dell emc ecdm · 2020-05-06 · dell emc ecdm version 2.1 administration and user guide 302-004-944...

Dell EMC eCDMVersion 2.1

Administration and User Guide302-004-944

REV 04

Copyright © 2016-2018 Dell Inc. or its subsidiaries. All rights reserved.

Published September 2018

Dell believes the information in this publication is accurate as of its publication date. The information is subject to change without notice.

THE INFORMATION IN THIS PUBLICATION IS PROVIDED “AS-IS.“ DELL MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND

WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. USE, COPYING, AND DISTRIBUTION OF ANY DELL SOFTWARE DESCRIBED

IN THIS PUBLICATION REQUIRES AN APPLICABLE SOFTWARE LICENSE.

Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be the property of their respective owners.

Published in the USA.

Dell EMCHopkinton, Massachusetts 01748-91031-508-435-1000 In North America 1-866-464-7381www.DellEMC.com

2 eCDM 2.1 Administration and User Guide

9

Getting Started 13eCDM software........................................................................................... 14Access the eCDM UI................................................................................... 14

Log in to the eCDM appliance as an LDAP or AD user.................... 16Management best practices for the UI admin account password... 16

Access the Help Center.............................................................................. 16Enable the Onboarding Panel...................................................................... 17Register the EMC Secure Remote Services gateway.................................. 17

Callhome........................................................................................ 19

Configuring the System 21Monitoring system state and system health............................................... 22

Monitor and change the state of the appliance..............................22Monitor system component health................................................ 23

Appliance system states............................................................................. 26Reconfigure the virtual appliance................................................................27

Reconfigure the network settings..................................................27Modifying the time zone................................................................ 28Modifying the lockbox passphrase.................................................29Managing passwords for OS user accounts................................... 29Managing keychains....................................................................... 31Troubleshooting reconfiguration issues......................................... 32

Modifying the eCDM appliance hardware settings......................................34Modifying the appliance memory configuration............................. 34Modifying the data disk size.......................................................... 34Modifying the system disk size...................................................... 36

Discovering Assets 37Inventory sources, storage systems, and protectable assets...................... 38

Data Domain credentials................................................................ 38Protectable assets.........................................................................38

Prerequisites for discovering inventory sources......................................... 39Discover array primary storage and protection inventory sources ............. 40Discover SQL and Oracle Instance Group inventory source ....................... 42

Application agents......................................................................... 42Stagger SQL discovery jobs in host scale-out environments......... 45Optimize SQL discovery workflow in database scale-outenvironments.................................................................................45

Virtual machine discovery...........................................................................45Discover VMware vCenter server.................................................. 47

Discover assets and copies manually.......................................................... 49Scheduled discovery...................................................................................49Edit Inventory Sources .............................................................................. 49Set or reuse key chain credentials..............................................................50

Preface

Chapter 1

Chapter 2

Chapter 3

CONTENTS

eCDM 2.1 Administration and User Guide 3

Create a new set of credentials:.................................................... 50Use a stored key chain...................................................................50Create new credentials on eCDM and Data Domain.......................50Create credentials on Data Domain only.........................................51

Discover Data Domain MTrees.................................................................... 51Configure Data Domain MTree Replication.................................................52Edit and delete Data Domain MTree Replication.........................................53

Edit Data Domain MTree Replication............................................. 53Delete Data Domain MTree Replication......................................... 53

Protection engines discovery..................................................................... 53Register Data Domain to vRPA cluster.......................................... 54

Managing Tenants 55Tenancy..................................................................................................... 56

System tenant............................................................................... 56Tenants......................................................................................... 56Users ............................................................................................ 56

Roles.......................................................................................................... 57Database Admin role...................................................................... 57Executive role................................................................................58Export and Recovery Admin role................................................... 59Operations Monitor role.................................................................60Remote Support role......................................................................61Security Admin role....................................................................... 62Storage Admin role........................................................................ 63System Tenant Admin role.............................................................64

Privileges....................................................................................................66Activity Management Privileges.................................................... 66Asset Management Privileges........................................................66Monitoring Privileges..................................................................... 67Plan Management Privileges..........................................................67Recovery and Reuse Management Privileges................................ 68Storage Management Privileges.................................................... 69Tenant Management Privileges..................................................... 69User Security Management Privileges........................................... 69

Configure the system tenant...................................................................... 70Managing tenants....................................................................................... 72

Create a tenant..............................................................................72Edit a tenant.................................................................................. 73Delete a tenant.............................................................................. 74View tenants..................................................................................74

Managing user accounts.............................................................................75Managing users..............................................................................75LDAP or AD authentication............................................................ 79

Review tenant compliance..........................................................................88

Managing Assets 91Asset Groups inventory.............................................................................. 92System default asset groups...................................................................... 92Tenant default asset groups....................................................................... 92View asset details....................................................................................... 93Custom asset groups..................................................................................94

Managing custom asset groups..................................................... 94Assign protection to a custom asset group....................................99

Chapter 4

Chapter 5

CONTENTS


vRPA cluster load balancing.......................................................... 99Associate a storage location to a custom asset group............................... 100Asset and asset group tags....................................................................... 100

Categorized tags..........................................................................100XtremIO Consistency Group tags.................................................100Using tags.....................................................................................101

Asset rules................................................................................................ 104Create a rule to organize assets by asset group........................... 104Edit asset rules.............................................................................106Delete asset rules......................................................................... 107Set asset rule priority................................................................... 107

Creating and Assigning Protection Plans 109Protection plans........................................................................................ 110Managing and monitoring SLO compliance................................................ 110Create a protection plan (SQL and Oracle Storage Groups)...................... 110

Set or reuse key chain credentials for SQL and Oracle ................. 111Name a protection plan................................................................. 111Validate compliance for application-consistent backups on DataDomain..........................................................................................112

Create a protection plan (VMAX Storage Groups).....................................114Name a protection plan................................................................. 114Define objectives for the protection plan...................................... 115

Create a protection plan (VMware virtual machine).................................. 126Name a protection plan................................................................ 126Define objectives for the protection plan......................................126

Create a protection plan (XtremIO Consistency Groups).......................... 133Name a protection plan................................................................ 133Define objectives for the protection plan......................................134

Review protection plans............................................................................ 145Configure protection plan settings............................................................ 146Assign a tenant to a protection plan ......................................................... 146Prerequisites for assigning protection to assets........................................ 147

Set Data Domain MTree credentials............................................. 147Configure Data Domain, VMAX, XtremIO, and RecoverPoint for usewith ProtectPoint ........................................................................ 147Configure XtremIO consistency groups to use ProtectPoint ....... 148vCenter and vRPA prerequisites...................................................148

Managing protection plans........................................................................ 149Assign protection to a custom asset group...................................149Edit a protection plan................................................................... 150Activate a protection plan to make it available to assigned tenants...150Assign or unassign tenants to a protection plan............................ 151Suspend or resume protection plans............................................. 151Delete a protection plan............................................................... 152Remove a protection plan that is assigned to an asset group....... 152Protection plan status.................................................................. 152

Recovering and Reusing Data 155View protected copy set summaries..........................................................156Delete copy sets........................................................................................157Exporting copy sets...................................................................................157

Prerequisites for exporting a VMAX copy set...............................158

Chapter 6

Chapter 7

CONTENTS


Create a FAST.X device manually.................................................158Export a VMAX copy set.............................................................. 162Export an XtremIO copy set......................................................... 163

Unexport an exported copy set................................................................. 164Restore a copy set to an alternate location............................................... 165Roll a copy back to production.................................................................. 167Restore a virtual machine..........................................................................168

Prerequisites to restore a virtual machine.................................... 168Enable app admins to use Application Agents to rollback applicationdata in guest virtual machine........................................................169Restore a virtual machine backup to the original location..............171Restore a virtual machine backup to an alternate location............ 174Troubleshooting virtual machine restores..................................... 178

Considerations and limitations...................................................................180

Using the Dashboard 183The eCDM Dashboard............................................................................... 184

Dashboard widgets.......................................................................185eCDM Dashboard capacity monitoring...................................................... 185

Review primary storage protection.............................................. 185Reviewing protection storage capacity information......................186

View the License in the Dashboard............................................................186Monitor Compliance in the Dashboard.......................................................187

Review asset compliance............................................................. 188Review tenant compliance............................................................188Review protection plan compliance.............................................. 189

eCDM Health............................................................................................ 190

Monitoring the System 193Activity Monitor window........................................................................... 194Monitoring protection plan compliance in the Plan Compliance tab...........194

Monitoring asset compliance........................................................195Monitoring tasks by activity or plan in the Tasks tab................................. 197

Monitor tasks by activity.............................................................. 197Monitor tasks by plan................................................................... 197

Monitoring events in the Events tab......................................................... 198View notifications......................................................................................198Monitoring system state and system health.............................................. 198

Monitor and change the state of the appliance............................ 199Monitor system component health.............................................. 200

Protecting the eCDM server 205Manage system backups.......................................................................... 206

Configure the Data Domain system............................................. 206Configure the appliance system protection..................................207Perform manual (ad-hoc) appliance backup................................ 208Monitor system protection activities........................................... 209Manually delete system backups.................................................. 210

Perform a disaster recovery......................................................................210Perform a eCDM disaster recovery ............................................. 210Troubleshoot disaster recoveries..................................................212

Logs and Troubleshooting 213

Chapter 8

Chapter 9

Chapter 10

Chapter 11

CONTENTS


Logs.......................................................................................................... 214Log levels..................................................................................... 214Export logs...................................................................................215

Collecting logs to troubleshoot issues....................................................... 217Create a log bundle on a vRPA cluster...................................................... 219Register the EMC Secure Remote Services gateway................................221

Callhome......................................................................................223Troubleshooting Microsoft Application Agent discoveries on Windows 2008and Data Domain Boost............................................................................ 224Troubleshooting SMIS/VMAX discoveries................................................224Time synchronization required between eCDM and the systems it interfaceswith.......................................................................................................... 225

CONTENTS


CONTENTS


Preface

As part of an effort to improve product lines, periodic revisions of software andhardware are released. Therefore, all versions of the software or hardware currently inuse might not support some functions that are described in this document. Theproduct release notes provide the most up-to-date information on product features.

If a product does not function correctly or does not function as described in thisdocument, contact a technical support professional.

Note

This document was accurate at publication time. To ensure that you are using thelatest version of this document, go to the Support website at https://support.emc.com.

PurposeThis document describes how to install, configure, and administer eCDM software.

AudienceThis document is intended for the host system administrator who is involved inmanaging, protecting, and reusing data across the enterprise by deploying eCDM.

Revision historyThe following table presents the revision history of this document.

Table 1 Revision history

Revision Date Description

01 June 14, 2018 First release of this document for eCDM 2.1.

02 June 27, 2018 Updates to the following sections:

l Access the eCDM UI on page 14

l Move assets to and from custom assetgroups on page 97

l View details about a user that is assignedto the system tenant on page 78

l Configure LDAP or AD authentication onpage 79

l LDAP or AD authentication on page 79

l Name a protection plan on page 111

l Set Data Domain MTree credentials onpage 147

l Log levels on page 214

03 July 13, 2018 Added troubleshooting topic "Timesynchronization required between eCDM andthe systems it interfaces with."

04 September 14. 2018 Updates to Roles on page 57


https://support.emc.com


Related documentationThe following publications provide additional information:

l eCDM Deployment GuideDescribes how to deploy and configure the software.

l eCDM Release NotesContains information on new features, known limitations, environment, and systemrequirements for the software.

l eCDM Security Configuration GuideContains security information.

You can use the following resources to find more information about this product,obtain support, and provide feedback.

Special notice conventions that are used in this documentThe following conventions are used for special notices:

NOTICE

Identifies content that warns of potential business or data loss.

Note

Contains information that is incidental, but not essential, to the topic.

Typographical conventionsThe following type style conventions are used in this document:

Table 2 Style conventions

Bold Used for interface elements that a user specifically selects or clicks,for example, names of buttons, fields, tab names, and menu paths.Also used for the name of a dialog box, page, pane, screen area withtitle, table label, and window.

Italic Used for full titles of publications that are referenced in text.

Monospace Used for:

l System code

l System output, such as an error message or script

l Pathnames, file names, file name extensions, prompts, andsyntax

l Commands and options

Monospace italic Used for variables.

Monospace bold Used for user input.

[ ] Square brackets enclose optional values.

| Vertical line indicates alternate selections. The vertical line means orfor the alternate selections.

{ } Braces enclose content that the user must specify, such as x, y, or z.

... Ellipses indicate non-essential information that is omitted from theexample.

Preface


You can use the following resources to find more information about this product,obtain support, and provide feedback.

Where to find product documentation

l https://support.emc.com

l https://community.emc.com

Where to get supportThe Support website at https://support.emc.com provides access to licensinginformation, product documentation, advisories, and downloads, as well as how-to andtroubleshooting information. This information may enable you to resolve a productissue before you contact Support.

