A recipe to update grommunio from openSUSE 15.6 to 16.0.
openSUSE 16.0 is here and grommunio provides packages for openSUSE 16.0, we may update the appliance.
Please note: If your system is still running on openSUSE 15.5, use this document to upgrade to openSUSE 15.6 first: https://community.grommunio.com/d/1879-update-form-open-suse-155-to-156
Note: With the script grommunio-update there is also a possibility to update to openSUSE 16.0. However, no backup of the configuration is created and there is no possibility to compare the package before and after the update.
This recipe shows the manual update way which offers more possibilities and error checking. I have never used grommunio-update to update a system so I do not have no experience of using it.
Note: The update process takes approximately 30 minutes. If the update takes longer than an hour, you have very slow hardware. Probably this hardware is below the specifications for grommunio.
Note: This is a huge update. For the update to succeed, you will need a modern CPU and you will also need to modify the package sources, among other things.
You may read the upgrade notes from SUSE: https://en.opensuse.org/SDB:System_upgrade#Changes_in_distribution_repositories_from_previous_releases
Note: That these instructions have only been tested with the Core product, i.e., Mail.
1. Preparing for the upgrade
- Have your Grommunio license details (username and password) ready. You may need them in Step 11. If you are using the Community Edition, you will not need a username or password
- Please note, this upgrade interrupts your mail system
- If you have a virtualised environment, take a snapshot of the system
- Connect to the grommunio server via SSH like Putty
- For most commands, you can copy and paste them to the grommunio server
- If the server has an uptime of more than 30 days, it is recommended to reboot the server. Check the uptime with the
uptime command and reboot with init 6 if necessary
- Stop and disable Postfix to prevent mail loss
systemctl --now disable postfix
- Remove any outdated kernels to free some space on
/boot/ volume
zypper purge-kernels
- Please note that the PHP 8.2 configuration will be overwritten. If you have made changes to any of the PHP FPM files in
/etc/php8/fpm/php-fpm.d/ configurations, such as: /etc/php8/fpm/php-fpm.d/pool-grommunio-web.conf, you will need to reapply them
- You may read the upgrade notes from SUSE: https://en.opensuse.org/SDB:System_upgrade#Changes_in_distribution_repositories_from_previous_releases
- The CPU must be at least x86-64-v2, the old kvm64 CPU will no longer work! Attempting to update a system with an older CPU than x86-64-v2 will render your server unusable. You will see this error "Fatal glibc error: CPU does not support x86-64-v2".
Use the lscpu | grep sse4_2 command to check the CPU. If the CPU flag sse4_2 is present, the CPU is usable for the update. If you have an old CPU, use the Proxmox console to set a newer one (x86-64-v2 or better, x86-64-v4 is preferred) and then reboot the system before starting the update.
Read this article to find out if your CPU is compatible: https://en.opensuse.org/X86-64_microarchitecture_levels
Note: A modern CPU is a requirement for all modern operating systems
2. Check that you have at least 8 GB of free space on the root volume
On the root / volume we need at least of 8 GB free space for the update, do not proceed if you not have less than 8 GB free on /. Run df -h to see the space statistics.
3. Create a tar backup of /etc for later comparison or restore
mkdir -p /root/WH/bck/
tar -cvzf /root/WH/bck/etc_$(date +%Y%m%d-%H%M%S).tgz /etc
4. Backup MariaDB
mysqldump --all-databases > /root/WH/bck/dump_grommunio_$(date +%Y%m%d-%H%M%S).sql
5. Install the 'purge-kernels' service to automatically free up space in the '/boot' directory
First remove any outdated kernels to free space on /boot/ volume
zypper purge-kernels
and second, install the purge-kernels service:
zypper in purge-kernels-service
If the purge-kernels service is already installed, simply ignore this step.
6. Install the latest updates for openSUSE 15.6 and grommunio
grommunio-update update --noreboot
If a reboot is required, wait a minute, then reboot the system manually with the command init 6.
Note: There are 2 possible problems at this point,
- The grommunio 15.6 repository is no longer available (tbd.), in this case just continue with the updgrade, at least the openSUSE components will be updated and grommunio will be upgraded when upgrading to 16.0 in step 12.
- Neither the grommunio 15.6 repository nor the openSUSE 15.6 repository (tbd.) exists anymore, then continue with step 10. However, you need to make sure that both 16.0 repositories exist, because if the 16.0 repositories do not exist, an update will not be easy.
