launch
Content Server Installer.
3. Accept the license agreement and click Next.
4. Specify an installation directory for Content Server.
The installation directory name must not contain spaces. For example, do not use
c:\Documentum Products as the name of the installation directory.
On Windows, the default installation directory is C:\Documentum.
On UNIX and Linux, there is no default installation directory. You can install Content Server in
/usr/local/bin/Documentum.
Click Next.
5. On Windows, type the installation owner password.
On Linux, type the root user password.
Note: You will not be prompted for the root user password on AIX and Solaris.
Click Next.
6. Set the administrator password and specify an available listening port for the embedded
application server used by Content Server:
Admin User Password: The password must not have the ", , <, >, %, |, ^, &, ( , and ) characters.
The application server administrator username is set to admin by default.
Listen Port: The port on which the application server listens for standard administration
connections. A total of 20 ports, starting from the one you specify, will be used by the
application server, and all of them must be available. The default port number is 9080.
Whether you accept the default port or choose another one, do not change this port after
the initial configuration.
Click Next.
7. Review the installation summary and click Install to begin installation.
8. Specify if you want to enter license keys for optional modules of Content Server and click Next.
Yes: In the next screen, select the optional modules you want to install and enter
corresponding license keys.
No: You can always enter license keys for optional modules later using the Content Server
configuration program.
9. Installer prompts you if you want to configure Content Server now.
Configure now: Configure now and have the installer launch the configuration program.

54
 Installing Content Server

If you choose this option, you will not be prompted to choose the connection modes (Native,
Secure, and Native and Secure). The configuration program automatically creates a
connection broker in Native and Secure mode using the default ports (1489 and 1490) and
you proceed to create a repository.
Note: Ensure that the default ports are available.
Configure later: Configure later and exit the installer. You then manually launch the
configuration program to resume the installation process.
If you choose this option, you will be prompted to choose the connection modes (Native,
Secure, and Native and Secure). You must create a connection broker first in the configuration
program before creating a repository.
10. On UNIX and Linux, run the dm_root_task script.
If dm_root_task does not run successfully during Content Server installation, you must run the
dm_root_task script manually to set the correct file permissions on a pair of programs required
for user authentication (dm_check_password and dm_change_password).
Run the script as the root user with the root user password.
a. Log in as the root user.
b. Navigate to the $DOCUMENTUM/dba directory and run script: ./dm_root_task
c. Type the name of the administrators group and press return.
The permissions on the files are changed.

Creating a connection broker

Skip these steps if you chose Configure now in the installer, in which case the installer automatically
launches the configuration program and creates a connection broker for you using the default ports
(1489 and 1490).
Follow these steps if you chose Configure later in the installer:

1. From $DM_HOME\install, run Server_Configuration_Program.exe (Windows) or

dm_launch_server_config_program.sh (UNIX and Linux) to launch the Content Server
configuration program.
2. In the configuration options screen, choose Connection broker and click Next.
3. Type the installation owner password and click Next.
On UNIX and Linux, you will not be prompted for installation owner password.
4. Choose Add a connection broker and click Next
5. Choose a connection mode in which the client will connect to the connection broker:
Native: Content Server listens for client connection requests only on standard native ports.
Content Server refuses requests for a secure connection.
Secure: Content Server listens for client connection requests only on a secure TLS/SSL
(Transport Layer Security/Secure Sockets Layer) port for encryption. The client and
Content Server do not use TLS/SSL authentication to authenticate each other. However, the

55
Installing Content Server

information exchanged between the client and Content Server is encrypted. Content Server
refuses connection requests other than TLS/SSL connections.
Native and Secure: Content Server accepts both native and secure connection requests.
Click Next.
6. Select Use certificates if you want to enable SSL certificates.
If selected, provide the following information:
Keystore file name: The name of the keystore file in the PKCS#12 format.
Keystore password file name: The name of the keystore password file.
Cipher list
Provide the DFC trust store information:
TrustStore: The location of the DFC trust store. For example, c\:/Documentum/dba/secure/
dfc.keystore
Password: The password of the trust store file.
Select Use Default Java TrustStore if you want to use the default DFC Java trust store.
Click Next.
Note: The Use certificates option will be visible only if you choose the connection mode as
Secure or Native and Secure.
7. Select the AEK or lockbox file for Select AEK file from the list box.
a. If you select the AEK file, specify the following information:
AEK key name
AEK passphrase
b. If you select a lockbox file, specify the following information:
AEK key name
AEK passphrase
Lockbox file name
Click Next.
8. Provide the connection broker information:
Connection broker name: A unique name for the connection broker.
Connection broker port: The port you specify and its subsequent port will be used by the
connection broker and both must be available. The default port is 1489. If you accept the
default port, make sure that the next port 1490 is also available.
Service startup type: On Windows, specify whether the connection broker service starts
automatically at startup or is started manually. If you use the key with a passphrase, manual
option only is available.
9. Review the summary information and click Next.
10. When the connection broker setup is complete, choose to perform additional configurations or
finish configuration.

56
 Installing Content Server

Creating a repository

Caution: Repositories using different AEK keys can only function independently. They cannot
participate in a federation, replication, and so on where encrypted data or password are shared
among them. If you are using multiple repositories with different AEK keys in lockbox, each
repository instance should use a different JMS instance running on different port and with
different dfc.properties, such that it points to the appropriate repository.

1. If you are not in the Content Server configuration program, from $DM_HOME\install, run
Server_Configuration_Program.exe (Windows) or dm_launch_server_config_
program.sh (UNIX and Linux) to launch the configuration program.
2. In the configuration options screen, choose Repository and click Next.
3. Type the installation owner password and click Next.
4. Choose Add a new repository and click Next.
5. Choose Use existing AEK key or Create new or update existing AEK key and click Next.

Caution: Changing the AEK key should be a planned activity since this is used for
multiple purposes such as encrypting all other keys, CNT files, passwords, other servers in
federation, and so on. Once the primary Content Server uses an upgraded key, all other
participating servers in the system which were using the old key should also start using the
new key. If the installer is used to upgrade the other servers, configuration updates and
copying of key is handled by the installer. However if this is done manually, you have to
modify server.ini and copy the key to all other systems. It is recommended to take a
backup of the old AEK key and CNT files.
a. If you choose Use existing AEK key, select the AEK or lockbox file for Select AEK file from
the list box.
i. If you select the AEK file, specify the following information:
AEK key name
AEK passphrase
ii. If you select a lockbox file, specify the following information:
AEK key name
AEK passphrase
Lockbox file name
b. If you choose Create new or update existing AEK key, specify the following information:
i. Select AEK algorithm
ii. AEK key name
By default, the name is CSaek.
iii. AEK passphrase

57
Installing Content Server

If you do not specify AEK passphrase, it takes a default passphrase for the AEK to
create. To upgrade a repository prior to 7.2 that is using a custom passphrase, run the
dm_crypto_boot utility. Use the following command:
dm_crypto_boot -passphrase <passphrase> -all
After running the command, invoke the installer and upgrade the repository.
iv. By default, Enable Lockbox is selected. Specify the following information:
Lockbox file name
Lockbox file name must have .lb as an extension.
Lockbox passphrase
Click Next.
6. Specify a Data directory path for storing content files and indicate whether it resides on a SAN
or NAS device.
The data directory must not be a top-level directory on a SAN or NAS device such as
\\x.x.x.x where x.x.x.x is the IP address. For SAN or NAS, enter the complete path including
a shared device. Here is an example of a valid data directory on a SAN or NAS device:
\\x.x.x.x\folder1\folder2.
The default data directory is $DOCUMENTUM/data.
Click Next.
7. Specify a share directory for storing client applications, code examples, and libraries.
The share directory can be on the Content Server host or on another host that Content Server
can access over the network.
If you specified a data directory that resides on a SAN or NAS device in the previous step, the
share directory is automatically created as a sibling on the same level as the data directory. For
example, if the data directory is \\x.x.x.x\Documentum\data where x.x.x.x is the IP address,
the following share directory is automatically created: \\x.x.x.x\Documentum\share.
The default share directory is $DOCUMENTUM/share.
Click Next.
8. Type the fully qualified domain name (FQDN) of the Content Server host computer and click
Next.
A fully qualified domain name specifies its exact location in the tree hierarchy of the Domain
Name System (DNS). For example, given a device with a local hostname myhost and a parent
domain name example.com, the fully qualified domain name is myhost.example.com.
9. Provide the following information for the repository:
Repository name: The name for a repository can have up to 32 characters, and must consist
of letter, numbers, or underscores (_). The first character must be a letter. All letters and
numbers in the name must be ASCII characters. Do not include spaces or non-alphanumeric
characters. The repository name docu is reserved by the system.
Repository ID: Valid repository IDs are shipped with the Content Server software. You
can also specify your own repository IDs. The repository ID can be any number from 1 to
16777215 and must not start with a zero (0). Each repository ID must be unique on the
network. You can request for additional repository IDs from the EMC support web site
(http://support.emc.com) to ensure that each of your repository IDs is unique.

58
 Installing Content Server

Description: Optionally, type a brief description of the repository.

Authentication domain: The default domain if the user does not specify a Windows domain
when connecting to the repository. Choose the domain with the largest number of users. The
configuration program automatically fills in this information.
Service startup type: On Windows, specify whether the repository service starts automatically
at startup or is started manually. If you use the key with a passphrase, manual option only is
available.
Click Next.
10. Provide the connection broker information and specify if you want to enable SSL certificates:
Connection Broker Port: Type the connection broker port number.
Connection Broker Host: Type the host name.
Use certificates: Select if you want to enable SSL certificates.
If Use certificates is selected, provide the DFC trust store information:
TrustStore: The location of the DFC trust store. For example, c\:/Documentum/dba/secure/
dfc.keystore
Password: The password of the trust store file.
Select Use Default Java TrustStore if you want to use the default DFC Java trust store.
Click Next.
11. Choose a connection mode for the repository:
Native: The client connects to the repository through a non-TLS/SSL port.
Secure: The client connects to the repository through a secure TLS/SSL port. The client and
the repository do not use TLS/SSL authentication to authenticate each other. However, the
information exchanged between the client and the repository is encrypted.
Native and Secure: The repository accepts both native and secure connection requests.
If you choose Secure or Native and Secure as the connection mode, the Use certificates option
will be visible.
Select Use certificates if you want to enable SSL certificates.
Note: You must select Use certificates if you had enabled SSL certificates while creating the
connection broker.
If selected, provide the following information:
Keystore file name: The name of the keystore file in the PKCS#12 format.
Keystore password file name: The password of the keystore file.
Cipher list
Note: The repository must use non-anonymous SSL if the connection broker uses non-anonymous
SSL.
Provide the DFC trust store information:
TrustStore: The location of the DFC trust store. For example, c\:/Documentum/dba/secure/
dfc.keystore
Password: The password of the trust store file.

59
Installing Content Server

Select Use Default Java TrustStore if you want to use the default DFC Java trust store.
Click Next.
12. Configure your relational database management system (RDBMS).
a. Choose whether to create a new database and a repository owner (database user with the
database owner role) or use existing ones.
b. Type or review the following information:
Data source name: The ODBC data source used to connect to the database server.
Administrator name and Administrator password: The database administrator account
has privileges to create and delete databases and perform other database administrative
tasks.
Database name: The name of the database Content Server uses to store content metadata
as well as system and repository information.
Repository Owner Account Name and Password: The database user account with the
database owner role that has read and write access rights to the database.
Click Next.
c. Configure the data file or data devices information: The configuration program automatically
fills in the information for Data device file path and Log device file path.
Click Next.
13. (Only for Windows) Provide the SMTP information:
SMTP server name: The name of the SMTP server or the IP address.
Owners email address: The installation owners email address that Content Server will
use for email notifications.
This is a required field. If a valid SMTP server host name is not available, enter an invalid one.
If the configuration program fails to connect to the SMTP server you provide, a warning is
displayed, but you can still proceed with the installation.
You can modify the SMTP server host name after installation.
Click Next.
14. Specify if you want to use the repository you just created as a global registry or to use another one:
Yes: Designates the repository just created as the global registry.
Type the Login name and Password information for the global registry user in the current
repository. Do not use the installation owner or the repository owner credentials.
Client applications and other repositories will use this login name and password to connect
to the global registry. Record the credentials so that you can provide this information when
installing other Documentum products that require global registry access.
No: The Specify whether to use another repository screen is displayed.
Yes: Designates an existing repository as the global registry.
Type the information about the repository you want to use as the global registry:
Connection Broker Host and Port
Select Use certificates if you want to enable SSL certificates.
The current repository will be configured to access the remote global registry.

60
 Installing Content Server

Note: You can change the global registry designation and edit connection information after
installation through Documentum Administrator or the dfc.properties file. The EMC
Documentum Content Server Administration and Configuration Guide contains the instructions
on enabling a repository as a global registry.
No: The global registry is not configured. You can manually add the global registry
through Documentum Administrator or the dfc.properties file.
15. Choose the modules you want to activate for the repository.
If you chose XML Store module, specify the following:
XML Store deployment mode to enable XML Store.
Set the xDB superuser password.
Provide the XML Store port and directory location.
Click Next.
16. Review the summary information and click Next.
17. Choose to perform additional configurations or finish configuration.
Note: Always click Finish to exit the Content Server configuration program; otherwise, you will
have to manually start the application server services.

Completing the installation

Reviewing Content Server installation and configuration

logs
Content Server Installer and configuration program both create log files. The log files are stored
in one of the following directories:
The installation owners desktop (Windows) or user home directory (UNIX or Linux)
The current working directory.
For Installer, the current working directory is the directory from which you started the program.
For the configuration program, the current working directory is typically $DM_HOME\install
(Windows, UNIX, and Linux).
The parent directory of the installation directory, if the installation owner does not have write
permission on the current working directory.
The users home directory, if the installation owner does not have write permission on the parent
directory.
The log filenames are install.log and UniversalServerConfigurator_Install_mm_dd_yyyy_hh_mm_ss.log.
Each script that runs during repository configuration creates a log file. These are stored in the
$DOCUMENTUM/dba/config/repository_name directory.
Content Server stores other log files in the $DOCUMENTUM/dba/log directory. After you install or
upgrade Content Server, examine the log file for the repository for error reports. The log is called

61
Installing Content Server

repository_name.log.save.date.time. repository_name is the name of the repository you created or

upgraded, and date and time are the date and time the log was saved.

Adding Java to the PATH environment variable

(Windows)
On Windows, you must manually add the path to the Java version installed with Content Server to
the PATH system environment variable. If this is not set correctly, custom Java methods executed by
the Java method server and the LDAP and federation jobs do not run correctly on the host.
During Content Server installation, Java is typically installed at $DOCUMENTUM/java64/version.
Add this to the PATH system environment value.

Enabling the purge audit job

The purge audit job deletes old audit trail objects from the repository. The job runs as the installation
owner. However, when a repository is created, the installation owner is not granted sufficient
extended privileges to run the job.
After you create a repository, create a new user with superuser privileges, connect as that user, and
grant the installation owner account Purge Audit extended privileges.

62
 Chapter 4
Post-Installation Tasks

After you have successfully installed Content Server, perform the tasks described in this chapter to
configure the system as required and get it up and running.
This chapter covers the following topics:
Configuring JBoss application server for SSL, page 63
Changing the connection mode from native to secure, page 65
Backing up keystore files, page 66
Changing the default passphrase, page 66
Binding Content Server to a network card, page 67
Installing Content Server client, page 67
Installing Content Server using an existing database account, page 67
Enabling xPlore search for new emails, page 68
Getting Started with Content Server, page 68

Configuring JBoss application server for SSL

Install the connection broker and Content Server in secure or native & secure mode. Once the Content
Server installation is complete, stop all the services (Content Server, connection broker, and JMS) and
proceed with configuration for Certificate-based SSL manually.
Note: Content Server installer does not support automatic configuration.

