1. September 26, 2017 Tricia Jiang
IBM Spectrum Protect 8.1.3
September 26, 2017
Tricia Jiang
Footnote goes here

2. 8. 1. 3 IBM Spectrum Protect Overview 8. 1
8.1.3 IBM Spectrum Protect Overview announce: 9/26/17 eGA: 9/29/17
SERVER and OC 8.1.3
Tiering to the Cloud
OC client update deployment
IBM Cloud Object Storage 3.8.3
TLS1.2 for Storage Agent
Server/OC
Client deployment and update from the OC
Directory container pools - Encryption
Object Store - Azure
RFE Multi session restore from container pool should result in load balanced sessions VE
VMware - Support for Fault Tolerant VMs
VMware virtual volume (vVol) experience - persistent snapshots in DP/VMware
VMware Virtual Volumes (VVOL) for vSphere 6.5
VMware - User Experience (not entirely sure the details here)
VMware - vSphere Web Client Native HTML 5 support (including HTML5 certification)
Hyper-V data protection function at reasonable scale - includes Windows 2016 RCT
BA Client
DSMADMC User Experience Improvements (Jim will get more details)
Snapshot UNIX and Linux
Support for XFS file system
Publication review/upgrade
HSM Windows
PMR: Performance - SMB share freezes if HSM for Windows stub file is accessed
Support for search&retrieve filters in CLI (Leftover from Search in Filespace item in )
Footnote goes here

3. Server – Tiering to Cloud
8.1.3
Exert greater control over where data is stored to better balance the performance & cost benefits of different tiers of storage
Client Data stored to disk for fast ingest, directory container based pool
Pool level tier delay sets how long to retain on disk
Data tiered to cloud after “retain on disk” elapses
Operational vs Long Term data
Compliance – needs different retention period and is a good fit for long term storage
Restore of data from where ever possible: disk, cloud or both
YouTube:
Footnote goes here

4. OC – Tiering to Cloud Setting Up For Tiering
8.1.3
OC / Storage / Tiering Rules

5. OC – Tiering to Cloud Amount of Tiered Data Moved
8.1.3
OC / Storage / Tiering Rules / Details

6. Server – Tiering to Cloud More About Storage Rules
8.1.3
Define STGRULE rule_name ….
Controls how long data stays on disk before being tiered
Determines when in the day tiering processes will automatically run
Defines which source stgpool will tier to which target stgpool
Can be configured via OC or Command Line
target_stgpool: on or off premise cloud pool (S3/Azure)
If only used for tiering, don’t need hybrid cache directory
SRCPools: one or more directory pools
ACTiontype: always set to “Tier” for this release
TIERDelay: how many days objects stay in source pool before being tiered
MAXPRocess: max # parallel process for each source stgpool
DURation: how long the daily tier process should run
STARTTime: when the daily tier process should start
Footnote goes here

7. Server – Tiering to Cloud Tiering Processes
8.1.3
Before Tiering

8. Server – Tiering to Cloud Tiering Processes
8.1.3
During Tiering
Parent process for each storage pool
Looks for node/filespace pairs with eligible objects to tier
Prepares batches of these objects
Max size 50MB
Puts them in a queue
At max, they will be 50 MB, so a fair amount smaller than the 1 GB for cloud cache, because we are taking chunks from potentially many different directory containers, and streaming them into one cloud object on the fly in memory. It won't affect performance, but they will have quite a few more containers in their cloud pool than they would with cloud cache.
Footnote goes here

9. Server – Tiering to Cloud Tiering Processes
8.1.3
During Tiering
Child process
One for each object batch queued by the parent process
Up to the MAXPROC as defined in the stgrule
1 parent process per srcpool, thus there can be up to MAXPROC*(# of SRCPOOLS) child processes

10. Server – Tiering to Cloud Tiering Processes
8.1.3
End of Tiering
Child processes end first, reporting progress
After all child processes end, parent process can end, reporting cumulative results of the tiering process.

