Mindbreeze InSpire G7

Tutorial Video “First Startup and Support”

Learn how to install a Mindbreeze InSpire appliance and perform the initial configuration. We will show you how to set up the network and which Mindbreeze support platforms are available.

https://www.youtube.com/watch?v=IiqqxPZeS_g

Preparation

Please find inside a short guide to help you prepare your infrastructure for Mindbreeze InSpire.

Please provide us with the desired fully qualified host names for Mindbreeze InSpire (e.g. search.companyname.com), the technical contact for the implementation and suitable dates for the on-site support via our Mindbreeze InSpire contact form: https://www.mindbreeze.com/inspire-contact. Please also provide us with all data sources that you would like to link to the search. If necessary, also provide us with the authentication mechanism to be used for the search (e.g. Kerberos, SAML, etc.).

Necessary hardware resources

• Mindbreeze InSpire is envisaged for installation in a 19” server rack.
  2RU are required – please reserve this space.
• We recommend making two power connections available for the Mindbreeze InSpire server to guarantee a failsafe power supply (each 750W rated output).
• If possible, please prepare 2 Ethernet LAN connections so that the network bonding can be configured. For this both connections must be in the same sub-network. An Ethernet LAN connection is essential.
• To connect the Remote Management Interface (iDRAC), you require a 3rd Ethernet port. Please make sure that it is assigned a correct IP address (DHCP/manual). The assigned IP address can then be viewed on the front panel display or in BIOS. This IP is mandatory for the initial contact with our consulting team.

Mindbreeze Service Users

For Kerberos-based authentication with Active Directory you must set up a service user in Active Directory, e.g. mindbreeze.service. Please ensure that the following requirements are met:

• There must be an NTP server that is time synchronous with your Active Directory server and that the Mindbreeze InSpire appliance can access.
• The user exists in Active Directory
• The user has the service principal name
  HTTP/<fully qualified host name for Mindbreeze InSpire>
  As Active Directory domain administrator you can set the service principal name in a Windows prompt with the following command:
  setspn –s HTTP/<full qualified hostname for Mindbreeze InSpire><domain>\<mindbreeze.service>
  Sample:
  setspn –s HTTP/search.companyname.com company\mindbreeze.service
• The fully qualified hostname must have a DNS listing.
• The service user must have the “Trusted for Delegation (Kerberos only)” attribute set. You can set the attribute “Trusted for Delegation (Kerberos only)” for the user in the Microsoft Management Console under “Active Directory Users and Computers”.

Optional Service User

To crawl the data sources, users with full read access rights for all data to be indexed should also be created. These are only used by Mindbreeze to index data.

Firewall Configuration

Please ensure that the following network connections are activated for the Mindbreeze InSpire server:

• As a minimum, port 443 for the Mindbreeze Client Service must be accessible by all users
• Port 8443 and 22 are accessible by administrators
• Port 2222 is available for synchronization of InSpire Appliances
• Ports 88 and 389 on all Active Directory servers must be accessible by the Mindbreeze InSpire Service
• Among data sources, other services and the Mindbreeze InSpire Appliance appropriate ports must be unlocked (e.g. NTP: Port 123)

Technical Requirements

Electrical and Other Technical Requirements for installing your Mindbreeze InSpire Appliance

Preparation

Your Mindbreeze InSpire Appliance must be installed in a location meeting the temperature, electrical, refrigeration, and other requirements shown in the following tables.

Requirements for Mindbreeze InSpire R760

Requirements for Mindbreeze InSpire R750

Requirements for Mindbreeze InSpire R740

Mindbreeze Management Center

Preparation

The Mindbreeze InSpire Management Center is the interface where administration and management tasks can be performed on a Mindbreeze InSpire Search Appliance.

Browser Support

The Mindbreeze InSpire Management Center is fully supported in the following browsers:
Google Chrome, Mozilla Firefox, Apple Safari.

Firewall Configuration

For accessing the Mindbreeze InSpire Management Center make sure that the following network ports are accessible on the connected Mindbreeze InSpire server network interfaces.

Admin and Management Ports:

• Port 8443 (HTTPS) for accessing the Mindbreeze Management Center
• Port 22 (SSH) for accessing the Mindbreeze System Configuration Interface through one of our consultants.