To configure the JBoss application server for SSL:

1. Build a keystore for JMS. The keystore must be in the JKS format. A new certificate must be
generated by exporting the keystore file. Ensure that the JMS certificate and the connection
broker certificate are imported into the SSL clients trust store.
2. Modify the standalone.xml in:
%JBOSS_HOME%\server\DctmServer_MethodServer\configuration\standalone.xml
For example, in standalone.xml, after
<subsystem xmlns="[urn:jboss:domain:web:1.1|urn:jboss:domain:web:1.1]"
default-virtual-server="default-host" native="false">

63
Post-Installation Tasks

add the following:

<connector name="https" protocol="HTTP/1.1" scheme="https"
socket-binding="https" secure="true"
<ssl name="https" password="password" certificate-key-file=
"c:/jms.keystore" cipher-suite="TLS_RSA_WITH_AES_128_CBC_SHA"/>
</connector>
Provide the keystore file path for certificate-key-file and password for password which you
have set for keystore.
Use the cipher-suite values depending on the following:
If you want to configure JMS in non-anonymous SSL mode, then cipher suite parameters are:
TLS_RSA_WITH_AES_128_CBC_SHA
AES256-SHA256
DHE-DSS-AES256-SHA256
DHE-DSS-AES256-SHA
Note: To use AES256 and SHA256 algorithms, ensure that you have the JCE Unlimited
Strength Jurisdiction policy files.
If you want to configure JMS in dual mode (anonymous and non-anonymous), then cipher
suite parameter is TLS_DH_anon_WITH_AES_128_CBC_SHA,SSL_DH_anon_WITH_3DES_
EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA.
3. Dump the dm_jms_config object and change the base_uri to point to the new URL:
API> retrieve,c,dm_jms_config
......080004d380000b1a
API> set,c,l,base_uri[0]
API> https://<content server host>:9082/DmMethods/servlet/DoMethod
API> save,c,l

4. Start the JMS.

The JMS starts successfully.

Supported communication configurations

This table contains the information on the supported communication configurations:

Content Server/Connection JMS Client

Broker/DFC
Non-anonymous Non-anonymous Non-anonymous
Anonymous Dual Non-anonymous
In case of a combination of JMS:
JMS1 and JMS2 can be configured for anonymous communication with Content Server.
JMS1 and JMS2 can be configured for non-anonymous communication with Content Server.
When using client such as Documentum Administrator, if JMS is configured for non-anonymous
SSL communication with Content server, you can find the dfc.security.ssl.use_existing_truststore
parameter in dfc.properties. If set to true, import all certificates (Content Server,
connection broker, and JMS) in default Java trust store on the client. If set to false, provide

64
 Post-Installation Tasks

the dfc.security.ssl.truststore and dfc.security.ssl.truststore_password parameters in

dfc.properties on the client and import all certificates (Content Server, connection broker,
and JMS) in DFC trust store.
Note:
The Distributed Content components (clients such as ACS, BOCS, and DMS) in anonymous
mode is not supported.
The following JMS and SSL mixed mode configurations are not supported:
JMS1 in non-anonymous SSL mode, JMS2 in anonymous SSL mode, and Content server in
anonymous SSL mode.
JMS1 in non-anonymous SSL mode, JMS2 in both (anonymous and non-anonymous) SSL
mode, and Content server in non-anonymous SSL mode.
JMS1 in non-anonymous SSL mode, JMS2 in native mode, and Content server in
non-anonymous SSL mode.

Changing the connection mode from native

to secure
You can change the connection mode from a native to a secure connection to enable SSL encryption
for traffic between DFC and Content Server. Follow the instructions in this section to change the
secure connection mode from native to secure connection to enable SSL at the Content Server level.

To change the connection mode from a native to a secure connection:

1. Update the dm_server_config object:
a. Connec to IAPI as installation owner.
b. Run the following commands:
API> retrieve,c,dm_server_config
(This command retrieves the object ID.)
API> dump,c,l
(Verify that the secure_connect_mode has changed to native by viewing the list.)
API> set,c,<objectID>,secure_connect_mode
SET> secure
API> save,c,l
API> dump,c,l
(Verify that the secure_connect_mode has changed to secure
by viewing the list.)

2. Update the dfc.properties file.

a. Navigate to the $DOCUMENTUM/config directory
b. Back up the original dfc.properties file.
c. Change the entry dfc.session.secure_connect_default=try_native_first to:
dfc.session.secure_connect_default=secure.
d. Save the dfc.properties file.
3. Update the docbroker.ini file.

65
Post-Installation Tasks

a. Navigate to the $DOCUMENTUM/dba directory.

b. Back up the original docbroker.ini file.
c. Change the entry secure_connect_mode=<blank> to:
secure_connect_mode=secure
d. Save the docbroker.ini file.
4. Restart Content Server.
Restart Documentum Master Service (from Services)
Wait until all Documentum services have started, (repository, connection broker, Java Method
Server and Master Service).
5. Verify that the connection broker (docbroker) and repository (docbase) are connecting to a secure
port.
a. Navigate to the $DOCUMENTUM/dba/logs directory.
b. View the connection broker and repository logs and verify that they have information about
secure port 1490.

Backing up keystore files

After you install the Content Server and repository, back up the keystore files, which are all the files
in the directory $DOCUMENTUM/dba/secure.
Take special care to back up and save the aek.key file in that directory. If the key becomes corrupted
and you do not have a backup, your repository cannot be started, and you cannot access encrypted
files.
When using Remote Key Management, the external keystore must also be backed up so that it can
be restored in event of a system failure or data corruption. Backing up the external keystore is a
best practice and must be done in addition to backing up the aek.key file. The RKM product
documentation contains the instructions and details on creating a backup of the external keystore.

Changing the default passphrase

During Content Server installation, a keystore is created that contains a passphrase that is used for
encryption. After installation, you can change the default passphrase to a custom passphrase. If you
create a custom passphrase after Content Server installation, any time you restart the server host,
you need to run the dm_crypto_boot utility. The EMC Documentum Content Server Administration and
Configuration Guide contains the instructions and details on encryption, keystores, and passphrases.

66
 Post-Installation Tasks

Binding Content Server to a network card

To configure Content Server to use a different network card, create an initialization file for the
connection broker. The file must include a [DOCBROKER_CONFIGURATION] section to identify the
IP address of the network card. Use the following format:
[DOCBROKER_CONFIGURATION]
host=IP_address_string
service=service_name
port=port_number

IP_address_string is the IP address of the network card.

The service name is the connection brokers service name, defined in the hosts services file. The
port number is the port defined in the service.
If you include a service name, the connection broker starts by using that service.
If you include a port number, the connection broker starts by using that port.
If you do not include a service name or a port number, the connection broker uses the default port
number 1489. If you are using the default port number, ensure that the next port number (1490) is
available for use because the connection broker requires that two ports be reserved.
The EMC Documentum Administrator online help contains more details on binding Content Server to
a network card.

Installing Content Server client

Install the following Content Server client applications:
Documentum Administrator, the primary web-based administrative client tool for configuring
and administrating Content Server and repositories
The EMC Documentum Administrator Deployment Guide contains the installation instructions.
Documentum Webtop, a web-based client application for accessing and managing content in
the repository
The EMC Documentum Web Development Kit and Webtop Deployment Guide contains the installation
instructions.

Installing Content Server using an existing

database account
When you choose the option to use an existing database account while configuring repository, you
can proceed only if you have a Database Administrator account.

67
Post-Installation Tasks

If you cannot provide the Database Administrator account at this stage, you can perform these actions
after the repository configuration is complete:
Create the Data Management System (DMS) user in the database instance.
Grant the DMS user permissions to access the DMS schema tables.

Enabling xPlore search for new emails

To enable the xPlore search for emails imported using MailApp.dar, perform the following:

1. Run the following query in the repository:

ALTER ASPECT mdmo_message_aspect FULLTEXT SUPPORT ADD ALL

2. Stop the xPlore service in the index machine.

3. Clear the BOF cache at <xPlore Home>\<JBoss version>\server\DctmServer_
Indexagent\data\Indexagent\cache\content_server_version\bof\repository_
name.
4. Start the xPlore service in the index machine.
5. Start the indexing using Documentum Administrator.

Getting Started with Content Server

Starting/stopping Content Server on Windows

On Windows systems, you start and stop connection brokers and repositories from the Server
Manager tool.

To start Content Server on Windows:

1. From the Windows Start menu, choose All Programs >Documentum > Documentum Server
Manager.
2. Under the DocBroker tab, choose a connection broker and click Start.
3. Under the Repository tab, choose a repository and click Start.
4. Start the application server service.
a. Click Start > All Programs > Administrative Tools > Services.
b. In the Services dialog box, scroll to Documentum Java Method Server.
c. Right-click Documentum Java Method Server and click Start.

To stop Content Server on Windows:

1. Stop the application server service.

68
 Post-Installation Tasks

a. Click Start > All Programs > Administrative Tools > Services.
b. In the Services dialog box, scroll to Documentum Java Method Server.
c. Right-click Documentum Java Method Server and click Stop.
2. From the Windows Start menu, choose All Programs > Documentum > Documentum Server
Manager.
3. Under the Repository tab, choose a repository and click Stop.
4. Under the DocBroker tab, choose a connection broker and click Stop.

Starting/stopping Content Server on UNIX and Linux

To start Content Server on UNIX and Linux:
1. Start the connection broker by running $DOCUMENTUM/dba/dm_launch_docbrokerName,
where docBrokername is the name of the connection broker.
2. Start the repository by running $DOCUMENTUM/dba/dm_start_serverconfigname, where
serverconfigname is the object name of the Content Server server config object, which consists of
the host name and the repository name.
3. Start the application server by running
$DOCUMENTUM/<JBoss version folder>/server/startMethodServer.sh.
Note: To ensure that JMS continues to work even on terminal closure, use the standard UNIX
background process execution procedure, such as using nohup as prefix and "& as the suffix to the
command. For example: nohup startMethodServer.sh &

To stop Content Server on UNIX and Linux:

1. Stop the application server by running
$DOCUMENTUM/<JBoss version folder>/server/stopMethodServer.sh.
2. Stop the repository by running $Documentum/dba/dm_shutdown_serverconfigname, where
serverconfigname is the object name of the Content Server server config object, which consists of
the host name and the repository name.
3. Stop the connection broker by running $Documentum/dba/dm_stop_docbrokerName, where
docBrokername is the name of the connection broker.

69
Post-Installation Tasks

70
 Chapter 5
Installing Content Server and
Java Method Server (JMS) for
High-Availability (HA)

If you want to install Content Server and Java Method Server for high-availability, follow the
instructions in this chapter to implement the system.
This chapter covers the following topics:
Content Server and JMS HA overview, page 71
Content Server HA configuration, page 72
Configuring Content Servers for HA, page 73
JMS HA configurations, page 75
Content Server and JMS HA considerations, page 76
Installing and configuring Java Method Server in HA mode, page 77
Synchronizing time between remote JMS hosts and Content Server hosts, page 81
Viewing and modifying JMS instances, page 81
Best Practices for configuring connection brokers and JMS for HA, page 82

Content Server and JMS HA overview

Content Server and Java Method Server (JMS) each support high-availability (HA). Content Server
supports two HA types: failover and load balancing. JMS supports failover only.
Failover
In a failover setup, if one of the Content Servers fails, the other Content Servers in the failover
setup continue with the service.
Load balancing
Load balancing involves operating redundant Content Servers where the service load is balanced
between Content Servers to maximize performance. In a standard Content Server load-balancing
scenario, proximity values are used to determine which Content Server processes an item. In a
cluster scenario, third-party load-balancers are used.

71
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

JMS is a customized version of an application server for executing Content Server Java methods. EMC
Documentum provides a servlet called DO_METHOD to execute Documentum server methods.
The method server itself is a Java-based web application. It communicates with the Content Server
via HTTP calls. Each time a method is invoked, the Content Server makes an HTTP request passing
the name of the Java class which implements the method along with any specified arguments to a
servlet which knows how to execute the specified method.
Technically, all EMC Documentum Java server methods are simple Java classes. JMS runs as an
independent process. You can stop or start the process without recycling Content Server. On
Windows platforms, the JMS can be run as a Windows service or as a process.
Before JMS can support HA, Content Server must be in a standalone HA configuration first.
You can also install additional private JMS instances. Before you can install additional JMS instances,
you must package all the web applications previously deployed to the default embedded JBoss
application server with the jmsPackage.bat batch file. You then deploy that file to the new JMS to
maintain consistency between the two JMS instances.
Additionally:
The default Java Method Server for a remote Content Server (RCS) does not participate in JMS
failover.
A JMS node must be bound to a Content Server host and cannot be installed on a standalone
independent machine.
JMS load balancing is not supported. A single Content Server cannot be explicitly associated to
multiple Java method servers.

Content Server HA configuration

Figure 7, page 72 depicts a fully redundant HA system, including Content Server, connection brokers,
JMS, full-text indexing system, and applications serving multiple repositories with a third-party
cluster load balancer. Third-party load balancers are only supported on clusters, not on standard
Content Server HA. The figure illustrates an HA system built on the EMC Documentum platform.
Each box in the diagram indicates a system component that can be installed on its own host. Dotted
lines in the diagram indicate those system components (application servers, content stores, database
and database stores) for which third-party products provide HA through clustering. HA for the rest
of the components is provided through EMC Documentum processes. The figure shows Content
Server HA in the form of clusters using third-party load balancer.

Figure 7. Content Server HA configuration

If a repository serves many users, having multiple servers can provide HA and enhance performance.
You can also dedicate one server to a particular application or group of users and have other servers
available to everyone. High availability provides those options. The servers used for load balancing
must project identical proximity values to any given connection broker. In that way, when a DFC
client determines which server, it will randomly pick one of the servers. If the values are different, the
DFC client will always choose the server with the lowest proximity value. If a Content Server stops
and additional servers are running against the repository with proximity values less than 9000, the

72
 Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

client library, with a few exceptions, will gracefully reconnect any sessions that were connected to
the stopped server to one of those servers. The exceptions are:
If the client application is processing a collection when the disconnection occurs, the collection is
closed and must be regenerated again when the connection is reestablished
If a content transfer is occurring between the client and server, the content transfer must be
restarted from the beginning
If the client had an open explicit transaction when the disconnection occurred, the transaction was
rolled back and must be restarted from the beginning
If the additional servers known to a sessions connection broker do not have the same proximity
value, the client library will choose the next closest server for failover. Sessions cannot failover to
a Content Server whose proximity is 9000 or greater. Content Servers with proximity values set
9000 or higher are called remote Content Servers, usually located at remote, distributed sites.
Note: A client session can only fail over to servers that are known to the connection broker used
by that session. To ensure proper failover, ensure that Content Servers project to the appropriate
connection brokers and with appropriate proximity values.

Configuring Content Servers for HA

The following instructions assume an HA configuration of two Content Servers for load balancing.
The first Content Server, CS1, is the primary server, and the second Content Server, CS2, is the
secondary Content Server.

Figure 8. Load balancing configuration

CS1 and its repositories are installed and configured like any Content Server repository configuration.
CS2 is installed as usual and is configured using the CFSConfiguration utility. This program is
used to configure the content-file server and the remote Content Server. This utility creates the
second server configuration object, and copies the required files such as aek.key, dbpasswd.txt,
server.ini, webcache, and so on.
To achieve load balancing and failover, you must ensure that the following criteria are met before
starting the setup process:
The Content Servers must share the Content Storage. Content Storage must not be distributed.
Proximities must be identical.
Use the CFSConfiguration utility to install additional instances of Content Server.
The process of setting up Content Servers for load balancing and fail-over includes the following tasks:
1. Installing Content Server on CS1.
2. Configuring the repository on CS1.
3. Installing Content Server on CS2.
4. Running the CFSConfiguration utility on CS2.