11. Server – Tiering to Cloud Additional Considerations: Encryption
8.1.3
Encryption Action During Tiering
Setting on Source
Setting on Target
Keep encrypted
Encrypted: Yes
Encrypted: Yes
Keep encrypted
Encrypted: Yes
Encrypted: No
Encrypt during tier
Encrypted: No
Encrypted: Yes
Don’t encrypt
Encrypted: No
Encrypted: No

12. Server – Tiering to Cloud Additional Considerations: Compression
8.1.3
Encryption Action During Tiering
Setting on Source
Setting on Target
Keep compressed
Compressed: Yes
Compressed: Yes
Keep compressed
Compressed: Yes
Compressed: No
Compress during tier
Compressed: No
Compressed: Yes
Don’t compress
Compressed: No
Compressed: No

13. Server – Tiering to Cloud Grouped Together Objects
8.1.3
Cloud tiering treats groups as one object, for clients & data types that group objects together
Such as: Windows System State, data protection modules, etc
Tier to cloud decision, is dependent on the eligibility of the oldest object in the group
Oldest object is typically the FULL backup
For Instance:
Oracle backup using Spectrum Protect for Databases
Doing weekly fulls + daily differentials
TIERDELAY=4 days
Day 1 - Full backup No tier action
Day 2 - Differential No tier action
Day 3 - Differential No tier action
Day 4 - Differential Full + 3 Diffs (day 2, day 3, day 4) tiered to the cloud
Day 5 - Differential Diff (day 5) tiered to the cloud
Day 6 - Differential Diff (day 6) tiered to the cloud
Day 7 - Full backup No tier action

14. Server – Tiering to Cloud RTO Considerations
8.1.3

15. Server – Tiering to Cloud RTO Considerations
8.1.3

16. Server – Tiering to Cloud RTO Considerations
8.1.3

17. Server – Tiering to Cloud RTO Considerations
8.1.3
On the primary Spectrum Protect server there would be 3 container pool topologies:
(1) Directory disk pool. Protect stgpool and node replication to target SP server. No cloud tiering.
- Incremental forever (RTO sensitive) data
(2) Directory disk pool. Protect stgpool and node replication to target SP server. Tiering of old data (8+ days) to cloud on primary only
- Full (Plus..) (RTO sensitive) data
- Dissimilar policies on primary and secondary replication disk container pool pair
- Tiering occurs on the primary disk container pool only (longer retention on primary to facilitate this)
(3) Directory disk pool. No protect stgpool/node replication. Fast tiering of “archival” data (~1 day tier) to cloud
- Compliance and long term retention data (RTO insensitive)
- Tiering to occur in fairly short order after ingest
Some thoughts on daily cycle server scheduling…
Hours 0-8: Ingest (backup/archive/etc.) to primary SP server pools
Hours 8-16: Protect stgpool *and* node replication *and* tiering
Protect stgpool and node replication on disk container pool in (1) above. Tiering of pool in (3) above
Protect stgpool on disk pool in (2). Follow this with combined node replication and tiering concurrently
Hours 16-20: Expiration (all pools)
Hours 20-22: SP database backup
Hours 22-24: “Spare” hours as a buffer

18. OC – Client Deployment
8.1.3
Seamless, secure updates of Spectrum Protect Backup/Archive Client
8.1.2 offers automatic updates via Command Line
Replaces existing client push mechanism that was in the Admin Center
8.1.3 integrates automatic updates into Operation Center
Download and view client updates
Select a maintenance level to be distributed to a list of existing clients
Review distribution status
Re-deploy clients that were unsuccessful to upgrade
Cancel update schedules
Backup - Archive client updates
Upgrades clients FROM >= TO 8.1.2
Backup/Archive clients with scheduler / CAD running
8.1.3 release supports platforms & OS versions as supported by Spectrum Protect 8.1
7.1.8 release supports platforms & OS versions as supported by Spectrum Protect 7.1
Requires minimum free disk on clients
Password access must be set to generate
NOT greenfield install, cluster node deployment, Spectrum Protect for …, HSM, SA, downgrade or configuration/modification
In the given context the new deployment concept remains limited to b/a client installations only.
System with additional SP feature like HSM, Storage Agent or TDP installed are not updated. If detected the client deployment stops and reports a failure.
Note: On Unix/Linux, the new client push concept does solely support updating 64Bit b/a clients. For Windows, update of 32bit clients is supported on 32-Bit Windows platforms as supported by SP 7.1.
Downgrade scenarios (e.g. downgrade from to 7.1.7)
Greenfield deployment (machine not having a client already installed)
Deployment to machines not having scheduler / CAD running
Component configuration modification / updates
Note: None of these limitations are new – all are inherited fromt the old client push concept
YouTube:
Footnote goes here