A full backup is recommended in both situations.
7. Check the MariaDB schema
gromox-dbop -U
The current schema is gx-132 (April 2026)
Note: If the mariadb service does not start, I assume you have a very slow server like a NAS with 5400 rpm mechanical disks. Try upgrading the database manually with /usr/lib/mysql/mysql-systemd-helper upgrade and consider upgrading to a faster server.
8. Wait about 5 minutes to allow the schema upgrade for the domain and user databases to complete and the index to be rebuilt
Use top or htop to view activity on the databases.
Also use journalctl -f to see activities on this system. If you see messages like:
.... dbop_sqlite: upgrading /var/lib/gromox/user/x/y/exmdb/exchange.sqlite3 to schema EV-nn
Wait until all databases have been updated.
The current database schema for the Community and Supported Editions as of April 2026 is EV-25.
9. Restart the server to activate the current 15.6 updates
init 6
10. Document the current state before the distribution update
rpm -qa | sort > /root/SLES_15.6.txt
11. Switch all repositories including other 3. party repositories like backup software from 15.6 to 16.0
sed -i 's/15.6/16.0/g' /etc/zypp/repos.d/*.repo
Check that all repositories have been updated with
cat /etc/zypp/repos.d/*.repo | more
You should only see 16.0 repositories.
Verify that /etc/zypp/repos.d/grommunio.repo is switched to 16.0!
cat /etc/zypp/repos.d/grommunio.repo
You should only see 16.0 repositories.
12. Remove outdated repositories
The structure of the openSUSE 16.0 repositories has changed. Some old repositories need to be deleted.
List the configured repositories with: zypper lr and delete the repositories mentioned below.
zypper rr backports-debug-update
zypper rr repo-backports-debug-update
zypper rr backports-update
zypper rr repo-backports-update
zypper rr sle-debug-update
zypper rr repo-sle-debug-update
zypper rr sle-update
zypper rr repo-sle-update
zypper rr update
zypper rr debug-update
zypper rr debug
Sometimes you have to delete some of the repositories multiple times; the reason is unknown, but sometimes deleting them multiple times is necessary. Verify with: zypper lr, that the repositories mentioned above are gone.
Now, verify that we have at least two repositories:
a) The openSUSE 16 base or oss repository and
b) The grommunio repository.
zypper lr
Repository priorities are without effect. All enabled repositories share the same priority.
# | Alias | Name | Enabled | GPG Check | Refresh
--+-----------+-----------+---------+-----------+--------
1 | base | base | Yes | (r ) Yes | Yes
2 | grommunio | grommunio | Yes | (r ) Yes | Yes
This repository list includes both oss and non-oss repositories, but the oss repository has not been renamed 'base':
# | Alias | Name | Enabled | GPG Check | Refresh
--+-----------------------+-----------------------+---------+-----------+--------
1 | grommunio | grommunio | Yes | (r ) Yes | Yes
2 | openSUSE:repo-non-oss | openSUSE:repo-non-oss | Yes | ( p) Yes | Yes
3 | openSUSE:repo-oss | openSUSE:repo-oss | Yes | ( p) Yes | Yes
Just in case there is no base or oss repository, add the openSUSE 16.0 repositories with zypper:
zypper addrepo -f http://cdn.opensuse.org/distribution/leap/16.0/repo/oss openSUSE:repo-oss
zypper addrepo -f http://cdn.opensuse.org/distribution/leap/16.0/repo/non-oss openSUSE:repo-non-oss
For the grommunio repository enable autorefresh and keep packages:
zypper mr -f -k grommunio
Note: The non-oss (Non-Open Source Software) repository in openSUSE is an official repository containing proprietary, non-free software, such as Adobe Flash, Java, Opera, or specific firmware. I assume that we need this repository for systems with grommunio-meet when it is ready for openSUSE 16.0.