73
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

The CFSConfigurtation Utility installs Content Servers with a proximity value of 9000 or more.
Proximity decides the distance between the connection broker and the server. Proximity must be less
than 9000 to achieve failover. Proximity values of the connection broker must be equal to achieve load
balance. If the servers have identical proximity values, clients pick one of the servers, randomly. If the
proximity values are different, clients will always choose the server with the lowest proximity value.
Requirements for load balancing Content Server and configuring fail over on the server are as follows:
The database client software must be installed on the content-file server hosts.
The values used on the primary and remote hosts for database connectivity must be identical and
must be valid on the remote hosts.
Content Server and the file store must be in the same domain. The installation user account of
Content Server must be available on the domain.
The installation user account must have full access control to the file store.
Ensure that the installations of the primary and secondary servers are completed by a domain
user account.

To configure Content Servers for HA:

1. Install CS1 and configure the connection broker and the repository on CS1.
CS1 and its repositories are installed and configured like any Content Server repository
configuration. Both Content Severs must share the same content storage. So, content storage
must be shared and not distributed. Ensure that you choose a network location for the content
storage while installing the first Content Server. Do not choose local storage because additional
Content Servers will not be able to access it. If you forget to choose the network location for
content storage, you must choose the network location for content storage separately later for
each dm type or custom type.
2. Install the Content Server software on CS2.
Install Content Server on CS2. Provide the host name and port number of the existing primary
connection broker and select Configure server later at the end of the installation.
3. Configure the connection broker on CS2.
4. Configure content file server on CS2. Run the CFSConfiguration utility.
5. Type the password of the installation owner and click Next.
6. Type the hostname of the primary connection broker for the repository and verify or type the port
number on which the connection broker listens, and click Next.
Note:
When CS1 and CS2 are on different hosts and the Content server is configured for HA,
if the repository is configured for Certificate-based mode then you need to manually
copy all the certificates and the password files from CS1 to CS2 and place it under
$DOCUMENTUM/dba/secure in the CS2 host.
The maximum number of characters for primary connection broker host name is 59.
7. Choose the repository for which you are installing the content-file server and type the username
and password for a super user in that repository, and click Next. The super user is the primary
Content Servers installation owner.

74
 Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

8. Browse to select a UNC path to store data. Use the same path as the Content Server installation
path. You must use the network location such as \\celerra\cs-fs1\data instead of using
the local data directory. Otherwise, problems can occur when one of the servers goes down,
and users try to access content files.
9. Accept the default location of the share directory or browse to a different location and click Next.
The share directory comprises clients, example code, and required libraries.
10. Accept the default service name for the new content-file server or type a different name and
click Next.
Note: The maximum number of characters for service name is 31.
11. This screen appears if there is no global registry information in the dfc.properties file.
If the repository being configured is the global registry, enter the global registry user name and
password; Otherwise, type the connection broker information first and then type the global
registry name, global registry user name and password.
12. Click Finish. The content-file server is configured and running.
13. In server.ini change the proximity to less than 9000 and identical to the first Content Server.
In general you can select 1.
14. On the client side, add the connection broker information of both Content Servers in the
dfc.properties file.
15. On the server-side, register both Content Servers with both the connection brokers. This is
important to achieve failover. Add the second connection broker host and port in server.ini
on the primary Content Server host.
16. To start the application server instance that is running the Java method server and Content Server:
On Windows, start the Documentum Java Method Server service.
On UNIX and Linux, run startMethodServer.sh.

To verify failover:
1. On a client computer, ensure that the dfc.properties files entries refer to both the connection
broker and hosts IP.
2. On a server computer(s), ensure the server.ini files entries refer to both connection broker
and proximity.
3. Stop CS1. Ensure that DFC client application connects through other CS2 (running).
4. Stop CS2 and start CS1. Ensure that DFC client application connects through CS1 (running).

JMS HA configurations
JMS supports the following HA configurations:
Content Server and JMS on a single host
Content Server and JMS on two hosts
Content Server and JMS on multiple hosts

75
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

Content Server HA deployment involves two or more Content Servers. JMS HA involves adding
JMSs to additional Content Servers such that each Content Server has a dedicated JMS. JMS HA is
automatically enabled by associating each Content Server with their dedicated JMS.

Content Server and JMS on a single host

Figure 9, page 76 depicts two Content Servers and their embedded instances of JMS set up on a
single machine, serving one repository.

Figure 9. Content Server and JMS HA on a single host

When installing the first Content Server, JMS is installed by default. When adding a Content Server
on same host, the JMS for the second Content Server is not installed. Instead, it shares the JMS of the
first Content Server. When creating a second Content Server on same host, add the second Content
Server configuration to jms_config.

Content Server and JMS on two hosts

Figure 10, page 76 depicts two Content Servers and two instances of JMS set up on two machines,
serving one repository. In this configuration all jms_config objects are automatically configured
for HA.

Figure 10. Content Server and JMS HA on two hosts

Content Server and JMS on multiple hosts

Figure 11, page 76 depicts multiple Content Servers and multiple instances of JMS set up on multiple
machines, serving one repository. In this configuration, during failover, JMS requests are distributed
in a round-robin fashion to the remaining failover nodes.

Figure 11. Content Server and JMS HA on multiple hosts

Content Server and JMS HA considerations

Choose an HA configuration based on available hardware and your business needs. An HA solution
provides both HA and enhanced performance. Use it when the system availability is critical or
Content Server performance is important or both.

76
 Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

The high availability solution improves performance in general. A load-balancing HA model can
improve performance and availability, but it might require additional resources. A failover HA
model enhances availability.
If the performance bottleneck is somewhere other than on Content Server, for example, in disk access
or WDK applications, adding more Content Servers will not improve performance significantly.
Content Server and JMS HA is supported on all operating systems that Content Server supports. The
EMC Documentum Environment and System Requirements Guide contains the details on supported
operating systems.

Planning the system size

The system sizing spreadsheet is provided to assist with system planning and sizing. It focuses
primarily on sizing deployments of the standard Documentum Editions. The spreadsheet
automatically provide estimates of hardware resource needs based on user and hardware profiles
provided. You can use this spreadsheet as an aid to size a Documentum deployment. This
spreadsheet is available from the EMC Support Site within a few weeks after product release. You
can download the EMC Documentum System Sizing Tool document from the EMC Online Support
(https://support.emc.com).

Installing and configuring Java Method Server

in HA mode
This section details how to install and configure JMS in HA mode.

Installing and configuring JMS for HA on a single host

Installing and configuring JMS HA involves several major steps:
Installing and configuring the main Content Server
Adding secondary Content Servers
Preparing JMS for HA and verifying the dm_jms_config objects setup
Adding additional JMS
Verifying the JMS HA installation and configuration
The following graphic shows a single JMS connected to two Content Servers on a single host
supporting one repository to two JMS instances each connected to its own Content Server, both
Content Servers on a single host supporting one repository.

Figure 12. Installing and configuring JMS for HA on a single host

77
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

To install and configure the main Content Server:

1. Install the main Content Server. Chapter 3, Installing Content Server contains the instructions.
2. After the installation completes, run the Content Server configuration program. The Content
Server Configuration program guides you through creating a repository.
The installation of the main Content Server also installs an instance of JMS. A single
dm_jms_config object for that instance of JMS is created in the repository.

To add secondary Content Servers:

1. Run cfsConfigurationProgram.exe (Windows) or dm_launch_cfs_server_
config_program.sh (UNIX and Linux) in $DM_HOME/install.
2. Provide the appropriate information when prompted to do so by the program.
3. When you are being prompted for the service name, choose a service name that is different from
that of the primary Content Server.

To prepare the JMS for HA and to verify the dm_jms_config objects setup:
By default the CFS configuration program would install Content Server as a remote Content
Server (RCS) and set its projection to the connection broker to have proximity values of 9001 and
9010. However, JMS HA at present does not support RCS configurations, so you need to make the
following changes manually:
1. Locate the server.ini file. This file is typically located in /Documentum/dba/config/<repository_
name>/server_<machine_name>_<service_name>.ini.
2. Modify the DOCBROKER_PROJECTION_TARGET for a single host setting: Comment out the
second set of settings, and the proximity value of the first set. The default proximity value will
then be 1. For example:
[DOCBROKER_PROJECTION_TARGET]
host = cshost1
port = 1489
#proximity=9001

[DOCBROKER_PROJECTION_TARGET_1]
#host =
#port =
#proximity =

#host=cshost1
#port=1489
#proximity=9010

3. Restart Content Server

4. Use Documentum Administrator to disassociate CS2 from JMS 1.
The EMC Documentum Administrator User Guide contains more information.
Note: You can also disassociate CS2 from JMS1 using IAPI commands.

To add Java Method Servers:

1. Package the Java Method Server.

78
 Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

Run jmsconfig.exe (Windows) or jmsconfig.sh (UNIX and Linux) in

$DOCUMENTUM/jmsTools/bin and choose Package only, and then follow the instructions
on the screen to complete the packaging process.
2. Configure the Java Method Server.
Run jmsconfig.exe (Windows) or jmsconfig.sh (UNIX and Linux) in
$DOCUMENTUM/jmsTools/bin and choose JMS config, and then follow the instructions on
the screen to complete the configuration process.
Note:
In the Application Server Credentials screen, note that a total of 20 ports, starting from the
one you specify, will be reserved for use by the application server, and all of them must be
available.
After adding the Java Method Server to the repository, each jms config object should be
configured to serve its respective Content Server.
3. Use Documentum Administrator to associate CS2 from JMS 2
The EMC Documentum Administrator User Guide contains more information.
Note: You can also associate CS2 to JMS2 with the proximity value as 1 using the IAPI commands.
Retrieve the JMS configuration using the IAPI query:
?,c,select r_object_id, server_config_id,
projection_proximity_value, object_name from dm_jms_config

Installing and configuring JMS for HA on multiple hosts

Installing and configuring JMS HA involves several major steps:
Installing and configuring the main Content Server
Adding Content Servers
Preparing JMS for HA and verifying the dm_jms_config objects setup
Adding additional JMS
Verifying the JMS HA installation and configuration
The following graphic shows two embedded JMS instances, each connected to its own Content
Server on a two hosts supporting one repository to two JMS instances set up for HA with Content
Servers on two hosts supporting one repository.

Figure 13. JMS instances configured for HA on two hosts

The following graphic shows an upgrade from multiple embedded JMS instances, each connected to
its own Content Server on multiple hosts supporting one repository to multiple JMS instances set up
for HA with Content Servers on multiple hosts supporting one repository.

Figure 14. JMS instances configured for HA on multiple hosts

79
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

To install and configure the main Content Server:

1. Install the main Content Server. Chapter 3, Installing Content Server contains the instructions.
2. After the installation completes, run the Content Server configuration program. The Content
Server Configuration program guides you through creating a repository.
The installation of the main Content Server also installs an instance of JMS.

To add Content Servers:

1. On multiple hosts, install the main Content Server. Chapter 3, Installing Content Server contains
the instructions.
2. On Windows, run $DM_HOME\install\cfsConfigurationProgram.exe as the installation
owner; on UNIX and Linux, run $DM_HOME/install/cfsConfigurationProgram.bin
as the installation owner.
3. Provide the appropriate information when prompted to do so by the program.
4. When you are prompted for the service name, EMC recommends that you choose a service name
that is different from that of the primary Content Server.

To prepare the JMS for HA and to verify the dm_jms_config objects setup:
By default the configuration program would install Content Server as a remote Content Server (RCS)
and set its projection to the connection broker to have proximity values of 9001 and 9010. However,
JMS HA at present does not support RCS configurations, so you need to make the following changes
manually:
1. Locate the server.ini file. This file is typically located in /Documentum/dba/config/<repository_
name>/server_<machine_name>_<service_name>.ini.
2. Modify the DOCBROKER_PROJECTION_TARGET for a single host setting: Comment out the
second set of settings, and the proximity value of the first set. The default proximity value will
then be 1. For example:
[DOCBROKER_PROJECTION_TARGET]
host = cshost1
port = 1489
#proximity=9001

[DOCBROKER_PROJECTION_TARGET_1]
#host =
#port =
#proximity =

#host=cshost1
#port=1489
#proximity=9010

3. Restart Content Server

4. To verify that the dm_jms_config objects in the repository were set up correctly, use the JMS
Admin panel in Documentum Administrator.
There will be two dm_jms_config objects.
5. Use the Documentum Administrator to associate the second JMS with the second Content Server.

80
 Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

The EMC Documentum Administrator User Guide contains more information. The EMC
Documentum Content Server Administration and Configuration Guide contains the information on the
incremental_jms_wait_time_on_failure and jms_max_wait_time_on_failures keys.

Synchronizing time between remote JMS hosts

and Content Server hosts
You must synchronize the date and time between the remote host and the Content Server host, or you
will not be able to authenticate connections between them. Do one of the following:
Set the Content Server host and the remote host system date/time to the same values.
Add the environment variable: CLIENT_AUTH_SIG_THRESHOLD to the start logic for the
remote JMS. Set this environment variable to the number of allowable seconds that the JMS
date/time may differ from the Content Server date/time. The default value, if the environment
variable is not set, is 1800 seconds (30 minutes).

Viewing and modifying JMS instances

Using Documentum Administrator

Use Documentum Administrator to perform the following JMS configuration tasks:
Viewing and updating JMS instances. Updating JMS instances is limited to associating and
disassociating JMS instances to and from Content Servers.
Associating additional Content Servers with JMS instances
Reset Content Server memory cache about JMS availability
View Content Server cache memory about JMS availability
The EMC Documentum Administrator User Guide contains the details on how to perform these tasks.

Using Apply methods

Use the REFRESH_JMS_CONFIG_LIST RPC in the Apply method to refresh the connected Content
Servers cache. Use the DUMP_JMS_CONFIG_LIST RPC in the Apply method to provide the list of
JMS configured for the current Content Server.
In a multi-server-single-repository environment, issuing REFRESH_JMS_CONFIG_LIST RPC call on
one Content Server will only refresh that connected Content Servers cache. It does not refresh other
Content Servers cache. To force the refresh of a target Content Servers JMS configuration list kept in
its cache, REFRESH_JMS_CONFIG_LIST RPC call must be issued from within a connected session
(an established session to the target Content Server).
Use the following syntax:

81
Installing Content Server and Java Method Server (JMS) for High-Availability (HA)

API> apply,c,NULL,REFRESH_JMS_CONFIG_LIST
API> apply,c,NULL,DUMP_JMS_CONFIG_LIST

Best Practices for configuring connection

brokers and JMS for HA
Use the following best practices to configure connection brokers and JMS for high-availability
environments:
Create at least two public connection brokers for application serversone primary and one
backup. Project all Content Servers to these connection brokers so that they are all visible and
accessible to all application servers. When projecting Content Servers to the connection brokers,
set the same proximity value for the connection brokers in the server.ini file so that workload
will be evenly balanced across all the Content Servers. Note that the proximity value must be less
than 9000 for failover or load balancing to work.
When configuring the internal connection brokerconnection broker that runs on the same host
as the Content Serverset the proximity value to 1 (the default) so that local jobs and methods
will always run locally on that server rather than get distributed to other hosts. This way, internal
operations are executed faster with increased performance.
You can optionally distribute local job and methods to other internal connection brokers. To
do this, project the Content Server to all other internal connection brokers with the proximity
value of 2 so that when the local server is unavailable or overloaded, operations will be evenly
distributed to other servers.
In the Content Server dfc.properties file, just register the internal connection broker.
For some jobs that need to run on a particular server, configure the Java Method Servers Location
parameter rather than configure connection brokers.
To address JMS failovers, configure JMS rather than connection brokers. If a JMS is down, the
affected Content Server will route its method calls to other Content Servers if JMS is properly
configured.
If JMS methods need to access multiple repositories, you must include public connection brokers
in the JMS dfc.properties file.

