NET Genium settings

1. NET Genium settings

• NET Genium settings are available to all users with administrator privileges.
• The icon for opening the NET Genium settings dialog is located in the toolbar in the navigation area in admin mode. The toolbar is displayed by clicking the gear icon or the NET Genium label located to the right of this icon.

1.1. Notification for administrator

• The “Notification for administrator...” icon in the “NET Genium” toolbar opens, in a new window, a page with the text of the notification and with the comments of administrators. The page is accessible only to users with administrator privileges.
• The text of the notification is saved with the “Save notification for administrator” button. A non-empty text is displayed to every user with administrator privileges after logging in with a user name and password in the login window or in the “Change password” dialog and after a forced password change; it is not displayed after logging in by other means (Microsoft sign-in, login ticket, Windows authentication). The notification is cancelled by saving an empty text.
• The “Insert comment” button adds a comment to the “Comments (History)” table together with the login name of its author and the date. Every saved non-empty text of the notification is written into the same table as well.
• The icons in the title of the “Comments (History)” table delete the whole history, or only the records older than 6 months.

1.2. Restart

• The “Restart” item in the “NET Genium” toolbar restarts NET Genium after a confirmation question, without entering a password. When configuration files need to be applied to the “Web.config” or “bin\RunScript.exe.config” file, the “Finish update” item is offered instead. If the “DenyLogin.txt” configuration file exists, neither of these items works.
• A restart first adjusts the “Web.config” file according to the “DenyCookieless.txt”, “ExecutionTimeout.txt”, “Framework.txt”, “MaxRequestLength.txt”, “SessionTimeout.txt” and “SSL.txt” configuration files and the “bin\ngef.dll.config” file, and adds the assembly binding redirects from the “bin\ngef.dll.config” file to the “bin\RunScript.exe.config” file as well – a change of these files therefore takes effect even without an update of NET Genium. Only the settings that the files turn on or change from the default value are applied; deleting a configuration file or returning to the default value does not restore the “Web.config” file to its original state. The same applies to a restart with the password on the “url-netgenium/restart” web page. Any other restart of the web application (recycling the application pool, replacing libraries in the “bin” directory) does not adjust the “Web.config” file.
• The items are offered only in full installations of NET Genium – they are not displayed in NET Genium Online, nor when the “Demo.txt” configuration file exists.

2. List of tabs in the settings dialog NET Genium

• General – Setting general properties of NET Genium
• Emails – Email settings
• Print templates – Setting up print templates
• Permissions – Permission settings
• Passwords – Password settings
• Colors – Color settings
• Other – Setting other properties

2.1. “General” tab

2.1.1. Name

• The name NET Genium displayed in the web browser tab.
• The NET Genium name is stored in the server variable “#portal#”.

2.1.2. Version

• The NET Genium version displayed in the header of the portal (on a mobile device in the title of the header) and as a prefix of the subject of all outgoing e-mail messages.
• The value may contain HTML; in the subject of e-mail messages the HTML tags are removed.

2.1.3. Portal address

• Intranet address – the Enter-separated list of these addresses will be used when initializing NET Genium in multiple instances.
  • When more than one address is filled in, the processes of the web application over the same database (for example several application pools or servers) share information about changes: a change of applications (among others application groups, applications, categories, view pages, edit forms, controls, database queries, scripts and their rights), of allowed IP addresses, of public external functions or of the custom color palette made in one process invalidates the cached copies of this data in the other processes as well.
  • Unless more than one address is filled in, these changes may not take effect in the other processes over the same database until they are restarted.
  • The part of the NET Genium settings that the process keeps in memory (for example the SMTP server for emails sent by NET Genium, the password strength or the time zone in which dates are displayed) takes effect in the other processes over the same database only after they are restarted, regardless of the number of addresses filled in.
• Internet address – the Enter-separated list of these addresses will be used in e-mail messages sent by the script and will ensure that the user can be redirected to NET Genium for specific records. When the internet address is not filled in, the intranet address is used in e-mail messages.
• The list of addresses in each of the two fields is stored with a length of at most 250 characters; a longer list is truncated.
• In NET Genium Online neither field is displayed – the address of the instance is given by its identifier (“identifier.netgenium.online”) and NET Genium inserts it into outgoing e-mail messages by itself.

2.1.4. Time zone

• The NET Genium time zone is automatically set to the time zone of the server on which NET Genium is hosted.
• By selecting a specific time zone from the drop-down list, this setting can be changed to the desired value.
• In NET Genium Online the time zone is chosen when the instance is registered.
• The time zone applies to the date values that the platform itself writes, and to the way they are displayed — for example to the values of the “#now#” and “#today#” variables and to the default values of date controls. The date and time filled in by the buttons of date and time fields and by the “Now” and “Now2” JavaScript functions, the current date in the header and the highlighting of today in the calendar and in the planners correspond to the time zone in which the user sees the times (see below).
• Changing the time zone does not recalculate the values already stored, it only changes their meaning. It is therefore advisable to set it when the instance is being deployed, not while it is in use.
• Individual users can have the times displayed in their own time zone — the Time zone and Show times in my time zone fields in their user account are there for that. The conversion only affects what is displayed: the value is always stored in the time zone of the instance, so the conditions of database queries, the values of the “#now#” and “#today#” variables in scripts and statistical queries are unaffected. Only the values that carry a time are converted — a date without a time (a due date, for example) is not a moment and stays unchanged.
  • The Time zone and Show times in my time zone fields exist only in newly created NET Genium installations; they are not added to older installations yet.
  • Values are displayed and entered in the user's time zone in the edit form, in the view table, in the calendar, in the planners, and in the data export and import of the view table. Filters and search in the view table, on the other hand, are entered in the time zone of the instance, as are the values of the “#ng_...:value#” variables.
• Print templates and exports follow the time zone of the user who prints or exports. In an e-mail composed by the “Send email” script step, the values of the controls listed in its body follow the time zone of the user whose action sent the e-mail — usually the user whose action started the script. An e-mail from the save scripts (OnBeforeSave, OnAfterSave) of a record whose saving changed a synchronized column is sent only together with the sending of the changes for synchronization, and the user whose action started that sending decides.

2.1.5. Date format

• The date format determines the order of the day and month in the short date across the entire application – when displaying as well as when entering and reading dates in forms, filters and scripts – regardless of the user's language. The separator (period or slash) and the decimal separator of numbers follow the user's language.
• The drop-down list contains the following options:
  • dd/mm/yyyy – day month year
  • mm/dd/yyyy – month, day, year

2.1.6. Default map

• The default map defines the default geographical center of all map data that does not contain any points on the map in the currently displayed data visualization. In other cases, the geographic center is calculated automatically from all points displayed on the map. The center to which a user has moved the map is remembered by NET Genium for each user separately and takes precedence over both.
• The default map controls the search for addresses stored in “TextBox” controls called “Find on map”, “Find on map” or “Find on map”.
• The drop-down list contains the following options:
  • Czech Republic – address search offers map portals “maps.google.cz” and “www.mapy.cz”.
  • Slovakia – address search is offered by the map portal “maps.google.sk”.
• In NET Genium Online the field is not displayed and the drop-down list offers no country – the setting stays empty and NET Genium behaves the same way as with the “Czech Republic” option.

2.1.7. Fulltext catalog

• Catalog for the full-text search of the content of file attachments. The content is searched only for the File control and only in files with selected extensions – a detailed description is provided in the separate guide Edit form – File.
• The drop-down list contains the following options:
  • None – the content of file attachments is not searched while searching for values in view tables; file names are always searched.
  • Windows Search – while searching for values in the view tables, the content of file attachments is searched as well using the “Windows Search” full-text catalog. A detailed description of the configuration of the “Windows Search” full-text catalog is provided in the separate guide Installing NET Genium on the web server.
  • Indexing Service – while searching for values in view tables, the content of file attachments is searched as well using the “Indexing Service” in the catalog, the name of which is entered in the text field below the drop-down list of the full-text catalog. The “Indexing Service” was last available in the “Windows Server 2008” operating system, so we recommend replacing its use with the full-text catalog “Windows Search”. A detailed description of the configuration of the “Windows Search” full-text catalog is provided in the separate guide Installing NET Genium on the web server.
• In NET Genium Online neither the drop-down list nor the text field with the catalog name is displayed – full-text searching of file attachments is not available in the cloud.

