Configuring IBM Spectrum Protect with a tape library

The Spectrum Protect Client writes the backup data through the Spectrum Protect Storage Agent (residing on the same server as the Spectrum Protect Client), directly to SAN storage, bypassing the Spectrum Protect server instance. The default SAN storage used in this topic is a SAN attached tape library (real or VTL). You can use a SAN attached tape library (real or VTL) to configure IBM Spectrum Protect for LAN-free backups.

Before you begin

Important: In order to run LAN-Free operations, contact IBM Support for initial setup and then continue with the following steps.

Ensure that the lin_tape driver packages are on IAS.
For IAS 1.0.16.1 and up, the compatible drivers are: lin_tape-3.0.39-1.src.rpm and lin_taped-30.39-rhel7.ppc64le.rpm. You can download them from FixCentral.
Log in as apuser on IAS.
Install lin_tape to manage persistent naming.
```
appkg_install lintapeinstaller -h
```
This ensures that the device names for the tape library and drives do not change after a Linux reboot.
Run the following commands from either the administrative command-line client dsmadmc on the IBM Spectrum Protect server or the IBM Spectrum Protect Operations Center, by using the command builder:
```
https://< IBM_Spectrum_Protect_Server_IP>:11090/oc/login
```
If you do not have the IBM Spectrum Protect Operations Center configured, configure it as in Configuring the Operations Center.
For installation process, see Installing the Operations Center.

Procedure

Ensure that IBM Spectrum Protect server is set up for server-to-server communication by confirming that its server name, server password, hl address, and ll address are specified.

Using the dsmadmc or command builder in the Operations Center on IBM Spectrum Protect Server, confirm whether or not this step has been completed by executing:

query server <IBM spectrum protect servername>

Example:

Server Name | Comm. Method | High-level Address | Low-level Address | Days Since Last Access | Server Password Set | Virtual Volume Password Set | Allow Replacement

TSMINST1    | TCPIP        | 9.xx.xxx.xxx       | 1500              | 320                    | Yes                 | Yes                         | No

If IBM Spectrum Protect server isn’t set up for server-to-server communication, run the following commands for server-server communication, including LAN-free sharing and library sharing:

set servername <IBMSpectrumProtectServerName>         
set serverpassword <IBMSpectrumProtectServerPassword>     
set serverhladdress <IBMSpectrumProtectServerIPaddress>      
set serverlladdress <IBMSpectrumProtectServerTCPport>

Example:

set servername tsminst1 
set serverpassword passw0rd
set serverhladdress 9.88.356.21
set serverlladdress 1500

Then, verify whether the server has been added by running the

query server <IBM spectrum protect servername>

command.

Define the tape library as a storage pool to receive backup data.
1. Define library.
  - For a real tape, run:
```
def libr tapelib libt=scsi shared=yes
```
  - For a virtual tape library, run:
```
def libr tapelib libt=vtl shared=yes
```
    In the commands, tapelib is used as the library_name.
    
    For more information, see DEFINE LIBRARY (Define a library).
2. Define the path to the library based on the library name in the /dev/lin_tap/by-id file.
```
def path tsminst1 tapelib srct=server destt=library autod=yes devi=/dev/lin_tape?changer_002676359990402
```

Define all the drives and their paths.

Use the /dev/lin_tape/by-id/ file for the device names.


def drive tapelib lto00 ser=autod online=yes
def path tsminst1 lto00 srct=server destt=drive libr=tapelib autod=yes devi=/dev/lin_tape2676356011


def drive tapelib lto01 ser=autod online=yes
def path tsminst1 lto01 srct=server destt=drive libr=tapelib autod=yes devi=/dev/lin_tape2676356012

Define a device class that points to the library.
1. Define device class:
```
def dev ltodc devt=lto mountr=0 mountw=10 libr=tapelib estcap=400g
```
  In the example, the tape resources are LTO.
  
  Set mountr to 0 to avoid delay when tapes are unmounted.
  
  Set mountw to 10 to give the library 10 minutes to mount a tape before posting a mount time out. The default is 1 hour.
  
  The estcap parameter should match the native capacity of the volume. For a real tape LTO3, the native capacity is 400 GB.
2. Check in the tapelib scratch and private volumes.
```
checkin libv tapelib stat=scratch search=y checkl=b
```
```
checkin libv tapelib stat=private search=y checkl=b
```
3. Audit the tapelib library.
```
audit libr tapelib checkl=b
```
4. Issue a full database backup to verify that IBM Spectrum Protect server can write to the tape library.
```
ba db t=f dev=ltodc
```
Define a storage pool to receive LAN-free backups.
In the example, a db2-tape storage pool that uses the ltodc device class is defined.
```
def stg db2-tape ltodc maxscr=800 colloc=node reclaimpr=4 reclaim=100
```
The storage pool uses a maximum of 800 tape volumes, collocating only 1 node's backup data per volume.

If the tape library has limited volumes, no collocation might be preferred. You can set the colloc parameter to no.

To help performance and manage tape space, set the reclaimpr parameter to 4. The db2-tape pool will run 4 processes when it reclaims space and will not reclaim it unless you issue a command or create an administrative schedule.

The reclaim parameter is set to 100, which means that the tape volume must be empty in 100% before it can be reclaimed.
Create a domain that can write to the storage pool.

To define a new policy domain, follow the steps that are provided in Creating a policy domain
1. Define a policy domain called db2_backups
```
def do db2_backups
```
  For more information, see DEFINE DOMAIN (Define a new policy domain)
2. Define a policy set under the db2_backups domain. Give the policy set the same name as the domain.
```
def po db2_backups db2_backups
```
  For more information, see DEFINE POLICYSET (Define a policy set).
  Note: The full name of the policy set is the domain name and the policy set name.
Define a default management class and its copy groups.

Under the default management class, there are two copy groups: backup and archive. These copy groups are where the retention rules are defined. The names are standard and cannot be changed.
1. Define a default management class under the db2_backups db2_backups policy set.
  Name the management class database and add the migdest parameter to prevent a warning from appearign when the policy set is activated.
```
def mg db2_backups db2_backups database migdest=db2-tape
```
2. Define the backup copy group:
```
def co db2_backups db2_backups database t=backup vere=3 verd=1 rete=30 retd=30 dest=db2-tape
```
  For more information, see DEFINE COPYGROUP (Define a backup copy group).
  Note: The active version has no retention and will never expire automatically.
3. Define the archive copy group:
```
def co db2_backups db2_backups database t=archive retv=365 dest=db2-tape
```
  For more information, see DEFINE COPYGROUP (Define an archive copy group).
Run the command below to activate the policy set:
```
act po db2_backups db2_backups
```

Set the password to passw0rd.

To ensure that the nodes are in the db2_backups domain, set do to db2_backups.

To allow Db2 to control the deletion of its backups, set backdel to yes.

Set maxnummp to 8 or above to allow 8 or more simultaneous mounts.

Example:


reg node0101-fab passw0rd do=db2_backups backdel=yes maxnummp=8 comp=no dedupl=serveronly
reg node0102-fab passw0rd do=db2_backups backdel=yes maxnummp=8 comp=no dedupl=serveronly
reg node0103-fab passw0rd do=db2_backups backdel=yes maxnummp=8 comp=no dedupl=serveronly
reg node0104-fab passw0rd do=db2_backups backdel=yes maxnummp=8 comp=no dedupl=serveronly
.
.

Define each Storage Agent on the IBM Spectrum Protect server by running the def ser command.

Example:


def ser node0101_sta serverpa=tsm hla=<IP address> ssl=yes lla=1500
def ser node0102_sta serverpa=tsm hla=<IP address> ssl=yes lla=1500
def ser node0102_sta serverpa=tsm hla=<IP address> ssl=yes lla=1500
def ser node0102_sta serverpa=tsm hla=<IP address> ssl=yes lla=1500
.
.
.

Note: def ser refers to the storage agent name that pertains to each node, not the IBM Spectrum Protect Server name.

Define paths for each Storage Agent.
Note: As the Spectrum Protect Server Instance controls all mounts and unmounts of the tape volumes, no library or library path is defined to the Storage Agents.

The IBM Spectrum Protect Server communicates to the Storage Agent how to write to the storage pool by telling the Storage Agent what path it can use to write to the shared location.

Use the device name listed on the /dev/lin_tape/by-id file of the Storage Agent. Ensure that the serial number of the Storage Agent tape device name matches the serial number of the Server Instance device name.
```
def drive tapelib lto00 ser=autod online=yes
def path node0101_sta lto00 srct=server destt=drive libr=tapelib autod=yes devi=/dev/lin_tape2676556033
```
On the Integrated Analytics System (IAS) appliance, run the following commands:
1. Log in to the docker container:
```
ssh bluadmin@<nodename> -p 50022
```
2. Issue command to validate the server and storage agent are communicating:
```
netstat -an | grep :1500 
```
  This command shows the TCP/IP port.
On IBM Spectrum Protect server, run the following commands to test if the configuration is completed successfully:
1. Show the number of sessions from Spectrum Storage Agent. The number depends on the number of configured Spectrum Storage Agents.
```
q sess
```
2. Show the other side of the settings for IBM Spectrum Protect server and Spectrum Storage Agent. This command routes the q sess command to the Spectrum Storage Agent that is specified by sta_name.
```
sta_name:q sess
```
3. Check whether Spectrum Storage Agent is pinged successfully, where sta_name is the name of Spectrum Storage Agent.
```
ping server sta_name
```
4. Check whether IBM Spectrum Protect server is pinged successfully, where sta_name is the name of Spectrum Storage Agent, and name is the name of IBM Spectrum Protect server.
```
sta_name:ping server name
```
If any of these tests fails, update the security for the node session for all nodes by running the following command:
```
update node nodename from client side sessionsecurity=transitional
```