82
 Chapter 6
Installing Content Server with Microsoft
Cluster Services

This chapter describes how to install and configure Content Server to provide failover support under
Microsoft Cluster Services.
This chapter covers the following topics:
Microsoft Cluster Services overview, page 83
Choosing a configuration, page 84
Pre-installation requirements, page 84
Configuring an active/passive cluster, page 85
Configuring an active/active cluster, page 89

Microsoft Cluster Services overview

Microsoft Cluster Services supports the following forms of clustering:
Active/passive clusters
In active/passive clustering, the cluster includes active nodes and passive nodes. The passive
nodes are on standby and are only used if an active node fails. In active/passive clusters, both
nodes support the same repository.
Active/active clusters
In active/active clusters, all nodes are active. One node is considered the primary node, and the
other node is considered the secondary node. If one node fails or is taken offline, the remaining
node takes on the additional processing operations. In active/active clusters, each node supports a
different repository.
In a cluster environment, every service that the cluster runs uses resources of the cluster node. Every
service has its own resources, such as hard drive, IP address, and network name, assigned to it. All
resources that a clustered service uses form a resource group. The connection broker and Content
Server are a part of this resource group. In a cluster, all resources form a virtual server that can move
from one physical server to another to provide failover support.
Note: Lockbox needs to be configured on Content Server depending on how Microsoft Cluster
Services is setup. The EMC Documentum Content Server Installation Guide and EMC Documentum
Content Server Administration and Configuration Guide contains detailed information.

83
Installing Content Server with Microsoft Cluster Services

Choosing a configuration
A Content Server installation supports two types of cluster service configurations:
active/passive
active/active
This chapter provides detailed installation instructions for both configurations. Choose the
configuration based on available hardware and your organizations business needs. The figure
illustrates Content Server and connection broker setup in an active/passive cluster.

Figure 15. Active/passive cluster

In an active/passive configuration, both nodes support the same repository. Content Server and
connection broker run on the primary node. If the primary node fails, the secondary node that was on
standby takes ownership of the resource group. After the cluster resources are brought online on the
secondary node, the connection broker and Content Server start on the secondary mode.
In an active/active configuration, each node supports a different repository. Each node is considered
the standby to the other node. Each node owns its own resource group. Each resource group has its
own virtual IP address, a virtual host name, shared disk, connection broker, and Content Server. The
figure illustrates Content Server and connection broker setup in an active/active cluster.

Figure 16. Active/active cluster

If a node fails or is taken offline, its resource group is moved to the remaining node in the cluster.
The remaining node then manages two resource groups. When the failed node is running again, the
cluster administrator can move one resource group back.
If you switch the content transfer from one node to the other during a content transfer operation,
it fails. This occurs because ACS may not be available on the second node to perform the content
transfer. If a subsequent content transfer operation is done, the content transfer takes place through
the Application Server (for example, Webtop) and is expected to succeed. If there are issues in
transferring large files, configuration changes may be required. The EMC Documentum Content Server
Distributed Configuration Guide contains more information.

Pre-installation requirements
Before you install and configure Content Server and a repository under Microsoft Cluster Services,
read Chapter 2, Pre-Installation Requirements and Tasks and perform the preinstallation tasks.
Whether you are configuring an active/passive cluster or an active/active cluster, set up the shared
disks to be used by the repositories. Ensure that the shared disks include a directory to use for
content storage.
If you are configuring an active/active cluster, the user who configures Microsoft Cluster Services
must have read and write permissions on both nodes on the directories where the connection broker
logs reside.

84
 Installing Content Server with Microsoft Cluster Services

Configuring an active/passive cluster

Follow these procedures to configure an active/passive cluster and install servers and a Content
Server.
Note: When setting up an active/passive cluster in a Windows cluster environment, configuration
of a repository on the second cluster node can fail if you are using different aek.key files and
dbpassword.txt files for each node. In active/passive cluster configuration, both the primary and
secondary node must have the same aek.key file (located in \Documentum\dba\secure) and
dbpasswd.txt (located in \Documentum\dba\config\docbase_name). When creating the
environment manually copy the two files from the primary node to the secondary node.

Creating the cluster resource group

Use this procedure to set up the cluster resource group.

To create the cluster resource group:

1. Use the MSCS Cluster Administrator utility to create a cluster resource group that contains the
following resources:
A virtual IP address
Content Server uses this IP address. Other products can share the IP address because the
connection broker and Content Server only listen on particular ports.
A virtual network host name
The virtual network host name is for the virtual IP address.
A shared disk partition
This is the location of the repository data directory, where content files are located.
2. Move the resource group between the primary and standby hosts to ensure that the virtual IP
address, virtual network host name, and shared disk partition fail over properly.
a. In the Cluster Administrator, right-click the cluster group name.
b. Click Move Group.
The resource group is toggled between the hosts and the owner name changes.
3. Ensure that the first node owns the resource cluster group.

Installing Content Server software on the nodes

The first part of the installation process copies files from the installation media to the hard disk. On
each of the two nodes, copy the files from the installation media to create a Content Server installation
on each node. Use the same drive letter on each node for the installation.

85
Installing Content Server with Microsoft Cluster Services

Configuring Content Server

The second part of the installation involves configuring Content Server and its associated connection
broker, which includes configuring them for Microsoft Cluster Services.

To configure Content Server on Node1:

1. Move the cluster control to Node1.
2. Extract the installation files, launch serverSetup.exe and install Content Server on Node1.
3. Configure the connection broker and repository on Node1. The Installing Content Server, page
54 section contains the instructions.
Note: Specify the location of the Data folder which will be the location of your file stores. It is
recommended that this folder be on a shared drive on the Microsoft Cluster setup or on a shared
drive accessible to both the nodes.

To configure Content Server on Node2:

1. Turn off the connection broker and repository services on Node1 and move the cluster control
to Node2.
2. On Node2, follow the steps used on Node1 using the same Repository name and Repository
ID as in Node1.
3. In the Select Database and Server Account screen, choose Use existing SQLServer user account
and database to use the database created earlier.
4. Installer prompts you to enter the details of the existing database. Type the details.
5. Type the information of the SMTP server and the repository owners email address. Type the
same details which were provided in Node1.
6. Choose the same optional modules selected on Node1.
7. If you have selected the RSA Key Manager option in the previous menu, then Installer prompts
you for the RKM details in the next few screens. Type the same details used earlier.
8. Installer proceeds with the connection broker configuration and an error message is shown due
to failure to connect to the repository. At this stage stop the installation.
9. Now turn off all the connection broker and repository services on Node2. Copy the
$DOCUMENTUM\dba\secure\aek.key and $DOCUMENTUM\dba\config\repository_
name\dbpasswd.txt files from Node1 to corresponding locations on Node2.
10. If you have configured the repository with RKM then you also need to copy the files rkm_config.
ini, client_reg_rkm.cfg, rkm_svc.cfg, rkmcachepasswd.txt, rkmclientcert.p12,
rkmpasswd.txt and rkmrootcert.pem from $DOCUMENTUM\dba\config\repository_
name> on Node1 to $DOCUMENTUM\dba\config\repository_name> on Node2. Restart the
repository on the Node2 and check the logs to ensure it has started successfully.
11. To configure more nodes, move the cluster control to that node and follow steps on Node2.
Note: If lockbox is enabled, copy all the lockbox related files from Node1 to Node2 and then run the
dm_crypto_boot and dm_crypto_create commands to enable lockbox work on Node2.

86
 Installing Content Server with Microsoft Cluster Services

The setup of connection broker and repository configuration on two nodes required for the purpose
of using Microsoft Cluster Services for failover is complete.

Configuring the connection brokers

You need to configure the connection brokers on both nodes to listen on the virtual network host.

To configure connection brokers:

1. Click Documentum > Documentum Server Manager to start Server Manager.
2. Click Docbroker, then click Edit Service.
3. Add the following line to the service command:
-host virtual_network_host_name
For example, if the virtual network host name is dmcluster1:
-host dmcluster1
Click OK.
4. Highlight repository and click Edit server.ini.
5. Edit the DOCBROKER_PROJECTION_TARGET section of the server.ini file:
[DOCBROKER_PROJECTION_TARGET]
host=virtual_network_host_name

6. Save the server.ini file.

7. Navigate to C:\Documentum\config and open the dfc.properties file in a text editor.
8. Edit the primary connection broker entry of the dfc.properties file:
For example:
dfc.docbroker.host[0] = dmcluster1

9. Save the dfc.properties file.

10. Repeat this procedure on the other node.

Creating additional cluster resources on Microsoft

Cluster Services
Use this procedure to create cluster resources for the connection broker and Content Server. Perform
the procedure only on the node that presently owns the existing resource group.

To configure the connection broker and repository for failover:

1. Navigate to Administrative Tools > Failover Cluster Management. The Failover Cluster
Management console is displayed.
2. Right-click the services node and choose the service you created. The High Availability Wizard is
displayed.

87
Installing Content Server with Microsoft Cluster Services

3. Choose Generic Service to configure for high availability and click Next. The Select Service
screen is displayed.
4. Choose the Documentum Docbroker Service connection broker service from the list, proceed
with the wizard and complete configuring the connection broker and repository for failover.
5. Right-click the new service, and choose Properties. The Properties dialog box for the service is
displayed.
6. In the General tab, choose NODE1 and NODE2 in the Preferred owners list. Click OK.
7. Right-click the Documentum Docbroker Service connection broker service, and choose
Properties. The Properties dialog box is displayed.
8. In the General tab, ensure that the Use Network Name for computer name option is selected
by default, and click OK.
9. Right-click the Documentum Docbroker Service connection broker service in the console, and
choose the Bring this resource online option. The resource is brought online and the Online icon
is displayed in the Status column of the Summary screen.
10. Right-click the configured service, choose Add a resource > Generic Service. The New Resource
Wizard dialog box is displayed.
11. Choose Documentum Docbase Service in the Select Service list of the Select Service screen.
12. Click Next. The Confirmation screen is displayed.
13. Click Next. The Summary screen is displayed confirming that the High availability was
successfully configured for the service or application.
14. Click Finish. The Documentum Docbase Service is added to the Other Resources list.
15. Right-click the Documentum Docbase Service in the Summary screen, and choose Properties.
The Properties dialog box for the service is displayed.
16. In the Dependencies tab, add the Documentum Docbroker Service.
17. In the General tab, ensure that the Use Network Name for computer name option is selected, and
click OK.
18. Right-click the Documentum Docbase Service in the Summary screen console, and choose
the Bring this resource online option. The resource is brought online and the Online icon is
displayed in the Status column of the Summary screen.
19. Right-click the configured service, choose Add a resource > Generic Service. The New Resource
Wizard dialog box is displayed.
20. Choose Documentum Java Method Server in the Select Service list of the Select Service screen.
21. Click Next. The Confirmation screen is displayed.
22. Click Next. The Summary screen is displayed confirming that the High availability was
successfully configured for the service or application.
23. Click Finish. The Documentum Java Method Server is added to the Other Resources list.
24. Right-click the Documentum Java Method Server in the Summary screen, and choose Properties.
The Properties dialog box for the service is displayed.
25. In the Dependencies tab, add the Documentum Docbroker Service and Documentum Docbase
Service.

88
 Installing Content Server with Microsoft Cluster Services

26. In the General tab, ensure that the Use Network Name for computer name option is selected, and
click OK.
27. Right-click the Documentum Java Method Server in the Summary screen console, and select
the Bring this resource online option. The resource is brought online and the Online icon is
displayed in the Status column of the Summary screen.

Verifying failover
After you complete the preceding procedures, verify that failover works properly.
Note: Ensure to run the dm_crypto_boot utility on all the Content Server nodes only if it has the
custom passphrase before switching Content Server services to any node.

To verify failover:
1. On a client computer, ensure that the dfc.properties entries refer to the virtual network host
name or virtual IP address.
2. Connect to the repository from the client computer.
3. Start the Cluster Administrator utility.
4. Move the resource group from the node where it is running to the other node.
5. After the resource group comes online on the other node, verify that the client can run queries.

Configuring an active/active cluster

In an active/active cluster, each node initially has its own repository and Content Server. You create
two cluster resource groups, and each node owns one. If a Content Server fails on one node, a second
Content Server starts on the second node to keep the repository on the first node running.
Each cluster resource group has the following:
virtual IP address
virtual network host name
one shared disk drive (where the repository resides)
one connection broker
one Content Server

Creating the first cluster resource group

Create the first cluster resource group by following the instructions in Creating the cluster resource
group, page 85.

89
Installing Content Server with Microsoft Cluster Services

Installing Content Server software on the hosts

On each of the two nodes, copy the files from the installation media to create a Content Server
installation on each node.
Note: Use the same drive letter on each node.

Configuring Content Server on the first and second

nodes
In an active/active configuration, configure a Content Server on each of the two nodes. The procedure
for configuring Content Server in an active/active cluster is the same as configuring Content Server in
an active/passive cluster. Follow the instructions on the first and the second node in the cluster.

Configuring the second cluster resource group

Create the second cluster resource group.

Modifying server.ini and dfc.properties

You might want to edit server.ini and dfc.properties on both nodes to ensure that each
repository projects to the connection brokers on the two nodes.
In the following examples, assume that the virtual network hosts for the two cluster resource groups
are called dmcluster1 and dmcluster2. It does not matter which cluster resource group is primary
and which is backup.
Edit all four of the server.ini files so that they read as follows:
[DOCBROKER_PROJECTION_TARGET]
host=dmcluster1
[DOCBROKER_PROJECTION_TARGET_1]
host=dmcluster2
Edit the two dfc.properties files so that they read as follows:
dfc.docbroker.host[0]=dmcluster1
dfc.docbroker.host[1]=dmcluster2

Configuring the connection broker and repository for

failover
The procedure for configuring the connection broker and repository for failover in an active/active
cluster is the same as configuring them in an active/passive cluster. But the configuration for failover
needs to be done separately for each of the two repository services binding them with their respective
dependant resources.

90
 Installing Content Server with Microsoft Cluster Services

Verifying failover
After you complete the preceding procedures, verify that failover works properly.

To verify failover:
1. On a client computer, ensure that the dfc.properties entries refer to both virtual network
host name or virtual IP address.
2. Connect to both repositories from the client computer.
3. Start the Cluster Administrator utility.
4. Move the two resource groups back and forth between the nodes.
5. After a resource group comes online on a new node, verify that the client can run queries.

91
Installing Content Server with Microsoft Cluster Services

92
 Chapter 7
Uninstalling Content Server

This chapter explains how to delete a repository or connection broker and how to uninstall an existing
Content Server. Do not uninstall an existing installation to upgrade to a new Content Server release,
because all upgrades are based on an existing installation. Use the procedures in this chapter only if
you want to uninstall an existing Content Server, a repository and its contents, a connection broker, or
a Content Server software installation.
This chapter covers the following topics:
Uninstalling components, page 93
Deleting a repository, page 93
Deleting a connection broker, page 94
Uninstalling the Content Server software, page 94
To delete a repository or connection broker or uninstall Content Server, you need to meet the
following requirements:
Be able to log in as the installation owner
Have sufficient database privileges to drop tablespaces or databases

Uninstalling components
Uninstall the software components in this order:
1. Stop the Java Method Server service.
2. Delete the repository.
3. Delete any connection broker located on the current host.
4. Uninstall the Content Server software.
5. Uninstall the Index Agent configuration program if full-text indexing is installed.

Deleting a repository
Use these instructions to delete a repository.

93
Uninstalling Content Server

To delete a repository you need to meet the following requirements:

Be able to log in as the installation owner
Have sufficient RDBMS privileges to drop tablespaces or databases.
Note: If the repository has a Content Transformation Services (CTS) product installed on it, you need
to uninstall the CTS product before deleting the repository. If you do not, the CTS product will not
be available in all other repositories.