19. OC – Client Deployment
8.1.3
In the given context the new deployment concept remains limited to b/a client installations only.
System with additional SP feature like HSM, Storage Agent or TDP installed are not updated. If detected the client deployment stops and reports a failure.
Note: On Unix/Linux, the new client push concept does solely support updating 64Bit b/a clients. For Windows, update of 32bit clients is supported on 32-Bit Windows platforms as supported by SP 7.1.
Downgrade scenarios (e.g. downgrade from to 7.1.7)
Greenfield deployment (machine not having a client already installed)
Deployment to machines not having scheduler / CAD running
Component configuration modification / updates
Note: None of these limitations are new – all are inherited fromt the old client push concept
Footnote goes here

20. OC – Client Deployment Settings
8.1.3
0 – Admin configures Spectrum Protect Hub server for automatic client updates
OC / Updates / Clients (first time)
OC / Settings / Updates

21. OC – Client Deployment Import & Replicate Packages
8.1.3
1 & 2 – Hub server automatically download updates and import into Hub Server
OC / Servers / Details / Completed Tasks

22. OC – Client Deployment Available Updates
8.1.3
3a – Admin selects clients to be updated and sets schedule
OC / Updates / Clients

23. OC – Client Deployment Available Updates
8.1.3
MOCK UP of additional update packages being available
OC / Updates / Clients

24. OC – Client Deployment Scheduling
8.1.3
3b – Admin selects clients to be updated and sets schedule
OC / Updates / Clients / Schedule Update

25. OC – Client Deployment Scheduled Updates
8.1.3
4,5,6 Clients automatically retrieve update packages, run update and send results
OC / Updates / Scheduled

26. OC – Client Deployment Initial Setup
8.1.3
Communication must be allowed between Hub & Spoke
If OC has Hub & Spokes
From HUB: query server
From SPOKES: query server
If hub not defined to spoke*: define server HUB_SERVER serverpassword=… hladdress=… lladdress=…
From HUB, make sure SSL1.2 certs exchanged: ping server SPOKE_SERVER
*The +spoke wizard in the OC does not define the hub server to the spoke server
Footnote goes here

27. OC – Client Deployment Initial Setup of RestAPI
8.1.3
Communication must be allowed between OC & Hub server RestAPI
RestAPI manages operations for OC’s client deployment processes
Embedded into Spectrum Protect server process, not a stand-alone services
Runs on HUB server only
Enable/open/customize the HTTPs port on the Hub server for the RestAPI inquiries from the OC
RESTHTTPSport
When HUB OC is first installed, sets up monitoring ID “IBM-OC-hubservername“ with system privileges
Query MONITORSETTINGS - shows whether monitor is on or off and whether monitoring admin set or not IBM Spectrum Protect:SERVER1 > Q MONITORSETTINGS Monitor Status: On Status Refresh Interval (Minutes): Monitoring Admin: IBM-OC-ADMIN1
Set STATUSMonitor ON - turns monitor on
Footnote goes here