To access a product specific Support page:

1. Go to https://support.emc.com/products.

2. In the Find a Product by Name box, type a product name, and then select theproduct from the list that appears.

3. Click .

4. (Optional) To add the product to My Saved Products, in the product specificpage, click Add to My Saved Products.

KnowledgebaseThe Knowledgebase contains applicable solutions that you can search for by solutionnumber, for example, 123456, or by keyword.

To search the Knowledgebase:

1. Go to https://support.emc.com.

2. Click Advanced Search.The screen refreshes and filter options appear.

3. In the Search Support or Find Service Request by Number box, type a solutionnumber or keywords.

4. (Optional) To limit the search to specific products, type a product name in theScope by product box, and then select the product from the list that appears.

5. In the Scope by resource list box, select Knowledgebase.The Knowledgebase Advanced Search panel appears.

6. (Optional) Specify other filters or advanced options.

7. Click .

Live chatTo participate in a live interactive chat with a support agent:


2. Click Chat with Support.

Service requestsTo obtain in-depth help from Support, submit a service request. To submit a servicerequest:


2. Click Create a Service Request.

Preface



https://community.emc.com


https://support.emc.com/products




Note

To create a service request, you must have a valid support agreement. Contact a salesrepresentative for details about obtaining a valid support agreement or with questionsabout an account.

To review an open service request:


2. Click Manage service requests.

Online communitiesGo to the Community Network at https://community.emc.com for peer contacts,conversations, and content on product support and solutions. Interactively engageonline with customers, partners, and certified professionals for all products.

How to provide feedbackFeedback helps to improve the accuracy, organization, and overall quality ofpublications. You can send feedback to [email protected].

Preface



https://community.emc.com

mailto:[email protected]

CHAPTER 1

Getting Started

This section includes the following topics:

l eCDM software.................................................................................................. 14l Access the eCDM UI...........................................................................................14l Access the Help Center...................................................................................... 16l Enable the Onboarding Panel.............................................................................. 17l Register the EMC Secure Remote Services gateway..........................................17

Getting Started 13

eCDM softwareeCDM software is an enterprise solution that streamlines the process of monitoring,managing, and analyzing copies of data while addressing copy sprawl. The eCDMsoftware is designed for self-service copy orchestration, automated Service LevelObjectives (SLO) compliance, and actionable insight that optimizes efficiency.

With the eCDM software, you can manage, protect, and reuse data across theenterprise by deploying services to accomplish the following tasks:

l Discover, access, and recover copies non-disruptively across primary andprotection storage without introducing new infrastructure or complexity

l Automate efficient copy creation

l Automate data SLO compliance and efficiency, which ensures that the rightnumber of copies are stored in the right place at the right level of protection

l Optimize operations based on actionable analytics and insight

Access the eCDM UIeCDM provides a stand-alone UI that you can use to manage and monitor systembehavior.

Procedure

1. From a host that has network access to the virtual appliance, use GoogleChrome to connect to the appliance:

https://appliance_hostname

Note

For IPv4 deployments, you can specify the hostname or the IP address of theappliance. For an IPv6 deployments, you must specify the hostname of theappliance.

2. At the login window, perform the following actions:

a. Type the username and password.

b. Click Login.

For new users, you may be prompted to update your password the first timeyou log in.

When you log in, you agree to accept the terms and conditions of the licensingagreement.

To review the agreement, click Terms and conditions.

3. To open the main menu from anywhere in the UI, click .

The eCDM window opens and displays the available menu items.

4. To browse to another location in the UI, click a menu item.

This action opens the menu item in the eCDM window.

5. To review the available features, click an icon from the menu.

Getting Started


Table 3 Main menu icons

Icon Description

The Dashboard provides at-a-glance insight into the overall state ofcopy replication management within a data protection environment.Use the Dashboard to view the following information:

l Compliance data

l Primary storage capacity and deduplication statistics

l Type of license that is in use and the state of the license

Use tenant management to perform the following tasks:

l Configure tenants and users

l Assign roles to users

Use assets to perform the following tasks:

l Assign tags to assets

l Set protection by assigning a protection plan to an asset

Use protection plans to perform the following tasks:

l Create and manage protection plans

l Assign protection plans to tenants

l Assign or remove protection against assets

Use discovery to perform the following tasks:

l Discover storage managers and assets

l Inventory sources

Use settings to review the following information and performconfiguration changes:

l Overview—General configuration settings

l Credentials—Password and key chain management

l Logs—Log configuration and export

l System protection—Server backup configuration for disasterrecovery preparedness

l Upgrades

Use the activity monitor to monitor tasks for various areas of thesystem, for example, compliance and discovery.

Use Rules to perform the following tasks:

l Add an asset rule

l Edit asset rules

l Delete asset rules

l Assign asset rule priority

Getting Started

Access the eCDM UI 15

Table 3 Main menu icons (continued)

Icon Description

Use the Help Center to review instructional videos.

6. To log out and log in as a different user, go to the Main menu, and then click

.

Log in to the eCDM appliance as an LDAP or AD userWhen you log in to the appliance as an LDAP or AD user, specify the username anddomain name.

Before you begin

The user account must be a member of an LDAP or AD group, which is assigned to arole on the appliance.

Procedure



Note


2. In the User name field, type the LDAP or AD user account in the followingformat:

username@domainFor example, [email protected].

3. In the Password field, type the password for the user account that youspecified in the User name field.

Management best practices for the UI admin account passwordYou cannot reset or recover the password for the admin account. Consider thefollowing best practices when you manage the password for the UI Admin account.

l Create another local user with the Security Admin role. The Security Admin rolecan change passwords for other users in eCDM.

l Map the System Admin role to one or more LDAP or AD groups.

l Create one or more users with the System Admin role and then authenticate theuser through LDAP or AD. The System Admin role can change passwords for otherusers in eCDM.

Access the Help CenterAccess the Help Center to view instructional videos for common eCDM tasks.

To access the Help Center, click Help Center.

Getting Started


Go to the Online Support site at https://support.emc.com/ to review the eCDMdocumentation set.

Enable the Onboarding PanelThe Onboarding Panel provides a quick-start guide to configure the eCDM appliance.Configuration steps include methods to license eCDM, create inventory sources,assign assets, create protection plans, and configure disaster recovery.

To enable the eCDM Onboarding Panel, select Main menu > Help Center, and thenclick ON.

To open the eCDM Onboarding Panel, in the upper-right corner of the window, click

. The Welcome to eCDM pane appears. After you complete the workflow, the panelis disabled.

Register the EMC Secure Remote Services gatewayEMC Secure Remote Services (ESRS) allows a System Tenant Admin user to registerthe eCDM appliance with a gateway host IP address for remote access. You canregister only one ESRS gateway for an eCDM appliance. After the eCDM appliance isregistered, Technical Support Engineers can remotely connect to an eCDM applianceto troubleshoot issues, and you can upgrade the eCDM appliance by using ESRSversion 3.20.10.08 or later.

Before you begin

Apply a valid license to the gateway and associate your customer service account(credentials) with the gateway site.

Use the following procedure to register or manage the ESRS gateway.

Procedure

1. From the eCDM UI:

a. Go to Main Menu > Settings > Overview > Secure Remote Services(ESRS).

b. Cick the Edit icon within the pane.

A dialog box appears.

Figure 1 ESRS panes in Settings window

Getting Started

Enable the Onboarding Panel 17

https://support.emc.com/

2. In the dialog box, type the gateway hostname or IP address.

Figure 2 Register the gateway hostname or IP

3. Click Save to complete registration of the ESRS gateway.

Note

Currently, you can use only an IPv4 address for the gateway. IPv6 is notsupported.

4. After you click Save, an Edit icon appears next to the gateway hostname field,which allows you to update the hostname or IP address of the gateway to whichthe device is already registered. When you update the hostname, eCDMoverwrites the previous entry but does not unregister this gateway, and there isno option within the Settings window to delete the previous entry. Tounregister the previous gateway address, you must use a curl command.

Note

You can only add or manage an ESRS gateway when you apply a front-end terabyte(FETB) license. If you are using a trial license, the Edit icon is disabled.

The following message displays in the ESRS pane.

Getting Started


Figure 3 ESRS Gateway disabled for trial license

CallhomeWhen you register an ESRS gateway, you also enable the Callhome feature, whichallows Technical Support Engineers to collect data related to troubleshooting deviceand eCDM appliance issues. Callhome does not collect any personal information.

The following table lists the types of information that Callhome collects.

Table 4 Information collected by Callhome

Category Type of information collected

eCDM appliance l Date of the last upgrade

l Any applied patches

l Version of the appliance

l Uptime (in days) since the last appliance reboot

Data Domaininventory

l Number of Data Domain systems

l Data Domain operating system version and system ID

l Mtrees per Data Domain system

l Data Domain system capacity

VMAX inventory l Number of VMAX systems

l VMAX operating system version and system ID

l Protected asset list of LUNS and storage groups with size

XIO inventory l Number of XIO clusters

l XIO operating system version

eCDM operationalinventory

l Asset information (number of assets, asset groups, assetsprotected versus unprotected)

l Protection plans (number of plans, plans instances per tenant)

l Tenants (number of tenants)

Getting Started

Callhome 19

Table 4 Information collected by Callhome (continued)


l Tags (number of tags and tag categories)

l Active plan details (assets and their types, objectives for eachstage)

Usage l Amount of data that is protected

Licensing l Status of the applied license

Storage managers l Number of Unisphere instances in inventory

l Unisphere hostnames and versions

l Number of DDMC instances in inventory

l DDMC hostnames and versions

Getting Started


CHAPTER 2

Configuring the System

This section contains the following topics:

l Monitoring system state and system health....................................................... 22l Appliance system states.....................................................................................26l Reconfigure the virtual appliance....................................................................... 27l Modifying the eCDM appliance hardware settings............................................. 34

Configuring the System 21

Monitoring system state and system healthThrough the Settings window, you can monitor the state of the appliance and thehealth of each system component. The Overview tab also provides you with the abilityto change the overall state of the appliance from Operational to Maintenance, or fromMaintenance to Operational.

On the Overview tab, you can display the overall health of the eCDM appliance, in theHealth panel. On the Health panel, you can click the View Services icon, which opensthe Services Status window, and displays the state of each system component.

Note

The Dashboard also provides a Health widget that you can use to review system healthinformation.

Monitor and change the state of the applianceOn the Overview tab, you can display the overall health of the eCDM appliance, in theHealth panel. The state of the appliance appears as an icon and is determined by thestate of all system components. For example, if one system component is not in aRunning state, the overall state of the appliance is Partially Operational. On theinterface, a summary of the state of each system component appears under the stateof the appliance.

The following table summarizes each appliance state.

Table 5 Appliance states

Icon State

Operational—This state appears when the appliance is accessible with fullfunctionality.When the state of the appliance is operational, the state of each systemcomponent is also operational.

Quiesce—This state appears during a quiesce of the appliance.

Failed—This state appears when the appliance cannot successfully changestates.When you see this state, contact Support for assistance.

Maintenance—This state appears when the appliance is in maintenancemode. You can access and manage the appliance but with limitedfunctionality.You must put the appliance in Maintenance mode for some configurationchanges, for example, to change the network settings or to upgrade theappliance. When configuration changes or an update completes, you mustmanually change the state of the appliance from Maintenance toOperational.

Partially operational—This state appears when one or more of the systemcomponents are not in an Up state.



Table 5 Appliance states (continued)

Icon State

View the System Health window to determine that state of eachappliance component.

Change the state of the applianceBefore you can put the appliance in maintenance mode, allow all tasks to complete.You cannot put the appliance in maintenance mode when there are in-progress tasks.

Before you begin

Changing the state of an appliance requires the Manage System Settings privilege.

Connect to the UI with a user that has System Tenant Admin, Security Admin, or theRemote support role, and then perform the following actions.

Procedure

1. From the Main menu, select Settings.

The Settings window appears with the Overview tab selected.

2. On the Overview tab, use the Maintenance mode toggle to change the systemstatus.

3. To enable Maintenance Mode, perform the following steps:

a. Change the Maintenance mode toggle from OFF to ON.

The Maintenance mode window appears with a summary of tasks.

b. Click Begin Maintenance Mode to start the change of the system status.

A Confirmation window appears.

4. To take the appliance out of Maintenance Mode, change the Maintenancemode toggle from ON to OFF.

Monitor system component healthThrough the Settings window, you can monitor the state of the appliance and thehealth of each system component. To view the health of the system components,click the Main menu icon and select Settings. The system health information appearsin the Health panel.When you select the View Services icon in the Health panel, theView Services window appears.

The View Services window displays system health components in four groups—Management, Infrastructure, Core, and Protection. The state of each componentappears beside the name of the component.The following table provides a summary of each component state.

Table 6 Component states

Icon State

Running—This state appears when the associated service or component isrunning with full functionality. When all components are in running state, thestate of the appliance is operational.