2.2. “Emails” tab

2.2.1. Default sender of all messages

• An email address that will be set as the default sender of all messages. Emails that have senders from another domain will be sent using the default sender of all messages. In this case, the original sender of the message is preserved in the “Reply-To” header of the message, so any replies are delivered to the original sender. If the message has its own reply address, that address is kept.
• In NET Genium Online the address is fixed to “identifier@netgenium.online” according to the identifier of the instance and the field cannot be edited – no instance can therefore send messages under the address of another instance.

2.2.2. System warnings

2.2.2.1. Service e-mail address

• Administrator's email address for sending system messages. If the address is empty, no system messages will be sent. An address in the “netgenium.com” domain does not receive reports of a login refused because of licenses nor reports of less serious errors in applications.
  • E-mail messages without any recipient – with empty To, Cc and Bcc fields (NG NO-RCPT: will be inserted in the subject of the message); a message whose entered addresses are all invalid is not redirected here
  • Reports of a login refused because the licenses are exhausted or because the system is running without a valid license key, in which case only one user may be logged in – a report is sent at every such refusal in the web browser and through the web services of the “NETGeniumConnection” library, not at a login with a token through the integrated MCP server
  • Error messages in applications when the “Enable automatic error reporting to NetGenium” field on the “Other” tab is checked, and error messages when synchronizing records

• In NET Genium Online the service e-mail address also receives warnings about running out of credit, about inactivity of the instance and about a failed automatic top-up of credit. When the service e-mail address is not filled in, these warnings are sent to the e-mail address with which the instance was registered.

2.2.2.2. Sender of system warnings

• An email address that will be set as the sender of system messages.
• If the address is empty, the address filled in as the “Default sender of all messages” is used. If that one is empty as well, messages about licences are sent from “license@netgenium.com” and reports of errors in applications or during record synchronisation from “error@netgenium.com”.
• In NET Genium Online the field is not displayed and system messages are always sent from the default sender address of the instance. The sender of other messages (the “Send email” script step, server functions, the “New email” form) is likewise always replaced by the default sender address of the instance in the cloud; if the message has no reply-to address, the original sender address is used as one.

2.2.3. Outgoing mail server

2.2.3.1. SMTP Server 1

• The name or Internet address of the SMTP mail server used to send e-mail messages.
• A port separated by a colon may follow the server name, for example “smtp.example.com:587”. Without a port the default port is used.
• The “The server requires authentication” checkbox turns on signing in to the server with the “Account name” and “Password” values. The “SSL” option (an encrypted connection to the server) applies only together with authentication.
• SMTP Server 1 is used to send e-mail messages through the following commands:
  • View page – New e-mail message
  • Button – Open the form for entering a new e-mail message
  • Script – Send email
  • Script – SENDMAILMESSAGE()
  • Script – SENDMAILINVITATION()
  • Script – SENDMAILINVITATION2()
  • Script – SCHEDULEMAILMESSAGE()
• In NET Genium Online the whole “Outgoing mail server” section is not displayed and cannot be configured – SMTP Server 1 is fixed to “localhost”, so all instances send mail through the mail service of the cloud server. The “SMTP TEST 1” and “SMTP TEST 2” buttons are not displayed either.

2.2.3.2. SMTP Server 2

• The name or Internet address of the SMTP mail server used to send e-mail messages.
• The port, the “The server requires authentication” field, the “SSL” option and the “Account name” and “Password” values have the same meaning as for SMTP Server 1.
• SMTP Server 2 is used to send e-mail messages through the following commands:
  • Backup SMTP Server – all e-mail messages that fail to be sent the first time using SMTP Server 1 are forwarded for sending using SMTP Server 2. If SMTP Server 2 is not defined, or fails when sending a message using SMTP Server 2, the e-mail message is saved in the “SMTP” directory as an “eml” file, and “ResendEmlFiles.exe” tries to resend it. Which is typically run every 30 minutes using a scheduled task.
  • Script – SENDMAILMESSAGE2()
• In NET Genium Online SMTP Server 2 is not displayed and cannot be filled in – a backup mail server is not available in the cloud.

• If neither SMTP Server 1 nor SMTP Server 2 is defined, all e-mail messages are stored in the “SMTP” directory in the form of “eml” files. The name of the “eml” file consists of the date and time of its creation and a unique GUID identifier (e.g. “2026-06-09 10-20-20 8925b488-b4a8-4192-a503-60b74b853186.eml”). The “ResendEmlFiles.exe” program, which typically runs every 30 minutes with a scheduled task, starts sending them only after SMTP Server 1 or SMTP Server 2 is set up; until then it does not send the messages and the sending attempts are not counted. Messages successfully sent by “ResendEmlFiles.exe” are deleted from the “SMTP” directory, unsuccessfully sent messages are attempted at most 48 times (the scheduled task created by “Setup.exe” runs from 6:00 to 24:00 every 30 minutes, so 48 attempts take about a day and a quarter); messages whose sending ended with a permanent error (for example invalid syntax of the recipient address – “Bad recipient address syntax”) are attempted only once. Afterwards the program ignores these files in the “SMTP” directory. The list of unsuccessfully sent or already ignored messages is stored in the configuration file “SMTP/ResendEmlFiles.errors”.

2.2.3.3. SMTP TEST 1 and SMTP TEST 2

• The “SMTP TEST 1” and “SMTP TEST 2” buttons send a test message with the subject “test” to the service e-mail address through SMTP Server 1 or SMTP Server 2 respectively. The values currently filled in the dialog are used, even if they have not been saved yet. The result of sending – “OK” or the error text – is displayed in a message.
• In NET Genium Online the buttons are not displayed.
• Without a valid service e-mail address the test message is not sent and the dialog asks for it to be filled in.
• The sender of the test message is the sender of system warnings; if it is not filled in, the default sender of all messages, and if that one is not filled in either, the service e-mail address.

2.3. “Print templates” tab

• List of print templates stored in the “Templates” directory with the option to add or remove templates from this directory.
• Print templates from this list are offered in “File” and “Button” controls.
• Unused print templates are shown in italics.
• A detailed description of print templates is provided in the separate guide Print templates.

2.3.1. Statistics

• The “Statistics...” link below the list of print templates opens an overview of all buttons in edit forms and on view pages and of all “File” controls that use any print template. For each control it shows the print template used and the date of its last change, and it allows opening the settings of the control.

2.3.2. Add template

• Button for inserting a new print template in the “Templates” directory.

2.4. “Permissions” tab

2.4.1. User account administrator

• List of user groups or users who:
  • they can set a new password for other users (except for users who have administrator privileges). As with user groups, the administrator of user accounts needs the right to edit the user record to save the new password.
  • they can add and remove user groups of other users; only the user “Administrator” may add or remove the “Administrators” group. To save changes in a user record, the administrator of user accounts additionally needs the right to edit the record, typically as a co-owner of the “User” form.
  • they can set up new user groups for each rights group.
  • they can send a chat message to a whole user group or to all users currently signed in (as well as users with administrator privileges).
  • sees all sessions in the list of online users (as well as users with administrator privileges). Other users see for each user online only one record for the interactive login in the web browser and one record for other access (for example the MCP server or the web services of the “NETGeniumConnection” library), in terms of time always the one with the latest user login date. The “IP address” and “License” columns are shown in the list of online users only to users with administrator privileges and to user account administrators.
  • they can log out sessions of other users in the list of online users; sessions of users with administrator privileges can be logged out only by a user with administrator privileges. This restriction and the restriction on the number of records per user apply only to the list of online users; the table inserted by the #usersonline# variable shows everyone who can see it all sessions in which the user worked within the last hour, including the “IP address” and “License” columns (an administrator and a user account administrator also see in it the sessions in which the user has not worked for more than an hour – they are displayed dimmed and consume no license), and a user account administrator can log out even a session of a user with administrator privileges in it. Logging out a session logged in with a token through the integrated MCP server does not end the access – the next request with a valid token logs in again. Logging out a session logged in through the web services of the “NETGeniumConnection” library ends the connection – further method calls fail and it is necessary to log in again.