General Mindbreeze Ports:

• Port 443 (HTTPS) for accessing the Mindbreeze Client
• Port 2222 (SSH) for synchronization between Mindbreeze Appliances

For using the iDRAC interface of the Mindbreeze InSpire Server the following Ports have to be accessible on the Mindbreeze InSpire Server’s iDRAC network interface:

• Port 443 (HTTPS) for accessing the iDRAC Web Interface
• Port 5900 (TCP, UDP) for accessing the iDRAC Virtual Console
• Port 8080 (TCP, UDP) for accessing the iDRAC Virtual Console

Getting Started

Connect by Wire

Make sure that the Mindbreeze InSpire Appliance network interface cards (NICs) are connected by wire. At least the iDRAC interface as well as one of the host NICs. Per default the Mindbreeze InSpire NICs are set to DHCP. See below on how to use iDRAC to obtain the host MAC address for reserving a DHCP lease.

IP Address Configuration of the iDRAC Interface (physical access required)

The IP address of the iDRAC interface after successful connection can be viewed locally on the front panel LCD by accessing the following menu:

• Home > View > iDRAC IP > IPv4 | IPv6 and selecting IPv4 (if it is the case).

More detailed instructions on how to check the iDRAC-IP-Address on the LCD panel can also be found here.

With this information, you can retrieve from the DHCP server which IP address was leased for the network interfaces.

If DHCP is not available for the iDRAC network interface the IP Address can be set manually via the Front Panel LCD, as follows:

• Navigate from home screen to setup screen and then to the Static IP tab:
  Home > Setup ->iDRAC -> DHCP | Static IP -> IP: 192.168.2.12
• After IP v4 configuration from the same screen we can configure sub network mask and gateway as well:
  Home > Setup > IDRAC > Static IP - >Sub: 255.255.255.0
  Home > Setup > IDRAC > Static IP - >Gtw: 192.168.2.1

More detailed instructions on how to manually configure the iDRAC -IP-Address on the LCD panel can also be found here.

On the Front Panel LCD of the server also the MAC addresses of the host interfaces are listed. For viewing the MAC addresses, please follow this path:

• Home > View > MAC >iDRAC| iSCSI1 | iSCSI2 | iSCSIn | NET1 | NET2 …NETn. Here the NET1..N interfaces are the host network interfaces.

Option 1) IP Address Configuration of the Host Interfaces via DHCP

If DHCP is available the MAC addresses of the host interfaces (either obtained in the previous step or obtained via the iDRAC Admin portal https://<iDRAC_IP>:443) can be used to identify/or reserve the respective DHCP leases and therefore the obtained IP addresses.

Login for the iDRAC Admin Portal:

• Username: root
• Password: Appliance123

Option 2) IP Address Configuration of the Host Interfaces via iDRAC

If DHCP is not available to automatically assign network settings to the host network interfaces, the network configuration for these interfaces can be accomplished by connecting to the Virtual Console using the iDRAC Web Interface (https://<iDRAC_IP>:443).

In the Virtual Console, log in with the following credentials:

• Username: config
• Password: Appliance123

After a successful login the Network Configuration Interface is shown. Here the DNS Server and the static addresses of the network interface (bond0) can be configured. It is recommended to configure the DNS server via “DNS configuration” to avoid using the fallback DNS Server 8.8.8.8. Also enter your domain via "Search Domains".

Finally, you have to set a hostname (without the domain) with the option "Set system hostname" (in the main menu of the NetworkManager TUI).

Option 3) IP Address Configuration of the Host Interfaces via physical access

If access to iDRAC is not available log in using the config user can also performed physically. See above for the steps to set the Device and DNS configuration.

Management Center

Accessing the Mindbreeze InSpire Management Center

After a successful network configuration the Mindbreeze InSpire Management Center is accessible via the following Secure HTTP Link: https://<ip_address>:8443 . Here the <ip_address> tag is the IP address of one of the connected network interfaces.

For accessing the Mindbreeze InSpire Management Center login credentials are required. By default, the management center can be accessed with “admin” user and “Appliance123” password.

For more information please take a look at the chapters Credentials, Change Password, Create user and Manage roles.

Sections

Below is the short description of the main sections in the Mindbreeze InSpire Management Center.

Insight Apps

In this section a preconfigured Mindbreeze Client Service and a Insight App Editor can be accessed.

Reporting

Here you can explore reports, telemetry data and statistics related to the Mindbreeze services.

By default, the PostgreSQL database of app.telemetry uses the user "telemetryuser" with the password "Appliance123".

Search Experience

Various advanced search parameters are defined in this area. The following submenu items are available:

Synonyms

Here you can edit the CSV file that the Synonym Transformer Plugin uses to transform search queries to also search for synonyms.

