9 File Server Administration

Note: If you use multiple IP interfaces the environment variable EDB_CHOST needs to be set for the interface which should be used. To ensure that EDB_CHOST is used, set the environment variable EDB_CHOST_FORCE.

9.1 File Server Administration Program

This Administration tool enables the management of the File Server. The File Server can be installed automatically with the Agile EDM component-based installation. Three vaults are created automatically (PUB (public), FMS, EIF).

Note: For more information on the component-based installation of the File Server and the standard vaults refer to the Agile EDM Server Guide.

The File Server Administration Tool can for example be used to execute the following functions:

• Stop a File Server

• Reload File Server configuration

• Request File Server information and flush File Server Log

• Set the log level of a File Server

• Create a new vault on a File Server

To execute the functions, the following arguments are available. Options market with * are only available with your File Server account:

-n <rpc>	RPC number of the File Server (Default: 804257548)
-l	Shows the File Server information
-v <number>	Set the log level to number
-k	Sends the shutdown request to the File Server*
-c <Vault Type>	Creates a new vault* EIF - Extended FMS - Standard PUB - Public More information on the specific vault types can be found below in the section "Adding a vault"
-p <path>	The vault path to create a new vault
-r	Reloads File Server configuration from configuration file (fileserver.cfg)*

Examples for using the Administration Tool:

Action	Prompt
Stop a File Server	fms_adm -n 804257548 -k
Request File Server information and flush File Server Log	fms_adm -n 804257548 -l
Create a new vault on a File Server	fms_adm -n 804257548 -c EIF -p /usr/edbserv/vault1

9.1.1 File Server on Windows

On Microsoft Windows, the File Server acts as a normal Windows Service Program and can be started via the Start button > Control Panel > Services. Events will be written to the Windows Event System.

All necessary arguments to run the File Server are provided in the Registry HKEY_LOCAL_MACHINE\Software\Wow6432Node\Agile\AgilePLM_Fileservice.

Note: Because the File Server uses Microsoft Windows Access Lists and Security Checks, it is not possible to use vaults on FAT file systems. Use the NTFS file system for vaults instead. Do not use a domain user for the service account of the File Server.

Key	Default	Description	Optional
LOG_FILE	%FMS_ROOT%\log\fms.log	File Server Log	No
LOG_LEVEL	5	Report Level of File Server Logs	No
MAX_THREADS	10	Maximum number of File Server requested processed in parallel	No
RPC_NMB	804257548	RPC number	No
USER	edbserv	User of service account	Yes
CHECK_VAULTS	1	Check of standard vault (0=off)	Yes
REQ_LICENSES	None	Requested licenses: FMS_DFM = DFM	Yes
CORE_LOG	%FMS_ROOT%\log\fms_core.log	Extended log (replaced by EP_ERRLOG)	Yes
EVENT_LOG_FILE	off	The values for EVENT_LOG_FILE. "on" - Create a special log file for some FMS operations, called events. For each FMS operation only one line is written into the log file. The log file is written in the sub directory log of the FMS and is called event.log "off" - no Log file is created	Yes
SECURITY_LEVEL	0x00000003 (3)	0 = Do not set and check file access 1 = Set and file access explicitly, shows warning in log file 2 = Sets file access explicitly bit does not check them 3 = Sets and checks file access explicitly and reports error when not possible.	Yes

9.1.2 File Server on UNIX

When running the File Server UNIX additional arguments are available:

-h	Shows help
-version	Shows version
-c <0|1>	Disable or enable vault checks on startup
-f	Disable check for additional licensed functions (DFM)
-r <licences>	Requested licences (available: FMS_DFM)
-t <retry>	Retry to request licences (on startup)
-u <user>	Use another user account
-n <number>	Use another RPC number than the default (804257548)
-m <number>	Max. number of parallel tasks (= user requests), default is set to 30
-l <file>	Another name for the log file (default is log/fms.log)
-verbose	Write all possible information to log file
-short	Write only errors to log file.