2.4.2. Administrators with access to the MCP server

• List of users who are allowed to work with the integrated MCP server of the instance. Users with administrator rights, i.e. members of the “Administrators” group, and the “Administrator” user can be selected. The “Administrator” user always has access; adding them to the list, however, makes the list non-empty, so adding only the “Administrator” user restricts the MCP server to that user alone.
• If the list is empty, the MCP server can be used by any user with administrator rights who has generated a personal MCP token.
• If the list contains at least one record, the MCP server can be used only by the “Administrator” user, i.e. the user with database ID 1, and by the users listed. For all other users the request is refused with a 403 response and the reason is written into the “Auth” log.
• The restriction applies to all tools of the MCP server, i.e. to reading and writing data, to the implementation model and to the framework documentation.
• The restriction applies to connecting an AI tool by signing in as well – an administrator who is not on the list is shown a message that their account is not allowed to access the MCP server instead of the consent screen.
• The “Access via a custom API” permission of the personal token is not restricted by the list — a custom API handles authorization on its own.
• An administrator who is not on the list is not offered the “Reading all data and the model via the MCP server” and “Writing all data and the model via the MCP server” token permissions on the “MCP token” tab.
• A detailed description of the MCP server is provided in the separate guide The integrated MCP server.

2.4.3. IP addresses allowed

• List of allowed IP addresses from which it is possible to log in to the application if the user is a member of the selected user group.
• The list of allowed IP addresses is used to set restrictions for users who are in the “Administrators” group and therefore have administrator privileges, including the admin mode option. Admin mode is then enabled only if the user accesses the application from specific IP addresses. An administrator who is also a member of another user group and accesses from another IP address logs in in the web browser – if the restrictions of their other groups allow it – without administrator rights; through the integrated MCP server or through the web services of the “NETGeniumConnection” library they cannot log in from such an IP address. An administrator who is only in the “Administrators” group, and the built-in Administrator account, cannot log in from another IP address at all. If the list contains no addresses for the “Administrators” group, an administrator is restricted by the addresses of their other user groups in the same way as a user who is not in the “Administrators” group – from an IP address outside them they cannot log in at all, neither in the web browser nor through the integrated MCP server or the web services of the “NETGeniumConnection” library.
• The list of allowed IP addresses is used to set restrictions for users who are not in the “Administrators” group. If the user accesses from another IP address, the option to log in to the application is removed. A user none of whose user groups is in the list is not restricted. A user who is a member of several user groups in the list needs to match the IP addresses of any one of them. When working in the web browser and when connecting through the web services of the “NETGeniumConnection” library, the IP address is checked only at login; the MCP server checks it with every request. The restriction does not apply on the server desktop (IP address “127.0.0.1”). Validation of a personal MCP token in a custom API does not evaluate the list; a detailed description of the validation is provided in the separate guide API.
• The addresses listed for the “Administrators” group also determine where a file can be uploaded from with the FileUpload tool if its profile unpacks a ZIP archive after transfer or its target directory or copy target is a “bin” or “update” directory or lies inside one. Without any address for this group, such an upload fails, and the exception for the IP address “127.0.0.1” does not apply to it.
• The line “IP: ?” in the configuration file “RequestHeaders.txt” turns off the check against the list on the server for all logins. A detailed description is provided in the separate guide Installing NET Genium on the web server.
• The allowed IP address can take the following values:
  • 1.2.3.4 – access is allowed only for this specific IP address
  • 1.2.3 – access is allowed for all IP addresses where the first three parts agree, the value of the fourth part can be arbitrary
  • 1.2 – access is allowed for all IP addresses where the first two parts agree, the value of the third and fourth part can be arbitrary
  • 1 – access is allowed for all IP addresses where the first part agrees, the following three parts can be arbitrary
  • An IPv6 address is compared in the same way, part by part separated by colons, and it is therefore written in the same text form in which NET Genium shows it in the “Auth” log.
• Deleting a user group also deletes the allowed IP address records of that group – in the “User group” edit form as well as when deleting with the “Delete record” script step or via the integrated MCP server.

2.4.4. Public external functions

• List of public external functions that a client may call without prior authorization by the server. For each function a user group to which it is accessible is selected: without a restriction the function is accessible to anyone including users who are not logged in, otherwise only to users with administrator privileges, or to members of the selected user group. A function cannot be restricted to an individual user.
• The definition of a public external function must contain only the identifier of the external function, ie the value of the “string id” parameter. A detailed description of external functions is provided in the separate guide External functions, and also for the function “string ngef” in the separate guide Server functions.
• Deleting a user group also deletes the public external function records of that group – in the “User group” edit form as well as when deleting with the “Delete record” script step or via the integrated MCP server.
• In NET Genium Online the list of public external functions is not displayed – external functions are not available in the cloud.

2.4.5. Add IP address

• The button inserts a new record of an allowed IP address with the IP address from which the administrator is currently accessing NET Genium and with the “Administrators” group.

2.4.6. Add external function

• Button for inserting a new record of a public external function.
• In NET Genium Online the button is not displayed.

2.5. “Passwords” tab

• Repeatedly entering a wrong password on the web pages protected by the passwords on this tab (print templates, restart, AI model) temporarily blocks entering the password – instead of the login form, the page displays the message “Please wait, your request is in order...” and reloads after 5 seconds. The same applies to the web services for downloading and uploading the model and for synchronization – after repeated wrong passwords they reject further requests. Wrong passwords are counted by the IP address the session started from: all visitors who are not logged in share one counter for an IP address and every logged-in user has their own counter for the same address, so the wrong passwords of a logged-in user do not block the others. The web pages, the web services for downloading and uploading the model (together with the FileUpload tool) and the synchronization each have their own counter. The block wears off an hour after the last wrong password at the latest. For the AI model, a correct password entered from an IP address that is not allowed also counts as wrong. Every wrong password is written into the “Auth” log.

2.5.1. Password strength required

• The password strength setting determines how complex passwords must be when changing old passwords to new ones.
  • None – The password may be blank.
  • Weak – The password must be at least 5 characters long. The password expires every 12 months, and the new password may be the same as the previous one.
  • Fair – The password must be at least 8 characters long, and must contain characters from at least 3 of the groups {lowercase, uppercase, numbers, special characters}. The password expires every 12 months, and the new password cannot be the same as the previous one.
  • Strong – The password must be at least 12 characters long (administrator password at least 17 characters), and must contain characters from all the groups {lowercase, uppercase, numbers, special characters}. The password expires every 12 months, and the new password cannot be the same as any of the previous passwords.
• Special characters: - _ , . : ; ! @ # $ % ^ & * = + ( ) { } [ ] < > / ? ' ` " | § and space
• Only letters without diacritics count as lowercase and uppercase letters; letters with diacritics and characters outside the listed special characters do not count toward any group.
• Previous passwords are looked up in the user's change history, so deleting the history shortens their list. The “User” edit form allows keeping a password identical to the current one; with the “Strong” password strength, however, no other previous password can be set there either.
• When a password strength is set, the password must not contain any four consecutive characters of the login name (case-insensitive).
• When a password strength is set, logging in with the login name “Administrator” (case-insensitive) and an empty password in the login window, in the “Change password” dialog, through the Login.aspx page and through the web services of the “NETGeniumConnection” library is possible only from the IP address 127.0.0.1.
• When a password strength is set, a user who has never changed their password themselves must enter a new password at the next login with a user name and password. Only a password change in the “Change password” dialog and on the login page (a forced password change and setting a new password after recovering a forgotten password) counts – a password saved in the “User” edit form is not taken into account and does not change the expiration period, not even when users change it in their own record. A user who has changed their password themselves, even before the password strength was set, enters a new password only after it expires, that is 12 months after their last own change.

2.5.2. Print templates

• Password for the “url-netgenium/templates” web page, which is protected only by this password, regardless of the user's privileges. If the password is blank, the page cannot be used.
• The password protects only this web page. In a full installation of NET Genium the print template files from the “Templates” directory can also be downloaded at the direct address “url-netgenium/templates/file name”, even without logging in; in NET Genium Online the “Templates” directory cannot be accessed at a direct address.
• On the page the print templates from the “Templates” directory can be downloaded, and an existing template can be replaced with a file of the same name using the “Browse...” button in the “Update template” row. New templates can neither be added nor deleted there.
• A user with administrator privileges manages print templates on the “Print templates” tab of the NET Genium settings dialog. For a user without administrator privileges the “NET Genium” toolbar offers the “Print templates...” link to this page instead of the settings dialog.
• If the “DenyLogin.txt” configuration file exists, the website is disabled, even on the server desktop.
• The password is available only in full installations of NET Genium – in NET Genium Online the field is not displayed.