To delete a repository:
1. Log in to the host as the Content Server installation owner.
2. Start the Content Server configuration program.
On Windows, launch the configuration program Server_Configuration_Program.exe
from the installation.
On UNIX and Linux, navigate to the $DOCUMENTUM/product/version_number/
install directory and run the dm_launch_server_config_Program.sh program.
The Content Server configuration program starts.
3. Choose Delete an existing repository.
4. Choose the repository to delete and click Next.
5. Click to finish the configuration or return to the starting panel.

Deleting a connection broker

Use these instructions to delete a connection broker.
Note: To delete a connection broker, you need to be able to log in to Windows as the installation
owner.

To delete a connection broker:

1. To delete a connection broker, click Delete a connection broker
2. Choose the connection broker to delete.
3. Choose whether to finish the connection broker deletion or whether to return to the starting panel
to perform another action.

Uninstalling the Content Server software

Use these instructions to uninstall the Content Server software from a host. You can only uninstall the
software after deleting all repositories and connection brokers in the installation.

To uninstall the Content Server software:

1. Delete all repositories and connection brokers in the installation.

94
 Uninstalling Content Server

Use the instructions in Deleting a repository, page 93 and Deleting a connection broker, page 94.
2. Run the Content Server uninstallation program.
On Windows, run $DOCUMENTUM/uninstall/server/uninstall.exe
On UNIX and Linux, run $DOCUMENTUM/uninstall/server/uninstall
Optionally, run $DOCUMENTUM/uninstall/dfc/uninstall to uninstall the DFC Runtime
Environment.
Note: Do not uninstall the DFC Runtime Environment if any other EMC Documentum
software is installed on the host.

95
Uninstalling Content Server

96
 Chapter 8
Troubleshooting

This chapter contains the information for troubleshooting common Content Server installation
problems and covers the following topics:
Identifying the problem and resolution, page 97
Recovering from a failed repository configuration or upgrade, page 101
Recovering from a stalled Content Server upgrade, page 101
Identifying issues for Certificate-based SSL communication, page 102
Recovering from a failed filestore configuration, page 109

Identifying the problem and resolution

When experiencing a problem, perform the following preliminary actions:
Ensure that you are connected as the installation owner.
On UNIX and Linux, ensure that the environment variables are set correctly in the installation
owners environment.
Setting required environment variables, page 30
Review the Content Server installation logs.
Reviewing Content Server installation and configuration logs, page 61
Table 3, page 97 can help you identify the problem you are experiencing, a possible cause, and
recommended resolution.

Table 3. Troubleshooting checklist

Symptom Cause Fix

Content Server installation or You are trying to install or Connect using the installation
upgrade fails upgrade the Content Server but owner account.
you are not connected as the
installation owner.

97
Troubleshooting

Symptom Cause Fix

While installing a repository, Three possible causes of this To fix these three causes:
you see an error message that error: 1. Make the installation
indicates that the user is not a 1. The installation owner owner group the
valid UNIX user: account does not have installation owners
the installation owner primary group.
Configuration of the
group designated as the
docbase fails with the 2. Set the shared library path
users primary group.
message user must be environment variable
Group ownership of the
a valid UNIX user correctly. Setting
Documentum binaries is
exec(): 0509-036 required environment
incorrect.
Cannot load program variables, page 30 provides
/u01/app/documentum/ 2. The shared library path information on setting
product/5.2/bin/ environment variable is not environment variables
dmisvaliduser because set correctly.
of the following 3. General database
errors: 0509-150 3. On DB2, the $DB2_BASE requirements, page 22
Dependent module environment variable is not contains more information.
libldap50.so could not set correctly.
be loaded. 0509-022
Cannot load module
libldap50.so. 0509-026
System error: A file
or directory in the
path name does not
exist.
Content Server upgrade There might be a cyclic group. Recovering from a stalled
appears unresponsive. Content Server upgrade, page
101 contains the details.
On Windows hosts, you see The correct video driver for the Review the hardware and
the following error during video card is not installed on software configuration of the
installation: the host. host.

Could not initialize

interface awt exception
ExceptionInitializa-
tionError
You see the following error The dm_ContentReplication Delete the following entry from
during an upgrade of an older method has some parameter the dm_ContentReplication
repository: arguments left over from method:
EDMS98.
Failed to retrieve serverconfigname
serverconfig [domain\]user,passwd
object with name
<serverconfigname>.

***Failed to encrypt
passwords for
docbase ec_epac,

98
 Troubleshooting

Symptom Cause Fix

status -1057226550
**Operation failed **
[DM_CRYPTO_E_NO_LOCAL_
COMPONENT_STORE] error:
"No local component
store for server"
Please read error log
C:\WINNT\Temp\dm_chec_
bin.ServerConfigurator.
log for more
information.
You see the following errors Invalid Oracle views belonging Make the views valid before
during upgrade from 5.3 SP6 to types _sv, _sp, _rv, and _rp. upgrading Content Server.
on Oracle 10:
A view in Oracle becomes To determine which views
Tue Feb 22 21:48:08 invalid when the base tables it in the Oracle installation
2005 098000 [DM_SES- references change (for example, are invalid, you can run
SION_I_INIT_BEGIN]info: by adding/dropping a column, the following query from
"Initialize dmCon- or dropping a unique constraint SQLPLUS logging in as the
tent." Tue Feb 22 index). repository owner:
21:48:08 2005 567000
select object_name,
[DM_SESSION_I_INIT_BE-
object_type from
GIN]info: "Initialize
user_objects where
dmiSubContent." Tue
status='INVALID';
Feb 22 21:48:08 2005
598000 [DM_TYPE_MGR_E_ To recompile the views:
CANT_FIND_TABLE]error:
"Failure to find table ALTER VIEW view_name
dmi_subcontent_sv as COMPILE;
part of fetch of type
The Oracle-supplied package
dmi_subcontent: error
named DBMS_UTILITY
from database system
has a procedure named
is ORA-24372: invalid
COMPILE_SCHEMA. This
object for describe"
procedure will compile all
Tue Feb 22 21:48:08
stored code, views, and so on,
2005 598000 [DM_SES-
for the schema provided. The
SION_E_INIT_FAIL-
best way to compile all database
URE1]error: "Failure
objects that are invalid is to
to complete dmiSubCon-
use a script in the $ORACLE_
tent initialization."
HOME/rdbms/admin directory
You might also see this named utlrp.sql. This script
message: finds all objects in the data
dictionary that are invalid and
ORA-24372: invalid compiles them. This script is
object for describe typically mentioned in patch
notes but you can use it any
time a schema change occurs.

99
Troubleshooting

Symptom Cause Fix

On AIX, you see the following IBM JDK 1.7 support is only Use the runtime jar
exception: from AxM Server 6.2. axm-runtime-api-6.2.jar
to connect to AxM Server 6.2.
Needed JSSE provider
IBMJSSE Cannot be found
Unable to start the repository. Changing the default During Content Server
passphrase to a custom installation, a keystore is
passphrase. created that contains a
passphrase that is used for
encryption. After installation,
you can change the default
passphrase to a custom
passphrase. If you create
a custom passphrase after
Content Server installation,
any time you restart the server
host you need to run the
dm_crypto_boot utility. The
EMC Documentum Content
Server Administration and
Configuration Guide contains
the instructions and details
on encryption, keystores, and
passphrases.

While installing on Linux, Installer hangs when the

number of mount points exceeds 4000
On a Linux machine, installation can hang when there are too many mount points open in the box.
Check the output in bytes by entering the following command:
mount | wc -c

Installer hangs when the number returned by the previous command exceeds 4000.
To work around this problem, do the following: Copy and paste the following into your Telnet
session, and run the installation as usual:
cd /tmp
mkdir bin.$$
cd bin.$$
cat > mount <<EOF
#! /bin/sh
exec /bin/true
EOF
chmod 755 mount
export PATH=`pwd`:$PATH

After the installation completes, delete /tmp/bin.$$ by running the following command (in the same
Telnet session):

100
 Troubleshooting

rm -r /tmp/bin.$$

Recovering from a failed repository

configuration or upgrade
If repository configuration fails, whether you are upgrading an existing repository or creating a new
one, you can recover from the failure.
Typical reasons for a failure include problems with the database connection or errors in Content
Server creation. Before you proceed with the following instructions, read the Content Server
installation logs and correct any problems. Reviewing Content Server installation and configuration
logs, page 61 provides details about logs.

To recover from a failed installation or upgrade:

1. Correct any problems noted in the Content Server installation logs.
2. Restart the Content Server configuration program.
3. Select Repository > Upgrade an existing repository.
4. Select the repository where the failure occurred.
5. Check Upgrade.
This takes you through the configuration steps again and reruns the scripts that create the
repository.

Recovering from a stalled Content Server

upgrade
A Content Server upgrade that stalls in the middle or takes hours to complete can be caused by
cyclic groups. A cyclic group is a subgroup of a member group, causing the Content Server to cycle
during the upgrade. If the Content Server has encountered a cyclic group, the last line of the Content
Server log is:
Thu Jun 28 14:00:14 2007 715540 [DM_SESSION_I_INIT_BEGIN]info:"Initialize dmGroup."

Use the following instructions to identify the cyclic group. After you locate the cyclic group, contact
EMC Documentum Technical Support for assistance in correcting the problem, which requires direct
SQL Server statements in the database.

To identify and correct a cyclic group:

1. From the operating system, stop the Content Server startup.
On Windows, open Task Manager, select the correct Content Server process on the Processes
tab, and click End Process.
On Linux, determine the correct Content Server process and use the kill command to end
the process.

101
Troubleshooting

2. If you are on Linux, restart the Content Server using the osqltrace option:
dm_start_repositoryname -osqltrace

3. If you are on Windows, edit the Content Server startup command, then restart the Content Server.
a. Click Documentum Server Manager.
b. Choose the correct repository.
c. Click Edit Service.
d. In the Command field, add -osqltrace after the repository name. Click OK.
e. Restart the Content Server.
4. When the Content Server appears to be unresponsive, open the Content Server log and identify
the query that is looping.
If there is a cyclic group, the last query in the log is recorded multiple times and takes this format:
Thu Jun 28 13:33:17 2007 435439: 21547[1]
SELECT SB_.R_OBJECT_ID FROM repository_owner.dm_group_s SB_
WHERE (SB_.R_OBJECT_ID=:objectp AND SB_.I_VSTAMP=:versionp)
Thu Jun 28 13:33:17 2007 435608: 21547[1] :objectp = 1200fb8080000909
Thu Jun 28 13:33:17 2007 435608: 21547[1] :versionp = 0

In the preceding example, the cyclic group has the r_object_id of 1200fb8080000909.
5. Run the following query:
SELECT group_name
FROM dm_group_s
WHERE r_object_id='r_object_id_of_cyclic_group

This query returns the name of the group, which you need for determining which group is
the cyclic group.
6. Run the following query:
SELECT groups_names
FROM dm_group_r
WHERE r_object_id = r_object_id_of_cyclic_group

The query returns the names of each group that is a member of the problem group.
7. For each of the group names returned, run this query:
SELECT r_object_id from dm_group_s where group_name = member_group_name'
The query returns the r_object_id for each member group.
8. Repeat steps 6 and 7 iteratively for each subgroup until you locate the cyclic group.
9. Contact EMC Documentum Technical Support for assistance in correcting the problem.

Identifying issues for Certificate-based SSL

communication
This section lists some of the common issues that occur during configuration of Certificate-based
SSL communication, causes, and its resolutions.

102
 Troubleshooting

Connection broker startup fails

1. Check if the connection broker keystore and keystore password files are available in the
$DOCUMENTUM/dba/secure directory.
2. Check if an entry for the connection broker keystore and keystore password files is available in
the connection broker configuration file (docbroker.ini).
Ensure to add the following entry in the docbroker.ini file:
[DOCBROKER_CONFIGURATION]
secure_connect_mode=secure
keystore_file=broker.p12
keystore_pwd_file=broker.pwd
cipherlist=AES128-SHA
crypto_keyname = <CSaek>
crypto_lockbox = <crypto_lockbox>

crypto_keyname = <CSaek> where <CSaek> is the AEK key name that is used to encrypt
the password in the broker.pwd file. Use the following syntax:
dm_encrypt_password -encrypt password -file broker.pwd -keyname <CSaek>
[-passphrase <AEKPassphrase>]

crypto_lockbox = <crypto_lockbox>: It is used if lockbox is present. When running

dm_encrypt_password, use the following syntax:
dm_encrypt_password -encrypt password -file broker.pwd -keyname <CSaek>
[-passphrase <AEKPassphrase>] -lockbox <lockbox> -lockboxpassphrase
<lockboxpassphrase>

3. Check if the format of the connection broker keystore is PKCS #12.

The following commands list the keys in the keystore if the keystore is in the PKCS #12 format.
Using OpenSSL:
openssl pkcs12 -info -in <keystore>
Using Keytool:
keytool -list v -storetype pkcs12 -keystore <keystore>

4. Check if the password in the keystore password file is correct.

Note: Specify the password in the plain text (without encryption) format, to perform the test.

Server startup fails

1. Check if the server keystore, server keystore password, and server trust store files are available in
the $DOCUMENTUM/dba/secure directory.
2. Check if the entry for the server keystore, server keystore password, and server trust store files is
available in the server configuration file (server.ini).
3. Check if the format of the server keystore is PKCS #12. The Connection broker startup fails, page
103 section contains more information on the commands.
4. Check if the server trust store is in the PKCS #7 binary (der) format. For verification, check if the
following command dumps it successfully:
openssl pkcs7 -in <Keystore> -inform der.
Example:

103
Troubleshooting

openssl pkcs7 -in server-trust.p7b -inform der

Server not able to connect to connection broker

1. Check whether the connection broker keystore contains the correct key and public certificate.
Use the following command to print the keys in keystore:
openssl pkcs12 -info -in <keystore>
Using Keytool:
keytool -list -storetype pkcs12 -keystore <keystore>

2. Check whether the connection broker is sending proper certificates.

The following command starts a simple client that connects to the SSL Server and displays the
certificate chain sent by the Server:
openssl s_client -showcerts -debug -connect
<SSL_Server_IP>:<SSL_Server_Port>

Example:
openssl s_client -showcerts -debug -connect 10.8.53.24:1490

3. Check if the server trust store contains the connection brokers public certificate or CA certificate
chain used to sign connection brokers public certificate.
Use the following command to display all certificates in the trust-store:
openssl pkcs7 -in <trust-store> -inform der -print_certs -text

4. Check if the servers trust store contains the connection brokers public certificate or CA certificate
chain used to sign connection brokers public certificate.
Use the following command to dump the trust store:
openssl pkcs7 -in <trust-store> -inform der -print_certs text > CA.PEM
Use the following command to check connectivity using this trust store:
openssl s_client -showcerts -debug Cafile CA.pem -connect
<SSL_Server_IP>:<SSL_Server_IP>
Example:
openssl s_client -showcerts Cafile CA.pem -debug -connect 10.8.53.24:1490
If there are no problems with the trust store , the verification will return (ok).

Clients are unable to connect to the connection broker

1. Check if proper entries are available in the dfc.properties file and if the trust store file is
available.
2. Check if the DFC trust store contains the connection brokers public certificate or CA certificate
used to sign connection brokers public certificate.
3. Run the following command to dump the trust store contents (do not specify the storetype
as the default type is JKS):
keytool -list -keystore <keystore> -storepass <storepass>

104
 Troubleshooting

Clients are unable to connect to the Server

1. Check if proper entries are available in the dfc.properties file and if the trust store file is
available.
2. Check if the DFC trust store contains the servers public certificate or CA certificate used to
sign the servers public certificate.
3. Run the following command to dump the content of the trust store (do not specify the store type
as the default type is JKS):
keytool -list -keystore <keystore> -storepass <storepass>

4. Check if the correct value has been specified for the trust store password in the dfc.properties
file. For verification, specify the password in plain text.