The following example sets the command to use the RPC number 777777777 with a maximum of 10 parallel accesses with all log messages on standard output.

fms_srv -n 777777777 -m 10 -v -l - &

Note: : Support of homogeneous networks (UNIX LAN) comprised of clusters or local nodes. Heterogeneous networks have been taken into account in the design process.

In the UNIX part, Berkley Services rpc must be available at all nodes.

9.1.3 File Server Log

Log information for the File Server is written to the file fms.log (default: %FMS_ROOT%\log\fms.log). Error messages and warnings are written into the Event Log (Windows) or the syslog (UNIX).

The File Server log can be configured by setting the following properties in the File Server configuration file (fileserver.cfg). The file can be found in the root directory of the File Server.

Table 9-1 File Server Log

Name	Default Value	Possible Values	Description
MaxFileSize	10000	1000-100000	The maximum file size for the fms.log in KB
MaxBackupIndex	10	1-9999	The maximum number of backup files like fms.log_0001 If the maximum number of backup files is reached a warning will be written to the syslog/ Event Log.
OverwriteOldLogs	yes	yes or no	This setting controls if the File Server overwrites old backup files. If an old backup log is overwritten, a warning will be written to the syslog/ Event Log.
StopOnError	no	yes or no	This setting controls if the File Server stops to work when no new log can be created. If set to yes, an error message is displayed and posted to the system log file as soon as no new log file can be created. The File Server administrator then needs to move the log files out of the log directory either by moving all backup logs or moving all backup logs except the fms.log. If the logs were removed, the File Server works again, a re-start is not necessary.

9.1.4 Adding a vault

With the standard installation the vaults are created automatically. To set up a vault you first need to create the vault definition within Agile EDM and in the next step in the Administration tool.

Vaults must be created by the system administrator as a physical entity in the network. To create the vault directories use the File Server Administration Tool:

fms_adm -n <rpc> -C <Vault Type> -p <path>

Once this is done, the area can be registered with the storage area management functions of Agile e6.

More detailed information on directory/file permissions for the vaults can be found in the Agile EDM Security Guide > Agile e6 Users and Permissions Detailed Access > File Server User Permissions

Note: Protected areas - referred to as storage areas - can be defined at any node of the network that provides File Server services. Such areas can only be accessed with SYSTEM or ROOT privileges.

9.1.4.1 Create a vault definition within the Agile EDM system

Vaults define and reserve a protected part of a storage media on individual computers or within a network. Access to this areas must go through the Agile e6 file management system and is restricted to users with the necessary access rights. Generally speaking, storage areas can be defined on any storage media within a network.

Vaults in a network are defined on the operating systems level using system privileges. Vault management functions of Agile e6 can be found in the File Server FMS-Vault mask. It is reasonable to create only such vaults that physically exist in order to ensure system integrity.

1. In Agile e6, select Manager > File Management > Vaults.

2. In Insert Mode, fill in the following fields:

   Field Name	Description
   Vault	Unique name of the vault
   Type	IN: Check-in, vault for standard file management operations BCK: Backup area, vault used for the file backup EXT: External storage area, vault that is used for export operations Or additional storage areas if required (additional areas are treated like "IN" type storage areas).
   Kind	FMS: Standard vault, encrypted machine-dependent vault (with predefined names) PUB: Public storage area, public vault with direct read access for all users via mounts or client programs EIF: Extended storage area, encrypted machine-dependent vault (with cache directories); meta files are created for each file. Or additional storage areas of other File Servers are used.
   Site	Defines the physical location of the computer.
   Node	Name of the computer/disc node of the corresponding vault.
   Disc + path	Defines the physical location of the computer. Name of the computer/disc node of the corresponding vault. Name of disc and path of the vault. Entry always has to end with a "/".
   Network reference	Automatically generated entry. Network reference for the File Server.
   FMS Daemon Host	Name of the FMS daemon host.
   FMS Daemon Port	Name of the FMS daemon port.
   Name	Automatic system entry: User name of the user who created the vault.
   Date	Automatic system entry: Date of creation.
   Remark	User comments.