Refresh repository list:
zypper refresh -f
Note that you may need your license details at this point. Check /etc/zypp/repos.d/grommunio.repo to see if username and password are in the file. The line in question looks like this:
baseurl=https://USERNAME:PASSWORD@download.grommunio.com/supported/openSUSE_Leap_16.0/?ssl_verify=no
The question from zypper about trust, should be answered as "a - trust always", if you are using a German OS, answer "i -immer vertrauen"
If you encounter any errors relating to outdated repositories, remove the relevant repository using the following command:
zypper rr REPOSITORY-NAME
and run refresh again:
zypper refresh -f
13. Distribution update to openSUSE 16.0
Before starting the distribution update, check for the expired Package Signing Key gpg-pubkey-39db7c82-5f68629b, and if this key is found, delete it to avoid error messages during the update. Check with:
rpm -qa gpg*|grep -i 39db7c82
If the signing key exist, delete it:
rpm -e gpg-pubkey-39db7c82-5f68629b
Refresh the repositories again:
zypper ref
Before starting the distribution update, again verify that your CPU supports at least x86-64-v2 or you will render your system unusable.
If the CPU is at least x86-64-v2, start the update.
zypper dup
If you see errors about plymouth-branding-openSUSE, remove the outdated plymouth-branding-openSUSE-15.6.x package:
Problem: 1: the to be installed plymouth-branding-openSUSE-16.0.20240405-lp160.10.1.noarch conflicts with 'plymouth-branding' provided by the to be installed plymouth-theme-grommunio-1-lp160.21.1.noarch
Solution 1: deinstallation of plymouth-branding-openSUSE-15.6.20240408-lp156.1.2.noarch
Solution 2: deinstallation of plymouth-theme-grommunio-1-lp156.20.1.noarch
Solution 3: keep obsolete plymouth-theme-grommunio-1-lp156.20.1.noarch
Choose from above solutions by number or cancel [1/2/3/c/d/?] (c): 1
You may see errors relating to package conflicts:
File /usr/bin/jsonschema
from install of
python313-jsonschema-4.24.0-160000.2.2.noarch (base)
conflicts with file from package
python311-jsonschema-4.17.3-150400.14.6.1.noarch (@System)
File /usr/bin/normalizer
from install of
python313-charset-normalizer-3.4.2-160000.2.2.noarch (base)
conflicts with file from package
python311-charset-normalizer-3.1.0-150400.9.7.2.noarch (@System)
File conflicts happen when two packages attempt to install files with the same name but different contents. If you continue, conflicting files will be replaced losing the previous content.
Continue? [yes/no] (no): yes
Answer yes to continue the upgrade as grommunio typically do not use this packages.
The upgrade process may rise errors regarding one or more outdated Package Signing Keys:
error: Key 70af9e8139db7c82 (SuSE Package Signing Key <build@suse.de>) expired on 2024-09-20 08:21:47
If you see an error message about an expired Package Signing Key, search for the last eight digits of the key ('39db7c82' in this example) using rpm and delete the package that you found:
rpm -qa gpg*|grep -i 39db7c82
gpg-pubkey-39db7c82-5f68629b
error: Key 70af9e8139db7c82 (SuSE Package Signing Key <build@suse.de>) expired on 2024-09-20 08:21:47
rpm -e gpg-pubkey-39db7c82-5f68629b
rpm -qa gpg*|grep -i 39db7c82
14. Enable redis
Sometimes redis is not enabled after the upgrade, enable it:
systemctl --now enable redis@grommunio.service
Verify that redis is up and running:
systemctl status redis@grommunio.service --no-pager
15. Restart MariaDB to force the DB upgrade
systemctl restart mariadb
Verify that MariaDB is up and running:
systemctl status mariadb --no-pager
Again: If the mariadb service does not start, I assume you have a very slow server like a NAS with 5400 rpm mechanical disks. Try upgrading the database manually with /usr/lib/mysql/mysql-systemd-helper upgrade and consider upgrading to a faster server.
16. Check that AppArmor is disabled, disable AppArmor if it is enabled
systemctl status apparmor --no-pager
If you see a message like Active: active (exited), stop, disable and mask AppArmor!
systemctl --now disable apparmor
systemctl mask apparmor
17. Check the PHP-FPM configuration
The PHP FPM configurations in the directory /etc/php8/fpm/php-fpm.d/ have been overwritten by the upgrade process. Apply all our changes again.
You can read the relevant article here: https://community.grommunio.com/d/2594-speed-up-grommunio-and-g-web
18. Disable the plymouth-start.service
The plymouth-start.service will not work any longer, disable this service:
systemctl --now disable plymouth-start.service plymouth-quit.service plymouth-quit-wait.service
systemctl mask plymouth-start.service plymouth-quit.service plymouth-quit-wait.service
Thanks to Duese6.