Replacements

Here you can edit the CSV file that the Replacement Transformer Plugin uses to replace search terms in search queries.

Query Boostings

Here you can edit the CSV file that the Term2DocumentBoost Transformer Plugin uses to increase the relevance of documents with certain metadata depending on the search term.

Vocabulary

Here you can edit the CSV file that the Vocabulary Synonym Transformer Plugin uses to transform the search query to search for synonyms. The differences to the Synonym Transformer Plugin are described here.

Relevance

Here you can use a simple user interface to edit the JSON file used by the Term2DocumentBoost Transformer Plugin to change the relevance model of the documents.

Services

In this section different operations related to the Mindbreeze services can be performed, such as starting and stopping the services or resetting the indices (reindexing).

Configuration

The detailed configuration of the Mindbreeze services and components can be accessed and modified from this section. A detailed description of the configuration settings is available on help.mindbreeze.com.

Setup

In this section you can setup Kerberos, generate keytabs, configure access to different parts of the appliance, configure a mail server and restart containers.

Kerberos

Kerberos configuration and keytab generation. Please find details in Configuration – Kerberos Authentication.

Credentials

The necessary credentials can be configured here. For more information, see Configuration – Back-End Credentials.

InSpire

For a complete explanation of the „InSpire“ menu item, please proceed to the chapter Mindbreeze InSpire Management.

SSL Certificate

The required SSL certificate can be uploaded here. For more information see Documentation – Mindbreeze InSpire – Tutorial Video “Install SSL certificate”.

Attention: The security header “strict-transport-security” can prevent the connection to the Mindbreeze Management Center, if the same browser has previously connected with a valid SSL certificate and now connects without a valid SSL certificate. If this is the case, use a “clean” browser (e.g. incognito mode) to connect to the Management Center and install a valid certificate.

Nodes

Nodes can be configured and edited here. For more information, see Handbook – Distributed Operation (G7) – Management of Nodes.

Tasks

Tasks can be added and edited here.

Snapshots

Snapshots can be used to back up a Mindbreeze InSpire appliance and migrate it to another appliance if necessary. For more information, see Handbook - Backup & Restore.

Update

Install updates. Please find details in the chapter Mindbreeze InSpire Updates.

Filemanager

„File Manager“ provides access to the filesystem. Detailed documentation can be found at Mindbreeze – Filemanager.

Credentials

Mindbreeze InSpire uses the software component Keycloak to manage backend-credentials. This section covers the most important use-cases (change password, create new users …). Please find additional documentation here: Keycloak 21.0 Server Administration

Change Password

The first time you log in to the Management Center, you will be prompted to change your password. If you want to change a user's password at a later time, proceed as follows: In the Management Center, navigate to "Setup," "Credentials," and then under "Manage," "Users." Find the user in question using the search function, or search for "*" to display a list of users. Click on the desired user. To set a new password, click "Reset Password" in the "Credentials" tab. To specify whether the user has to change the password themselves the next time they log in, select the "Temporary" setting. Confirm your entries with "Save".

Create User

You can create multiple users. In the Management Center, navigate to "Setup", "Credentials" and then to "Users" under "Manage". Click on "Add User", then enter the user name under "Username" and click on "Save". Next, switch to the "Credentials" tab and click "Set Password" to set a password. This is described in the previous section "Change Password". After you set a password, you still need to assign roles to the user. Otherwise, the new user will not be usable in any meaningful way. For more information, see the following section: "Manage roles". In order to be able to use the "Forget/Reset Password" function, it is recommended that you enter a valid e-mail address for each user.

Manage Roles

Access to the different areas of the Management Center (e.g. "Reporting", "Configuration") is managed using predefined roles. For example, to use the "Configuration" item in the Management Center, a user must have the "InSpire Config Administrator" role. Several InSpire roles are already created by default. You can access the list of all available roles as follows: In the Management Center, navigate to "Setup", "Credentials" and then under "Configure", "Roles". By default, the "admin" user has all roles. You can assign or remove roles to users as follows: In the Management Center, navigate to "Setup", "Credentials" and then under "Manage", "Users". Locate the desired user using the search function or click "View all users*" to display a list of users. Click "Edit" for the user in question. Switch to the "Role Mappings" tab. Here you can assign the roles.

Continuous Updating of the Operating System Patches

Operating system patches are provided as part of the Mindbreeze InSpire update package.

After applying the update a restart of the appliance is required.