   
   

   To create a vault for the Web Client, additional information needs to be entered under the tab Web-Address and fill in the fields:

   Field Title	Description
   Protocol	Protocol for the Web File Service (e.g. http)
   Host	Host name where the Web File Service runs
   Port	Port number of the Web File Service
   Path	Servlet Path on the Web Server (Default: /FileService)

   
   

3. Save the entry.

9.1.4.2 Registering the vault on the File Server by using the FMS Administration tool (fms_adm)

1. After the installation of the File Server the fileserver.cfg configuration file must be adapted to match the vault definition within Agile e6.

   The fileserver.cfg defines the ”valid” vault paths for the File Server.

   In the default configuration file the standard vaults created by the File Server during startup are pre-configured and you need to add your vault path:

   [Vaults]
   FMS=fms/
   EIF=area/
   PUB=pub/
   

   For example you have two additional vaults in your Agile e6 vault definition:

   Vault Name	Host Name	Path
   CADFiles	fms.example.com	/app/fms/vaults/cad/...
   OfficeFiles	fms.example.com	/app/fms/vaults/offiice/...

   
   

   Then the fileserver.cfg should contain the following entries:

   [Vaults]
   FMS=fms/
   EIF=area/
   PUB=pub/
   CADFiles=/app/fms/vaults/cad/
   OfficeFiles=/app/fms/vaults/office/
   

   
   

   Note: In the configuration file fileserver.cfg the size for transfer packages can be configured independently for every client. Also the default package size can be configured.

   
   

2. Reload the configuration using the FMS Administration Tool.

   e.g. fms_adm -h fmsHost -n 804257548 -r

9.1.5 File Server Functionality in the EDM System

Several administration functions for Manager/System Users are available in the Agile EDM system itself.

• Export files not needed regularly and move to an external vault

• Import files - re-import files which were previously exported to an external vault if they need to be changed or viewed by the user.

• Move a file to a Backup vault

• Restoring files from a Backup vault

The import, export, or transfer of files must be performed by a system administrator. Users may only request that files are imported / exported (flag ID) using the file management functions.

The import, export, and transfer of files as well as backup, retrieve, copy, and distribute functions for files are only available between vaults of the same storage type, i.e. FMS -> FMS, PUB -> PUB, EIF -> EIF.

9.1.5.1 Export files

Note: Files cannot be exported unless an export request has been generated for the file (Status A).

1. Select Manager > File Management > Files.

2. Select the file to be exported.

3. Select Export file from the context menu.

4. Select a vault of the type EXT.

   The original file will be deleted after the export. The external vault may later be archived on storage media using operating system functions.

Note: "Files can only be exported to vaults of the vault type "EXT". The vault type ("FMS", "PUB", "EIF", etc.) of the source area and the external area must be identical. Agile e6 cannot write directly to a secondary storage media It can only access devices that feature a file system (such as CD-ROM drives).

9.1.5.2 Import Files

Exported files must be re-imported before they can be viewed or modified. After an import request has been generated, the file can be imported into the system (Status E). The file to be imported must exist in the export area and needs to be copied from a secondary storage media to the corresponding export area.

1. Select Manager > File Management > Files.

2. Select the requested file to be imported.

3. Select Import from the context menu.

Note: Files must be imported from devices with a file system (e.g. CD-ROM drives).

9.1.5.3 Transfer File

This function transfers the selected files from a specified vault to another vault. The file must exist at the specified location in the source area (BCK and EXT type vaults are an exception). The file is deleted in the source area once the transfer is completed.

1. Select Manager > File Management > Files.

2. Select the file to be transferred.

3. Select Transfer from the context menu.

4. Select a vault.

   The files stored in a vault of the type "BCK" (backup) or "EXT" (external), need not to be present at the specified location since the File Server cannot access secondary media. Only the relationships will be updated.

   The storage area type (FMS, PUB, EIF, ...) of the source and target areas should be identical.

9.1.5.4 Move a File to a Backup Vault

This function transfers files from a specified vault to a backup vault. A system administrator may later archive the contents of the back vault using operating system functions.