Miscellaneous
Run the following command to verify whether the connection is secure and if the encryption
algorithm used while starting the client is correct:
jvm parameter -Djavax.net.debug=all

Content Server error messages and causes

Table 4. Content Server error messages and causes

Error message Cause

[DM_SERVER_E_START_NETWISE]error: "The Server keystore is missing
server failed to start due to an error returned by
the Netwise networking subsystem. Failed API: Format of the Server keystore is different
nl_init(). Error (705) SSL error(10100) in call to from PKCS #12
SSL_CTX_new(). Winsock error: 10100."
Server keystore is corrupt
[DM_SERVER_E_START_NETWISE]error: "The
server failed to start due to an error returned Server keystore password file contains the
by the Netwise networking subsystem. Failed wrong password
API: nl_open(). Error (501) Network Library not
Server keystore password file is missing
initialized. Extended network error: 0."
[ERROR] [AGENTEXEC 3088] Detected Server keystore is empty
during program initialization: Command
Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0,
with error message [DM_SESSION_E_RPC_
ERROR]error: "Server communication failure"

javax.net.ssl.SSLHandshakeException: Received
fatal alert: handshake_failure

105
Troubleshooting

Error message Cause

[DM_SERVER_E_START_NETWISE]error: "The Server trust store is missing
server failed to start due to an error returned
by the Netwise networking subsystem. Failed Server trust store is corrupt
API: nl_init(). Error Unknown error code 10008
(_nl_error_ = 0). Extended network error: 0."

[DM_SERVER_E_START_NETWISE]error: "The
server failed to start due to an error returned
by the Netwise networking subsystem. Failed
API: nl_open(). Error (501) Network Library not
initialized. Extended network error: 0."
[DM_SERVER_E_START_NETWISE]error: "The Server trust store is in the wrong format
server failed to start due to an error returned
by the Netwise networking subsystem. Failed
API: nl_init(). Error Unknown error code 1795
(_nl_error_ = 0). Extended network error: 0."

[DM_SERVER_E_START_NETWISE]error: "The
server failed to start due to an error returned
by the Netwise networking subsystem. Failed
API: nl_open(). Error (501) Network Library not
initialized. Extended network error: 0."
[DM_DOCBROKER_E_NETWORK_ Server trust store is empty
ERROR]error: "An error occured performing
a network operation: (Unknown error code Connection broker keystore is empty
112 (_nl_error_ = 0)). Network specific error:
(Extended network error: 0)."

[DM_DOCBROKER_E_CONNECT_FAILED_
EX]error: "Unable to connect to DocBroker.
Clients please check your dfc.properties file for a
correct host. Server please check your server.ini
or target attributes in server config. Network
address: (INET_ADDR: family: 2, port: <port>,
host: <host_name> (<host_ip>, 1835080a))."
[ERROR] [AGENTEXEC 2692] Detected DFC trust store is missing
during program initialization: Command
Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0,
with error message [DFC_DOCBROKER_
REQUEST_FAILED] Request to Docbroker
"<docbroker_name>:<port>" failed

[DM_SESSION_E_RPC_ERROR]error: "Server
communication failure"
javax.net.ssl.SSLException: java.lang.Run-
timeException: Unexpected error: java.secu-
rity.InvalidAlgorithmParameterException: the

106
 Troubleshooting

Error message Cause

trustAnchors parameter must be non-empty
java.lang.RuntimeException: Unexpected error:
java.security.InvalidAlgorithmParameterEx-
ception: the trustAnchors parameter must be
non-empty
java.security.InvalidAlgorithmParameterEx-
ception: the trustAnchors parameter must be
non-empty
[ERROR] [AGENTEXEC 2968] Detected The Server Certificate is missing in the DFC
during program initialization: Command trust store
Failed: connect,<server_name.docbase_
name>,>user>,,,,try_native_first, status: 0,
with error message [DFC_DOCBROKER_
REQUEST_FAILED] Request to Docbroker
"<docbroker_name>:<port>" failed

[DM_SESSION_E_RPC_ERROR]error: "Server
communication failure"
javax.net.ssl.SSLHandshakeException: sun.se-
curity.validator.ValidatorException: PKIX path
building failed: sun.security.provider.cert-
path.SunCertPathBuilderException: unable to
find valid certification path to requested target
sun.security.validator.ValidatorException: PKIX
path building failed: sun.security.provider.cert-
path.SunCertPathBuilderException: unable to
find valid certification path to requested target
sun.security.provider.certpath.SunCert-
PathBuilderException: unable to find valid
certification path to requested target
[ERROR] [AGENTEXEC 2436] Detected
during program initialization: Command
Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0, with
error message [DM_SESSION_E_RPC_ER-
ROR]error: "Server communication failure"
javax.net.ssl.SSLHandshakeException: sun.se-
curity.validator.ValidatorException: PKIX path
building failed:
sun.security.provider.certpath.SunCert-
PathBuilderException: unable to find valid
certification path to requested target
sun.security.validator.ValidatorException: PKIX
path building failed: sun.security.provider.cert-
path.SunCertPathBuilderException: unable to
find valid certification path to requested target
sun.security.provider.certpath.SunCert-

107
Troubleshooting

Error message Cause

PathBuilderException: unable to find valid
certification path to requested target
[ERROR] [AGENTEXEC 1672] Detected DFC trust store is in a different format
during program initialization: Command
Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0,
with error message [DFC_DOCBROKER_
REQUEST_FAILED] Request to Docbroker
"<docbroker_name>:<port>" failed
[DM_SESSION_E_RPC_ERROR]error: "Server
communication failure"
java.net.SocketException: java.security.
NoSuchAlgorithmException: Error constructing
implementation (algorithm: Default, provider:
SunJSSE, class: com.sun.net.ssl.internal.ssl.
DefaultSSLContextImpl)
java.security.NoSuchAlgorithmException:
Error constructing implementation (algorithm:
Default, provider: SunJSSE, class: com.sun.net.
ssl.internal.ssl.DefaultSSLContextImpl)
java.io.IOException: Invalid keystore format
[ERROR] [AGENTEXEC 2608] Detected DFC trust store is corrupt
during program initialization: Command
Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0,
with error message [DFC_DOCBROKER_
REQUEST_FAILED] Request to Docbroker
"<docbroker_name>:<port>" failed
[DM_SESSION_E_RPC_ERROR]error: "Server
communication failure"
java.net.SocketException: java.security.
NoSuchAlgorithmException: Error constructing
implementation (algorithm: Default, provider:
SunJSSE, class: com.sun.net.ssl.internal.ssl.
DefaultSSLContextImpl)
java.security.NoSuchAlgorithmException:
Error constructing implementation (algorithm:
Default, provider: SunJSSE, class: com.sun.net.
ssl.internal.ssl.DefaultSSLContextImpl)
java.security.cert.CertificateException:
Unable to initialize, java.io.IOException:
DerInputStream.getLength(): lengthTag=127,
too big.
java.io.IOException: DerInputStream.
getLength(): lengthTag=127, too big.
[ERROR] [AGENTEXEC 5720] Detected DFC trust store contains the wrong password
during program initialization: Command

108
 Troubleshooting

Error message Cause

Failed: connect,<server_name.docbase_
name>,<user>,,,,try_native_first, status: 0,
with error message [DFC_DOCBROKER_
REQUEST_FAILED] Request to Docbroker
"<docbroker_name>:<port>" failed
[DM_SESSION_E_RPC_ERROR]error: "Server
communication failure"
java.net.SocketException: java.security.
NoSuchAlgorithmException: Error constructing
implementation (algorithm: Default, provider:
SunJSSE, class: com.sun.net.ssl.internal.ssl.
DefaultSSLContextImpl)
java.security.NoSuchAlgorithmException:
Error constructing implementation (algorithm:
Default, provider: SunJSSE, class: com.sun.net.
ssl.internal.ssl.DefaultSSLContextImpl)

java.io.IOException: Keystore was tampered

with, or password was incorrect
java.security.UnrecoverableKeyException:
Password verification failed

Recovering from a failed filestore configuration

If the configuration of a filestore to use a mapped drive as the file_system_path fails, the following
error message appears:
DiUtil: Unable to set permission of file: X:\data: Unable to get DACL - Access is denied

Content Server is unable to connect to the drive even though you have full control on the target
shared drive. This error does not occur in partitions configured as FAT32.
The reason for this failure is because of the way in which the NTFS security handles the mapped
drives as compared to FAT32.
You can recover from the failure by specifying a UNC path as the file_system_path name for the
filestore.

To specify a UNC path name for the filestore:

1. Log in to the Content Server repository.
2. Set the storage area offline.
EXECUTE set_storage_state
WITH store = 'filestore_name', offline = TRUE

3. Copy the files in the storage area to the new directory.

4. Update file_system_path property of the dm_location object associated with the file store object
to point to the new directory for the storage area.

109
Troubleshooting

UPDATE "dm_location" OBJECT

SET "file_system_path" = '\\server_name\share'
WHERE "object_name" = location_object_name

5. Reinitialize the server to make the change visible.

6. Set the storage area online.
EXECUTE set_storage_state
WITH store = 'filestore_name', offline = FALSE

Note: You can also use Documentum Administrator to set the storage area offline or online. The EMC
Documentum Administrator User Guide provides more details.

110
 Appendix A
Installation Checklist

Use this installation checklist to plan your installation and record system information during
installation and configuration. You can print out the checklist and keep it handy for reference.
Note: Information marked with an asterisk (*) next to it is prerequisite information you should
obtain or plan for before installing Content Server.

Table 5. Installation checklist

Information Note Default Value Your Value

Content Server:

Content Server host e.g. myhost.example.com

FQDN *
Installation directory Must not contain spaces C:\Documentum
(Windows)
On UNIX and Linux: no
default;
e.g. /usr/local/bin/
Documentum
Installation owner
username/password
Application server
administrator (admin)
password
Application server A total of 20 ports, starting 9080
listening port * from the one you specify, will
be used by the application
server, and all of them must be
available.
Connection broker:
Connection broker Native, Secure, or Native and
connection mode Secure
Connection broker name

111
Installation Checklist

Information Note Default Value Your Value

Connection broker port The port you specify and its 1489
subsequent port will be used
by the connection broker and
both must be available.
Connection broker host
name *
Repository:
Data directory Local, SAN, or NAS $DOCUMENTUM/
data
For SAN or NAS, enter the
complete path including
a shared device. For
example: \\x.x.x.
x\folder1\folder2
where x.x.x.x is the IP
address.
Share directory $DOCUMENTUM/
share
Repository name Up to 32 alphanumeric
characters beginning with a
letter

The name docu reserved by

the system
Repository ID Also referred to as the docbase
ID.

The docbase ID is crucial for

identifying all system-related
data, including configurations,
objects, content, etc., and should
be unique per repository. Each
repository should have a
unique docbase ID. These IDs
are used to create file system
paths in storage locations to
ensure that they do not conflict
with other repositories.

If a customer creates two

docbases with the same
docbase ID, and point to the
same file location path, they
might overwrite each others
data. This is because the system
assumes that it has full access to

112
 Installation Checklist

Information Note Default Value Your Value

a particular storage path (which
includes the docbase ID).

Any number from 1 to

16777215 and must not start
with a zero (0)

Must be unique on the

network
Authentication domain The default domain if the user
(Windows) * does not specify a Windows
domain when connecting to the
repository
Repository connection Native, Secure, or Native and
mode * Secure
ODBC data source name
(DSN)
Database administrator The account has privileges to
name/password * create and delete databases
and perform other database
administrative tasks
Repository owner The database user account with
name/password the database owner role that
has read and write access rights
to the database
Repository database The name of the database
name Content Server uses to store
content metadata as well
as system and repository
information
Repository data device The configuration program
file path automatically fills in this
information
Repository log device file The configuration program
path automatically fills in this
information
SMTP server name * SMTP server name or IP
address that Content Server
will use for email notifications
Installation owner email Installation owners email
address * address that Content Server
will use for email notifications

113
Installation Checklist

Information Note Default Value Your Value

Global registry name The central repository to
manage installation-wide
elements
Global registry user login dm_bof_registry
name
Global registry user
password

114
 Appendix B
Content Server Installation Directories
and Repository Configuration Scripts

This appendix describes the file structure, scripts, and configuration objects that are a part of a
Content Server installation. The following topics are discussed:
Content Server installation file structure, page 115
Scripts run during installation or upgrade, page 120
Configuration objects, page 124

Content Server installation file structure

A Content Server installation consists of a number of files distributed among several directories.
Some of these files, such as the executable files, are supplied as part of the Content Server installation
package. Others, such as the Content Server startup file, are created during the installation process.
The installation procedure creates the subdirectories in the $DOCUMENTUM directory.
On Windows:
apptoken
Checkout
config
dba
Export
fulltext
java64
jboss_version
jmsTools
logs
patch
product

115
Content Server Installation Directories and Repository Configuration Scripts

share
Shared
tcf
temp
tools
uninstall
dctm.jar
On Linux:
data
dba
fulltext
jmsTools
product
share
shared
uninstall

uninstall
This directory contains the Content Server uninstallation program.

data
The files and directories in this category are the content storage areas. These directories must exist
and location objects must be defined for them in the repository before you start Content Server. The
installation procedure creates a default storage area and associated location object and a default
full-text index object and associated location object.
The data directory contains the directories that store the data manipulated by users and Content
Server. The installation procedure creates a subdirectory for the repository in the data directory and
in that repository subdirectory, creates a content storage area.
The data includes the full-text indexes and the content files associated with objects in the repositories.
The location of these directories is the most flexible component of the configuration.
Most sites will want to add more storage areas and index directories, particularly as the repository
grows larger. The EMC Documentum Content Server Administration and Configuration Guide provides
information and instructions about adding additional storage areas and full-text index storage
directories.

116
 Content Server Installation Directories and Repository Configuration Scripts

dba
The dba directory contains the log and config directories and several files.
The log directory is where the Content Server places any log files generated by user actions during
a session with the Content Server. The Content Server creates any necessary subdirectories for
these log files under the log directory.
The config directory includes a subdirectory for each repository that contains the startup files for
Content Server.

fulltext
The fulltext directory contains the third-party full-text indexing software.

product
The product subdirectory contains the Content Server executables.

server_uninstall
This directory contains a script that you can run manually to destroy a repositorys database tables
after you delete the repository.

share
The share directory holds all the files that can be shared by the Content Server and the clients. Clients
that connect to the share directory remotely can benefit in file sharing and event notification. The
client must be using NFS software to receive these benefits. The EMC Documentum Content Server
Administration and Configuration Guide contains the details.
The share directory has four subdirectories:
data
The data directory contains the data that is read and written by the Content Server and the clients.
The data directory has several subdirectories. Ensure that these subdirectories can be mounted
by clients.
events
The events subdirectory contains a file for any user who has queued inbox items that have not
been viewed. The files are empty. They serve as a flag to the Content Server that items that
have not been viewed are in that users inbox.
common

117
Content Server Installation Directories and Repository Configuration Scripts

The common subdirectory is where the Content Server puts copies of requested content files if
users are not using client local areas and if users do not specify an alternate location for the files.
clients
The clients subdirectory contains the win and Linux subdirectories, which respectively contain
the files and executables for Windows and Linux clients.
temp
The temp subdirectory is used by the Content Server as a temporary storage space. For
example, results generated by the execution of a procedure by using the Apply methods
DO_METHOD function are stored here.
sdk
The sdk subdirectory contains two subdirectories of files that are useful to software developers.
The two subdirectories are:
Include
This subdirectory contains the dmapp.h file and the import libraries.
example
This subdirectory contains the code examples.