Monitor system component health 23

Table 6 Component states (continued)

Icon State

Quiesce—This state appears during a quiesce of the associated service orcomponent.

Maintenance—This state appears when the associated service is inmaintenance. In the maintenance state, components have limited functionality.Infrastructure services do not go into maintenance state. When othercomponents are in maintenance, the appliance state is also maintenance.

Note

You must put the appliance in Maintenance mode for some configurationchanges, for example, to change the network settings or to upgrade theappliance. When configuration changes or an update completes, you mustmanually change the state of the appliance from Maintenance to Operational.

Initializing— This state appears when the component is starting. When thecomponent successfully starts, the state changes to Running.

Shutting down— This state appears when the service that is associated withthe component is stopping.

Shut down— This state appears when the service has stopped.

No response— This state appears when the service that is associated with thecomponent is running, but the service is not responding.

Business Service componentsThe following table summarizes the business services health components.

Table 7 Business Service components

System option Description

Application Data Management Service Provides the status of the Application DataManagement Service.

Common Business Service Provides the status of the Common BusinessService.

Storage Manager Provides the status of the Storage Manager.

VMDM Provides the status of the VMDM service.

Core Service system health componentsThe following table summarizes the core services system health components.

Table 8 Core system health component


Authentication Provides the status of the Authentication Service.



Table 8 Core system health component (continued)


Catalog Provides the status of the Catalog.

ComplianceVerification

Provides the status of the Compliance Verification service.

DatabaseManagement

Provides the status of the Database Management service.

Event Provides the status of the Event Service.

Log Manager Provides the status of the Log Manager service.

Server DisasterRecovery

Provides the status of a system disaster recovery

System Manager Provides the status of the System Manager.

Task Manager Provides the status of the Task Manager service.

Infrastructure Service system health componentsThe following table summarizes the Infrastructure system health components.

Table 9 Infrastructure system health component


API Gateway Provides the status of the API Gateway service.

Catalog Store Provides the status of the Catalog database.

CommonInfrastructureService

Provides the status of the Common Infrastructure Service.

HTTP Proxy Provides the status of the HTTP Proxy service.

Message Bus Provides the status of the Message Bus.

Secrets Manager Provides the status of the Secrets Manager service.

Service Manager Provides the status of the Service service.

Service Registry Provides the status of the Service Registry service.

UI Provides the status of the User Interface service.

UI Store Provides the status of the UI database.

Web Server Provides the status of the Tomcat service.

Workflow Database Provides the status of the Workflow database.

Management Service system health componentsThe following table summarizes the Management system health components.



Table 10 Management system health components


Dashboard Provides the status of the Dashboard service.

Historical Provides the status of the Historical Data Service.

License Manager Provides the status of the License Manager service.

Scheduler Provides the status of the Scheduler service.

Workflow Manager Provides the status of the Workflow Manager service.

Protection Service system health componentThe following table summarizes the Protection system health component.

Table 11 Protection system health component


Discovery Provides the status of the Discovery Service.

Appliance system statesThe eCDM appliance has two user-configurable states, operational and maintenancemode. Maintenance mode provides limited access to the appliance and reduces user-initiated functionality. Some configuration changes, for example, changes to networksettings and upgrades, require that the appliance state is maintenance mode tocomplete.

If the system is idle when you change the state of the appliance to maintenance mode,the state change occurs immediately. If any tasks are occurring, the change stateoperation waits 10 minutes, and then checks for running tasks. If the tasks are notcomplete, the change state operation tries to cancel all running tasks.

The change state operation cannot cancel the following tasks, and waits for thesetasks to complete before changing the system state to maintenance mode:

l Rollback

l Configuration tasks, such as XtremIO and VMAX configuration tasks

l Redirected Restore

l Export

When you put an appliance in Maintenance mode, the following changes occur:

l In the Services status window, the states of most services with the exception ofInfrastructure services appear as Maintenance. The infrastructure services whileoperational only allows some processing requests, for example, the requests thatare required to change network settings, or to update the appliance.

l Users that are logged in to the GUI and did not start the maintenance modeoperation are logged out of the GUI.

l An orange banner appears in the GUI that indicates the systems is in maintenancemode.

The state of appliance changes in the Overview window and in the Health box.



Reconfigure the virtual applianceThe options in the Settings window enable you to reconfigure the appliance.

To reconfigure the network settings, and the time zone, use the options on theOverview tab in the Settings window.

To change the password for OS user accounts and the lockbox passphrase, use theCredentials tab in the Settings window.

Reconfigure the network settingsPerform the following steps to modify the IP address, netmask, gateway, and DNSservers defined for the appliance.

Before you begin

To reconfigure the appliance, you must put the appliance in maintenance mode.

Procedure



2. On the Overview tab, click the Maintenance mode toggle switch to change thesystem status to Maintenance mode.

3. On the Overview tab, click the Information icon in the Network box, performone of the following tasks.

l To change the hostname of the virtual appliance, in the Hostname (FQDN)field, specify the Fully Qualified Domain Name (FQDN) for the virtualappliance.

Note

Ensure that you correctly configure hostname resolution for the name of theappliance. Do not specify the FDQN as localhost.

l To change the IP address of the virtual appliance, in the IP Address field,type the IPv4 address or IPv6 address for the virtual appliance.

Note

You cannot change the IP address family.

l To change the netmask of the virtual appliance, in the Netmask field, whenyou use IPv4 addressing, specify the netmask of the virtual appliance. Whenyou use IPv6 addressing, specify the prefix length.

l To change the gateway that is used by the virtual appliance, in the Gatewayfield, type the default gateway IPv4 address or IPv6 address that you wantthe virtual appliance to use.

l To change the DNS servers that are used by the virtual appliance, performone of the following tasks:

n To remove an existing DNS server, in the DNS Addresses box, clear thespecified IP address, and then click Save.


Reconfigure the virtual appliance 27

Note

The appliance requires at least one defined DNS server in the first DNSAddresses field, you can only clear the entry for additional DNS servers.

n To edit an existing DNS server, in the DNS Addresses box, select the IPaddress of the DNS server, modify the value, and then click Save.

n To add the IP address of a new DNS server, specify the IP address of theDNS server in an empty DNS Addresses field, and then click Save.

Note

You can specify up to three DNS servers.

4. Click Save.

Troubleshooting reconfiguration issues on page 32 provides information abouttroubleshooting issues that might appear when saving the configuration.

Results

After the configuration completes, the services on the appliance automatically restartand you must put the appliance back to Operational mode. The web browser redirectsyou to the following page: http://new_ip_address:9000/index.html, however the loginscreen does not appear. To put the appliance in Operational mode, perform thefollowing steps:

1. Change the web address to http://new_ip_address/index.html.

2. If an SSL certificate warning page appears with the message Your connection isnot private, click Advanced, and then click Proceed to new_ip_address(unsafe).

3. Log in to the appliance.

4. Use the Maintenace mode toggle to put the appliance in Operational mode.

Modifying the time zonePerform the following steps to modify the time zone for the appliance.

Procedure



2. In the Time Zone box, click the Information icon.

The Change Time Zone window appears.

3. Select the new time zone, and then click Save.

Optionally, specify the name of the time zone in the Search field. The list boxwill display the time zones that match the Search field text.

Results

After you complete the configuration changes, the services on the appliance willautomatically restart.



Modifying the lockbox passphrasePerform the following steps to modify the lockbox passphrase.

Note

You cannot change the passphrase when the appliance is in a pending or quiesce nodestate.

Procedure



2. Select the Credentials tab.

3. Click they key icon in the upper right-most corner of the lockbox.

The Change Lockbox Passphrase window appears.

4. In the Old Passphrase field, type the current passphrase for the lockbox.

5. In the New Passphrase field, type a new passphrase for the lockbox.

Ensure that the password meets the following requirements:

l Minimum of nine characters and a maximum of one hundred characters

l At least one numeric character (0-9)

l At least one uppercase character (A-Z)

l At least one lowercase character (a-z)

l At least one special character from the following list of acceptablecharacters:

~!@#$%^&*()_+`-={}|[]\:'";,./<>?

6. In the Confirm New Passphrase field, type the same value that you specified inthe New Passphrase field, and then click Save.

7. Click Save.

Managing passwords for OS user accountsThis section describes how to change the password for the admin, root, and supportuser accounts when an acount lockout occurs, before the password expires, and afterthe password expires.

Modifying the OS user passwords before expirationThe password for each OS user account expires every 60 days. Before the passwordexpires, perform the following steps to modify the password for the root, admin, andsupport accounts.

Note

You cannot change the password when the appliance is in a pending or quiesce nodestate.


Modifying the lockbox passphrase 29

Procedure



2. Select the Credentials tab.

The Systems window displays a list of OS user accounts.

3. Click they key icon in the upper right-most corner of the OS user account withthe password that you want to change.

The Change Password window appears.

4. In the Old Password field, type the current password for the selected useraccount.

5. In the New Password field, type a new password for the selected user account.







~!@#$%^&*()_+`-={}|[]\:'";,./<>?

6. In the Confirm New Password field, type the same password that youspecified in the New Password field.

7. Click Save.

Modifying an expired OS user passwordProcedure


https://appliance_ip_addressThe Login window appears.

2. In the Login field, type the name of the user whose password has expired.

Note

eCDM does not support using the ssh command with the root account. To usessh to connect to the appliance and change the password for the root account,log in to ssh with the admin account, and then use the su command to changeto the root account.

3. In the Password field, type the expired password.

A warning message appears. A password change is required.

4. In the (current) UNIX password field, type the expired password.

5. In the New password field, type a new password.









~!@#$%^&*()_+`-={}|[]\:'";,./<>?

6. In the Retype new password field, specify the new password.

Unlocking OS user accounts

After five failed log in attempts, the eCDM appliance locks out an OS user accountand displays the following message:

Account locked due to 5 failed loginssu: Authentication failureYou can wait five minutes to retry the log in, or as a system administrator you canperform the following steps to manually reset the password and unlock an OS useraccount.

Procedure

1. Connect to the appliance console with the root account.

Note

eCDM does not allow you to use ssh to connect to the appliance with the rootaccount.

2. To reset the password for the OS account, type /sbin/pam_tally2 -r -u .

For example, to unlock the Admin account, type:

/sbin/pam_tally2 -r -u admin

Output similar to the following appears:

Login Failures Latest failure Fromadmin 5 07/12/16 14:36:01 pts/2

3. Type /sbin/pam_tally2 to confirm that the Admin account does not appearin the list of accounts with failed user login tries.

Managing keychainsYou can create, edit, delete, and view keychain credentials.

Adding a keychainProcedure

1. Click the Main menu and select Settings > CREDENTIALS > KEYCHAIN. TheKEYCHAIN window appears.

2. Click + New Credentials. The New Credential window appears.


Managing keychains 31

3. Specify a Credential name, Username, and Password.

Note

The username and password in the keychain must match the required user andpassword for the inventory source or managed asset. Refer to storage vendordocumentation for information on credentials.

Editing a keychainProcedure


2. Select the keychain that you would like to edit. The Keychain Details windowappears.

3. Toggle the Edit Mode field to ON.

4. Edit the values in the following fields as required:

l Credential name

l Username

l Password

Note

The username and password in the keychain must match the required user andpassword for the inventory source or managed asset. Refer to storage vendordocumentation for information on credentials.

Deleting a keychainProcedure


2. Select the keychain that you would like to delete. The Keychain Details windowappears.

3. Toggle the Edit Mode field to ON.

4. Select Delete Credential.

Viewing keychain credentialsTo view keychain credentials, click Main menu > Settings > CREDENTIALS >KEYCHAIN and then select the user whose keychain details that you want to review.

Troubleshooting reconfiguration issuesThis section summarizes how to troubleshooting and resolve common issues thatmight occur when you change settings on the appliance.



Cannot reconfigure network settingsWhen you change the network settings on the appliance, and then click Save, an errormessage similar to the following might appear:

Error 403: The specified DNS servers cannot resolve thshostname of the virtual machine, to the specified IP address.

remediation: Confirm that you can perform forward and reverselookup validations for teh short hostname, long hostname(shortname and domain suffix), and the IP address of thevirtual machine.This message appears when an incorrect value was specified for the FQDN of theappliance or the gateway address during the initial appliance configuration.

To resolve this issue, deploy a new appliance and specify the correct configurationsettings or manually change the gateway addresses. SuSE documentation describeshow to manually change network configurations.

Note

eCDM only supports manually changing the gateway and subnet mask networksettings. To change the hostname or the IP address of the appliance, deploy a newappliance and specify the new configuration settings.

Configure the eCDM appliance properties

Perform the following steps from the Console window on the virtual appliance.

Procedure

1. Log in to the appliance with the root user account.

The default password for the root account is changeme.

2. From the command prompt, type configure_appliance.

The prompt to configure the appliance appears.