1. Select Manager > File Management > Files.

2. Select the file to be moved to the backup area.

3. Select Backup from the context menu.

4. Select a vault.

   
   

   Note: Files must be imported from devices with a file system (e.g. CD-ROM drives).

   
   

   Backup files must be transferred to backup vaults (vault type must be "BCK").

   The vault type ("FMS", "PUB", "EIF", etc.) of the source area and the target area must be identical.

   Exported files (vault type "EXT") and files in a backup vault (vault type "BCK") cannot be archived with this function.

   Files can only be stored once in a vault. Consecutive backup operations of a file to a vault will overwrite the original backup file.

9.1.5.5 Restore a File

This function restores a file from a specified (backup) vault at its original location in the vault. The file to be restored in the system must exist at the specified location of the backup area. The system administrator needs to copy files to be restored in the system from a secondary storage media to the corresponding backup area.

1. Select Manager > File Management > Files.

2. Select the file to be restored into the system.

3. Select Store back from the context menu.

4. Select a vault.

Note: Files must be imported from devices with a file system (e.g. CD-ROM drives).

Files can only be restored from a vault (storage area) of vault type "BCK".

The vault types ("FMS", "PUB", "EIF", etc.) of the backup vault and the original (target) vault must be identical.

Exported files (vault types "EXT") cannot be restored in the system. Distributed copies of files that have been distributed to several vaults will be marked as "not actual" (relationship status "N"). Only the original file will retain the "actual" status (relationship status "A").

In case of an original file the "Change date" and "File size" fields will be updated once the restore process is complete.

9.1.5.6 Distribute Files into a different Vault

Sometimes files need to be distributed into several vaults. Distribution into several vaults can ensure that users, who do not have access to certain areas, will have access to certain files or you may wish to distribute into additional backup vaults.

9.2 Web-enabled File Server

If you are operating a data service or a file service you will need to install the servlets into your Tomcat servlet container. If a site is just implementing one of the two it can switch off not needed servlets by adapting the web.xml configuration file. If you operate a file service the servlets will need access to the usual native fms libraries.

Normally the presentation service will be tightly coupled with the data service. But if you have access to existing services on your network you could just access these services in your presentation service and would not need to install the servlets. Still the access to the data service must be protected with authentication and authorization mechanisms as mentioned above.

The users do not need to install DLLs or other components on top of the browser.

If you use a web presentation service (Web Client), the Web File Service requires access to this! Using a Java Client the access is not required.

The web based file management assumes three factors:

• A (meta) data service in cooperation with a presentation service to manage data about documents and files and display it to the user.

• Access to these services must be protected with authentication and authorization mechanisms.

• A file service that manages the physical files. A user or application who wants to check-in, check-out or delete files via the browser.

These factors may be based on different machines connected through LAN or WAN or just on one machine (mainly during test). In most cases all services will run on one machine while the users browser will run on a different machine. For better security the communication between the user and the services should use SSL connections. The communication between the services is based on encrypted messages.

9.2.1 Technical View of the WebFile Server

9.2.1.1 Secure Socket Layer (SSL)

Web servers support the HTTPS protocol which encrypts the data to inform the caller about the server the data is coming from.

For more information about setting up the HTTPS environment refer to the Apache Tomcat Security information on the following Apache Web page: http://tomcat.apache.org/tomcat-8.0-doc/security-howto.html

9.2.1.2 Communication Path during File Viewing

This section describes the communication between the several components in a medium and high-end security environment.

Software components:

Browser	The browser is used to access the web site on the Web Server.
Web Client	The Web Client is a web service, which gains access to the Agile EDM system.
FMS Data Service	The FMS Data Service is an internal service, which provides the Meta data for the file access.
Web File Service	The Web File Service provides the file access for the user.
PLM Server	The PLM Server represents the Agile EDM system.
File Server	The File Server manages the files within the Agile EDM system.

Communication steps:

1. The user pushes the viewing button to view a file.

2. The Web Client calls the xfile userexit over ECI.

3. The PLM Server calls the FMS callable over ECI (the Meta data will be stored in the Cache of the FMS Data Service).

4. The Web Client responds a redirection URL to the browser and the browser sends a GET request to the Web File Service (the request contains an access ticket).