2.5.3. Restart

• Password required when restarting NET Genium on the “url-netgenium/restart” web page outside admin mode. If the password is blank, NET Genium cannot be restarted this way.
• In admin mode NET Genium is restarted without a password, see the [[#restart Restart]] chapter.
• The NET Genium restart website is located at “url-netgenium/restart”.
• If the “DenyLogin.txt” configuration file exists, the website is disabled, even on the server desktop.
• The password is available only in full installations of NET Genium – in NET Genium Online the field is not displayed and NET Genium is restarted by the service provider.

2.5.4. Synchronisation

• If the password is blank, it will not be possible to synchronize data from the remote server with your NET Genium.
• Anyone who knows the synchronization password can create, modify and delete records of any edit form in this installation – receiving synchronization does not check which forms are linked with the sender. The password should therefore be strong, should be given only to linked installations, and the communication should use the “https” protocol.
• The password is available only in full installations of NET Genium – in NET Genium Online the field is not displayed and data synchronisation between instances is not supported.

[[Kotva:ai-model-password]]

2.5.5. AI model

• Password required when downloading the [[ai-models AI model]] automatically using web services and when uploading model changes back to NET Genium. If the password is blank, the model can neither be downloaded nor uploaded automatically.
• Anyone who knows the password can upload model changes to this installation – create, modify and delete application groups, applications, categories, edit forms, view pages, controls and scripts, create and modify database queries, user groups and rights groups, and set rights. The changes are written as the Administrator account, so they include objects that other administrators are not allowed to change. The password should therefore be strong, and access should be restricted by “IP addresses allowed” for the “Administrators” group.
• The website for downloading the model with this password is located at “url-netgenium/ai”.
• The tool that downloads and uploads the model authenticates itself with this password – in the “ai-model.json” configuration file it is the value of the “ngPassword” key. After changing the password, that configuration file must be updated as well.
• The password is stored in the database only as an irreversible hash, so it is never displayed in the settings – a forgotten password cannot be retrieved, only replaced with a new one.
• Besides the password, the IP address the model is downloaded or uploaded from is verified as well – if “IP addresses allowed” on the “Permissions” tab lists addresses for the “Administrators” group, it must match one of them. Without addresses for this group the IP address is not restricted, and the restriction does not apply on the server desktop (IP address “127.0.0.1”).
• The password is available only in full installations of NET Genium. In NET Genium Online the field is not displayed at all and the model can neither be downloaded nor uploaded automatically – in the cloud the AI assistant connects to the [[mcp-data-server integrated MCP server]] of the instance, which serves the model directly.

2.5.6. Generate password

• The button generates a random password in the form of a GUID identifier and writes it into the dialog together with an icon for copying it to the clipboard.
• The generated password is not stored anywhere – it only serves as a source of a random value that can be pasted into any of the passwords above. It is displayed only once, so copy it and store it safely.

[[Kotva:colors]]

2.6. “Colors” tab

• List of colors offered by the color picker when editing a value in “TextBox” controls with the “Show color picker in the edit form” option checked.
• If the color list is empty, the color picker offers a default color palette.

2.6.1. Add color

• Button for inserting a new color record.

2.7. “Other” tab

2.7.1. Navigator

• The navigator type setting determines how the navigation area lists the applications.
  • Type A – displays a list of all applications in the navigator, including the options for editing them.
  • Type B – speeds up the work with NET Genium in admin mode, but it is not as comfortable as type A.
• The option is offered only in the old design (up to 2016); in the current appearance of NET Genium it is not displayed in the settings.

2.7.2. E-Learning

• The e-learning style setting determines what appearance will be used to visualize e-learning courses.
  • Style A – displays e-learning courses in pleasant blue and orange colors and contains pictorial navigation buttons.
  • Style B – is rather conservative and respects the color settings of NET Genium.
• In NET Genium Online the style option is not displayed.

[[Kotva:performance-logging]]

2.7.3. Logging

• Logging is used to measure the processing time of database queries, scripts, view pages, edit forms and external functions.
  • Off – Server-side processing times are not measured.
  • To database – Processing times for database queries, scripts, view pages, edit forms and external functions are stored in the database. From this data it is possible to display aggregated statistics using the “Logging” button directly in the settings of the given control element, resp. its database query, as well as in the settings of the script, view page or edit form. Another option is to display these statistics on the reports page, where statistics of measurements of external functions are also available. A detailed description of the reports is provided in the separate guide [[reports Reports]].
  • To disk – Processing times for database queries, scripts, view pages, edit forms and external functions are stored on disk in the “Logs” directory.
  • To database and disk – Server-side processing times are stored in the database and on disk at the same time.
  • Logging to console – a separate checkbox, independent of the logging option. It displays a console at the bottom of the web browser window into which the processing times of view pages, edit forms, the main page with portlets and the “New email” form are written. The console is displayed to all users, not only to administrators; on mobile devices the times are not measured.
    • Data Transferring Time – communication time between client and server
    • Page Processing Time – server-side page processing time
    • Page Rendering Time – time of page rendering in the web browser
    • Total Waiting Time – total waiting time for the page to be viewed
  • Measure memory consumption – Monitoring the memory consumption of each database query that retrieves data.
    • Memory consumption is calculated as the difference of the allocated memory of the “w3wp.exe” process before and after the data is successfully retrieved from the database.
    • The “w3wp.exe” process serves the requests of all users of the web application, so the calculated value may be inaccurate and may also include the memory consumption of other requests.
    • The calculated value can also be negative if memory was freed by the Garbage Collector during data loading.
    • The measured value of memory consumption is available in reports when database logging is enabled, and on disk in the log file “Logs\Data-yyyy-MM.log” for those database queries whose memory consumption exceeds 1GB (the word “LastMemoryConsumption”).
  • Delete old logs in the database – Deletes all measured data from the database, regardless of its age.
  • Delete old logs on the disk – Deletes log files whose name begins with a date and files in dated user subdirectories from the “Logs” directory, both only when older than 7 days. Other files, such as “System.log” or the monthly logs with a prefix (for example “Data-yyyy-MM.log”), are kept.
• In NET Genium Online the drop-down list offers only the “Off” and “To database” options – logging to disk is not available. The “Measure memory consumption” option is not displayed either.

[[Kotva:options]]

2.7.4. Options

• Enable automatic error reporting to NetGenium
  • Checking this box turns on sending e-mail messages about errors that occur in NET Genium while users without administrator privileges work. Errors of users with administrator privileges are not sent.
  • A message about a serious error is received by NetGenium Technical Support and by the service e-mail address, a message about a less serious error only by the service e-mail address. A less serious error is not reported when it occurs for the first time; it is reported once it recurs later than one hour and no later than 24 hours after the previous recorded occurrence. The occurrences are kept only in the memory of the web application, so a restart resets them.
  • The same error is reported at most once an hour.
  • The message contains the technical description of the error (type, message and stack trace), the page address, the login name of the user (if the user is known), the user's IP address, the identification of the user's web browser, the server name, the versions of the operating system and of .NET Framework, the account the web application runs under, and the date and time of the error.
  • Without checking this box, messages about errors in applications are sent neither to the technical support nor to the service e-mail address.
  • For each error, the user is shown an error message on a separate page.
  • If the database cannot be connected to, the message “An error occurred during connecting to the SQL database server!” with the link “Try again” is shown instead, and the reason why the database is unavailable is written to the “Errors.log” log file.
• Log usage of view pages
  • Checking this box determines whether the use of individual view pages in the database should be logged in the “Settings” application:
    • Logging into the “Settings/Statistics” table – Visited view page, User, Date
    • Logging into the table “Settings/Statistics 2” – Visited view page, Number of visits
    • Logging into the table “Settings/Statistics 3” – Visited view page, User, Number of visits
  • View page logging is used to detect underused or unused view pages by users.
  • The opening of the same page by the same user is logged in the database only once an hour. The visits in the “Settings/Statistics 2” and “Settings/Statistics 3” tables are counted in the same way.
  • Visits of the anonymous user are not logged.
  • In NET Genium Online this field is not displayed.
• Enable sending lost passwords on the login page
  • Checking this box determines whether the “Lost password” button should be displayed on the login page next to the “Log in” button, which is used to send password recovery instructions to the user's email address.
  • When the “Portal address” is filled in, the e-mail contains a link for setting a new password; the link is single-use and valid for 1 hour. When no portal address is available, a temporary password with the same validity is sent instead, with which the user logs in and changes the password right away.
  • An unused link and a temporary password are invalidated by every successful login of the user in the browser (with a login name and password, through Microsoft, Google, Facebook or Apereo, through Windows Integrated Authentication or with a login ticket) and by every successful login through the Login.aspx page (the Uploader.Login_aspx method of the NETGeniumConnection library); password recovery then has to be requested again.
  • Every password recovery request creates its own link, valid for 1 hour from that request; a new request does not invalidate earlier unused links. A temporary password, on the other hand, is valid only from the latest request.
  • In NET Genium Online the portal address is derived from the identifier of the instance, so the link works with no further configuration.
  • Password recovery can be requested at most five times in 24 hours for each user, and at most three times in five minutes from a single IP address.
  • The login page always answers the same way, regardless of whether the entered user exists and has an email address filled in — valid user names therefore cannot be probed. When the entered user does not exist or has no valid e-mail address, this is written to the “Warnings” log; the result of sending the e-mail is not evaluated.
  • Once the password change through the link or the temporary password is complete, the user receives a notification at their email address with the date, the IP address and the browser the change was made from.
  • In NET Genium Online both e-mails — the one with the link and the change notification — are sent in the visual style of the other cloud messages, with a button instead of a bare link and with an overview of the request details. A classic installation sends the e-mails unchanged.
• Send emails with tips on getting the instance going
  • The field is displayed only in NET Genium Online. Checking this box determines whether NET Genium sends e-mails with tips on getting started with the instance in the first weeks after registration. Each e-mail points out a step that is still missing in the instance: the first work in the instance (no earlier than the 3rd day after registration), an application built by AI (no earlier than the 7th day) and connecting an AI agent through the MCP server (no earlier than the 14th day). Each e-mail is sent at most once, only within 30 days of registration and only on working days.