Mindbreeze InSpire Updates

Tutorial Video „Update a Mindbreeze InSpire appliance“

In this video we show you how to update your Mindbreeze InSpire Appliance to the latest software version. It features also how to downgrade to older versions and discusses patches and other enhancements.

Link to video: https://www.youtube.com/watch?v=pwyDkJ_gsyc

Introduction

New versions of Mindbreeze InSpire can be installed via the Management Center. You need the (G7-)Image-File and a webbrowser with access to the Management Center. You can aquire the Image-File at the following link on the Mindbreeze website: Updates & PI

Installation

Open the Management Center and navigate to the section „Update“ „Upload“.

Select the image file via „Choose File“ and click on „Upload File“. A progress bar is displayed during the upload process.

The next step shows important information about the update.

You can choose if the appliance should reboot automatically if needed.
The default behaviour on recoverable errors is to abort the update. Using the option “Force Update on Recoverable Verification Errors” you can try to continue with the update regardless.

A password is only required if the update does not start (please contact Mindbreeze support if that happens).

If you agree to the General Terms and Conditions, click on „Perform Update“ to start the update process. Notice: Services are not available during the update. The update step shows detailed information about the update process.

The message „Success“ is displayed after the update is done successfully.

During the update you may be have to enter your credentials for the management center again.

If you do not want to start the update immediately after the upload your can always come back to the section “Update”->”Perform Update”.

Mindbreeze InSpire Management

Mindbreeze InSpire Management allows you to configure global settings for the InSpire appliance and restart individual containers as needed.

Open the Management Center and navigate to the section “Setup” “InSpire”.

Global settings

SMTP settings

Mindbreeze InSpire needs to send emails for resetting the administration password and app.telemetry notifications. Please supply your mail server in “SMTP Server”. To use the same mail server for sending alerts, configure “localhost” for the Client Service Alerts setting “SMTP-Server”. The default sender address for emails sent by InSpire Services can also be configured.

Time Settings

For Kerberos based authentication using Active Directory, an NTP server that is time-synchronous with your Active Directory server has to be specified in the configuration of your Mindbreeze InSpire appliance.

Fill out both the “NTP-Servers” and “Timezone” fields.
The time server is applied immediately. A reboot is needed for the timezone to be effective in all containers.

Container management

The “Container Management” section enables you to restart the InSpire Container. If the InSpire Container is stopped, the InSpire services are not available.

You also have the option of restarting the InSpire infrastructure.

Uploading certificates

The “SSL Certificate” section enables you to exchange the SSL certificate for the Management Center of the appliance. You can install a p12 or pfx certificate file via upload. For encrypted certificates, the password for decrypting the certificate file must be entered.

Tutorial Video „Install SSL certificate“

This video demonstrates how to install the SSL certificates for both the Web Client and for the Management Center: https://www.youtube.com/watch?v=oThC_VNcc5s

Backup Strategy

Mindbreeze InSpire Backup Strategy

This document describes the key facts that should be regarded for backups of Mindbreeze InSpire configuration files and index data.

The backup strategy should include the following type of data and should especially be performed before installing product updates:

• Mindbreeze Configuration data: after major changes in the Mindbreeze configuration you should take a backup of the main configuration files.
• Custom Insight Apps: after deploying custom Mindbreeze Insight Apps you should take a backup of those changed files.
• Mindbreeze Index Data: before starting product updates or for huge data sources after they have been fully crawled you should take a backup of the index.
• app.telemetry Configuration Data: also the app.telemetry configuration should be included in your backup strategy (at least if modified/extended for custom needs).
• Credentials: The user database contains the credentials of the users and role mappings for the access control system and should be in the backup.
• Other adjustments: Take a backup of any further adjustments that do not conform to the Mindbreeze standard product.

Backup Strategies

Backing up the Configuration Data

The last 10 revisions of the Mindbreeze configuration data files are kept in the configuration directory. Nevertheless, you should take an external backup of those files:

• Configuration files are stored in /etc/mindbreeze

Important configuration files:

• mesconfig.xml
• license
• plugins
• mesmasteruri.conf

Furthermore, please execute export_managerconfig.sh including a path (e.g. export_managerconfig.sh /data/export) and make a backup of the folder export.

Backing up Custom Insight Apps

If you have deployed your own Insight Apps, you should take a backup of these changes:

• Custom Insight Apps
  (/data/apps/<yourApp>)

Backing up the Index Data

Fabasoft Mindbreeze uses a file based index. These index files can be backed up completely in a consistent state.