5. The Web File Service decrypts the access ticket and sends a signed request envelope to the FMS Data Service to gain the Meta data.

6. The FMS Data Service responds with a signed envelope, which contains the Meta data.

7. The Web File Service calls the File Server via RPC by using the FMS client library. The RPC return packet contains the socket for the file transfer.

8. The File Server creates a new thread for the file transfer and sends the file via socket to the calling Web File Service.

9. The Web File Service sends the receiving data without caching as respond of the redirection GET request to the browser.

The high-end security environment communication is a little bit different.

Software components:

Browser	The browser is used to access the web site on the Web Server.
Web Client	The Web Client is a web service, which gains access to the Agile EDM system.
FMS Data Service	The FMS Data Service is an internal service, which provides the Meta data for the file access.
Web File Service	The Web File Service provides the file access for the user.
PLM Server	The PLM Server represents the Agile EDM system.
File Server	The File Server manages the files within the Agile EDM system.

Communication steps:

1. The user pushes the viewing button to view a file.

2. The Web Client calls the xfile userexit over ECI (the PLM Server checks if a proxy configuration is available for the Web Client site and adds the proxy data to the Meta data).

3. The PLM Server calls the FMS callable over ECI (the Meta data will be stored in the Cache of the FMS Data Service).

4. The Web Client responds a redirection URL to the browser and the browser sends a GET request to the Web File Service (the request contains an access ticket).

5. The Web File Service decrypts the access ticket and sends a signed request envelope to the FMS Data Service to gain the Meta data.

6. The FMS Data Service responds with a signed envelope, which contains the Meta data.

7. The Web File Service generates a POST request to the Web File Service, which is running on the internal Web Server to get the file. The POST request contains an encrypted envelope with the Meta data.

8. The Web File Service calls the File Server via RPC by using the FMS client library. The RPC return packet contains the socket for the file transfer.The File Server creates a new thread for the file transfer and sends the file via socket to the calling Web File Service.The Web File Service sends the incoming file data without caching to the calling proxy Web File Service.The (Proxy) Web File Service send the receiving data without caching as respond f the redirection GET request to the browser.

9.2.2 Configuration

Note: The JNI of the 64bit JVM does not work with 32bit libraries and the File Server client library cannot be loaded.The 32bit JVM is the only supported JVM on AIX.

The possibilities to configure the Web Proxy Server of the web file management system is described here.

The web proxy supports a main switch to activate or deactivate the proxy mechanism. The main switch is accessible via the "Configuration parameter" mask (Manager > System Configuration > Other Parameters).

EDB-FMS-PROXY -> ON/OFF (default)

You have to insert this configuration parameter to activate the proxy mechanism.

In case of a high-end security environment, the Web File Service on the external Web Server works as a proxy to the internal Web File Service. The definition of a Web Proxy needs two steps.

1. Define a default proxy for a site or a specialized proxy for a vault for the site.

   You can define a set of default proxy entries for several sites, by adding the information of the external Web Server with the path to the (Proxy) Web File Service.Additionally, you can define a set of proxy entries for several sites, by adding the information of the external Web Server with the path to the (Proxy) Web File Service. If a vault has no proxy information, the default proxy information is used.

   Field Name	Description
   Site	Site of Web Client
   Protocol	Protocol for the Web FileService (e.g. http)
   Web Host	Host name where the Web File Service runs
   Web Port	Port number of the Web FileService
   Web Path	Servlet Path on the Web Server (Default: /FileService)

   
   

2. Set the site information in the configuration file of the Web Client.

   Each external Web Client should have a unique site information, so that the PLM Server could decide if a (Proxy) Web File Service is necessary. You can add this information in the webplm.properties file of the Web Client, which is located in the <webclient_root>/config directory.

   The following line sets the site "www" for this Web Client:

   axalant.env.EP_PROXY_SITE=www
   

9.2.3 Administration

The Config file web.xml

The web file service has a configuration file to setup the necessary data for the servlets.