28. OC – Client Deployment Storing and Managing Updates
8.1.3
Hub server, , needs a repository directory to download the updates to
40GB directory space, writable by server instance
Hub server, using this directory, automatically creates a FILE device class and storagepool under cover
Device class: IBM_DEPLOY_CLIENT_IMPORT
Storage pool: IBM_DEPLOY_CLIENT_POOL
Policy domain: IBM_DEPLOY_CLIENT
Policy set: IBM_DEPLOY_CLIENT
Management class: IBM_DEPLOY_CLIENT
Copy group: IBM_DEPLOY_CLIENT
Default management class: IBM_DEPLOY_CLIENT
Failed import or replication processes for given package levels, are viewable in Hub Completed Task panel
This is different in approach from the manual deployment guidance
8.1.2 separate devices for import location versus stored media
8.1.2 customer identified a storage pool explicitly
Spoke servers,
Under the covers Spectrum Protect selects an existing pool where archived packages will be stored
Can be FILE or container pool
10gb free space suggested, pool with most capacity taken in consideration
Use the OC Policy panels to select a different storage pool if preferred
Hub will automatically replicate applicable client update content to Spoke servers
Footnote goes here

29. OC – Client Deployment Catalog Processing
8.1.3
Catalog.json & update packages for deployment model available on the Client Maintenance site
HUB server automatically connects every 24 hours to IBM’s maintenance site
Hub server downloads catalog.json from HTTPs client maintenance site
Parses and populates Hub server’s internal manifest table
To view manifest table issue: SELECT PKG_NAME,PKG_TYPE,STATE FROM CLIENT_PKG
OC / Updates / Clients graphically shows available update packages
Identifies for download only applicable update packages (https method used)
Places downloaded export packages in repository directory and indicates readiness in internal server manifest table
Hub server automatically imports downloaded update packages into Hub server
Hub automatically replicates applicable platform packages to Spokes ( Spoke level required )
Catalog.json
Hub server’s Manifest
Footnote goes here

30. OC – Client Deployment Options
8.1.3
New SET Option: CLIENTDEPLOYCATalogurl
Specifies the location from which the client deploy catalog file (catalog.json) will be downloaded for client deploy operations
Intended use is for customers/partners that want to setup and manage their own package server
May be set in dsmserv.opt or using the server’s SETOPT command
To revert to the default URL, use SETOPT with a blank string: SETOPT CLIENTDEPLOYCATALOGURL “”
New Option: CLIENTDEPLOYUSELOCALcatalog
Default is “No” – Always download the catalog.json file
If set to “Yes” the server will use the existing catalog.json that resides on the local filesystem at the following sub-directory: <Instance_dir>/deployconfig
AUTODEPLOY NO
To turn off automatic client deployment add autodeploy no to the client options file
AUTODEPLOY NOREBOOT
To prevent automatic deployment if a system restart is required specify autodeploy noreboot
Footnote goes here

31. OC – Client Deployment Clients
8.1.3
Client Update packages are grouped by the following platform groups: Mac, Windows, Unix
Node names created automatically:
IBM_DEPLOY_CLIENT_MAC owns packages for Mac client
IBM_DEPLOY_CLIENT_UNX owns packages for AIX, Linux, HP-UX, and Solaris client
IBM_DEPLOY_CLIENT_WIN owns packages for Window clients
Packages are replicated to spoke servers if it has any clients in the platform group
Currently no granularity to replicate packages for a specific platform within a group
During install of Update, client platform changed DEPLOYMGR

32. OC – Client Deployment Scheduling
8.1.3
Can select a single client or multiple clients to be updated
Ctrl + Click to choose single client
Shift + Click to choose multiple consecutive clients
Should choose a start time for the update schedule that is after the backup completes
If backup is still running, update schedule will be queued for up to 2 hours before being marked as failed
A schedule will be created for each client update
Cancel Update or Reschedule buttons
Schedule will uninstall and then reinstall backup/archive code
Use client option “AUTODEPLY NOREBOOT” to prevent updates that require a reboot
Use client option “AUTODEPLOY NO” to prevent automatic updates
OC / Updates / Scheduled
Footnote goes here

33. OC – Client Deployment Storing and Managing Updates
8.1.3
Licensing does not charge for the storage of updates
Pruning of updates
Packages no longer referenced in the catalog (catalog.json) file will be removed from manifest table after 3 days
Once no more clients able to use update, the update is automatically removed within 15 days from archive pool
If the archive pool’s retention period is met, (365 days) the updates will also be expired from archive pool
Retention of Schedules
Update schedules are deleted 14 days after they are scheduled
Can retain record of updates using EXCEL export capability
OC / Updates / Scheduled / Export to CSV
Footnote goes here