19. Enable SSH root login - if needed
Please note that logging in as root with a certificate is always possible, but logging in with a plaintext password will no longer work after the update unless you make adjustments. If you need SSH root login (login with password via Putty) create the override file my_config file in the /etc/ssh/ directory and add PermitRootLogin yes to the file.
echo "PermitRootLogin yes" >> /etc/ssh/my_config
Thanks to CRPB
20. Reboot the server to activate the new modules and the new kernel
init 6
21. Check for failed services
systemctl --failed
We should not see any failed services. If you have failed services, repair these errors and start all services.
If you see errors like [FATAL] exmdb call failed: Prefix not served , see this thread to solve this issue: https://community.grommunio.com/d/2588-exmdb-client-failed-to-connect-localhost5000-prefix-is-not-served/50
Check again that AppArmor is disabled:
systemctl status apparmor --no-pager
If you see a message like Active: active (exited), disable as explained in step 16.
22. Document the upgrade
rpm -qa | sort > /root/SLES_16.0.txt
23. Compare old state with current state
vim -d /root/SLES_16.0.txt /root/SLES_15.6.txt
It is unlikely that you will find missing packages but if you do, reinstall them as follow
zypper in <MISSING-PACKAGE>
Ignore obsolete kernel, libfmt7-7, php8.2, python3-* packages and old grup2 packages.
24. Repair the SASL Authentication
The configuration file /etc/pam.d/smtp was renamed to /etc/pam.d/smtp.rpmsave. To re-enable SASL authentication rename the file back to:
mv /etc/pam.d/smtp.rpmsave /etc/pam.d/smtp
Thanks to CRPB
ref: pam_gromox
25. Find newer sample configuration files, these usually have the extension .rpmnew
find /* -iname '*.rpmnew'
Manually migrate the changes from the .rpmnew file into the original configuration file, this can be done with vim or diff. However, be careful not to overwrite or destroy the configuration of your system. Note: we made a backup of the configuration in the third step.
vim -d <FILE> <FILE>.rpmnew
or use diff
diff <FILE> <FILE>.rpmnew
and manually edit the configuration file to reflect the changes.
This requires some knowledge of the system, as overwriting the wrong variables may render your system unusable.
In /etc/postfix/master.cf, replace fifo with unix. The fifo transport is obsolete.
sed -i.bak 's/fifo/unix/g' /etc/postfix/master.cf
Modify the file: /etc/postfix/main.cf. We need to replace some outdated parameters. This is the list of parameters, remark or remove the outdated parameters and add the new parameters:
# Change openSUSE 15.x to 16.0
#smtp_use_tls = [no|yes]
#smtp_enforce_tls = no
smtp_tls_security_level = may
#
#smtpd_use_tls = [no|yes]
#smtpd_enforce_tls = no
smtpd_tls_security_level = may
#
# disable_dns_lookups = no
smtp_dns_support_level = enabled
#
Thanks to ??
It is also a good idea to migrate any new/updated comments from .rpmnew to the configuration file and remove any outdated comments. After making the changes to the configuration files, delete the .rpmnew files, they are no longer needed. Also restart the affected services or reboot the server again with init 6.
26. Find and delete outdated configuration files, these usually have the extension .rpmsave
find /* -iname '*.rpmsave'
Manually delete any obsolete configuration files, they are no longer used.
27. Check at the logs for errors
journalctl -f and tail /var/log/nginx/*.log -f
Fix any errors that you find.
28. Check for obsolete kernels
Check how many kernels are located in /boot/?
ls -lar /boot/
If you have more than two kernels, you did not install the purge-kernels service in step 6.
Check with: rpm -qa purge-kernels-service.
29. Finalize the upgrade
Run the grommunio update script to finalize the upgrade:
grommunio-update update --noreboot
30. Remove any coredumps
The Plymouth service, which is no longer working, may have left a core dump in /var/lib/systemd/coredump, so delete this coredump.
rm /var/lib/systemd/coredump/*
31. Test the system
Note that Postfix is still disabled, so it is not yet possible to send emails.
Test the system by connecting with Outlook and g-Web and verifying that you can see all your emails.
You should also test the functionality of the grommunio-admin command: grommunio-admin user query displays all mailboxes on the system.
Fix any errors that you find.
32. When everything works, enable and start postfix
systemctl --now enable postfix
and delete the snapshot
33. Now the system should be fully up and running again
Enjoy grommunio
Changes:
