Configuring Storwize family and SAN Volume Controller dynamic target allocation (SVCDTA)

Edit online

To allow dynamic volume creation during backup operations, you must enable Secure Shell (SSH) remote access to the storage system command-line interface (CLI) with Secure Shell (SSH) keys. An SSH key pair must be created to authenticate users for a secure connection to SAN Volume Controller.

Before you begin

Verify that the OpenSSH client is installed on the production server, and the backup or clone server where IBM® Storage Protect Snapshot is installed. The OpenSSH client is installed by default on most AIX and Linux distributions. If it is not installed on your system, consult your AIX or Linux installation documentation.

About this task

SSH is used to remotely enter commands on the SAN Volume Controller CLI. The following steps are required to enable CLI access with SSH keys:
  • Generate a public and a private key pair
  • Import the public key to the storage system
  • Configure IBM Storage Protect Snapshot to authenticate with the private key.

The IBM Storage Protect Snapshot user must have a unique SSH key at the SAN Volume Controller. After you generate the key pair, import the public key and add a key file for the SAN Volume Controller user as specified in the IBM Storage Protect Snapshot profile. The parameters are COPYSERVICES_USERNAME and COPYSERVICES_REMOTE_USERNAME. The user at the remote site also needs a key file.

The IBM Storage Protect Snapshot user owns the private key and has RW access to that key file.

The full path to the private key file is specified in the profile. By default, the path is $HOME/.ssh/svc_sshkey. The public counterpart of the private key file must be imported to the SAN Volume Controller and associated to the user.

Procedure

  1. Generate an RSA key pair on the production server for the storage user name to access the storage system by entering the following command from the $HOME/.ssh directory.
    Ensure to enter the command as the database instance owner or application backup user from the $HOME/.ssh directory.
    ssh-keygen -t rsa

    This command generates two files, which you are prompted to name. If you select the name svc_sshkey, the private key is named svc_sshkey, and the public key is named svc_sshkey.pub.

    Tip: Do not enter a passphrase for the file when prompted. For SVCDTA dynamic target allocation, the passphrase must be empty.
  2. If you do not remotely install the backup or cloning servers with SSH, you must copy the key pair to the backup and clone servers. Ensure that the key pair is stored in the same path as on the production server.
  3. Upload the public key to the storage system for the SAN Volume Controller user that is specified by COPYSERVICES_USERNAME in the profile.

    For instructions about how to upload to the storage system, see the documentation that is provided for your storage system. The documentation is available in IBM SAN Volume Controller Knowledge Center http://www.ibm.com/support/knowledgecenter/STPVGU/welcome?lang=en.

  4. Switch to the IBM Storage Protect Snapshot instance directory and run the setup script in advanced mode: 
    ./setup_orasap.sh [-advanced]
    Note: If you do not want to use an alternative SSH binary and the private key file is named svc_sshkey in the default path $HOME/.ssh, you can proceed to run the setup script in basic mode.
  5. When prompted to specify a SSH_DIR path, enter the path where the Secure Shell protocols and executable files are installed.
    The default location is /usr/bin.
  6. When prompted to specify a SVC_SSHKEY_FULLPATH path, enter the path and the file name for the private keyfile.
    The following example shows the default path and file name:
    SVC_SSHKEY_FULLPATH    $HOME/.ssh/svc_sshkey
  7. When prompted to specify FlashCopy® mapping techniques, enter the parameter names based on type of backups, the default state is DISABLED.
    You can specify the following parameters:
    • IGNORE_FLASHCOPY_MAPPINGS: The volume group snapshot is created even if the FlashCopy mappings are present.
      Note: If you plan to use the volume group snapshot feature, consider the following key points:
      • Any existing backup taken by using the FlashCopy mapping cannot be restored.
      • You cannot switch back to the FlashCopy mapping.
      In case you want to use the FlashCopy mapping, all volume group snapshots must be deleted.
    • ENFORCE_NO_FLASHCOPY_MAPPINGS: The volume group snapshot is not created if the FlashCopy mappings are present.
    Volume group snapshots will be generated by the option 'IGNORE_FLASHCOPY_MAPPINGS', but flash copy mapping techniques will be avoided.
The older snapshots created using the flash copy mapping technique will not be affected by this. Choose this option if you've recently upgraded from the older Storage Protect Snapshot
software version to a newer one.
    Option 'ENFORCE_NO_FLASHCOPY_MAPPINGS' will create snapshots, based on volume groups and will not allow snapshots using flash copy mapping based techniques.
[DISABLED]
  8. Continue configuring IBM Storage Protect Snapshot for SAN Volume Controller with the setup script for your component. When you are configuring SAN Volume Controller Dynamic Target Allocation, the profile that is created is saved with the necessary parameters.
  9. The IBM Storage Protect Snapshot daemons are automatically restarted by running the setup script either in basic mode or in advanced mode.

What to do next

If you are using SAN Volume Controller remote mirroring, the setup script asks if you want to create another SSH key to facilitate mirroring with the remote cluster. The key file SVC_REMOTE_SSHKEY_FULLPATH parameter specifies the private key file that is used for connecting to the secondary SAN Volume Controller site, and is specified by COPYSERVICES_REMOTE_SERVERNAME. The remote site user is the one specified by the parameter COPYSERVICES_REMOTE_USERNAME.