34. Server – IBM Cloud Object Storage 3.8.3 or higher
8.1.3
IBM Cloud Object Storage needs to be at for Spectrum Protect
If run against an older IBM Cloud Object Storage code level
May see intermittent errors on requests to the IBM Cloud Object Storage:
Activity Log:
ANR3715E A request to the cloud service provider for the write object operation on the CLEVER storage pool failed with the following HTTP status: UNAUTHORIZED.
FFDC Log:
[ :06:23.535][ FFDC_GENERAL_SERVER_ERROR ]: (sdcloud.c:4622) com.tivoli.dsm.cloud.api.ProviderS3 handleException com.amazonaws.services.s3.model.AmazonS3Exception Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: e e b2d- 5eaa134baf5e) HTTP Status Code: 403
Due to a compatibility issue with older IBM Cloud Object Storage and the newer Amazon SDK
Solution: Update the IBM Cloud Object Storage to or higher
IBM COS public cloud is already at 3.9+
Footnote goes here

35. Server, OC, Client – Security Enhancements
8.1.3
Spectrum Protect strives to be secure-by-design
Government, Enterprise, IT landscape… continually changing
EU GDPR
US Federal Government (OnRamp, NIST, ….)
Regulatory (HIPPA….)
Spectrum Protect maintains “assets” needing protection against various levels of threats
Increased computed power making attacks easier
Sharing of tools and exploits (dark web, …)
More savvy attackers
Attacks from many vectors
Spectrum Protect 8.1.2
Changes how local “credentials” are stored and managed
Product wide adoption & exploitation of TLS 1.2 to secure point-to-point communication
Spectrum Protect 8.1.3
Support for additional types of sessions
Support for exchange based on possession of required certificate
Works for most server-server sessions and storage agent-server sessions
Footnote goes here

36. Server, OC, Client – Security Enhancements
8.1.3
Upgrading servers or storage agents, using self-signed certs, may require setting default cert
gsk8capicmd_64 -cert -setdefault -db cert.kdb -stashed -label "TSM Server SelfSigned SHA Key"
Server-Server sessions
8.1.2 Server to server process sessions, such as replication and protect stgpool, automatically acquire certificates
Must exchange certificates ahead of time & both servers must be in Transitional state to complete the exchange
8.1.3/ sessions can dynamically acquire certificates regardless of strict/transitional mode
Server to Server sessions that use administrator or node credentials to authenticate
8.1.2 requires the certs to already be exchanged, or to manually exchange the cert
Virtual Volume sessions
Command routing sessions, which do not initiate a server-server session ( including PING SERVER cmd )
Export Server to Server
8.1.3/7.1.8 Certificates are obtained if not already possessed, target servers do not obtain requester’s certificate
Virtual Volume sessions acquire certificate of target server
Command routing sessions, which do not initiate a server-server session, ( including PING SERVER cmd)
Export Server to Server acquires certificate of target server
Storage agent certificates between Server & Storage Agents
8.1.2 must be manually configured
8.1.3/7.1.8 Storage Agents automatically exchange server certificates with their Data Base Server
Acquisition of Data Base Server is noted in storage agent option file dsmsta.opt
Via new STASESSIONSECURITY option
Updated dynamically following certificate acquisition
Manual configuration is necessary for Library Client or Library Manager servers which storage agents contact
Unless they are the same servers as their Data Base Server
Both servers must be in Transitional state to complete the exchange (8.1.2)
7.1.8/8.1.3 servers allow exchange if they do not already have a certificate, regardless of strict/transitional mode
Storage Agent-Server Trust-On-First-Use acquisition is not available in 8.1.2
Available in and 7.1.8
Once a partner is marked as strict, certificate exchange is no longer allowed (8.1.2)
UPDATE SERVER servername sessionsecurity=transitional
allows for retrying
UPDATE SERVER servername forcesync=yes
Deletes certificate from server’s security table
In 8.1.3/7.1.8 Criterion is existence of the certificate, rather than strict vs. transitional mode
8.1.2 Server-Server sessions must exchange certificates ahead of time & both servers must be in Transitional state to complete the exchange
Server to Server sessions that use administrator or node credentials to authenticate
Virtual Volume sessions
Command routing sessions, which do not initiate a server-server session ( including PING SERVER cmd )
Export Server to Server
Server to Server configuration does NOT require command line gsk_capicmd_64 commands
Server to Server process sessions, such as replication and protect stgpool, acquire certificates automatically
8.1.2 Storage Agent certificates between servers & storage agents must be manually configured
All Server-Server sessions can dynamically acquire certificates regardless of strict/transitional mode
Certificates are obtained if not already possessed
Virtual Volume sessions acquire certificate of target server (but not vice versa)
Command routing sessions, which do not initiate a server-server session, ( including PING SERVER cmd ) acquire certificate of target server (but not vice versa)
Export Server to Server acquires certificate of target server (but not vice versa)
8.1.3/7.1.8 Storage Agents
Storage Agents automatically exchange server certificates with their Data Base Server
Acquisition of Data Base Server is noted in storage agent option file dsmsta.opt
Via new STASESSIONSECURITY option
Updated dynamically following certificate acquisition
Manual configuration is necessary for Library Client or Library Manager servers which storage agents contact
Unless they are the same servers as their Data Base Server
Footnote goes here