3. At the Specify the Fully Qualified Domain Name (FQDN) for this VM prompt,specify the Fully Qualified Domain Name (FQDN) for the virtual appliance.

Note

Ensure that you correctly configure hostname resolution for the name of theappliance. Do not specify the FDQN as localhost.

4. At the Specify the IP address family for this VM(IPv4/IPv6) prompt, typeIPv4 or IPv6.

5. At the Specify the IP address for this VM prompt, type the IPv4 address orIPv6 address for the virtual appliance.

l For IPv4 addresses, do not specify the 127.0.0.1 loopback address.

l For IPv6 addresses, use the nslookup command to resolve the hostnameof the appliance to the IP address. Specify the IPv6 address in the formatthat appears in the nslookup output.For example, if the nslookup output returns the expanded form of the IPaddress (2620:0000:0170:0714:6d63:c749:beec:c2e4), do not specify thecompressed form of the IP address (2620:0:170:714:6d63:c749:beec:c2e4).


Troubleshooting reconfiguration issues 33

https://www.suse.com/documentation/sled11/book_sle_admin/data/sec_basicnet_manconf.html

6. At the Specify the default gateway address for this VM prompt, type thedefault gateway IPv4 address or IPv6 address that you want the virtualappliance to use.

7. At the Specify the netmask (for IPv4 only) or the prefix length (for IPv6only) prompt, when you use IPv4 addressing, specify the netmask of the virtualappliance. When you use IPv6 addressing, specify the prefix length.

8. At the Specify up to three domain name servers for this VM prompt, type upto three domain name servers, separated by commas, for this virtual appliance.

The Setting up the network and hostname status appears.

Modifying the eCDM appliance hardware settingsFollow the steps in this section to expand the size of the data disk and system disk,and modify the memory configuration, only under the guidance and recommendationof Support.

Modifying the appliance memory configurationAdjust the memory configuration of the appliance to support changes in the protectionenvironment.

Procedure

1. Log in to the vSphere web client.

2. Right-click the appliance and select Edit Settings.

The Edit Settings window appears with the Virtual Hardware button selected.

3. In the Memory field, specify the new memory value.

Ensure that the value you specify does not exceed 16 times the amount ofmemory the virtual machine has when powered on and is a multiple of 4 MB.

4. Click OK.

Modifying the data disk sizeFollow these steps to expand the size of a data disk that is single partitioned and hasthe log partition is on the system disk.

Procedure

1. Perform the following steps from the vSphere web client:

a. Right-click the appliance and select Shut Down Guest OS.

b. After the appliance power off completes, right-click the appliance and selectEdit Settings.

The Edit Settings window appears with the Virtual Hardware buttonselected.

c. Increase the provisioned size of Hard disk 2 to the desired size, and thenclick OK.

Note

You cannot decrease the provisioned size of the disk.



d. Right-click the appliance and select Power On.

2. Perform the following steps from the appliance console, as the root user.

Note

If you use ssh to connect to the appliance, log in with the admin account, andthen use the su command to change to the root account.

a. Reboot the appliance by typing reboot.

b. On the GNU GRAB menu, press e to edit the GNU GRAB menu.

c. In the edit screen, search for the line that starts with Linux, and then addword single before the entry splash=0

The following figure provides an example of the edit screen with the updatedtext.Figure 4 Editing the GNU GRUB menu

d. Press Ctrl-x to reboot into single-user mode.

e. When prompted, type the password for the root account.

f. Unmount the data disk, by typing umount /data01.

g. Start the partition utility, by typing parted, and then perform the followingtasks:

a. Type select /dev/sdb.

b. Type print. If you are prompted to fix issues, type fix at each prompt.The output displays the new disk size in the Size field and the currentsize in the table.

c. Type resize 1 new_size. Where new_size is the value that appears inthe Size field in the output of the print command.

For example, to resize the disk to 700 GB, type: resize 1 752GBd. Type quit.

3. Reboot the appliance by typing systemctl reboot.

4. Log in to the appliance console as the root user.


Modifying the data disk size 35

Note

If you use ssh protocol to connect to the appliance, log in with the adminaccount, and then use the su command to change to the root account.

5. Grow the xfs file system by typing xfs_growfs -d /data01.

6. Confirm the new partition size by typing df -h.

Modifying the system disk sizeFollow these steps to expand the size of a data disk when the log partition is the lastpartition on the system disk.

Procedure

1. Perform the following steps from the vSphere web client:

a. Right-click the appliance and select Shut Down Guest OS.

b. After the appliance power off completes, right-click the appliance and selectEdit Settings.

The Edit Settings window appears with the Virtual Hardware buttonselected.

c. Increase the provisioned size of Hard disk 1 to the desired size, and thenclick OK.

Note

You cannot decrease the provisioned size of the disk.

d. Right-click the appliance and select Power On.

2. Boot from a SLES 12 CD.

3. Start the partition utility, by typing parted, and then perform the followingtasks.

a. Type select /dev/sdx.

b. Type print. If you are prompted to fix issues, type fix at each prompt. Theoutput displays the new disk size in the Size field and the current size in thetable.

c. Type quit.

4. Reboot the appliance by typing systemctl reboot.

5. Log in to the appliance console as the root user.

Note

If you use ssh protocol to connect to the appliance, log in with the adminaccount, and then use the su command to change to the root account.

6. Grow the xfs file system by typing xfs_growfs -d /data01.

7. Confirm the new partition size by typing df -h.



CHAPTER 3

Discovering Assets


l Inventory sources, storage systems, and protectable assets..............................38l Prerequisites for discovering inventory sources.................................................39l Discover array primary storage and protection inventory sources .....................40l Discover SQL and Oracle Instance Group inventory source ...............................42l Virtual machine discovery.................................................................................. 45l Discover assets and copies manually..................................................................49l Scheduled discovery.......................................................................................... 49l Edit Inventory Sources ......................................................................................49l Set or reuse key chain credentials..................................................................... 50l Discover Data Domain MTrees............................................................................51l Configure Data Domain MTree Replication........................................................ 52l Edit and delete Data Domain MTree Replication................................................ 53l Protection engines discovery............................................................................. 53

Discovering Assets 37

Inventory sources, storage systems, and protectable assetsInventory sources are the mechanism that eCDM uses to communicate with andmanage the storage systems and protectable assets.

To manage inventory sources, each type of storage manager offers a programmaticinterface to it. Usually, the storage manager is an externally addressable system. Forexample, the Data Domain Management Center (DDMC) is the programmaticinterface for controlling the Data Domain systems. Many storage managers also offerthe benefit of providing programmatic interfaces to multiple storage arrays.

For discovery to work, provide information that gives eCDM access to the inventorysources in the environment. By interrogating those inventory sources, eCDMdetermines what storage systems exist, and what resources to protect on them. WheneCDM performs actions, such as creating a snapshot, eCDM communicates with theinventory source for a resource to create the snapshot for protection. When eCDMverifies objective compliance, eCDM communicates with the inventory source todiscover the available copies in the storage groups. Storage systems are what eCDMallows you to protect.

Data Domain credentialseCDM manages Data Domain systems through the Data Domain ManagementConsole and requires credentials for each Data Domain system to correctly managevDisk functionality.

vDisk pools appear as Data Domain MTrees in the Discovery section of the eCDM userinterface. When you discover a new Data Domain Management Console inventorysource, eCDM discovers all Data Domain systems that are managed by that DataDomain Management Console. After each Data Domain system is discovered, eCDMrequires the vDisk credentials to be set. For any vDisk pool that is being used foreCDM protection, set the respective credentials of the vDisk user for the vDisk pool.To set credentials for vDisk users on vDisk pools, go to Discovery > InventorySources > Data Domain Management Center > Data Domain system > Details. Discovering Data Domain MTrees provides more information.

Protectable assetsA protectable asset is a resource that is made up of storage groups, otherwise knownas consistency groups, to which you can assign protection and then verify that thegroups are protected.

eCDM protects resources through protection plans. eCDM limits the assignment ofprotection to storage groups or consistency groups (collections of disks) as opposedto individual disks. Storage groups and consistency groups are storage-array specificconcepts which, in general, represent a collection of disks/LUNs/volumes that areacted on as a single entity.

Protection is assigned at the asset group level. You can assign protection to an assetgroup that contains one or more of the following:

l Storage Groups for VMAX.

l Consistency Groups for XtremIO.

l Virtual machines

Note that because protection is assigned at the asset group level, you cannot assignprotection directly to a consistency group or individual virtual machine in eCDM.

Discovering Assets


Prerequisites for discovering inventory sourcesPerform these tasks before you discover the inventory sources.

l Ensure that the eCDM virtual appliance is deployed and configured in theenvironment. in the eCDM Deployment Guide provides information.

l Ensure that the eCDM appliance is not in maintenance mode. You are unable todiscover inventory sources while the eCDM appliance is in maintenance mode.

l Log in with administrative rights.

l Configure all inventory sources with an NTP server.

l For discovery in eCDM of Data Domain for RecoverPoint backups, ensure that youset up an interface group on Data Domain so that the fastest network link is usedfor RecoverPoint backups. After you create the interface group, add the clients(RecoverPoint IP) and specify which interface group that client should use. DataDomain documentation provides more information on interface groups.

l For discovery of VMAX SMI-S Provider and Data Domain Management Centerhosts, note the following known problem number 253887:

n SMIS-IP reverse lookup from host fails and displays the following error:

- Failed to set up SymApi handle: Could not establish symapi Client/Server session: SYMAPI_C_NET_HANDSHAKE_FAILED.

n Data Domain–related failures might result if the FQDN cannot be resolved fromthe host, and the following error appears:

DD Error: Severity: 1 ERROR: ddv_connect_with_user_pwd() failed, Err: 5138-**** Error communicating with host <DDHOSTNAME>: could not resolve host.

To avoid these errors, ensure that SMI-S Provider and Data Domain ManagementCenter FQDN can be resolved from the appliance.

l Before discovery of VMAX SMI-S Provider inventory sources:

n Verify that the storapid and storsrvd daemons are running on the SMI-Sserver.

n Ensure that the CIM Object Manager (ECOM) is running on the SMI-S providerhost. This is the service that eCDM uses to communicate with VMAX SMI-Sprovider.Refer to corresponding Solutions Enabler Installation and Configuration Guidefor information on how to check and start the ECOM service.

l Before you register an SQL application, ensure that Data Domain ManagementCenter (DDMC) discovery is done. Without a Data Domain Management Centerdiscovery, application copies will not be discovered, and Data Domain BoostautoConfiguration is not possible.

l For discovery of SQL and Oracle Instance Group inventory sources:

n Ensure that all clocks on both the SQL Server host, Oracle host, and eCDM aretime-synced to the local NTP server to ensure discovery of the backups.

n Ensure that the SQL Server/Oracle host and the eCDM appliance network cansee/resolve each other.

n Ensure that port 7000 is open on the SQL Server/Oracle host and is bi-directional.

Discovering Assets

Prerequisites for discovering inventory sources 39

l For Oracle Instance Group inventory sources, ensure that the the maximum lengthof the hostname plus storage unit is 59. There are no special character limitations.For example, oracle_database_department_123_accounts

Verify that the storapid and storsrvd daemons are running

1. Use ssh to access the VMAX SMI-S host.

2. To display the daemon statuses, run the stordaemon list command. Check forthe status of the storapid and storsrvd daemons. If they are not running,continue to the following step.

3. To start the required daemons, run the following commands:

l stordaemon start storsrvdl stordaemon start storapid

4. Save the changes

5. Exit the VMAX SMI-S host.

Discover array primary storage and protection inventorysources

Primary storage and protection includes the following:

l Data Domain Management Center

l VMAX

l XtremIO

l RecoverPoint Cluster Management IP

The Storage Admin and System Tenant Admin roles can perform the following task.

Procedure

1. Click main menu > Discovery > Inventory Sources.

2. To define a new inventory source, click New.

3. In the New Inventory Source window, specify the new Inventory Sourceattributes:

a. In the Management Type field, select the inventory Source type storagemanager application from the list. You can select from the Primary orProtected categories.

Data Domain Management Center in the Protected discovers all of theData Domain systems within the Data Domain Management Center.

b. In the Name field, specify an Inventory Source name.

Discovering Assets


Note

Do not use any of the following special characters when naming an XtremIOasset because it could result in problems when assigning a ProtectPointconfiguration plan to an XtremIO asset group.

l !

l @

l #

l $

l %

l ^

c. Specify the system hostname and the port for SSL communication.

The hostname can be the hostname, fully qualified domain name, or the IPaddress. To specify an IPv6 address, enclose the address in square brackets[ ].

eCDM automatically populates the port according to the storage managerapplication that is selected from the list box. This field is user-configurable.

