Page 1 of 2

Migration Options

Posted: Fri Sep 14, 2018 1:35 pm
by yellowhousejake
Good day,

I am in process of replacing our Zimbra 8.0.7 installation with a new box running Ubuntu 16 and Zimbra 8.8.9. While we are perfectly happy with 8.0.7, it is no longer covered by our paid support. I have read through the forums and wiki articles and, as always, consulted everything written by AJCody. I still have some questions I cannot find answers to.

Obviously, is there a preferred migration method? It seems several options from REST, to backups, to zmztozmig are used with success by others. But there is no "Official" supported method that I could find.

What will happen with HSM? We recently began using HSM and it is working well. When I migrate the mailboxes will HSM begin a large run that night or will the messages be stored in the proper HSM volume on the new server during migration?

I made all the required changes for SSL to enable us to get an A+ grade at SSL Labs (now down to B because of AEAD). Will the 8.8.9 version pass SSL testing after install, or will I need to make modifications again?

Thanks for any suggestions.

DAve

Re: Migration Options

Posted: Fri Sep 14, 2018 2:27 pm
by phoenix
Use the ZeXtras Migration Tool, it's the easiest method for moving to a new server.

Re: Migration Options

Posted: Fri Sep 14, 2018 2:45 pm
by yellowhousejake
phoenix wrote:Use the ZeXtras Migration Tool, it's the easiest method for moving to a new server.
Does anyone know how Zimbra paid support feels about third party apps? I have been stuck in the "It's your vendor. No, it's the app." merry go round before. I am not knocking ZeXtras or Zimbra, but I have been left with no support on another product and it was not a good time.

DAve

Re: Migration Options

Posted: Fri Sep 14, 2018 2:51 pm
by L. Mark Stone
yellowhousejake wrote:
phoenix wrote:Use the ZeXtras Migration Tool, it's the easiest method for moving to a new server.
Does anyone know how Zimbra paid support feels about third party apps? I have been stuck in the "It's your vendor. No, it's the app." merry go round before. I am not knocking ZeXtras or Zimbra, but I have been left with no support on another product and it was not a good time.

DAve
If you have Network Edition, the ZeXtras apps are now included in NE, rebranded slightly as NG (Backup NG, Mobile NG, etc.).

I have been with Support on this a number of times, and installing the full ZeXtras Suite using a Trial License on your old server to perform a side-by-side migration is fully supported.

No worries on this!

Mark

Re: Migration Options

Posted: Tue Sep 18, 2018 1:26 pm
by yellowhousejake
L. Mark Stone wrote:
If you have Network Edition, the ZeXtras apps are now included in NE, rebranded slightly as NG (Backup NG, Mobile NG, etc.).

I have been with Support on this a number of times, and installing the full ZeXtras Suite using a Trial License on your old server to perform a side-by-side migration is fully supported.

No worries on this!

Mark
Thank you for the info, it is good to know. I will start reading up on ZeXtras as we do have the NE edition.

Still curious if anyone has migrated when using HSM volumes and if anyone has checked the SSL configuration against third party testing.

DAve

Re: Migration Options

Posted: Tue Sep 18, 2018 2:56 pm
by L. Mark Stone
I get A+ on the Qualys SSL labs test with just a few minor tweaks no problem.

As re HSM volumes, I recall that at one point there was an issue with this, but that it had been fixed. Of the migrations I’ve done this year, none have had HSM issues.

Mark

Re: Migration Options

Posted: Wed Sep 19, 2018 8:07 am
by pup_seba
Hi,

Obviously, is there a preferred migration method? It seems several options from REST, to backups, to zmztozmig are used with success by others. But there is no "Official" supported method that I could find.

This is the method I like: https://wiki.zextras.com/wiki/ZxBackup: ... ras_Backup. Back in the day, if zimbra support ever see anything "zextras", they would immediatly point that as the responsable for any problem. Based on Mark comments, I guess that has change since zimbra is now shipping zextras modules. You could even find that zextras migration guide in a zimbra wiki page here https://wiki.zimbra.com/wiki/Zimbra_NG_ ... -migration which I would consider as you call it an '"official" supported method'.

What will happen with HSM? We recently began using HSM and it is working well. When I migrate the mailboxes will HSM begin a large run that night or will the messages be stored in the proper HSM volume on the new server during migration?
I still did not migrate hsm stores with zextras. But I would expect (i'm just guessing here, you should test this on a lab if you have the opprotunity or ask zimbra support if you hava a contract) that the migration process will just recover the information in a primary storage (not in an hsm), later on, you could run a powerstore task (which is actually part of the incremental migration process) and configure it if you want it to be scheduled at nights (hsm is a process one have to excecute to organize things, is not enough to just confiugre the secondary volume).

I made all the required changes for SSL to enable us to get an A+ grade at SSL Labs (now down to B because of AEAD). Will the 8.8.9 version pass SSL testing after install, or will I need to make modifications again?
By default, if your certificate is good, it will pass with an A. It will still show a copule weak ciphers but that won't take that A away from you.

Things to notice when using zextras migration tool, is that the user id (long ldap identifier) is not migrated to the new ldap server, a new one is created instead. With this being said, note that outlook with zimbra connector will need to be reconfigured in case you use it. It could also affect your synched mobile devices (the ones using mobile syncronization via an exchange/active sync account). Nothing to worry about, just be warned so you can warn your users and prepare in case you need to go "desk by desk" to reconnect the outlook connector.