37. Spectrum Protect Blueprints
IBM Spectrum Protect – Simplify
What’s new in v3.2 of the Blueprints:
Spectrum Protect Blueprints
Faster server deployments than ever before! Up in running in a few hours!

38. Licensing – Cloud Object Storage Tier
Market Need
Clients are bridging to the cloud to expand/shift their data center
Clients want to consume cloud via a utility model - “pay for what you use”
Clients want a way to leverage cloud efficiently and predictably
IBM Goals
Establish Spectrum Protect as best of breed when utilizing cloud infrastructure
New Offering
IBM Spectrum Protect Suite - Cloud Object Storage Tier
Similar to IBM Spectrum Protect Suite - “ProtecTIER® Option” or “Archive Option”
Price per TB is lower for data stored in IBM Cloud Object Storage
Applies to IBM Spectrum Protect Suite (Back end) only
Applies to:
On-premises IBM COS
Public IBM COS
IBM Spectrum Protect
Server

39. Licensing – Adding new Cloud Option
New lower pricing when IBM Cloud Object Storage is chosen for backup and archive data.
Can be used either on-premise or in public-based IBM Cloud Object Storage.
New Program Unique Terms (PUTs):
Licensee must obtain sufficient entitlements for the total amount of managed data stored in IBM cloud Object Storage repositories that are available to the Program’s primary storage pool, excluding the capacity for disaster recovery sites used for replication only.
Footnote goes here

40. UPCOMING (October 2016)
7.1.8
The purpose of is to refresh the 7.1.x Stream with key security fixes that were rolled out in Spectrum Protect 8.1.3
7.1.8 is functionally equivalent to concerning certificate exchange and security fixes
7.1.8 will be able to automatically exchange certificates with and servers
7.1.8 updates will be available for the automatic client deployment
Footnote goes here

41. CORRECTION Server – NDMP Backup to containers for NetApp
8.1.2
NetApp filers can backup, dedupe, compress & encrypt to container pools (dir & cloud)
NetApp NDMP backups can go to container pool:
Backup Node / Restore Node from Admin
Backup NAS / Restore NAS from BA client
Server option: ENABLENASDEDUP TRUE
Caviats
TOC must go to legacy stgpool
snapdiff incremental IS supported with container pools
SNAPMIRROR is not supported in containers
Other filers are currently not supported (EMC, Avere…)
Only NetApp freely documents their bsd dump format
CONVERT STGPOOL does not work for pre-existing NAS data
PROTECT STGPOOL can be utilized for NAS nodes’ data
REPLICATE NODE is not supported for NAS nodes
Protect stgpool data on target server can be used by the source server for instance to repair a damaged container
Protect stgpool data on the target server can not be used for client restore
Footnote goes here

42. Footnote goes here