4. Type the inventory source credentials, and then click Save and verifyconnection.

eCDM automatically discovers all the storage systems, protectable assets, anddata copies within the inventory source.When you click Save and verify connection to create the inventory source aspart of the Setting or reusing keychain credentials workflow, a pop-upwindow indicates that eCDM is starting the discovery process. The section Setting or reusing keychain credentials provides information. eCDM checks forconnectivity to the storage manager, including the credentials, and discoversthe storage arrays. If discovery fails because of incorrect credentials, failedconnectivity, or inability to gather device information, eCDM displays a messageto inform you of the failure.

Discovery time is based on networking bandwidth. The resources that arediscovered and those that are doing the discovery take a performance hit eachtime that you go through a discovery process. It might appear that eCDM is notupdating the Inventory Source data when you click Refresh or Discover tocarry out a discovery. It is not recommend that you click Refresh or Discoverrepeatedly because each click starts the discovery process again, which causesa delay in reflecting the updated inventory source data.

5. Click Next.

6. (Optional) Perform the following:

l Schedule a daily discovery at a specified time. In the left-pane, clickSchedule.The schedule appears.

a. Select the time at which you want the daily discovery to occur. Theoption to schedule discovery is enabled by default. If you deselect theoption to disable schedule discovery, eCDM disables the option to enteror change the schedule discovery time.

b. Click Next.

Discovering Assets

Discover array primary storage and protection inventory sources 41

c. Click Finish.

l Click Finish.

If verification step timed out because it is taking too long, eCDM provides thefollowing message on Finish: Initial inventory source update for<inventory_source_name> is successful. However, unable toupdate discovery job and schedule due to connectionverification issues. Please see Activity Monitor forstatus.After discovery of all inventory sources, within each asset's details, a columnappears in a color to represent the percentage of capacity used:

l Green—Below 40%

l Orange—Below 60%

l Red—Greater than 60%

After you finish

Optional: Follow the procedure outlined in Discovering Data Domain MTrees.

Discover SQL and Oracle Instance Group inventory sourceBefore you begin

l Ensure that all clocks on both the SQL Server host, Oracle host, and eCDM aretime-synced to the local NTP server to ensure discovery of the backups.

l Ensure that the SQL Server/Oracle host and the eCDM appliance network cansee/resolve each other.

l Ensure that port 7000 is open on the SQL Server/Oracle host and is bi-directional.

l For Oracle Instance Group inventory sources, ensure that the the maximum lengthof the hostname plus storage unit is 59. There are no special character limitations.For example, oracle_database_department_123_accounts.

Procedure

1. Discover Protection storage for Data Domain Management Console. Discoverarray primary storage and protection inventory sources provides information.

2. Install the application agents.

Application agents provides information.

3. Choose one of the procedures to approve or add SQL or Oracle inventorysources:

l Accept registration requests

l Preapprove SQL and Oracle application agents

l Manually approve agent registration

Application agentsApplication agents are the lightweight agents that enable an application administratorto protect and recover the application data on the application host. eCDM integrateswith the application agents to check and monitor backup compliance againstprotection plans. eCDM also allows central scheduling for backups.

l SQL Server instance governanceThe Microsoft application agent installation is a GUI wizard that runs on aWindows host. The Microsoft application agent installation wizard contains an

Discovering Assets


option to enable eCDM integration. The Microsoft Application Agent Installation andAdministration Guide provides information on installing the Microsoft applicationagent for SQL operations.

l Oracle instance governanceThe Oracle RMAN agent installation is a command line process whereby the rootuser installs the required Oracle RMAN agent and eCDM software and configuresdatabase authentication. The Oracle RMAN Agent Administration Guide providesinformation on integrating the Oracle RMAN agent with eCDM.

Accept registration requestsYou can manually approve the registration requests on the appliance.

The pre-approved IP and hostnames can be edited or deleted only before you acceptagent registration. After you register the agent, you cannot edit or delete the pre-approved IP or hostname.

Procedure

1. Click Main Menu > Discovery > Application Agents.

2. Select the application host you would like to approve.

3. Verify the pre-approved IP and hostnames, and edit as applicable.

After you register the agent, you cannot edit the pre-approved IP or hostname.

4. Click Actions and select Accept Registration.

Reject registration requests

You can manually reject the registration requests on the appliance.

The pre-approved IP and hostnames can be edited or deleted only before you acceptagent registration. After you register the agent, you cannot edit or delete the pre-approved IP or hostname.

Procedure


2. Verify the pre-approved IP and hostnames and delete as applicable.

After you register the agent, you cannot delete the pre-approved IP orhostname.

3. Click Actions and select Reject Registration.

Pre-approve SQL and Oracle application agentsLearn how to pre-approve application agent registration.

Before you begin

The Storage Admin and System Tenant Admin roles can perform this task.

This process is also called whitelisting.

Procedure


2. Click Actions and select to add a New agent by IP Address or New agents byCSV.

l If you selected to add agents by New agent by IP Address, perform thefollowing steps:

Discovering Assets

Application agents 43

a. Type the application agent's IP Address and Expiration Date.

b. Click Save.

l If you selected to add agents by New agents by CSV, perform the followingsteps:

a. To select a CSV File, click the Upload File icon.

Note

The contents of the CSV file must be in the following format, forexample:

"10.25.115.113""10.25.115.112""10.25.115.145"

b. The Explorer window appears. Select the .csv file, and click Open. Thefile displays in the Application Agents window.

c. Select the Expiration Date.

d. Click Save.

Manually approve agent registrationProcedure

1. In the Inventory Sources tab click Pending Instances on a group.

The registered agents are displayed with a status of Waiting.

2. Approve or reject the required registration:

l To approve a particular registration select the waiting agent, and then click.

lTo approve registration for all the waiting agents, click . All theagents are selected. Then select Actions > Accept Registration. The statusfor all the agents changes to Registered.

l To reject a registration, select the waiting agent, and then click .

Provide Data Domain vdisk credentials to the application admin userFor application-consistent ProtectPoint for Virtual Machines copies, the eCDMadministrator must provide the Data Domain vdisk credentials manually to theapplication admin user to add to that user's lockbox and configuration file.

Procedure

1. SSH to the eCDM appliance as the admin user.

2. Obtain the credentials ID from the ES document by typing the following curlcommand:

curl -XGET 'localhost:14300/configurationmanager/configurationmanager__cred/_search?fields=secretId&q=username:ecdmsu-*&pretty'

Discovering Assets


3. Using the secretId returned from step two, obtain the password by typing thefollowing curl command, and provide the credentials to the application admin.For example:

curl -XGET https://localhost:9092/secrets/71c5c155-5120-4de3- b767-33a7610b2b61 --cacert /etc/ssl/certificates/rootca/rootca.pem --cert /etc/ssl/certificates/component/component.pem --key /etc/ssl/certificates/component/componentkey.pem

Stagger SQL discovery jobs in host scale-out environmentsIn the host scale-out environment, where there are large number of SQL hosts toregister to eCDM, consider the following methods for staggering the SQL discoveryjobs.

Kick off the installer in smaller group of hostsIf you are installing MS appAgent by script, kick off the installer in smaller group ofhosts. The discovery jobs will kick off after the agent installation; therefore,distributing the installer in smaller group will help stagger the incoming discoveryresults to eCDM.

Example 1 Stagger the Schedule Discovery in Inventory Sources

When you create an Inventory Sources custom group for SQL, eCDM sets the defaultschedule to run discovery every day at 1am. Consider staggering this schedule atdifferent times among different Inventory Sources.

Optimize SQL discovery workflow in database scale-out environmentsIn a database scale-out environment, where a single client hosts a large amount ofSQL databases, consider the following tips to optimize the discovery of SQL in eCDM.

Match the backup polling to the backup intervalCurrently the default backup polling is at 5 minutes interval in eCDM. Consider alteringthis interval to be in line with the environment backup schedule. To change the backupinterval, create a text file named "mssql-backup.poll" under {agent install dir}/bin withvalue Xmin where X is any integer. For example, to set backup polling to run every 30minutes, enter "30min" inside the mssql-backup.poll file.

Example 2 Setup "delete" plan objective to retire old backups

Virtual machine discoveryThe VMware vCenter server is discovered as an inventory source within eCDM. Thisdiscovery operation allows you to collect the desired VMware entity information from

Discovering Assets

Stagger SQL discovery jobs in host scale-out environments 45

the vCenter server, as shown in the following diagram, and save the virtual machinesas eCDM resources for the purposes of protection, recovery, and activity monitoring.

Figure 5 VMware entity information

After the vCenter is discovered, virtual machine assets that are associated with thevCenter can be protected by leveraging Hypervisor Direct data path technology toperform snapshot backups to Data Domain devices, which facilitates the movement ofdata from the ESXi server to the Data Domain destination. Once they are protected,these assets are available for recovery to the original virtual machine, or to analternate location.

The initial virtual machine discovery performed within eCDM is a full discovery, whichidentifies all ESX clusters, hosts and virtual machines within the vCenter and occursautomatically after the vCenter is added as an inventory source. Incrementaldiscoveries are subsequently performed automatically according to a fixed interval toidentify any modified, or added VMware entities since the last discovery operation.You can also manually initiate a discovery of VMware entities at any time from theInventory Sources tab of the Discovery window.Figure 6 Manual discovery of virtual machine assets

When the discovery completes, virtual machines are added as assets to a VMwareVirtual Machines asset group which can be viewed on the Assets window, as shown inthe following figure. Click the asset group to display individual asset details andperform virtual machine protection and recovery operations.

Discovering Assets


Figure 7 Assets window after virtual machine discovery

Discover VMware vCenter serverPerform the following steps to add the vCenter server as an inventory source. eCDM

Before you begin

By default, eCDM enforces SSL certificates during communication with the vCenterserver. A requirement of SSL certificate enforcement is that the common name (cn)of the x509 certificate must match the hostname of the vCenter URL. The commonname of the x509 certificate is typically the vCenter server fully qualified domainname (FQDN), but it could be the vCenter server IP address. You can inspect thevCenter server SSL certificate to determine whether the x509 common name is aFQDN or an IP.

When creating an inventory source resource, and in order to pass SSL certificateenforcement, the inventory source resource hostname must match the common nameof the x509 certificate on the vCenter server.

Note

You can disable certificate enforcement by settingvmdm.discovery.ignore_vcenter_cert=true in the /home/admin/vmdm_discovery.properties file.

Procedure

1. Go to Main menu > Discovery.

The Discovery tab displays.

2. Click the Inventory Sources tab.

3. Click +New, and then select VMware vCenter.

4. On the Name and Credentials page, specify the vCenter name, the system IPaddress or FQDN, and credentials for the vCenter server.

Discovering Assets

Discover VMware vCenter server 47

Figure 8 Name and credentials

Note

It is recommended to use the FQDN instead of the IP address in the SystemHostname field.

5. Click Save and Verify connection to ensure that eCDM can successfullyaccess the vCenter server, and then click Next.

The Schedule page appears.

6. On the Schedule page, select a time to run discovery, if required. By default,discovery runs once a day at the time you specify. If you deselect the option todisable schedule discovery, eCDM disables the option to enter or change theschedule discovery time.

7. Click Next.

The Summary page appears.

8. On the Summary page, verify the vCenter server and all the details youspecified, and then click Finish.

If verification step timed out because it is taking too long, eCDM provides thefollowing message on Finish: Initial inventory source update for<inventory_source_name> is successful. However, unable toupdate discovery job and schedule due to connectionverification issues. Please see Activity Monitor forstatus.

Results

When the vCenter is added successfully, the Inventory Sources tab displays thevCenter server. You can view the progress of the discovery within the Tasks tab ofthe Activity Monitor window.

Discovering Assets


Discover assets and copies manuallyWhen the system takes a long time to respond because of networking bandwidthvariations, eCDM might not perform asset and copy discovery operationsautomatically. In this situation, perform this discovery manually.

Procedure


2. Manually start the discovery:

a. Select an asset.

b. Click .

c. Click .

Scheduled discoveryScheduled discovery is an optional step in the regular asset discovery workflow.

Discovering Array Primary Storage and Protection Inventory Sources , Discovering aSQL instance group inventory source, and Discovering a VMware vCenter serverprovide information.

Edit Inventory SourcesBefore you begin

l The Storage Admin and System Tenant Admin roles can perform this task.

l Log in with administrative rights.

Procedure

1. Click main menu icon > Discovery > Inventory Sources.

2. From the list of inventory sources, select the inventory source that you wouldlike to change.

3. To get a list of available operations to perform, hover over the options icon .

4. Click the Edit icon within the inventory source that you want to edit.

The Edit Inventory Source window appears.

5. In the Edit Inventory Source window, edit the applicable attributes, and thenclick one of the save options.

"Setting or reusing keychain credentials" in the eCDM Administration and UserGuide provides information.

6. Optional:

l Schedule a daily discovery at a specified time. In the left-pane, clickSchedule. The schedule appears.

a. Select the time at which you would like the daily discovery to occur. Theoption to schedule discovery is enabled by default.

b. Click Next.

Discovering Assets

Discover assets and copies manually 49

c. Click Finish.

l Alternatively, click Finish.