3. Application “Settings”

3.1. Core application

• NET Genium contains a default set of edit forms and their corresponding view pages, which are essential for the correct functioning of the entire application. These edit forms are located in the “Settings” application.
• The “Settings” application cannot be deleted or moved to another application group.
• Modifications to edit forms and view pages in this application can be performed only by a single user with the highest permission level — the “Administrator” user with database ID 1.
• The “Settings” application contains the following edit forms and their corresponding view pages:
  • User – database table “susers” with the list of users
    • Full name – the user’s full name
    • Surname – the user’s surname
    • First name – the user’s first name
    • Title – the user’s title
    • Login name – the user's login name
    • Password – the user’s password
    • Language – the user’s language setting (cs, de, en, fr, sk)
    • Windows account – the domain account name of the user in Active Directory, used to enable automatic login to NET Genium without entering a username and password
    • E-mail – the user’s email address
    • M-Password – password for the user’s Android mobile - device account
    • Rights group – foreign key to the rights group directory, defining the list of user groups of which the user is a member. Assigning a user to a rights group is the preferred method of granting permissions, though manual assignment of user groups is possible via the next control “User groups”.
    • User groups – list of user groups in which the user is a member. Manual assignment of user groups for each user individually is not the preferred method of permission assignment; the recommended method is selecting a rights group as described above.
  • User group – database table “susergroups” with the list of user groups
    • User group – name of the user group
    • Description – description of the user group
  • Rights group – database table “srightsgroups” with the list of rights groups
    • Rights group – name of the rights group
    • Description – description
    • User groups – list of user groups defining the rights group
  • Public holiday – database table “sholiday” listing current public holidays. Content is generated automatically according to the language settings of NET Genium.
    • Holiday name – name of the public holiday
    • Date – date of the public holiday
    • Half-day – checkbox for marking half - day public holidays (used mainly in Germany)
  • Layout – database table “slayout” with the list of graphic themes of NET Genium
    • Name – name of the layout
    • Save as active layout – checkbox for marking the layout as active and regenerating CSS
    • Font name
    • Text size
    • Font color
    • Header – Logo
    • Header – Background image
    • ...
  • Invalid login – database table “sinvalidlogins” with invalid login attempts
    • Date – date of the invalid login
    • IP address – IP address from which the login attempt was made
    • Login name – login name that was used
    • Password – always the value “*****”; the entered password is not stored
  • Statistics – database table “sstatistics” with view page usage statistics
    • View page – visited view page
    • User – login name of the user who visited
    • Date – date of visit
  • Statistics 2 – database table “sstatistics2”
    • View page – visited view page
    • Session – number of visits
  • Statistics 3 – database table “sstatistics3”
    • View page – the visited view page
    • User – the login name of the user who visited the page
    • Session – the number of visits
  • Synchronization – database table “ssynchro” with synchronization errors; some errors, for example in reserving an ID on the remote side, in locally renumbering a new record, in preparing a change for sending or in sending emails, are written only to the “Synchro-year-month.log” log file
    • Error date
    • Edit form – name of the form where the error occurred
    • Record ID – ID of the record involved
    • Error – error description

3.2. Optional applications

• The “Install” directory contains a set of optional applications that can be imported into NET Genium.
• Available optional applications:
  • API – management of API keys for external system access and SQL - query records available for download via API.
  • Applications – overview and management of applications installed in NET Genium. The edit forms use views defined in their settings; these views must be created afterwards on the “Administration” tab using the “CREATE VIEW” command.
  • Business Logins – management of credentials and tokens for communicating with the Google, Facebook and Microsoft APIs.
  • DataGrid Settings – saving/loading individual datagrid settings. The application uses the “SAVEDATAGRIDSETTINGS” and “LOADDATAGRIDSETTINGS” server functions and includes an example of their use.
  • E-learning – e-learning courses and materials.
  • E-mail – mail accounts, contacts and signatures of users for the Email control and the new e-mail message form, management of email templates and sent emails.
  • FileUpload – management of files uploaded to the server (used by FileUpload.exe).
  • Licenses – monitoring license usage over time.
  • Maps – map backgrounds and geographic data visualization. The application demonstrates working with maps and the use of the “PLACESONMAP” server function.
  • Practical information – a list of public holidays and foreign words.
  • Reset password – mass password reset and email delivery.
  • RUIAN – address lookup in the Register of Territorial Identification, Addresses and Real Estate (RÚIAN). The lookup is handled by the “RUIAN_Search” external function, which NET Genium itself does not contain – it must be added to the “ngef.dll” file as a call of the “RUIAN.Adresa.Search” method of the “NETGeniumConnection.dll” library (see [[external-functions External functions]]). The method looks up addresses in the “ng_ruianobec”, “ng_ruianulice” and “ng_ruianadresa” tables, which must be filled with RÚIAN data.
  • Services – monitoring services running via Windows Scheduler or console apps.
  • SMS – sending and receiving SMS. The application is required for the “SMSService” service to run.
  • Stats – edit forms for reading logs recorded by NET Genium while database logging is enabled. The edit forms use views defined in their settings; these views must be created afterwards on the “Administration” tab using the “CREATE VIEW” command.
  • UNION – examples of the SQL UNION operation using views. The edit forms use views defined in their settings; these views must be created afterwards on the “Administration” tab using the “CREATE VIEW” command.
  • Web – management of content published via NET Genium.