Additional directories
Table 6. Subdirectories created during installation

Directory Description
bin Contains the Content Server software.
convert Contains the transformation engine executable
files.
dba/auth When you install Content Server, a default
base directory is created. Under default base
directory Installer creates a subdirectory specific
to the repository. The repository configuration
also creates an auth_plugin location object
that points to the base directory and sets the
auth_plugin_location attribute in the server to
the name of the location object. Any plugin
installed in this directory is loaded into every
server at startup for all repositories. To use a
plugin only with a particular repository, place
the plugin in the repository-specific dba/auth
directory.

For example, if you want to use the

Netegrity plugin with a repository called
engr_db, move the Netegrity module to

118
 Content Server Installation Directories and Repository Configuration Scripts

Directory Description
the DOCUMENTUM\dba\auth\engr_db
directory.

When Content Server starts, it loads the plugins

found in its repository-specific directory first
and then those found in the base directory.
dba/secure/ldapdb Contains the secure connection attributes. You
need to define the following setup values to use
a secure LDAP connection:
SSL mode

SSL port

Certificate database location

The ssl_mode attribute in the ldap_config object

defines whether the LDAP server is using a
secure or nonsecure connection. You need to set
this when defining the LDAP setup values.

To configure a secure connection, chose Secure

as the SSL mode. When you do, the interface lets
you edit the SSL port field. SSL port, represented
in the ldap config object by the ssl_port attribute,
identifies the port the LDAP server uses for the
secure connection. This value is 636 by default.

Certificate database location, represented in

the ldap_config object by the certdb_location
attribute, identifies the location of the certificate
database. The attribute value is the name of
the location object pointing to the certificate
database. The value is ldapcertdb_loc. The
directory that ldapcertdb_loc points to is
DOCUMENTUM\dba\secure\ldapdb.
example* Contains the code examples.
external_apps Contains a shared library.
include* Contains the header files for any external
applications that will communicate with
Content Server.
install Contains the installation scripts.
java Contains the Java package bundled with Content
Server.
messages *.e files (error messages).

119
Content Server Installation Directories and Repository Configuration Scripts

Directory Description
Oracle Contains the language files needed by Oracle.
During installation, the environment variable
ORA_NLS33 is set to that location. Do not
remove that directory or reset the that variable.
tcf References the task chaining framework, which
is related to lifecycles and is part of the BPS and
BPM group.
Uniscape Contains the NLS files for server code page
conversions.
Linux* Contains the libraries for a Linux client.
unsupported Contains the executable files that are provided
for your convenience but that are not supported
by Content Server.
webcache Includes webcache.ini. The documentation
for Documentum Interactive Delivery
Services/Interactive Delivery Services
Accelerated contains the details.
thumbsrv Installation directory for Thumbnail Server.
The documentation for Documentum Media
Services contains the details.
win* Contains the executable files for a Microsoft
Windows client. These include IAPI and IDQL
for MS Windows and the DDE server and
libraries.
jboss Contains the application server installation files
used to create an instance for the Java method
server.
An asterisk (*) indicates that the directory is optional.

Scripts run during installation or upgrade

During repository configuration, the following scripts are run, whether you are installing a new
repository or upgrading an existing repository:

120
 Content Server Installation Directories and Repository Configuration Scripts

Table 7. Repository configuration scripts

Script name Location Purpose Other

headstart.ebs $DM_HOME/install/ Loads the initial
admin default objects for
the repository. Creates
mount point objects,
location objects, file
store objects, and
method objects.
dm_apply_formats.ebs $DM_HOME/bin Creates or updates
format objects, which
are required for
content file operations.
dm_cas_install.ebs $DM_HOME/install/ Creates a method,
admin location, template
type, folder structure,
and template object for
use of the electronic
signature.
csec_plugin.ebs $DM_HOME/install/
admin
dm_routerconv_ $DM_HOME/install/ Loads methods that Run only during an
install.ebs admin are used for converting upgrade.
routers to workflow
template.
templates.ebs $DM_HOME/install/ Creates default
admin templates that are used
by EMC Documentum
clients for creating
new documents in the
repository.
replicate_bootstrap. $DM_HOME/bin Creates objects and
ebs registered tables
that are required for
replication.
desktop_client.ebs $DM_HOME/install/ Creates folders
desktop_client required by
Documentum Desktop
and installs the default
SmartList.
disable_fulltext_jobs. $DM_HOME/install/ Run only during an
ebs admin upgrade.

121
Content Server Installation Directories and Repository Configuration Scripts

Script name Location Purpose Other

dfc.ebs $DM_HOME/install/ Loads default
admin objects required by
the Documentum
Foundation Classes.
Dfc_bof2.ebs $DM_HOME/install/ Creates the types for
admin dm_module, dmc_jar,
and dmc_java_library
and configures a
repository to use DFC
version 5.3 SP1 and
later.
dfc_javadbexpr.ebs $DM_HOME/install/ Creates types, relation
admin types, acls, and
repository folders
for DFC evaluation of
validation expression
constraints in Java.
dm_bpmmodules_ $DM_HOME/install/
install.ebs admin
createMethodServer- $DM_HOME/install/
Object.ebs admin
csec_plugin_upgrade_ $DM_HOME/install/ Upgrades the Run only during an
53.ebs admin plugin for using upgrade.
content-addressable
storage areas.
toolset.ebs $DM_HOME/install/ Installs repository
admin administration tools.
dm_bpm_install.ebs $DM_HOME/install/
admin
dm_wfTimer_ $DM_HOME/install/ Converts workflow Run only during an
upgrade.ebs admin pre- and post-timers upgrade.
set up in repositories
prior to version 5.3 to
the version 6.5 timer
implementation.

dmbasic -f
dm_wfTimer_
upgrade.ebs
-e Install --
repository_
nameuserpassword
dm_setup_java_ $DM_HOME/install/
lifecycle.ebs admin

122
 Content Server Installation Directories and Repository Configuration Scripts

Script name Location Purpose Other

create_fulltext_objects. $DM_HOME/install/ Creates repository
ebs admin objects related to
full-text indexing.
dm_ldap_install.ebs $DM_HOME/install/ Creates or upgrades
admin the ldap config object
type and upgrades any
existing ldap config
objects.
dm_storageservices_ $DM_HOME/install/
install.ebs admin
dm_emailTemplate_ $DM_HOME/install/
install.ebs admin
dm_xml_install.ebs $DM_HOME/install/ Installs object types
admin and formats for XML
files.
dm_gwm_install.ebs $DM_HOME/bin Executes scripts
that install
workflow-related
types, methods,
folders, and jobs.
upgrade_java_ $DM_HOME/install/ Upgrades existing Java
methods_51.ebs tools methods.
ci_schema_install.ebs $DM_HOME/install/ Installs the object types
tools used by Documentum
Content Intelligence
Services.
display_config_setup. $DM_HOME/install/ Configures the
ebs tools repository for the
Documentum Offline
Client.
offline_config_setup. $DM_HOME/install/ Migrates offline
ebs tools configuration settings
from the offline_config
object to the docbase
config object.
upgrade_ $DM_HOME/install/ Run only during an
contentreplication_ admin upgrade.
job.ebs

123
Content Server Installation Directories and Repository Configuration Scripts

Script name Location Purpose Other

dm_acs_install.ebs $DM_HOME/install/
admin
dd_populate.ebs $DM_HOME/bin Populates the data
dictionary with
attribute and type
information from
datafiles.

Configuration objects
Each repository contains the objects that together define your configuration. These objects include:
Server config object
Docbase config object
Fulltext index objects
Location objects
Mount point objects
Storage objects
Format objects
Method objects
As you make choices about how to configure the installation and repositories, modify these objects or
add new ones. The EMC Documentum Content Server Administration and Configuration Guide contains
the details on configuration.

124
 Appendix C
Object Type Categories for Oracle
Database Storage

This appendix lists the object types by their size category. An object types size category is used
in two contexts:
To determine where to create the object types tables and indexes if the optional
[FUNCTION_SPECIFIC_STORAGE] parameters are defined in the server.ini file
To determine the default initial and next extent allotments for the object types tables in the RDBMS
This appendix covers the following topics:
Type categories for tablespace specifications, page 125
Type categories for extent allocation, page 126
The categories for each context are not the same. Type categories for tablespace specifications, page
125 helps you to find the categories for tablespace determination and Type categories for extent
allocation, page 126 shows the tables listing the categories for extent allotments.

Type categories for tablespace specifications

By default, the tables and indexes for all object types are created in the same tablespace. However,
you can set parameters in the server.ini file to define alternate tablespaces for large and small
object types. When you do so, the system sorts the objects into large and small for the purposes of
determining which object types to create in which tablespace.
The majority of the object types are considered small for this purpose. The following list shows the
object types that are considered large. Any type not appearing on this list is considered small.

dm_acl dm_process dmi_dump_object_record

dm_assembly dm_reference dmi_linkrecord
dm_audittrail dm_relation dmi_load_object_record
dm_composite dm_router dmi_otherfile
dm_document dm_script dmi_queue_item
dm_folder dm_smart_list dmi_replica_record
dm_locator dm_sysobject dmr_containment

125
Object Type Categories for Oracle Database Storage

dm_note dm_workflow dmr_content

dm_procedure dm_workitem

Type categories for extent allocation

This section lists object type size categorizations for extent allocation and the default initial and
next extent storage parameters for each category.
The object types are categorized as large, small, or default based on how many objects of the type
will be created in the repository. For example, dm_document is categorized as large because most
enterprises create large numbers of documents in a repository. Similarly, dm_docbase_config is
categorized as small because a repository has only one docbase config object. Those types that do not
fall into either the large or small category are categorized as default.

Object types categorized as large

The object types categorized as large are created with an initial extent size of 100 K. The next extent
size is 1 M. The following object types are categorized as large for the purposes of allocating extents.

dm_acl dm_reference dmi_dump_object_record

dm_assembly dm_relation dmi_load_object_record
dm_document dm_router dmi_object_type
dm_folder dm_sysobject dmi_queue_item
dm_locator dmi_containment dmi_replica_record
dm_note dmr_content dmi_subcontent

Object types categorized as small

The object types categorized as small are created with an initial extent size of 10 K. The next extent
size is 50 K. The following object types are categorized as small for the purposes of allocating extents.

dm_alias dm_filestore dm_relation_type

dm_blobstore dm_foreign_key dm_server_config
dm_distributed_store dm_format dm_store
dm_dump_record dm_fulltext_index dmi_change_record
dm_docbase_config dm_linkedstore dmi_expr_code
dm_docbaseid_map dm_load_record dmi_recovery
dm_extern_file dm_location dmi_session

126
 Object Type Categories for Oracle Database Storage

dm_extern_free dm_mount_point dmi_sequence

dm_extern_store dm_opticalstore dmi_tdk_collect
dm_extern_url dm_outputdevice dmi_tdk_index
dm_federation dm_registered dmi_vstamp

Object types categorized as default

The object types categorized as default are created with an initial extent size of 20K. The next extent
size is 100K. The following object types are categorized as default for the purposes of allocating
extents.

dm_acs_config dm_cabinet dm_domain

dm_activity dm_client_registration dm_expression
dm_aggr_domain dm_client-rights dm_federation_log
dm_application dm_cond_expr dm_func_expr
dm_app_ref dm_cond_id_expr dm_group
dm_aspect_type dm_component dm_job
dm_audittrail dm_cont_transfer_config dm_job_request
dm_bocs_config dm_dd_attr_info dm_key
dm_builtin_expr dm_dd_info dm_ldap_config
dm_cabinet dm_dms_config dm_lightweight
dm_literal_expr dm_public_key_certificate dm_user
dm_media_profile dm_query dm_value_assist
dm_method dm_qual_comp dm_value_func
dm_nls_dd_info dm-retainer dm_value_list
dm_plugin dm_script dm_value_query
dm_policy dm_smart_list dm_validation_descriptor
dm_process dm_staged dm_workflow
dm_procedure dm_type dm_workitem
dmc_aspect_type dmc_relationship_def dmc_wfsd_element_string
dmc_calendar dmc_routcase_condition dmc_wfsd_parent
dmc_calendar_event dmc_scope_config_relation dmc_wfsdrp_boolean
dmc_completed_workitem dmc_transition_condition dmc_wfsdrp_date
dmc_datatable dmc_type_info dmc_wfsdrp_double
dmc_datatable_row dmc_wf_package_skill dmc_wfsdrp_integer
dmc_datatable_schema dmc_wfsd_element dmc_wfsdrp_parent
dmc_datatable_settings dmc_wfsd_element_boolean dmc_wfsdrp_string

127
Object Type Categories for Oracle Database Storage

dmc_module dmc_wfsd_element_date dmc_workqueue

dmc_preset_info dmc_wfsd_element_double dmc_workqueue_policy
dmc_preset_package dmc_wfsd_element_integer dmi_autittrail_attrs
dmi_dist_comp _record dmi_package dmi_registry
dm_expr_code dmi_transactionlog dmi_wf_timer
dmi_workitem

128
 Appendix D
Defining Oracle or DB2 Database
Parameters for Repository Tables

To improve performance and increase the throughput of the system, you might want to control where
repository information is stored. For example, you can store frequently used data on different disks
than less frequently used data. Defining database parameters to store data in different tablespaces
also partitions data into smaller, more manageable pieces.
When a repository is created, the system automatically creates object-type tables and indexes in the
underlying database. The object-type tables and indexes are described in EMC Documentum Content
Server Fundamentals Guide.
If you do an express installation of Content Server, by default, Content Server creates all object-type
tables and indexes in the same tablespace. The size and number of the extents allotted for each
table are determined by default configuration parameters. If you do a custom Content Server
installation, you are prompted to configure the object-type tables and indexes, and you can create
them in separate tablespaces.
You can edit the server.ini file to change any configuration parameters when the repository
is created, before you start the Content Server.
On Oracle, you can change two parameters:
The tablespace for the object-type tables and indexes
The size of the extents allotted for system-defined object types
You cannot change the number of extents allotted for the object types.
Under Oracle 10, always create tablespaces as locally managed tablespaces (LMTs) using the
LOCAL value. If you have dictionary managed tablespaces (DMTs) under Oracle 10, use the
Oracle DBMS_SPACE_ADMIN package to convert DMTs to LMTs, for example,
SQL> exec dbms_space_admin.Tablespace_Migrate_TO_Local('Table_space1');
The Oracle documentation set contains the details on extent management and DMT-to-LMT
conversion.
On DB2, you can change the tablespace for the object-type tables and indexes. On Oracle, you
can change two parameters:
The tablespace for the object-type tables and indexes
The size of the extents allotted for system-defined object types
You cannot change the number of extents allotted for the object types.

129
Defining Oracle or DB2 Database Parameters for Repository Tables

Defining the tablespace

The parameters in the [FUNCTION_SPECIFIC_STORAGE] and [TYPE_SPECIFIC_STORAGE]
sections of the server.ini file define the tablespace in which to create the object-type tables and
indexes.

FUNCTION_SPECIFIC_STORAGE
Set the parameters in the [FUNCTION_SPECIFIC_STORAGE] section to define the tablespace for the
type tables and indexes for a particular category of object types. EMC Documentum sorts object types
into the categories large and small for the purposes of defining their tablespace.
Object types in the large category are those that are expected to have a large number of object
instances. For example, dm_SysObject is in the large category.
Object types in the small category are those that are expected to have very few object instances.
For example, dm_docbase_config is in the small category. Each repository has only one Docbase
config object.
The format of the [FUNCTION_SPECIFIC_STORAGE] section is:
[FUNCTION_SPECIFIC_STORAGE]
database_table_large=tablespace_name
database_table_small=tablespace_name
database_index_large=tablespace_name
database_index_small=tablespace_name

For example, to define a tablespace for the object-type tables in the large category, include the
following lines in the server.ini file, substituting the name of the tablespace:
[FUNCTION_SPECIFIC_STORAGE]
database_table_large=tablespace_name

For example, to put the indexes for the large category in the tablespace named production_1, include
the following lines in the server.ini file:
[FUNCTION_SPECIFIC_STORAGE]
database_index_large=production_1

You can specify the function-specific parameters singularly or in any combination.