If verification step timed out because it is taking too long, eCDM provides thefollowing message on Finish: Initial inventory source update for<inventory_source_name> is successful. However, unable toupdate discovery job and schedule due to connectionverification issues. Please see Activity Monitor forstatus.

Set or reuse key chain credentialsYou can create a set of credentials in the New Key chain tab or use a previouslystored set of credentials, which can be found on the Stored Keychain tab.

Create a new set of credentials:If you have an existing user account on the Data Domain system but this user accountdoes not exist within eCDM, create a new set of credentials.

Procedure

1. Click main menu > Discovery > Inventory Sources, choose the type ofinventory source, and then select the New Key chain tab.

2. Specify a username, password, and credential name.

These credentials identify the new key chain in the Stored Keychains tab.

Note

The username and password in the key chain must match the required user andpassword for the inventory source or managed asset. Refer to storage vendordocumentation for information on credentials. Data Domain ManagementCenter sets the credentials for the Data Domain Management Center instance.

3. Click Save and verify connection.

Use a stored key chainIf you have an existing user account on the Data Domain system that you previouslycarried out the procedure in "Creating a new set of credentials" for this user accountand this user already exists within eCDM, use a stored key chain.

Procedure

1. Click main menu > Discovery > Inventory Sources, choose the type ofinventory source, and then select the Stored Key chains tab.

2. Select the desired key chain.

3. Click Save and verify connection.

Create new credentials on eCDM and Data DomainIf you are creating an MTree on a new Data Domain system for which a user account isnot yet created either within eCDM or on Data Domain, use this procedure . eCDM willcreate the user account on the Data Domain system as well as within eCDM.

This procedure applies only to creating Data Domain MTrees. This workflow does notappear in eCDM for discovering Inventory Sources.

Discovering Assets


Procedure


2. Select the Data Domain Management System asset for which you want toconfigure Mtree Replication, and click the details icon.

3. Follow the steps in the UI, and when you get to the Key Chain step, selectCreate New.

4. Populate the Key Chain fields:

a. In the Credential Name field, type the name that you want to give to theeCDM Key Chain.

This is how eCDM identifies the Key Chain in the list of Key Chains.

b. In the Username field, type the username that you want to assign to the KeyChain.

This is how Data Domain identifies the user in the Data Domain system.

c. In the Password field, type the password you want to assign to the KeyChain.

5. Click Next.

Create credentials on Data Domain onlyIf you are creating an MTree on a new Data Domain system for which a user account isnot yet created on Data Domain, but you would like to reuse existing credentials withineCDM, use this procedure . eCDM can create the user account on the Data Domainsystem.

This procedure applies only to creating Data Domain MTrees. This workflow does notappear in eCDM for discovering Inventory Sources.

Procedure


2. Select the Data Domain Management System asset for which you want toconfigure Mtree Replication, and click the details icon.

3. Follow the steps in the UI, and when you get to the Key Chain step, select UseSaved Key Chain.

The list of stored Key Chains opens.

4. Select the saved Key Chain that you want to use for the Data Domain MTreeand click Next.

Discover Data Domain MTreesThe Storage Admin and System Tenant Admin roles can perform this task.

Before you begin

You must have previously discovered Data Domain Inventory Sources in your eCDMenvironment. "Discover Inventory Sources" in the eCDM Administration and User Guideprovides information.

Discovering Data Domain MTrees is part of the Discovering Inventory Sourcesworkflow.

Discovering Assets

Create credentials on Data Domain only 51

Procedure


2. Select the Data Domain Management System asset for which you want todiscover Mtrees, and click the details icon.

3. Select the Data Domain system for which you want to discover MTrees, andclick New > Data Domain MTree.

The option in the left pane is selected for Capacity and Stream Quotas.

4. Follow the steps in the UI.

l Click the information icons in the guided UI for more information aboutHard and Soft Capacity, vDisk Pools and Storage Units, and otherinformation."Setting or reusing keychain credentials" the eCDM Administration and UserGuide in provides information about credentials with Data Domain MTrees.

l If you are configuring Data Domain Boost, select Storage Unit.

l If you are configuring ProtectPoint solutions, including Data Domain Boostfor ProtectPoint , select VDisk Pool.

l If you are configuring ProtectPoint for XtremIO, configure a Storage Unitfor each RecoverPoint Cluster and vDisk Pool.

l Click Activity Monitor for updates on the discovery status.

After you finish

Optionally, configure MTree Replication. Configure Data Domain MTree Replicationprovides information.

Configure Data Domain MTree ReplicationThe Storage Admin and System Tenant Admin roles can perform the following task.

Before you begin

l You must have previously discovered Data Domain Inventory Sources in the eCDMenvironment. "Discover Inventory Sources" in the eCDM Administration and UserGuide provides information.

l You must enable the VDISK service.

Configuring Data Domain MTree Replication is part of the Discovering InventorySources workflow.

Procedure


2. Select the Data Domain Management System asset for which you want toconfigure Mtree Replication.

3. Click the details icon.


5. Ensure that both the source Data Domain and target Data Domain systems aremanaged by the same Data Domain Management Console.

6. Click Activity Monitor for updates on the discovery status.

Discovering Assets


Edit and delete Data Domain MTree ReplicationThe Storage Admin and System Tenant Admin roles can perform this task.

Edit Data Domain MTree ReplicationProcedure


2. Select the Data Domain Management System asset for which you want to editMtree Replication, and then click the details icon.

3. Click the edit icon.


Click Activity Monitor for updates on the status.

Delete Data Domain MTree ReplicationProcedure


2. Select the Data Domain Management System asset for which you want todelete Mtree Replication, and then click the details icon.

3. Click the edit icon.

4. In the left pane, click Replication Settings .

5. Unselect the system to be used to be used as the Replication Target:

a. Click Next.

b. Click Finish.

Click Activity Monitor for updates on the status.

Protection engines discoveryDiscovery of protection engines occurs after vRPA registration. The vRPA deploymentand registration is performed by Professional Services.

The following image displays the Discovery > Protection Engines tab after vRPA hasbeen deployed and the vRPA cluster is registered.Figure 9 Protection Engines tab with vRPA deployment

Discovering Assets

Edit and delete Data Domain MTree Replication 53

Note

The # Protected VMs count refers to the number of assets protected by eCDM. Thiscount, however, does not indicate that all of the virtual machines have been protectedsuccessfully. To determine the success or failure of asset protection, use the eCDM UIActivity Monitor window.

Register Data Domain to vRPA clusterUse the following procedure to register a Data Domain system to a vRPA cluster listedin the eCDM Protection Engines window.

Procedure

1. From the eCDM UI, go to Main Menu > Discovery.

2. Select the Protection Engines tab, and then click Actions > Register DataDomain.

A list of available Data Domain systems appears. These are the Data Domainsystems that were discovered when the Data Domain Management Center(DDMC) inventory source was added.

3. Select a Data Domain system and click OK to create a storage unit in the DataDomain.

This storage unit will be registered with all of the vRPA clusters under theProtection Engines tab.

4. Go to Main Menu > Activity Monitor to determine if the task completedsuccessfully and to view the registration information (name of the storage unitcreated, registered clusters).

Results

After successful registration, the Register Data Domain button in the Discoverywindow's Protection Engines tab changes to Change Data Domain, which allows youto change the Data Domain system registered to the vRPA cluster as long as you havenot protected any assets and the # Protected VMs is listed as 0 under the VMProtection Summary.

Discovering Assets


CHAPTER 4

Managing Tenants


l Tenancy............................................................................................................. 56l Roles.................................................................................................................. 57l Privileges........................................................................................................... 66l Configure the system tenant..............................................................................70l Managing tenants...............................................................................................72l Managing user accounts.................................................................................... 75l Review tenant compliance................................................................................. 88

Managing Tenants 55

TenancyWith eCDM tenancy, service providers can logically separate assets and protectionplans into different organizational units, called tenants, within the eCDM environment.

Creating multiple tenants helps you to manage complex configurations.

Users and LDAP groups are defined at the system tenant level and can access alltenants, protection plans, and assets within the eCDM environment.

eCDM provides tenants the following configuration options for users or LDAP and ADgroups:

l Ability to restrict what can be monitored in the eCDM UI

l Ability to restrict operations

l Ability to supply customized auditing, billing, and chargeback

System tenantThe eCDM environment has a single system tenant, which is also known as the serviceprovider tenant or landlord. You can create multiple subtenants under the systemtenant.

Users and LDAP groups that are defined at the system tenant level can access alltenants, protection plans, and assets within the eCDM environment.

TenantsA tenant is an organizational unit or container in a eCDM deployment.

A tenant can represent a business group in an enterprise or a stand-alone companythat subscribes to cloud services from a service provider. Each tenant has its owndedicated configuration. Some system-level configuration tasks are shared acrosstenants.

UsersUsers belong to the system tenant and can be defined as either local or LDAP/ActiveDirectory. Users and LDAP groups that belong to the system tenant can access alltenants, protection plans, and assets within the eCDM environment.

The role that is assigned to a user defines what privileges are associated with the userand determines the tasks that the user can perform.

Note

User authorization grants or denies users access to resources managed by eCDM.User authorization is identical, regardless of whether the user is authenticated locallyor by a Microsoft Windows Active Directory/LDAP server.

Default admin userThe default admin user is preassigned the System Tenant Admin role during eCDMinstallation. TThis user has super user control over the eCDM appliance and cannot be

Managing Tenants


deleted if it is the only remaining System Tenant Admin. However, you can modify theattributes of the default admin user.

Users defined at the system tenant levelUsers that are defined at the system tenant level can access protection plans andassets for all tenants within the eCDM environment depending on the user's assignedrole.

The role that is assigned to a user defines what privileges are associated with the userand determines the tasks that the user can perform within the tenant container.

Note

The user can be defined as either local or LDAP/AD. User authorization grants ordenies users access to resources managed by the tenant. User authorization isidentical, regardless of whether the user was authenticated locally or by a MicrosoftWindows Active Directory LDAP server.

RolesA role defines the privileges and permissions that a user has to perform a group oftasks. When a user is assigned a role, you grant the user all of the privileges that aredefined by the role. Only one role can be associated to a user account.

Roles that are defined at the system tenant level and assigned to users, span theentire eCDM environment. The following roles, when applied to users at the systemtenant level, span the system tenant and apply across all tenants under the systemtenant:

l Database Admin

l Executive

l Export and Recovery Admin

l Operations Monitor

l Remote Support

l Security Admin

l Storage Admin

l System Tenant Admin

Database Admin role

Database AdminThis role is defined for a dedicated DBA or Application Owner set of users that areresponsible for the backup and recovery of their particular Application/DB Assets. Theintent is to restrict the new DBA/Application owner Role to just managing theirProtection Plans for their Assets and explicitly blocking them from making any othereCDM configuration changes such as Data Domain storage configuration changes andAsset Group changes where Data Domain storage settings are configured.

This table outlines the privileges and tasks that are associated with the DatabaseAdmin.

Managing Tenants

Roles 57

Table 12 Database Admin role privileges and tasks

Privileges Tasks

Activity Management l Manage Discovery Jobs

l Manage Task

l Workflow Execution

Asset Management l View Data Source Assets

l View Protection Storage Targets

Monitoring l Monitor Events

l View Historical Data

l View Tasks and Activities

Recovery and ReuseManagement

None

Remote AgentManagement

None

Service PlanManagement

l View Plan

l Manage Plan

l Assign Data Source to Plan

Storage Management l View Storage Array

l View Inventory Sources

l Manage Inventory Sources

Support Assistance andLog Management

l View Diagnostic Logs

System Management l View System Settings

System Security andAudit

None

Tenant Management l View Tenants

User and SecurityManagement

l View User Security

Executive roleWith the Executive role, the user can monitor the dashboard. Users who are assignedto this role cannot access other screens and functionality.

For example, you might assign the Executive role to an IT management-level user in anorganization that requires an overview of compliance status and operations.

PrivilegesThis table outlines the privileges and tasks that are associated with the Executive role.

Managing Tenants


Table 13 Executive role privileges and tasks

Privileges Tasks

Activity Management l Workflow Execution





l View Host


l View Plans




Export and Recovery Admin roleWith the Export and Recovery Admin role, the user can export data and recover data.You can audit the activities of the Export and Recovery Admin role. This role isintentionally separated from the System Tenant Admin role and should be assigned toan individual with specific security clearance for managing eCDM data and performingcopy access and recovery operations.

For example, you might assign the Export and Recovery Admin role to a user in theorganization who requires access to data because they export and recover data forother users in the organization. The actions that are associated with the Export andRecovery Admin role are maintained in a chain of record within eCDM.

PrivilegesThis table outlines the privileges and tasks that are associated with the Export andRecovery Admin role.