To save index data, perform the following steps:

1. Change the mode of the index service to “Mode: readonly” with mescontrol (adapt the index port for the desired index)
   mescontrol http://indexserver.yourcompany.com:23100 readonly
2. Check the consistency of the index with mescontrol (adapt the index port for the desired index)
   mescontrol http://indexserver.yourcompany.com:23100 checkconsistency
3. Verify the exit code (ERRORLEVEL) of mescontrol
   echo %ERRORLEVEL% (should return the value 0 on success)
4. In order to start the backup process navigate to the directory where the index is stored and perform the backup (after a successful consistency check) as follows:
   1. Either copy the whole index directory to the target backup path using the operating system copy tools (e. g. Linux Console). You could compress this target folder later on to save disk space.
   2. Or directly create a backup archive of the index directory using any compression tool of your choice. But be careful and consider the following issues:
      1. Creating a compressed backup archive may take much longer than a simple copy task therefore the Mindbreeze index will stay in readonly-mode for a longer time.
      2. The backup tool must not modify any index files and must be able to handle open files with shared read access (locked by some Mindbreeze processes for read-access). For example using the 7-Zip tool you have to activate the option „Compress shared files“ (-ssw).

1. Change the mode of the index service to “Mode: normal” with mescontrol (adapt the index port for the desired index)
   mescontrol http://indexserver.yourcompany.com:23100 readwrite

Backing up the app.telemetry Configuration

Just take a copy of the main app.telemetry configuration file (infra.xml) located at following location:

/etc/app.telemetry/

Backing up the app.telemetry Database

A Cron-Job creates daily backups of the database that are accessible with the File Manager in “/data/backups/telemetrydb-pgdump”.

Backing up Credentials

The user database is exported daily into the following location within the keycloak container:

/data/backup/curr

This location is also accessible in the host under the location:

/var/data/keycloak/data/backup/curr

Add this location to your backup.

Running Third-Party Software

General notes about Mindbreeze InSpire as an appliance

Mindbreeze InSpire is delivered to customers as a preconfigured appliance. The pre-installed software components were coordinated with one another and tested for possible side effects.

It is not intended that customers make changes to the software status on their own.

Possible examples of adverse changes to the software status include:

• Software updates from installed applications (except Mindbreeze product updates)
• Removing (uninstalling) preinstalled software
• Installing new software (such as antivirus software)

Impact of third-party software on Mindbreeze InSpire

Depending on the type of third-party software components, the effects this may have on Mindbreeze can vary.

The possible effects of third-party software include:

• Negative impact on system performance …
  • due to excessive hard disk access (e.g. antivirus software)
  • due to excessive storage usage of the third-party application
• Stability problems due to unexpected file access …
  • File locking
  • Modification of file contents

The most common problems are to be expected through the use of antivirus software and can be minimized as described in the following chapter.

Minimizing the impact of antivirus software on Mindbreeze

To minimize any negative impact on Mindbreeze performance and stability, the following directories should be specifically excluded from virus scanning runs:

• Mindbreeze index directories (depends partly on the configuration)
  • Automatic path: /data/servicedata
  • Configured paths, e.g.: /data/indices and /data/cache
• Mindbreeze log directories (path depends on the configuration)
  • Example: /data/logs
• Mindbreeze configuration directory
  • /etc/mindbreeze
  • /data/resources
• Mindbreeze product directory:
  • /opt/mindbreeze
• Fabasoft app.telemetry product directory:
  • /opt/app.telemetry
• Fabasoft app.telemetry data directory:
  • /var/opt/app.telemetry/
• Directory of the Fabasoft app.telemetry telemetry database:
  • /data/postgres/
• Temp-directories used by the individual services:
  • /tmp
  • /var/opt/mindbreeze
  • /data/servicetempdata
• Insight Apps:
  • /data/apps

However, any type of virus scan run can have a potential negative effect on the system performance and consequently the response time behaviour of Mindbreeze. If regular system scans are unavoidable, we recommend that they be performed in maintenance windows or outside the core time in which the search is offered.

Mindbreeze InSpire support process

Directions in case of problems with Mindbreeze InSpire

To ensure the best possible support, we ask all our customers and partners to follow our standard support process.

1. For any standard product problems (software, hardware), each customer and partner creates a ticket from our support desk at https://tickets.mindbreeze.com.
2. The members of our support team are the first point of contact for resolving any problems that arise and will ensure that the problem is remedied quickly.