Before we get SecurityInsider configured, here is what SecurityInsider needs from a technical perspective:
- For using the SecurityInsider Database:
An IBM Lotus Notes Standard (Eclipse) client Release 8.5.2 or higher
- For performing a SecurityInsider Scan:
An IBM Lotus Notes client Release 8.5 or higher
IBM Lotus Domino servers Release 8.5 or higher
Servers that are scanned remotely can be of any Notes/Domino Release from 4.x and up
- Wherever a SecurityInsider scan is being carried out from (client or server), you may have to adjust this parameter in notes.ini:
The JavaMaxHeapSize defaults to 64 MB on Notes clients and 32-bit Domino servers if not set differently in notes.ini. 64-bit Domino servers often default to 1,024 MB. To see how much Java memory is available on your server, create a Java scheduled agent with the following code:
System.out.println("Java memory (in bytes): " + Runtime.getRuntime().maxMemory());
This will print the current JavaMaxHeapSize to the server console.
Whether you require a higher JavaMaxHeapSize setting depends on the following factors:
- The number of groups and users in your public addressbook
- How large your groups are (the more large groups you have, the more memory is required)
- How many databases are scanned as per server and especially how many users have access to your databases (the more databases you have and especially the more users that have access to your databases, the more memory is required). Some of the memory is freed up during scanning when moving from server to server.
- Whether endpoint processing is enabled or not (endpoint processing typically at least doubles memory requirements)
A customer with 12,000 users and 3,000 groups may require 128 MB or more
A customer with 150,000 users and 12,000 groups may require 1,024 MB or more
Domino under OS400 only recognizes JAVAMAXHEAPSIZE values expressed as bytes.
Domino under all other platforms can have JAVAMAXHEAPSIZE expressed as bytes or megabytes. Use the suffix MB to indicate megabytes. For example, specifying "64MB" is the same as "67108864".
In order for changes to this setting to take effect, the JVM must be restarted. In many cases, this means that the Notes client / Domino server needs to be restarted.
- Note that a Domino server instantiates memory according to JavaMaxHeapSize PER AGENT MANAGER!
This means that if a Domino server has four (4) Agent managers configured and JavaMaxHeapSize is set to 1024 MB, the Domino server will grab 4*1024MB = 4 GB of memory upon server startup!
Unfortunately there is no way to only have one particular agent manager run SecurityInsider and only associate a higher JavaMaxHeapSize to one particular agent manager.
- Also note that if the JavaMaxHeapSize is not sufficient during a SecurityInsider scan, your server may crash by running out of memory - this has nothing to do with SecurityInsider, but with the way Domino & Java handle insufficient memory - it is therefore HIGHLY RECOMMENDED to first run a production-like scan from a dedicated workstation to determine the best JavaMaxHeapSize setting.