Configuration drift detection overview
Configuration drift detection is a feature for IBM Storage Protect environments that identifies and tracks unauthorized or unintended changes in server configurations over time by comparing baseline configuration snapshots against current runtime configurations.
Configuration drift detection helps you maintain configuration integrity by automatically detecting changes between a known-good baseline and the current server state. The feature uses a policy-centric approach with snapshot-based comparison to identify configuration drift.
Core concept
The system uses a policy-centric (server database) plus snapshot-diff approach:
- A baseline configuration snapshot of the IBM Storage Protect server database is saved as baseline.json
- Periodic snapshots (current.json) are collected and compared to detect drift
- Differences are reported in structured formats (JSON, HTML, ZIP bundles)
- You can accept or reject drift changes through an interactive workflow
Key benefits
Configuration drift detection provides the following benefits:
- Audit compliance
- Periodic audits and independent validation of IBM Storage Protect configurations
- Change tracking
- Detect unauthorized configuration changes before they cause issues
- Multi-server support
- Per-host snapshot generation and drift reporting for multiple servers
- Flexible acceptance
- Accept drift changes for all hosts, selected hosts, or none
- Coverage metrics
- Track which configuration parameters are monitored
Architecture
The feature operates in a 4-step workflow:
- Baseline generation: Create initial configuration snapshot
- Runtime collection: Collect current configuration periodically
- Comparison: Compare baseline versus current by using diff engine
- Reporting: Generate drift reports with classification and severity
Configuration coverage
The drift detection feature monitors the following configuration domains:
- Server status: Server name, version, uptime, ports, licensing
- Monitoring: Thresholds, intervals, watchdog flags
- Database: Database capacity, tablespace usage
- Logs: Active and archive log usage
- Policies: Domain configuration, retention rules
- Replication: Replication source and target
- Storage: Device classes, storage pools
- Management: Lifecycle rules, retention values
- System: System identity, OS version, kernel
- Hardware: Hardware summary
- Network: Network configuration
- Components: IBM Storage Protect server and client components
- Configuration files: Parsed option files (dsm.sys, dsm.opt)
- Nodes: Node metadata, schedules
- Storage agents: Agent state and configuration
- Audit: Alerts, audit logs summary indicators
Generated reports
The system generates the following files per host:
- current_host.json - Latest configuration snapshot
- baseline_host.json - Approved baseline configuration
- drift_report_host.json - Structured drift data
- drift_report_host.html - Human-readable drift report
- drift_report_bundle_host.zip - Complete report bundle
- sp_field_distribution_host.md - Coverage metrics