Also, depending on the amount of data you have, which I will guess is quite a lot since you use hsm, note that migration could take a long time. Don't understimate how slow SATA disks are. The main concern about this, is that if you are using an incremental migration procedure, after you do the 1st of your restores, those items won't be modified upon next recovers. This means that if users delete those items, or just move them, those changes won't be reflected on the new servers. So the longer you run the migration, the more changes are going to be lost. Again, nothing to worry about, but users should be aware of this situation before hand so you don't get flooded with support calls with things like "i dont find the email" just because they moved it somewhere and that change was lost.

Another thing important thing to consider when migrating is user id and gruop id. Maybe the zimbra uid and gid in origin server is differnt from destinty server. This could lead to some problem as if they are different, you wont have read access in the destiny server. In this zextras forum thread I started a discussion (only with myself apparently :D) https://forums.zextras.com/zxbackup/180 ... d-gid.html about that very same thing. As right now, I'm testing "number 2" on that list I propose as "number 1" is not working with the nfs server the customer has. I'm not a big fan of creating the zimbra user before the installation, forcing its uid and gid to match the original server, but I guess ( i should try to check that first) that should work just fine too.

As a personal recomendation, you are talking about a "box". Idk if this is your case or not, but I would suggest to have at least 2 servers. 1 with the core services (store/ldap/webapp/logger/etc) and a second one with frontend services (mta/proxy/memcached/dnscache/av/as/etc). So you can put your frontend in your dmz in case you have one.

Anyways, good luck with your migration!!!

Re: Migration Options

Posted: Wed Sep 19, 2018 12:56 pm
by L. Mark Stone
So, just some clarification on the uid, gid and Zimbra ID comments above...

Side by side migrations are absolutely supported by Zimbra using the ZeXtras Trial download on the old Network Edition Server to migrate to a new a Network Edition server (which already includes the ZeXtras Suite, rebranded as "NG" or NextGen"). Indeed, the tools are so good I no longer recommend in-place upgrades at all.

Configuring the new 8.8.x server as an NFS server and configuring the old Zimbra server to use that NFS share as its ZeXtras backup target is my preferred migration method, when both old and new servers are on the same network and ideally connected over a 10Gbps switching fabric. And it is true that because the uid:gid values of the zimbra Linux user account will likely be different on both servers, this can result in permissions issue when doing a restore. The trick here is to have the NFS server write the data from the old server with the uid:gid of the zimbra user on the new server, so the new server can read the local directory with the files already owned by zimbra.zimbra.

This is done like so on the new server:

Code: Select all

[root@mb5 ~]# cat /etc/exports
/export    10.7.57.220(rw,all_squash,async,insecure,no_subtree_check,anonuid=1006,anongid=1005)
[root@mb5 ~]# 
The directory /export on the new server is the NFS share and 10.7.57.220 is the IP address of the old server. 1006:1005 are the uid:gid pair of the zimbra user on the new server. On the old server, mount the NFS share normally, create a "newserverbackups" or somesuch subdirectory (if needed -- if ZeXtras sees a Lost + Found entry in the target backup directory it thinks the directory is not empty and won't let you place the old server's backup there.), and after the old server starts writing files, if you do an "ls -alh /export" on the new server you'll see everything is owned by zimbra:zimbra already.

As re the Zimbra ID (zmprov ga <account_name> zimbraId), because a ZeXtras restore recreates everything fresh on the new server, this unique zimbra mailbox identifier number on the new server will not match the zimbraId for the same mailbox on the old server. In my experience, this means that if you use ZCO (Zimbra Connector for Outlook), you'll need to create a new profile. Since you need to upgrade ZCO anyway, there is an extra burden on the Help Desk and the users, but my customers report this burden is not overwhelming, and gives their Help Desk an excuse to look over each impacted user's workstation/laptop anyway, which isn't a bad thing they report.

Further, on account of this ZimbraId change, a number of mobile devices connected via ActiveSync will trigger a fresh resync of the mailbox. This may trigger excess cellular data usage for some users towards the end of their billing period, especially if they've configured their mobile to keep a long amount of email history.

Bottom Line is that the ZeXtras migration tool for NE customers is awesome, fully supported, and gives you opportunities for testing your migration without having to actually cutover.

Hope that helps,
Mark

Re: Migration Options

Posted: Wed Sep 19, 2018 4:57 pm
by pup_seba
Thanks for the advices! :)

I agree with you in the NFS, in fact, that was the first thing I tried. Sadly, the qnap being used does not allow it for some reason (no option in webui and if we tweak the export file itself and reload the service, it makes no difference).
Image So, if there is a chance to configure an nfs share on the server itself (either destiny or origin), I would say take it! :) sadly that's not the case for every scenario.

"Bottom Line is that the ZeXtras migration tool for NE customers is awesome, fully supported, and gives you opportunities for testing your migration without having to actually cutover."
I completly agree with you. ZeXtras has been a great tool to perform migrations and it is a big step forward for zimbra to finally include it as part of the product.

Re: Migration Options

Posted: Wed Sep 26, 2018 7:48 pm
by yellowhousejake
Thank you pup_seba and Mark,

The NFS option is a preferred on for me and the UID issue is as I would have solved the problem. Good to know it will work. I hope to give a test run a shot within the next week to iron out any issues. I need to look into transferring our licensing first.

DAve