4. Configuration files

• Configuration files contain data required for the correct operation of the web application but are not part of the database. They are located in “NETGenium\Config” as text files or, in some cases, as files in the JSON format.
• Most configuration files are read by NET Genium only when the web application starts, so creating, changing or deleting a file takes effect only after NET Genium is restarted (see the [[#restart Restart]] chapter). The “UnderConstruction.txt”, “UnderConstruction2.txt” and “Holidays.txt” files are read every time they are used. NET Genium reads the “ConnectionString.txt” and “License.txt” files again during operation under certain conditions, but a change to them, too, takes effect reliably only after a restart. A license key uploaded or activated in the “License key request” dialog takes effect immediately in the web application process that received it. The “DenySynchro.txt” file is read by the NETGeniumConnection library (external functions, Windows services) every time a record is saved. The update program “Update.exe” reads the “Tester.txt” file and the “SqlBackup.exe” program reads the “UpdateArchive.txt” file themselves every time they run.
• BlindFriendly.txt – when this file exists, view tables, the “Calendar”, “Planner”, “TimeTable” and “Tree” controls and the portlets on the main page use a static toolbar displayed permanently under their title instead of a dynamically displayed one. The file may optionally contain a list of control types (one per line) to which the static toolbar is restricted (“DataGrid”, “Calendar”, “Planner”, “TimeTable”, “Tree”; the portlets are represented by the value “HTML”). An empty file applies to all of them. The types are compared literally, so a file without types must not contain even an empty line.
• ConnectionString.txt – the connection string to the NET Genium database.
• Copyright.txt – placeholder HTML code for the copyright displayed in the navigation area. If the file does not exist, the text “© 20xx NetGenium” is shown. A second option for modifying the copyright is via the NETGenium.Copyright external function, see the [[external-functions#netgenium-copyright External functions]] guide.
• CustomIcons.txt – a list of custom icons replacing default icons used in the application. Each line defines one icon in the format: “Images/Picker.gif:Images/Custom/Picker.svg”
• DefaultLanguage.txt – two-letter code of the default language in which the “Settings” application is localized and which is assigned to users “Administrator” and “Anonymous” upon creation (“cs”, “de”, “en”, “fr”, “sk”).
• Demo.txt – when this file exists, saving or deleting anything in the web application is disabled. The file may optionally contain a list of database tables (one per line) in which changes remain allowed. For example, “susers_vf” enables user customization of view tables. Where changes are disabled, scripts do not send e-mails either – neither the “Send email” step nor the server functions sending e-mails are performed. In tables in which changes are allowed, e-mails are sent as usual. Demo mode does not prevent writes performed by the own code of an external function: an external function called from a button script, an HTML control, JavaScript, a scheduled task or as a “NETGenium.*” callback outside saving and deleting a record is executed the same way as outside demo mode (the “test” parameter does not depend on demo mode; the exceptions are the “NETGenium.Import” and “NETGenium.ImportXml” callbacks, which do not run in demo mode), and everything it writes to the database through the script’s “DbCommand” passed to it or through its own “DbCommand” is saved – demo mode suppresses only the writes of the script itself.
• DenyContextMenu.txt – when this file exists, right-clicking selected text in the “RichTextBox” control and in the “TextArea” control with the “Wiki” or “Markdown” data type displays the default context menu of the web browser instead of the formatting context menu. Text is then formatted with the tools in the toolbar above the control.
• DenyCookieless.txt – when this file exists, the web application requires cookies on the client side. It takes effect only after an update or a restart of NET Genium (see the [[#restart Restart]] chapter) rewrites the “Web.config” file; deleting the file is, however, not applied to the “Web.config” file by a restart, only by an update of NET Genium. Consequently:
  • SessionID will not be inserted into page URLs (“.../netgenium/(S(33cipeb0js15bo1t1xhkupr4))/default.aspx”)
  • it will not be possible to log in within a single web browser under different user accounts in different tabs — the web browser merges individual sessions.
• DenyExport.txt – when this file exists, exporting applications in the NET Genium web interface is disabled; the “ApplicationManager.exe” program run on the server does not respect the restriction.
• DenyInvalidLogins.txt – when this file exists, account blocking after repeated invalid logins does not apply to logins with a user name and password in a web browser from IP addresses listed in “IP addresses allowed” for the “Administrators” group; the exception applies to any login name entered from such an address, but not to connections via the web services of the “NETGeniumConnection” library.
• DenyLogin.txt – when this file exists, login with a user name and password is possible only on the server desktop or from the IP address “127.0.0.1”. From anywhere else the login window is not displayed and a login with a user name and password is refused; users can log in from there only by other means (login ticket, Microsoft sign-in, Windows authentication). Connections via the web services of the “NETGeniumConnection” library are not restricted by the file, whereas the integrated MCP server is disabled while the file exists. While the file exists, the websites for restarting NET Genium (“url-netgenium/restart”) and for editing print templates (“url-netgenium/templates”) are disabled as well, even on the server desktop. The file may optionally contain a URL for redirecting unauthorized login attempts and for redirecting after logout. The URL may contain the “#viewpage#”, “#form#” and “#id#” variables, which are replaced with the values of the “viewpage”, “form” and “id” parameters of the request address (0 if the parameter is missing), and the “#loginname#” and “#language#” variables, which are replaced with the login name and the language of the user from the last login in the same browser. If the file contains the “#loginname#” or “#language#” variable, the login name or the language is stored at login in a browser cookie valid for 6 months; without the cookie an empty value is used.
• DenyStartSynchro.txt – when this file exists, the web application does not send the synchronization queue itself; the queue is then sent only by the “StartSynchro.exe” program run by a scheduled task.
• DenySynchro.txt – when this file exists, changes are neither queued for synchronization nor sent to linked servers; receiving synchronization from other installations is not disabled by it (an empty synchronization password disables it).
• EncryptionKey.txt – encryption key used for encrypting “TextArea” and “RichTextBox” columns. If the file does not exist, a default encryption key is used. The first 16 characters of the file, including any line break, are used; shorter content is padded with characters of the default encryption key. Values encrypted earlier with a different key cannot be decrypted after the key is changed.
• ErrorLabel.txt – text that the “#errorlabel#” variable returns after the text “ERROR”; if the file does not exist or is empty, the variable contains an empty string. The same value that the variable returns is also appended to the subject of NET Genium system e-mails. A detailed description is provided in the separate guide [[variables Variables]].
• ExecutionTimeout.txt – maximum request-processing time (in hours) used to extend the default limit of 5 hours, typically for long-running scripts. This influences the “executionTimeout” attribute in “Web.config”, which is set by “FinishUpdate.exe” after every update of NET Genium and by NET Genium itself at a restart from admin mode or with the password (see the [[#restart Restart]] chapter).
• Framework.txt – automatically generated file containing the detected .NET Framework version configured in the IIS application pool.
• GoogleTranslationApiKey.txt – API key for Google Translation API used for translating texts in the “RichTextBox” and “TextArea” controls with the “Wiki” or “Markdown” data type in an edit form, in the preview window of the “RichTextBox” control, and in the “Details” panel of a datagrid. If the file does not exist, the translation icon is not displayed at all.
• GoogleTranslationLanguages.txt – semicolon-separated list of two-letter language codes offered for translating texts. If the file does not exist, all languages installed in NET Genium are offered.
• Holidays.txt – condition used to filter public-holiday records loaded into date pickers, into the name of today's public holiday in the portal header, into the marking of public holidays in the “Calendar”, “Planner” and “TimeTable” controls, and into functions such as “ADDWORKDAYS”, “MEASUREWORKDAYS”, “MEASUREWORKHOURS”, “jsMeasureWorkDays”, or “Date.addWorkDays”. Example: “ng_country = 'USERDETAILS(ng_countryforholidays)'”
• License.txt – NET Genium license key. A detailed description of the license key is provided in the separate guide [[security-and-users#licensing-model Security and users]].
• LoginByIdentity.txt – the presence of this file ensures that the NET Genium login window includes a checkbox enabling automatic user login through Windows Integrated Authentication, without the need to manually enter a username and password.
  • For this purpose, the user must exist in Active Directory, and the user’s domain account name must be filled in within NET Genium in the users table (“susers”) in the “Windows account” column (“account”). The account must be filled in for one user only – if more users have it, the login is refused. The account is compared by the database according to the collation of the column, so on a Firebird database with the default collation, which is case sensitive, it has to match the account verified by Windows including letter case.
  • The automatic login process performs only authentication, while authorization is handled by NET Genium — each user has an assigned list of user groups to which the user belongs.
  • If the “LoginByIdentity.aspx” page does not log the user in (for example when the user's account is not found in NET Genium or the login is rejected by the check of allowed IP addresses), the next opening of the portal in the same browser session no longer attempts the automatic login and displays the login window; this does not apply when NET Genium requires cookies through the “DenyCookieless.txt” file. The automatic login is attempted again as soon as the user ticks the automatic login in the login window again.
  • Along with creating the “LoginByIdentity.txt” file, it is necessary to configure the “LoginByIdentity.aspx” page in IIS so that it supports Windows Integrated Authentication; more details are provided in the separate guide [[installing-netgenium-web-server Installing NET Genium on the web server]].