Table 14 Export and Recovery Admin role privileges and tasks

Privileges Tasks







l View Host

l Manage Host

l Rollback to Production

Managing Tenants

Export and Recovery Admin role 59

Table 14 Export and Recovery Admin role privileges and tasks (continued)

Privileges Tasks

l Recovery to Alternate Location

l Export for Reuse








Operations Monitor roleThe Operations Monitor role provides read-only access to monitor activities andoperations within the scope and boundaries of a tenant.

Assign the Operations Monitor role to a user that monitors the following activities andoperations, but does not need to configure a tenant or the system.

l Dashboard

l Activity Center

l Notification Center

The Operations Monitor role cannot access other eCDM screens and functionality.

PrivilegesThis table outlines the privileges and tasks that are associated with the OperationsMonitor role.

Table 15 Operations Monitor role privileges and tasks

Privileges Tasks




l Manage Events




l View Host


l View Plans

Managing Tenants


Table 15 Operations Monitor role privileges and tasks (continued)

Privileges Tasks







Remote Support roleThe Remote Support role provides support personnel with read-only access so theuser can monitor system activities to diagnose and troubleshoot system issues andgather log files. Support personnel cannot configure changes or perform usermanagement tasks.

PrivilegesThis table outlines the privileges and tasks that are associated with the RemoteSupport role.

Table 16 Remote Support role privileges and tasks

Privileges Tasks








l View Host

Security and SystemAudit

l Monitor Security and System Audit

l View Deleted Tenant


l View Plans





l Manage Diagnostic Logs

Managing Tenants

Remote Support role 61

Table 16 Remote Support role privileges and tasks (continued)

Privileges Tasks


l Manage System Settings




Security Admin roleThe Security Admin role enables the user to manage user accounts, access audit logs,and manage the authentication source.

For example, you might assign the Security Admin role to a user that is dedicated tomaintaining security, but does not require full system access.

PrivilegesThis table outlines the privileges and tasks that are associated with the Security Adminrole.

Table 17 Security Admin role privileges and tasks

Privileges Tasks






l View Host



l Manage Security and System Audit








l Manage Tenants


l Manage User Security

Managing Tenants


Table 17 Security Admin role privileges and tasks (continued)

Privileges Tasks


Storage Admin roleThe Storage Admin role enables a user to monitor and manage assets, which includesassigning tenants or protection plans to assets or removing tenants or protectionplans from assets.

Assign the Storage Admin role to a user that manages storage devices, manages andmonitors assets, and assigns or removes tenants or protection plans from assets.

PrivilegesThis table outlines the privileges and tasks that are associated with the Storage Adminrole.

Table 18 Storage Admin role privileges and tasks

Privileges Tasks


l Manage Tasks



l Manage Data Source Assets


l Manage Protection Storage Targets

l Assign Data Source to Tenant





l View Host

l Manage Host

l Rollback to Production

l Recovery to an Alternate Location

l Export for Reuse


l View Plans

l Manage Plans


l Manage Storage Array

Managing Tenants

Storage Admin role 63

Table 18 Storage Admin role privileges and tasks (continued)

Privileges Tasks







System Tenant Admin roleA System Tenant Admin is an eCDM system-wide role that is typically assigned to anindividual or small group that is made up of trusted personnel with system-wideaccess.

The default System Tenant Admin role is assigned to the person who installs theeCDM software. This role ensures that the product is available for other users,configuring single sign-on, and performing basic tenant setup tasks. Tenant setuptasks include designating at least one identity source, creating tenants, and assigningusers and roles. You might assign the System Tenant Admin role to the user thatrequires full access control to the system tenant or a subtenant.

The System Tenant Admin role performs the following tasks or defines dedicated rolesto perform them:

l Creates tenants and manages them

l Creates users and assigns roles

l Manages system-wide configuration such as system defaults for branding andnotification providers

l Monitors system logs

l Performs troubleshooting

In a eCDM single-tenant deployment, the System Tenant Admin role can also assumeother roles.

System Tenant Admin Privileges

This table outlines the privileges and tasks that are associated with the System TenantAdmin role.

Table 19 System Tenant Admin role privileges and tasks

Privileges Tasks


l Manage Tasks


Managing Tenants


Table 19 System Tenant Admin role privileges and tasks (continued)

Privileges Tasks


l Manage Data Source Assets


l Manage Protection Storage Targets

l Assign Data Source to Tenant


l Manage Events




l View Host

l Manage Host

l Roll back to Production

l Recovery to an Alternate Location

l Export for Reuse



l Manage Security and System Audit



l View Plans

l Manage Plans

l Assign Plan to Tenant

l Assign Data Source to Plan





l Manage Storage Array





Tenant Management l Manage Tenants

l View Tenants


l Manage User Security

Managing Tenants

System Tenant Admin role 65

Table 19 System Tenant Admin role privileges and tasks (continued)

Privileges Tasks


PrivilegeseCDM Privileges define the tasks that a user can perform within a tenant and areassigned to roles.

Activity Management PrivilegesThis table defines the Activity Management Privileges.

Table 20 Activity Management Privileges

Privilege Task

Manage DiscoveryJobs

l Create discovery jobs.

l View discovery jobs.

l Edit discovery jobs.

l Delete discovery jobs.

Manage Task l Create task resources.

l View task resources.

l Edit task resources.

Workflow Execution l Start workflow execution.

l Cancel workflow execution.

l View the status of workflow execution.

Asset Management PrivilegesThis table defines the Asset Management Privileges.

Table 21 Asset Management Privileges

Privilege Task

Manage Data SourceAssets

l Create, read, edit, and delete a data source.

l Create, view, edit, and delete the policy in the protectiongroup resource.

l Create, view, edit, and delete asset group resources.

l Create, view, edit, patch, and delete tag category resources.

Managing Tenants


Table 21 Asset Management Privileges (continued)

Privilege Task

Manage ProtectionStorage Targets

l Create, view, edit, and delete a data target.

l Create, view, edit, and delete asset group resources ofprotection storage targets.

View Data Source Assets l View a data source.

l View asset group resources.

l View the policy of the protection group resource.

l View tag category resources.

Assign Data Source toTenant

l Assign data source to tenant.

View Protection StorageTargets

l View a data target.

Monitoring PrivilegesThis table defines the Monitoring Privileges.

Table 22 Monitoring Privileges

Privilege Task

View Historical Data l View historical data that relates to protection plans, arrays,data targets, data sources, and capacity data.

View Tasks or Activities l View task resources.

Monitor Events l View events.

Manage Events l Create (publish), cancel, ignore, promote, and demoteevents.

Plan Management PrivilegesThis table defines the Plan Management Privileges.

Table 23 Plan Management Privileges

Privilege Task

Assign Data Source toPlan

l Assign a data source to a protection plan resource.

Assign Plan to Tenant l Assign a protection plan to a tenant.

Manage Plans l Create, view, edit, and delete the policy for a protection planresource.

Managing Tenants

Monitoring Privileges 67

Table 23 Plan Management Privileges (continued)

Privilege Task

l Create, view, edit, and delete a plan definition resource.

l Create, view, edit, and delete schedule resources.

l Create, view, edit, and delete an objective definition resource.

l Create, read, edit, and delete an action definition.

View Plans l View the policy for a protection plan resource.

l View schedule.

l View a protection plan definition.

l View objective definition.

l View services.

l View service resources.

l View assets that are assigned to a protection plan.

l View action definitions.

l View asset group resources.

Recovery and Reuse Management PrivilegesThis table defines the Recovery and Reuse Management Privileges.

Table 24 Recovery and Reuse Management Privileges

Privilege Task

View Host l View a host.

Manage Host l Create, view, edit, and delete a host.

Export for Reuse l Create, view, edit, and start export and reuse operations.

l View resources that are related to media manager assets.

l Create, view, edit, and delete resources that are related to mediamanager assets.

Roll back toProduction

l Create, view, edit, and start rollback to production operations.



Recovery to AlternateLocation

l Create, view, edit, and start recovery to alternate locationoperations.


Managing Tenants


Table 24 Recovery and Reuse Management Privileges (continued)

Privilege Task


Storage Management PrivilegesThis table defines the Storage Management Privileges.

Table 25 Storage Management Privileges

Privilege Task

View InventorySources

l View a management interface.

l Read storage manager resources such as exported, deleted, andrestored copies.

View Storage Array l View a storage array.

Manage StorageArray

l Create, view, edit, and delete a storage array.

Manage InventorySources

l Create storage manager resources and run creation-relatedstorage array operations.

l Create exported and restored copies and run restore-relatedstorage array operations.

l Create expunged copies and run deletion-related storage arrayoperations.

l Create, view, edit, and delete a management interface.

Tenant Management PrivilegesThis table defines the Tenant Management Privileges.

Table 26 Tenant Management Privileges

Privilege Task

Manage Tenants Create, edit, change state, and delete tenant resources.

View Tenants View tenant resources.

User Security Management PrivilegesThis table defines the User Security Management Privileges.

Managing Tenants

Storage Management Privileges 69

Table 27 User Security Management Privileges

Privilege Task

Manage User Security l Create, view, edit, and delete users.

l View roles.

l Create, view, edit, and delete identity sources.

l Create, view, edit, and delete user groups.

View User Security l View users and roles.

l View identity sources and user groups.

Configure the system tenantThe eCDM environment has a single system tenant, which is also known as the serviceprovider tenant or landlord. You can create multiple subtenants under the systemtenant..

The System Tenant Admin role performs basic tenant setup tasks. Setup tasks includedesignating users or LDAP and AD user groups, and assigning roles for each tenantwithin the eCDM environment.

You can create local users to perform management tasks for tenants. When youcreate a local user account, you must assign a role to the user.

Note

By default, all assets on the eCDM server belong to the default System Tenant Admin.Only the System Tenant Admin can assign asset groups to other tenants.

Procedure

1. To edit the default system tenant that was created during installation:

a. From the eCDM UI, go to Main menu > Tenant Management.

The Tenant Management window appears.

b. Click the TENANTS tab.

The system tenant that you named during installation appears in the list oftenants.

Note

Take note of the name of the system tenant. Within eCDM, the systemtenant appears in a list with other tenants and is only differentiated fromother tenants by its name.

c. Select the tenant that you specified as the system tenant during installation,

and then click .

The Tenant Information window appears.

Managing Tenants


d. To edit the name of the system tenant, select the PROFILE tab, and then, inthe Tenant field, type a new name for the system tenant. For example, typethe company name or division.

Note

The tenant name attribute is not case-sensitive. If you use the same namewith different capitalization when you edit the tenant name field, the updatefails.

e. To edit the description information for the system tenant, in the Descriptionfield, type a description of the system tenant.

f. Click Update.

2. To edit the system-defined user account for the system tenant:

a. Click the USERS tab.

The default user account for the system tenant appears in the USERSwindow.

b. To edit the account, click .

The User window appears.

c. Type the first and last name of the System Tenant Admin.

d. In the Username field, type the name of the System Tenant Admin.

For the username:

l Ensure that the name is 1 to 50 characters in length.

l Acceptable characters include the following:

n Lowercase characters (a-z)

n Uppercase characters (A-Z)

n Numeric characters (0-9)

n Period (.)

n Underscore (_)

Note

Do not use the following special characters in the username: @%,$#!^&*()?"}{[]<>

e. Type an email address that you can use to contact the System TenantAdmin. Use the following format for the email address:

[email protected]

f. In the Password fields, type a password for the System Tenant Admin.





Managing Tenants

Configure the system tenant 71



~!@#$%^&*()_+`-={}|[]\:'";,./<>?

g. To assign the System Tenant Admin role, in the Role section, select SystemTenant Admin.

h. Click Save.

3. To configure LDAP or AD authentication for the system tenant, see ConfigureLDAP or AD authentication.

Managing tenantsA tenant is an organizational unit or container in an eCDM environment, whichcontains assets. This section includes information about creating, editing, removing,and viewing a tenant.

Create a tenantEither the System Tenant Admin or the Security Admin role can create tenants.

Note

You cannot label a tenant with the same name as another tenant, even if the othertenant was deleted.

Procedure

1. From the eCDM UI, go to Main menu > Tenant Management.


2. Create a tenant:

a. In the Tenant Management window, click the TENANTS tab.

If tenants were previously created, they appear in the list.

b. To create a tenant, click + New.

c. In the Add a New Tenant field, type the name of the tenant.

Note

The Tenant Name attribute is not case-sensitive. Do not use the same namewith different capitalization when you edit the Add a New Tenant field.

For example, type the company name or division.

Ensure that the tenant name meets the following requirements:






Managing Tenants


n Period (.)

n Underscore (_)

d. Type a description of the tenant.

The description can contain:

l A maximum of 1,000 characters.

l Any string of characters including the following: a-z, A-Z.

e. To apply changes, click Save.

The new tenant appears in the list with the date that it was created.

f. To sort the tenants alphabetically, click Name.

Edit a tenantEither the System Tenant Admin or the Security Admin role can edit tenant attributes.

Procedure

1. Go to Main menu > Tenant Management.


2. Select the tenant whose attributes that you want to edit.

To sort the tenants alphabetically, click Name.