TYPE_SPECIFIC_STORAGE

Set the parameters in the [TYPE_SPECIFIC_STORAGE] section in the server.ini file to define a
tablespace for the type tables or indexes for a specific object type.
The format of the [TYPE_SPECIFIC_STORAGE] section is:
[TYPE_SPECIFIC_STORAGE]
database_table_typename=tablespace_name
database_index_typename=tablespace_name

You can specify the type-specific parameters individually. For example, to put the object-type
tables for the dm_SysObject type the tablespace named sysobj_space, include the following lines in
the server.ini file:

130
 Defining Oracle or DB2 Database Parameters for Repository Tables

[TYPE_SPECIFIC_STORAGE]
database_table_dm_sysobject=sysobj_space

If you want to put both the tables and indexes for an object type nondefault tablespaces, define the
tablespace for each. Defining a tablespace for an object types tables does not affect where the types
indexes are stored. The system creates the indexes in the default tablespace. Defining a tablespace for
a types indexes does not affect where the types tables are stored.
For example:
[TYPE_SPECIFIC_STORAGE]
database_table_dm_sysobject=sysobj_space
database_index_dm_sysobject=sysobj_idx_space

The object-type tables and indexes of any object type not specified in a type-specific parameter are
created in the default tablespace or, if specified, in the tablespace for the types category.
If the server.ini file includes both function-specific and type-specific parameters that apply to
an object type, the type-specific parameters override the function-specific parameters. For example,
suppose you add the following function-specific and type-specific parameters to the file:
[FUNCTION_SPECIFIC_STORAGE]
database_index_large=production_1
[TYPE_SPECIFIC_STORAGE]
database_table_dm_sysobject=sysobj_space

Both parameters apply to the dm_SysObject type because dm_SysObject is in the large category.
The object-type tables for dm_SysObject are created in the sysobj_space tablespace because the
type-specific parameter overrides the function-specific parameter.

Defining the Oracle extent sizes

For the purposes of extent allocation, the Documentum object types are sorted into three categories:
large, small, and default. The category name describes the quantity of expected objects of the type.
For example, dm_document is considered a large type because most enterprises generate large
quantities of documents. In contrast, dm_repository_config is a small type because there is only one
docbase config object in a repository. Those object types that typically do not have large numbers of
objects or very small numbers of objects fall into the default category.
A types category determines how much database storage is allocated to it by default. Object types
categorized as:
Large object types receive an initial extent of 100 KB and a next (second, third, fourth.) extent of
1 MB.
Small object types receive an initial extent of 10 KB and a next extent of 50 KB.
Default object types receive an initial extent of 20 KB and a next extent of 100 KB.
The default storage parameters set the initial and next extent sizes. There are also parameters that
define the default minimum and maximum number of extents allotted to an object type table and
the percentage increase of extents allotted after the second extent. The minimum number of allotted
extents is 1 and the maximum number is determined by Oracle, based on the data block size. By
default, object-type tables and indexes are allocated the minimum number of extents when they
are created.

131
Defining Oracle or DB2 Database Parameters for Repository Tables

The percentage increase default is 10 percent. This means that extents allotted after the second extent
are increased in size by 10 percent over the previously allocated extent. For example, if the second
extents size is 100 KB, then the size of the third extent is 110 KB, 10 percent greater than 100 KB. The
fourth extent would be 121 KB, 10% greater than 110 KB.
You can change the initial and next extent default sizes for an individual object type or for an entire
category by setting parameters in the server.ini file before the repository is created.
You can change the following parameters by using the Oracle ALTER TABLE command through
sqlplus:
Next extent
Minimum extent
Maximum extent
Percentage increase
The Oracle documentation contains the instructions.

Changing storage parameters for individual object

types on Oracle
To change the initial and next extent parameters for an object type, add a [TYPE_EXTENT_SIZE]
section to the server.ini file. This section has the following format:
[TYPE_EXTENT_SIZE]
database_ini_ext_typename=new_value[K|M]
database_next_ext_typename=new_value[K|M]

typename must be the internal name of a system-defined object type. It cannot be a user-defined
object type.
The database_ini_ext_typename parameter defines the size of the initial extent allotted to the type.
The database_next_ext_typename parameter defines the size of the second extent allotted to the type.
new_value is an integer. If you include K, the value is interpreted as Kilobytes. If you include M, the
value is interpreted as Megabytes. If you include neither K nor M, the value is interpreted as bytes.
For example, to change the defaults for dm_sysobject, add the following lines to the server.ini
file:
[TYPE_EXTENT_SIZE]
database_ini_ext_dm_sysobject=new_value[K|M]
database_next_ext_dm_sysobject=new_value[K|M]

You can set either parameter or both for an object type. The section can include parameter
definitions for more than one object type. For example:
[TYPE_EXTENT_SIZE]
database_ini_ext_dm_sysobject=new_value[K|M]
database_next_ext_dm_sysobject=new_value[K|M]
database_next_ext_dm_user=new_value[K|M]

132
 Defining Oracle or DB2 Database Parameters for Repository Tables

Changing storage parameters for categories of types

on Oracle
To change the initial and next extent parameters for all object types in one category, add a
[FUNCTION_EXTENT_SIZE] section to the server.ini file. This section has the following format:
[FUNCTION_EXTENT_SIZE]
database_ini_ext_large=new_value[K|M]
database_ini_ext_small=new_value[K|M]
database_ini_ext_default=new_value[K|M]
database_next_ext_large=new_value[K|M]
database_next_ext_small=new_value[K|M]
database_next_ext_default=new_value[K|M]

The database_ini_ext_large parameter defines the size of the initial extent allotted by default
to object types categorized as large.
The database_ini_ext_small parameter defines the size of the initial extent allotted by default to
object types categorized as small.
The database_ini_ext_default parameter defines the size of the initial extent allotted by default to
object types categorized as default.
The database_next_ext_large parameter defines the size of the second extent allotted by default
to object types categorized as large.
The database_next_ext_small parameter defines the size of the second extent allotted by default to
object types categorized as small.
The database_next_ext_default parameter defines the size of the second extent allotted by default to
object types categorized as default.
new_value is an integer. If you include K, the value is interpreted as Kilobytes. If you include M, the
value is interpreted as Megabytes. If you include neither K nor M, the value is interpreted as bytes.
For example, to change the default extent sizes for all large object types, add the following to
the server.ini file:
[FUNCTION_EXTENT_SIZE]
database_ini_ext_large=new_value[K|M]
database_next_ext_large=new_value[K|M]

You can set any combination of the parameters. It is not necessary to set the parameters for all
three categories. You can also set only one of the parameters for a category. To illustrate, the
following example sets the initial extent for objects categorized as large and the next extent for
object types categorized as default:
[FUNCTION_EXTENT_SIZE]
database_ini_ext_large=200K
database_next_ext_default=120K

User-defined object types

A user-defined object type derives its database storage parameters from its supertype. If the type
has no supertype, then the type is assigned to the large category for tablespace assignment and to
the default category for the extent allocations.

133
Defining Oracle or DB2 Database Parameters for Repository Tables

You cannot change the storage parameters for user-defined object types.
On DB2, if you create a tablespace for objects of type dm_SysObject, then create a user-defined object
type whose supertype is dm_SysObject, the user-defined object type is not stored in the tablespace
for dm_SysObject. Instead, the user-defined object type is stored in the default tablespace, unless
you define the tablespace for dm_SysObject in the server.ini file.

134
 Appendix E
SSL Tools

This appendix describes the information on SSL tools.

OpenSSL
OpenSSL is a widely-used SSL library or tool. You can use it to generate certificates and keys,
convert among the different representations, convert among the key/certificate/store formats, dump
key/certificate/store details/contents, debug connections, and so on.
The OpenSSL documentation contains more information.

Keytool
Keytool is a widely-used SSL tool. You can use this tool to generate certificates and keys, convert
among the different representations, convert among the key/certificate/store formats, dump
key/certificate/store details/contents, and so on.
The Java documentation contains more information.

135
SSL Tools

136
 Index

A requirements, 30
Accelerated Content Services (ACS) connection broker, 14, 55
Server, 13 connection brokers
active/active clusters, 90 in resource groups, 83
described, 84, 89 connection mode, 18, 65
first cluster resource group, 89 to 90 Content Server, 13
server.ini file, 90 Content Storage Services, 18
verifying failover, 91 in resource groups, 83
active/passive clusters internationalization, 39
configuring, 85 Retention Policy Services, 18
configuring the repository, 86 uninstalling, 94
creating resource groups, 85 uninstalling Content Server, 93 to 94
creating resources, 87 Content Storage Services, 18
described, 84 create_fulltext_objects.ebs, 120
installing Content Server, 85 csec_plugin_upgrade_53.ebs, 120
verifying failover, 89 cyclic groups, 101
application server, 13
D
B data directories, described, 116
backing up keystore files, 66 data directory, 17
database
code page, 22
C database location, 84
ci_schema_install.ebs script, 120 databases
clients directory, 117 DB2, 25
cluster resource groups Windows requirements, 22
creating, 85 DB2
resources, 85 current configuration, 35
cluster resources environment variables, 25
creating, 87 performance wizard, 25
code pages requirements, 25
supported, 39 dba directory, 117
common directory, 117 dd_populate.ebs script, 120
config directory, 117 desktop_client.ebs script, 120
configuration dfc.ebs script, 120
basic server installation, 120 directories
default, 120 clients, 117
file locations, 117 common area, 117
objects, described, 124 config, 117
overview, 124 content storage, 84

137
Index

data, 116 F
dba, 117 failed filestore configuration,
DM_HOME, 117 troubleshooting, 109
event subdirectory, 117 failover, 84
events, 117 failover verification, 91
log, 117 failover, verifying, 89
product, 115 files
required for installation, 30 services, 32
SDK, 117 tnsnames.ora, 34
share, 117
temp, 117
version, 30 G
disks, shared, 84 global registry, 15
display_config_setup.ebs script, 120 global registry user, 15
dm_apply_formats.ebs script, 120 groups
dm_cas_install.ebs, 120 installation owner, 27
dm_change_password, 54
dm_check_password, 54
dm_gwm_install.ebs script, 120
H
DM_HOME environment variable, 30, 117 headstart.ebs script, 120
dm_ldap_install.ebs script, 120 high-availability (HA), 71
dm_root_task script, 54 host locales, 39
dm_routerConv_install.ebs script, 120
dm_wfTimer_upgrade.ebs, 120 I
dm_xml_install.ebs script, 120
installation checklist, 111
Documentum Content Intelligence
installation logs, 61
Services, 120
installation models, 15
DOCUMENTUM environment variable, 30
basic installation model, 16
Documentum Foundation Classes
installation owner, 26
dfc.ebs script, 120
email account, 27
Documentum Foundation Classes
environment variables, 30
(DFC), 13
password, 27
Documentum Offline Client, 120
required permissions On UNIX and
Linux, 27
E uninstalling Content Server, 93 to 94
environment variables, 30 username, 27
DB2, 25 Windows requirements, 27
DM_HOME, 30 Windows rights, 27
DOCUMENTUM, 30 installation owner group, 27
installation owner environment, 30 installation workflow, 53
LANG, 39 installing Content Server
ORACLE_HOME, 24 basic configuration for server, 120
events subdirectory, 117 configuration requirements, 30
external password checking, 27 configuration scripts, 120
external password validation, 27 configuring repositories, 86
database, 25
DB2, 25
directory structure, 115
environment variables, 30

138
 Index

Microsoft Cluster Services, 83 O

UNIX and Linux group accounts object type categories, 125
required, 27 offline_config_setup.ebs script, 120
internationalization, 39 optional modules, 18
database code page, 22 Oracle
server host code pages, 39 CONNECT privileges, 28
SQL Server, 22 database aliases, 34
Unicode, 22 environment variables, 24
ORACLE_HOME, 24
J repository owner requirements, 28
Java Method Server (JMS), 13 RESOURCE privileges, 28
TNS aliases, 34
tnsnames.ora file, 34
K ORACLE_HOME environment
keystore files, backing up, 66 variable, 24
order of uninstalling, 93
L
LANG environment variable, 39 P
local administrators group, 27 passwords, 27
log directory, 117 port numbers, 32
logs, server installation, 61 ports
native connections, 32
secure connections, 32
M postinstallation tasks
Microsoft Cluster Services, 90 PURGE AUDIT, enabling, 62
active/active clusters, 84 reviewing server installation logs, 61
active/passive clusters, 84 preinstallation requirements
configuration options, 84 database administrator account, 22
configuring active/active clusters, 89 database code page, 22
configuring active/passive clusters, 85 DB2, 25
to 86 directories, 30
connection broker projection, 90 DM_HOME, 30
content storage directories, 84 environment variables, 30
database location, 84 installation directory, 30
Documentum configurations, 84 supported code pages, 39
installation choices, 84 product directory, described, 115
modifying server.ini file, 90 PURGE AUDIT job, 62
preinstallation tasks, 84
repository owner, 28
resource groups, 83 R
shared disks, 84 remote key management, 40
user permissions, 84 replicate_bootstrap.ebs script, 120
verifying failover, 91 repositories
active/passive cluster, 85
configuring, 86
N services file entries, 32
native connections, 32 user authentication, 29
users, 29
repository, 13, 57

139
Index

repository configuration failure, 101 stalled server upgrade,

repository configuration scripts troubleshooting, 101
ci_schema_install.ebs, 120
create_fulltext_objects.ebs, 120
csec_plugin_upgrade_53.ebs, 120
T
dd_populate_install.ebs, 120 temp directory, described, 117
desktop_client.ebs, 120 templates.ebs script, 120
dfc.ebs, 120 tnsnames.ora file, 34
display_config_setup.ebs, 120 toolset.ebs script, 120
dm_apply_formats.ebs, 120 troubleshooting
dm_cas_install.ebs, 120 diagnosis, 97
dm_gwm_install.ebs, 120 failed filestore configuration, 109
dm_ldap_install.ebs, 120 repository configuration failure, 101
dm_routerConv_install.ebs, 120 stalled server upgrade, 101
dm_wfTimer_upgrade.ebs, 120 Trusted Content Services
dm_xml_install.ebs, 120 port numbers, 32
headstart.ebs, 120 services file, 32
offline_config_setup.ebs, 120
replicate_bootstrap.ebs, 120 U
templates.ebs, 120 Unicode, 22
toolset.ebs, 120 uninstalling Content Server, 94
upgrade_java_methods_51.ebs, 120 Content Server, 93
repository owner, 28 installation owner, 93 to 94
Microsoft Cluster Services, 28 order, 93
Oracle, 28 requirements, 93 to 94
SQL Server, 28 UNIX and Linux requirements, 54
repository user, 29 directories, 30
resource groups, 83 environment variables, 30
Retention Policy Services, 18 installation owner account, 27
root task, 54 services file, 32
shells, 30
S upgrade_java_methods_51.ebs script, 120
scripts users
dm_root_task, 54 authentication on Windows, 29
repository configuration, 120 UTF-8 code page, 39
SDK directory, 117
secure connections, 32 V
server installation logs, 61 verifying failover, 89, 91
server.ini file, 90 version directory, 30
database_conn key, 34 virtual IP addresses, 83
services file, 32 virtual network hostnames, 83
port numbers, 32
service name, 32
share directory, described, 117 W
shared disks, 84 Windows
SQL Server user authentication, 29
custom installation, 23 Windows requirements
internationalization, 22 database service, 22
repository owner requirements, 28 installation owner user rights, 27

140
 Index

local administrators group, 27

141