The General Section

Key	Default	Description
Webmaster	[e-mail]	The e-mail address of the administrator to whom questions and comments regarding this application should be addressed to.
tracemasks	Default all 0	Trace masks and flags for packages and classes: 0 - no output 1 - trace output 2 - debug output 3 - trace and debug output

9.2.3.1 Servlet definitions

Data Service

A Servlet to handle the data information about file operations. It has a dual role. One role is as a singleton that can be accessed from other classes of the application. The other role is of a servlet that can be POSTed to.

Key	Default	Description
ECIHandleLifeTime	3600	lifetime in seconds before an ECIHandle expires 5min=300 1hr=3600 1day=86400

Check-in Service

Accepts a file posted as multi-part form data and checks it into the file management system. A free (for some requirements see the license) MultipartParser is available from Jason Hunter (www.servlet.com) and his cos.jar is used by FmsCheckinServlet.

Key	Default	Description
maxPostSize	100242880	The maximum size in bytes a posted file may have.

Checkout Service

Handles checkouts from the file management system. File check-outs can be requested from this servlet. A handle must be supplied that has been issued from the application. FmsCheckoutServlet will then initiate a communication with the FmsDataServlet to finish the operation.

Delete Service

Handles delete requests from the file management system File deletes can be requested from this servlet. A handle must be supplied that has been issued from a data source. FmsDeleteServlet will then initiate a communication with the data source to finish the operation.

Additional MIME Types

The following content types are currently mapped to the associated file extensions in the Tomcat web.xml file.

Further content types can be added in the web.xml file!

Mime Content-Type	File Extensions	Comment
application/msword	.doc	Microsoft Word Documents
application/octet-stream	.exe, .bin	Binary
application/pdf	.pdf	Adobe Portable Document Format
application/postscript	.ps	Adobe Postscript
application/rtf	.rtf	Microsoft Rich Text Format Docs
application/vnd.framemaker	.fm, .frm, .frame	Adobe Frame Maker
application/vnd.hp-HPGL	.pgl	HP Graphics Language files
application/vnd.lotus-1-2-3	.wks,.wk3,.wk4,.wg2,.wt4,.123	Lotus 123 Files
application/vnd.lotus-freelance	.pre,.prz,.mas,.prs	Lotus Freelance Files
application/vnd.lotus-wordpro	.lwp	Lotus Wordpro Files
application/vnd.ms-access	.mdb	Microsoft Access Files
application/vnd.ms-excel	.xls,.xlc	Microsoft Excel Files
application/vnd.ms-powerpoint	.ppt,.pot,.pps	Microsoft Powerpoint Files
application/vnd.ms-project	.ppm	Microsoft Project Files
application/vnd.visio	.vsd,.vst,.vsw,.vss	Visio Drawing File
application/x-mif	.mif	Maker Interchange Format (Frame)
application/x-msbinder	.obd	Microsoft Binder Files
application/x-quattro-win	.wb1,.wb2,.wb3	Quattro Pro for Windows Files
image/cgm	.cgm	Computer Graphic Metafile (CGM)
image/g3fax	.fax	Fax
image/gif	.gif	GIF image files
image/jpeg	.jpg,.jpeg,.jpe	JPEG image files
image/png	.png	Portable Network Graphics Files
image/tiff	.tif,.tiff	TIFF Image Files (.TIF)
image/vnd.dwg	.dwg	AutoCad files
image/vnd.dxf	.dxf	AutoCad Interchange Files (.DXF)
image/vnd.fpx	.iges, .igs	Kodak Flash Pix
model/vnd.dwf	.dwf	AutoCad drawing files
text/x-vcard	.vcf	VCard

Several DIFFERENT content types use the same extensions:

Mime Content-Type	File Extensions	Comment
application/wordperfect5	.wpd	WordPerfect 5 documents
application/wordperfect5.1	.wpd	WordPerfect 5.1 documents
application/x-wordperfect6	.wpd	WordPerfect 6 documents