• LoginByMicrosoft.txt – the presence of this file ensures that the NET Genium login window includes a checkbox enabling automatic user login through Microsoft Integrated Authentication, without the need to manually enter a username and password. For this purpose, the user must exist in Azure Active Directory (Microsoft Entra ID), and the user’s email address must be filled in within NET Genium in the users table (“susers”) in the “E-mail” column (“email”), and only for one user; on a Firebird database with the default collation, the e-mail is compared including letter case. The automatic login process performs only user authentication, while authorization is handled by NET Genium — each user has an assigned list of user groups to which they belong. Along with creating the “LoginByMicrosoft.txt” file, NET Genium must be configured in the portal at “https://portal.azure.com”; more details are provided in the separate guide [[configuring-user-login-via-ms-entra Configuring user login via MS Entra]].
• MaxExcelColumns.txt – maximum number of columns of a data export from a view table into the XLSX or XLS format; when it is exceeded, the export automatically switches to the CSV format. If the file does not exist or contains zero, the number of columns is not limited. A detailed description is provided in the separate guide [[datagrid-data-export DataGrid data export]].
• MaxExcelRows.txt – maximum number of rows of a data export from a view table into the XLSX or XLS format; when it is exceeded, the export automatically switches to the CSV format. If the file does not exist or contains zero, the number of rows is not limited. A detailed description is provided in the separate guide [[datagrid-data-export DataGrid data export]].
• MaxRequestCount.txt – maximum number of requests per second of the anonymous user (the built-in account in whose context anonymous web forms work) from a single IP address, which replaces the default limit of 100 requests per second – typically it increases the limit, but a smaller number decreases it; zero, a negative number or invalid content means the default limit. For visitors who have not logged in, this limit (default or set) also multiplies the allowed volume of data per second, which is 50 MB for edit forms, pickers and file uploads (or the value from the “MaxRequestLength.txt” file) and 1 MB for other pages. Increasing it is relevant mainly for anonymous web forms, where all users work in the context of a single user who is not logged in. This limit also applies to every visitor who has not logged in yet, and all visitors who have not logged in from one IP address share it. Logged-in users have a fixed limit of 10 requests per second, which this file does not change. Both limits are counted separately for each kind of page – for example for edit forms, view pages including the main page with portlets, pickers, file uploads and the login page – and when they are exceeded, the message “Please wait, your request is in order...” is usually displayed instead of the page.
• MaxRequestLength.txt – maximum request size (in MB) that replaces the default limit of 50 MB (a smaller value lowers the limit), typically required for uploading large files using “File” and “Image” controls. The same value also sets the data volume per second that the overload protection allows for edit forms, pickers, and file uploads. This affects “maxRequestLength” and “maxAllowedContentLength” in “Web.config”, which are set by “FinishUpdate.exe” after every update of NET Genium and by NET Genium itself at a restart from admin mode or with the password (see the [[#restart Restart]] chapter).
• MaxSyncCount.txt – maximum number of records for one-time synchronization of all data in an edit form database table, used to increase the default limit of 10,000 records. A detailed description of one-time synchronization is provided in the separate guide [[edit-form Edit form]].
• MetaTags.txt – list of HTML tags inserted into every edit form inside the <head> section.
• MicrosoftOAuth.json – configuration of user login via Microsoft (Microsoft Entra ID) in the JSON format. A detailed description is provided in the separate guide [[configuring-user-login-via-ms-entra Configuring user login via MS Entra]]. The file is also used by the “CRMService”, “InvoiceService” and “PaymentService” services for signing in to a mailbox via OAuth2.
• NoFrames.txt – when this file exists, NET Genium runs in frameless mode — the header and navigation area become part of each page’s HTML.
• NoScript.txt – text message inserted inside <noscript> in every edit form, view page, picker and configuration dialog and in the page with portlets, displayed to users with JavaScript disabled. Example:
  “Dear users,
  Your browser unfortunately does not support JavaScript, which is required to display these pages correctly.
  Please enable it.
  Thank you.”
• OCRServer.txt – URL of a remote NET Genium instance providing OCR services. The address is returned by the “#ocrserver#” variable; NET Genium itself does not use it anywhere – it applies only when the variable is passed to the “OCR2TEXT”, “OCR2HTML” or “OCR2FILE” function as the “url” parameter, e.g. “OCR2TEXT(#ng_attachment#, #ocrserver#)”.
• PublicDirectory.txt – path to a public directory on the server from which the “File” control in an edit form offers the files of the record's directory through the “Browse Cloud” option. When the file is filled in, the toolbar of the edit form also shows the “Cloud...” icon, which opens the content of the record's directory; the icon is not shown in NET Genium Online, to the anonymous user, on a mobile device, in an edit form whose “Notes” field contains “DISABLEPAGETOOLS()”, or in user mode in an edit form that displays priority HTML code (an HTML control with the “Priority HTML code placed in front of the form” check box selected). A detailed description is provided in the separate guide [[edit-form-file Edit form – File]].
• RequestHeaders.txt – lines in the format “key: value”, of which NET Genium uses only the line with the “IP” key: its value is the name of the forwarding header from which the client IP address behind a reverse proxy is read, and the value “?” turns off the check against the “IP addresses allowed” list. A detailed description is provided in the separate guide [[installing-netgenium-web-server#client-ip-behind-proxy Installing NET Genium on the web server]].
• ResponseHeaders.txt – list of HTTP headers (one per line, format “key: value”) added automatically to the responses of NET Genium web pages.
  • When the “Content-Security-Policy” header contains a “script-src” directive terminated by a semicolon, NET Genium adds the “'unsafe-eval'” value to it for users with administrator privileges and in the dialogs in which a user customizes controls (for example a view table), unless the directive already contains it. A “script-src” directive without a semicolon at its end is not changed.
  • Regardless of this file, NET Genium sends the “Cache-Control: no-store, no-cache, must-revalidate”, “X-Content-Type-Options: nosniff” and “X-Frame-Options” (see “XFrameOptions.txt”) headers with its web pages, and additionally “X-XSS-Protection: 0” to users with administrator privileges. It sends the “Strict-Transport-Security: max-age=31536000; includeSubDomains; preload” header over an HTTPS connection, when the “SecureCookies.txt” file exists, and when the “SSL.txt” file exists without content or with an address starting with “https://” – except for requests from the IP address “127.0.0.1”. It removes the “Server” header from the response.
• SecureCookies.txt – when this file exists, every cookie is assigned the “Secure” attribute. Use this only when SSL termination happens on a firewall (e.g., F5). When SSL is terminated in IIS, this file is not needed.
• SessionTimeout.txt – session timeout in minutes after which inactive users are automatically logged out (default 480 minutes; regardless of this length, however, a sign-in in the web browser ends 24 hours after signing in at the latest, so a value above 1440 minutes has no effect in the browser – except for a user authenticated by the web server (for example by integrated Windows authentication or a client certificate) with an account matching their “Windows account” field); it takes effect only after an update or a restart of NET Genium (see the [[#restart Restart]] chapter) rewrites the “Web.config” file; a return to the default value or deleting the file is, however, not applied to the “Web.config” file by a restart, only by an update of NET Genium.
• SingleLogin.txt – when this file exists, a user may have only one active session of each kind; older sessions of the same kind are automatically logged out. There are two kinds of login: an interactive login in the web browser, and all other logins together, for example a login with a token through the integrated MCP server, through the web services of the “NETGeniumConnection” library and a Windows login from an address with the “autologin” parameter. A service connected through the “NETGeniumConnection” library and the integrated MCP server therefore log each other out when they use the same account. A login with an address containing a login ticket and an automatic login through Microsoft, Google or Apereo count as an interactive login in the web browser.
• SimpleClick.txt – when this file exists, records in view tables open with a single click instead of the default double click. If a view table has the display of details turned on, a single click displays the details of the record and the record is opened by double-clicking or by the link at the beginning of the row.
• SSL.txt – when this file exists, all HTTP requests are automatically redirected to HTTPS. Requests from the IP address “127.0.0.1” are not redirected. The content of the file adjusts the redirection:
  • an empty file or content other than the values below – an HTTP request is redirected to the same address over HTTPS,
  • a URL starting with “https://” – an HTTP request is redirected to this URL, and so is an HTTPS request whose address does not start with it,
  • a URL starting with “http://” – an HTTP request is not redirected and an HTTPS request is redirected to this URL,
  • “auto” – redirection is turned off completely,
  • “http” – the file behaves as if it did not exist.
  • The content of the file is compared literally, so the value must not end with a line break.
• SysLog.txt – IP addresses of SysLog servers (separated by semicolons) to which log messages will be sent. See the [[#logging Logging]] chapter.
• Tester.txt – when this file exists, “Update.exe” downloads testing versions of NET Genium intended for partners and developers. These versions may contain bugs or be unstable.
• UnderConstruction.txt – when this file exists, the web application becomes unavailable, and all requests are redirected to “UnderConstruction.aspx”. The file may optionally contain a custom message.
• UnderConstruction2.txt – similar to the above, but only users with administrator rights can log in; all other users, including those already logged in, are redirected to “UnderConstruction2.aspx”. The restriction does not apply to the anonymous user – edit forms and view pages made accessible to the anonymous user remain available. A custom message may be included.
• UpdateArchive.txt – definition of the records archived by the “SqlBackup.exe” program run with the “/updatearchive” parameter. A detailed description is provided in the separate guide [[utilities Utilities]].
• Version.txt – the current version number of NET Genium.
• XFrameOptions.txt – value of the “X-Frame-Options” header inserted into the responses of NET Genium web pages. This header tells the web browser whether a web page may be displayed in a frame.
  • Without this file, or when it is empty, the header has the value “sameorigin” – NET Genium pages can be displayed in a frame only on a web page of the same origin (the same scheme, host and port).
  • The value “*” omits the header and thus allows framing from other domains as well. Any other value is inserted into the header unchanged.
  • The pages for downloading a file, an image and a document and the consent screen of connecting an AI tool by signing in always send the header with the value “deny”.

5. File attachments

• File attachments are stored on disk in the “Files” directory. Each file attachment has its original filename stored in the database in the “sfiles” table, while the actual file on disk is saved under a modified filename. The filename on disk (without extension) is defined as the ID of the file - attachment record in the “sfiles” table, and the file extension is preserved. For example, the first file attachment stored in NET Genium may appear as “1.pdf”.
• File attachments are created by uploading a file using the “File” or “Image” controls in an edit form, by creating a file attachment through a server function in a script, and similar mechanisms.
• The file-attachments directory can be redirected to a different location on disk using a configuration file named “Files” (without extension), which is stored directly inside the “Files” directory in the same way as other file attachments. The content of the “Files” configuration file defines the disk path to the alternative directory where file attachments should be stored.

[[Kotva:logging]]

6. Logging

6.1. Incident logging

• Incident logging is handled by two primary operations:
  • Saving log messages to files on disk in the “NETGenium\Logs” directory
  • Sending log messages to a “SysLog” server

6.1.1. Log files

• Log messages are stored in the “NETGenium\Logs” directory, among others in the following files:
  • AI-year-month.log – List of changes of the implementation model written via web services or the integrated MCP server, and of errors when uploading them
  • Auth-year-month.log – List of successful and unsuccessful logins and logouts
  • Data-year-month.log – List of database queries whose result loaded into a table had more than a million rows (queries that modify data are not written), or whose memory consumption exceeded 1GB
  • Download-year-month.log – List of downloaded files
  • Errors.log – List of errors that occurred during user activity; some errors are intentionally not written to it, typically query timeouts (“Execution Timeout Expired.”) and deadlocks (“deadlock”), and for users without administrator privileges also MS SQL Server errors that NET Genium does not evaluate as serious; unhandled page errors are not subject to this restriction
  • Export-year-month.log – List of user-exported data
  • FinishUpdate.log – List of errors that occurred during application updates
  • Fulltext-year-month.log – List of errors during full-text searching of file attachments
  • Google-year-month.log – List of errors when calling the Google services for geocoding addresses and translating texts
  • Install.log – Records of the “Setup.exe” program: the result of setting the permissions to the NET Genium directory and to the MS SQL database, failed attempts to connect to MS SQL Server when no connection succeeds, and errors when working with the IIS configuration
  • Install-year-month.log – List of errors when loading the “Administrator” account from the “Config\Administrator.xml” file while the system users of a new database are created
  • MultiTableApplication-year-month.log – List of warnings and errors when creating an application with the “AI-generated application” wizard
  • Push-year-month.log – List of results of sending notifications to a mobile phone
  • ResendEmlFiles-year-month.log – List of SMTP communication commands executed when attempting to resend email messages queued on disk (in the “NETGenium\SMTP” directory)
  • RunningTasks.log – List of tasks that were running at the moment the application ended
  • RunScript-year-month.log – List of scripts executed through the “RunScript.exe” application
  • Scripts60sec-year-month.log – List of the scripts of buttons run by a click, the scripts of the “File” control when a document is created from a template and the scripts of a new record from the “Planner” and “TimeTable” controls whose processing took 60 seconds or longer
  • SMTP-year-month.log – List of successfully and unsuccessfully sent emails
  • Synchro-year-month.log – Progress of sending the synchronization queue and its errors
  • System.log – List of informational messages related to application startup (often associated with application-pool starts or restarts)
  • Update.log – List of errors of the update by the “Update.exe” program run with the “-j” parameter; with logging set to “To disk” or “To database and disk” also the progress of the manual update and of the update with the “-j” parameter
  • Version.log – List of database - structure changes related to new application versions
  • Warnings.log – List of warnings
  • yyyy-MM-dd.log – Daily log of messages that have no log file of their own, for example messages of external functions
• With the logging set to “To disk” or “To database and disk”, subdirectories named after the login name of the user are created in the “NETGenium\Logs” directory, and in them subdirectories named after the date (yyyy-MM-dd) with the logs of the individual users, for example with the “stables_stats.log”, “sviewpages_stats.log” and “squerybuilder_stats.log” files containing statistics of edit forms, view pages and database queries. The detailed course of a login through Microsoft, Google, Facebook or Apereo (the “loginbymicrosoft.log” file and similar) is written to the subdirectory of the user in whose session the login takes place: for a login to NET Genium to the subdirectory of the anonymous user, for obtaining a token with the “loginByMicrosoft”, “loginByGoogle” and “loginByFacebook” JavaScript functions to the subdirectory of the logged-in user.
• The log-file directory can be redirected to another location on disk using a configuration file named “Logs” (without extension), which is stored directly inside the directory of the same name, in the same way as other log files. The content of the “Logs” file defines the disk path to the alternative directory where log files should be stored.
• Log files with a year between hyphens in their name (for example the monthly “SMTP-year-month.log” logs) are packed by “ResendEmlFiles.exe”, for years that ended more than a month ago, into ZIP archives by the log name and the year (for example the files “SMTP-2025-01.log” to “SMTP-2025-12.log” into the archive “SMTP-2025.zip”) in the same directory, and the original files are deleted. A detailed description is provided in the separate guide [[utilities Utilities]].

6.1.2. SysLog

• Sending log messages can be configured for multiple SysLog servers simultaneously. The configuration is done using the “SysLog.txt” file located in the “NETGenium\Config” directory.
• If the “SysLog.txt” configuration file exists and contains one SysLog server IP address or several SysLog server IP addresses separated by semicolons, log messages will be automatically sent to the specified SysLog servers and stored in the “NETGenium\Logs” directory.
  • The SysLog servers receive, for example, the messages of the “Auth”, “Errors”, “System” and “Warnings” logs and of the daily log “yyyy-MM-dd.log”.
  • Some logs, for example “Download”, “Export”, “RunScript”, “SMTP” and “Synchro”, are stored only in files in the “NETGenium\Logs” directory and are not sent to the SysLog servers.
• If the “SysLog.txt” configuration file is not present, logging is performed only into the files located in the “NETGenium\Logs” directory.
• Messages sent to a SysLog server use the following format, with space as the separator between values: “date time server_domain_name application category event_type user_login_name user_ip_address message”
  • Category – the name of the log, for example Auth, Errors or System; for some logs, for example “AI”, “Data” and the daily log, the category corresponds to the event type (System, Warnings or Errors)
  • Event type – VERBOSE, NOTICE, WARNING, ERROR, FATAL

6.2. Web application performance logging

• NET Genium logs the following events into the database:
  • Loading speed of edit forms – into the database table “stables_stats”
  • Loading speed of view pages – into the database table “sviewpages_stats”
  • Database query performance – into the database table “squerybuilder_stats”
  • External function performance – into the database table “sngef_stats”
  • Script performance – into the database table “sngscript_stats”
• Enabling or disabling logging is done in a dedicated dialog under “Modify NET Genium” on the “Other” tab:
  • Off – logging is turned off
  • To database – logging is performed only into the database
  • To disk – logging is performed only to disk in the “Logs” directory
  • To database and disk – logging is performed both into the database and to disk in the “Logs” directory
• Aggregated statistics generated from database-logged events can be viewed using reports. More details are provided in the separate guide [[reports Reports]].
• The log tables keep growing until old records are deleted from them. The deletion is performed by the “SqlBackup.exe” program run with the “/deletelogs” parameter – for regular cleanup as a scheduled Windows task, see the [[utilities Utilities]] guide. In addition, the “BackupServer.exe” program deletes records older than 1 month before backing up each database, see the [[server-backup-and-restore Server backup and restore]] guide.