3. Click .

The Edit Tenant Profile window appears.

4. To edit the name and description of the tenant:

a. Click PROFILE.

b. Edit the name and description of the tenant.

c. Click Update.

Note

The Tenant field is case-insensitive.

5. To edit a user account that is assigned to a tenant:

Note

To edit a user, you must provide the password for that user's account.

a. Click PROFILE.

b. Edit the profile information.

c. Click Update.

Editing a user provides detailed information.

6. To edit an LDAP or AD authority that was configured for the tenant:

Managing Tenants

Edit a tenant 73

a. Click LDAP.

b. Edit the LDAP or AD authority information.

c. Click Save.

Editing LDAP or AD authority configuration provides detailed information.

Delete a tenantEither the System Tenant Admin or the Security Admin role can soft-delete tenants. Asoft-deleted tenant is disabled in the UI. From any other role, deleting a tenant hidesthe tenant. After a tenant is deleted, it cannot be recovered.

Note

You cannot label a tenant with the same name as another tenant, even if the othertenant was deleted.

Procedure



2. To sort the tenants alphabetically, click Name.

3. Select the tenant that you want to delete.

4. Click .

The Remove Tenant message appears.

5. To remove the tenant, click OK.

Results

Deleted appears beside the deleted tenant in the list. This tenant is deleted from anyassigned assets and protection plans. Deleting the tenant stops all compliancemonitoring operations. Do not run any actions on this tenant.

View tenantsAny role can view tenant attributes.

Procedure



2. To sort tenants alphabetically, click Name.

3. To filter tenants by state, click .

4. Select the tenant whose attributes you want to view, and then click .


5. To view the name and description of the tenant, click PROFILE.

6. To view the assets that are assigned to a tenant, select Main menu > Asset >Asset Groups.

Managing Tenants


Managing user accountsEither the System Tenant Admin role or the Security Admin role can create users orLDAP and AD groups.

UsersYou can create local users to perform management tasks for tenants. When youcreate a local user account, you must assign a role to the user.

LDAP or AD groupsWhen you configure LDAP or AD authentication in the Authentication Service, use theUser Group resources to assign roles to the LDAP groups. The User Group resourcedefines the role assignments for an LDAP or AD user group.

Managing usersEither the System Tenant Admin or the Security Admin role can manage users.

However, the following roles can view users, roles, identity sources, and user groups:

l Database Admin


l Security Admin

l Remote Support


Users can see only their own role within their own account.

Note

User authorization grants or denies users access to eCDM resources. Userauthorization is identical, regardless of whether the user was authenticated locally orby a Microsoft Windows Active Directory LDAP server.

You can create local users to perform management tasks for tenants. When youcreate a local user account, you must assign a role to the user.

Add a user to the system tenantEither the System Tenant Admin role or the Security Admin role can add users to thesystem tenant.

Procedure




3. Select the system tenant, and then click .

4. Click the USERS tab.

The USERS window appears.

5. To create a user, click + New.

The New User window appears.

Managing Tenants

Managing user accounts 75

6. In the First Name and Last Name fields, type the first and last name of theuser.

7. Type the username.

Ensure that the username meets the following requirements:






n Period (.)

n Underscore (_)

Note

Do not use the following special characters in the username: @%,$#!^&*()?"}{[]<>

8. Type an email address that you can use to contact the user.

Use the following format for the email address:

[email protected]

9. Type a password for the user.







~!@#$%^&*()_+`-={}|[]\:'";,./<>?

10. In the Role section, assign one role for the user.

11. Click Save.

The Tenant Management Users window appears and the newly created userappears in the list with the name and the date that the user was created.

To sort the user names alphabetically, click Name.

Results

After you create a user, you can edit or delete that user.

Managing Tenants


Edit a user that is assigned to the system tenantEither the System Tenant Admin or the Security Admin role can edit users that areassigned to the system tenant.

Note

To edit a user, you must provide the password for that user's account.

Procedure








5. Select the user whose attributes that you want to edit.

6. Click .

The Edit User window appears.

7. In the appropriate fields, edit the user information:

l Change the first or last name of the user.

l Change the username.

Note

The username attribute is not case-sensitive. Do not specify an existingusername with different capitalization because the update will fail.

l Change the email address of the user.

l Change the password of the user.Type a password that meets the following requirements:

n Minimum of nine characters and a maximum of one hundred characters

n At least one numeric character (0-9)

n At least one uppercase character (A-Z)

n At least one lowercase character (a-z)

n At least one special character from the following list of acceptablecharacters:

~!@#$%^&*()_+`-={}|[]\:'";,./<>?

8. In the Role section, select a new role.

Note

Performing this task requires the System Tenant Admin or the Security Adminrole. Users cannot change their own roles.

Managing Tenants

Managing users 77

9. Click Save.

10. At the prompt, type the password of the user that you are currently logged into.

This step checks that you have permission to edit a user account.

Delete a user from the system tenantEither the System Tenant Admin or the Security Admin role can delete users.

Procedure







5. Select the user that you want to delete.

6. Click .

The Remove User message appears.

7. Click OK.

Results

The deleted user is removed from the list of users in the USERS window.

View details about a user that is assigned to the system tenantEither the System Tenant Admin or the Security Admin role can view details aboutusers.

The following roles can view the attributes of a user that is assigned to a tenant:

l Database Admin

l System Tenant Admin role

l Security Admin role

l Remote Support role

l Export and Recovery Admin role

Procedure






Managing Tenants


Results

The USERS window appears and lists the users. For each user, you can review theusername, first and last names, assigned roles, email address, and the date on whichthe user was created.

LDAP or AD authenticationWhen you authenticate users through an external authentication authority, users canlog in with their authority username and password. The authority username andpassword are managed by Lightweight Directory Access Protocol (LDAP),Lightweight Directory Access Protocol over SSL (LDAPS), or a Microsoft ActiveDirectory server (AD).

When the user's credentials are validated, the Authentication Service issues a tokenfor the user. The eCDM GUI uses the token information to authorize the user'sactivities.

Note

You can configure only one authority per tenant.

Configuring LDAP or AD authorities and assigning rolesEither the System Tenant Admin or the Security Admin role can configure the systemtenant to use an external LDAP, LDAPS, or AD authentication authority.

Configure LDAP or AD authentication

Either the System Tenant Admin or the Security Admin role can configure the systemtenant to use an external LDAP, LDAPS, or AD authentication authority.

Procedure



3. Click the LDAP tab.

The LDAP window appears.

4. Click + New LDAP Server.

The LDAP Server window appears.

5. In the Required tab, configure the following attributes:

Attribute Description

LDAPServer

Type the protocol and hostname or IP address of the LDAP or ADserver, in the following format:

protocol://hostname_or_ip_address

where:

l protocol is LDAP for LDAP or AD authorities and LDAPS forLDAPS.For example, to configure an AD server that is named idd-ad.iddlab.com, type ldap://idd-ad.iddlab.com

Managing Tenants

LDAP or AD authentication 79


l hostname_or_ip_address is the FQDN or IP address of theexternal authentication authority. When the authority usesIPv6 addressing, enclose the IP address in square brackets [ ].For example, ldap://[2620:0:170:5a9::1:2]

Note

When you specify the LDAPS protocol, eCDM automaticallydownloads the certificates that are required to connect to theauthentication authority.

Domain Type the base distinguished name (DN) of the LDAP or ADauthority.For example, dc=pp_lab, dc=ldap.example.com

Port Type the port number that the external authentication authorityuses.

l For LDAP, the default port number is 389.

l For LDAPS, the default port number is 636.

UserSearch

a. Type the DN of the search path that the authenticationservice uses when it searches for users in the LDAP or ADhierarchy.

b. Ensure that you specify a search path that is relative to thebase DN that you specified in the Domain option.

For example:

l For an AD configuration, specify the value in the objectClassproperty for an AD user.

l For an LDAP configuration, specify the value in the accountobject class.

GroupSearch

a. Type the DN of the search path that the authenticationservice should use when searching for groups in the LDAP orAD hierarchy.

b. Ensure that you specify a search path that is relative to thebase DN that you specified in the Domain attribute.

For example:

l For an AD configuration, specify the value in the objectClassproperty for an AD group.

l For an LDAP configuration, specify the value in theposixGroup object class.

GroupAttributeName

Type the attribute that the authentication service should use tovalidate the group name in the LDAP or AD hierarchy.For example:

l For an AD configuration, specify sAMAccountName.

l For an LDAP configuration, specify cn.

Managing Tenants



UserAttributeID

Type the attribute that the authentication service should use tovalidate the username in the LDAP or AD hierarchy.For example:

l For an AD configuration, specify sAMAccountName.

l For an LDAP configuration, specify cn.

Query User Type a user account that has full read access to the LDAP or ADdirectory, in the following format:user@domainFor example, [email protected]

QueryPassword

Type the password of the user account that you specified in theQuery User attribute.

6. Optional, in the Advanced tab, configure the following attributes:

l User Search Path—Type the DN of the search path that the authenticationservice uses when searching for users in the LDAP or AD hierarchy. Ensurethat you specify a search path that is relative to the base DN that youspecified in the Domain option. For example:

n For an AD configuration, specify the value in the objectClass property foran AD user.

n For an LDAP configuration, specify the value in the account object class.

l User Group Search Path—Type the DN of the search path that theauthentication service should use when searching for groups in the LDAP orAD hierarchy. Ensure that you specify a search path that is relative to thebase DN that you specified in the Domain attribute. For example:

n For an AD configuration, specify the value in the objectClass property foran AD group.

n For an LDAP configuration, specify the value in the posixGroup objectclass.

7. Click Save.

8. Assign LDAP or AD groups to a role. For more information, see Assign an LDAPgroup to a role.

This step is required before you can log in to the appliance with an LDAP or ADaccount.

Assign a role to an LDAP or AD group

With the System Tenant Admin or the Security Admin role, you can assign a role,which contains eCDM access privileges and defined tasks, to the LDAP, LDAPS, or ADgroups. Each member of the group receives the same privileges. eCDM privileges areavailable only through role assignment; they cannot be given directly to a user or anLDAP or AD group.

Before you begin

Configure eCDM to use an LDAP or AD authentication authority.

Procedure


Managing Tenants



3. Click the LDAP tab, and then click .

The MAP: LDAP Group Role window appears.

4. In the LDAP Group field:

a. Type the group name.

b. Click Search.

The LDAP Group field supports the use of the * wildcard option.

The Group list displays a list of LDAP or AD groups that contain the searchstring that you specified.

5. In the Group list:

a. Select the LDAP or AD group.

b. From the Roles list, select the role.

A role is assigned to the group.

6. Perform one of the following tasks:

l To save the LDAP group to role assignment, click Save.

l To save the LDAP group to role assignment and assign another LDAP groupto a role, click Save and Add Another.

l To close the window without saving the changes, click Close.

Example: Configuring an AD authority for the system tenantIn this example, an AD server that is named idd-ad.iddlab.com has an AD group calledProtection_admins. Protection_admins contains three users: Meghan, Patrick, andLiam. These users require access to the eCDM appliance with the privileges that areassigned to the Executive role.

View the properties of the AD configurationTo view the properties of the AD configuration, use a third-party tool such as the ADExplorer program.

The following figure provides an example of the key user attributes on the AD server,which are required to configure idd-ad.iddlab.com.

Figure 10 AD and user properties in AD Explorer

Managing Tenants


Based on this AD configuration, specify the following values for eCDM LDAPconfiguration options:

l Domain: dc=iddlab, dc=coml Hostname: idd-ad-iddlab.coml User Search: One of the following values: top, inetOrgPerson, or userl User Attribute ID: cn

Configure the idd-ad.iddlab.com authorityThe following figure provides an example of the group attributes that are required toconfigure the idd-ad.iddlab.com authority.

Figure 11 AD group properties in AD Explorer

Based on the properties of Protection_admins, specify the following values for theLDAP configuration options:

l Group Search: top or groupl Group Attribute Name: sAMAccountName

Add an LDAP server to the System TenantThe following figure provides an example of the LDAP configuration window, with thevalues that are associated with the AD server that is named idd-ad.iddlab.com.

Managing Tenants


Figure 12 LDAP configuration window for an AD authority

Assign an AD group to the Executive roleIn this example, the * wildcard is used to search for the group.

The following provides an example of the LDAP Groups to Role window.

Figure 13 LDAP Groups to Role window

Example: Configuring an LDAP authority for the system tenantIn this example, an LDAP server that is named alberta.lss.emc.com has a group that isnamed AlbertaAllGroups. AlbertaAllGroups contains three LDAP users: alberta_user1,alberta_user2, and alberta_user3. These users require access to the eCDM appliancewith the privileges that are assigned to the Executive role.

View the LDAP configuration propertiesTo view the properties of the LDAP configuration, use a third party tool such as theLDAP Admin program.

Managing Tenants


The following figure provides an example of the key user attributes to use whenconfiguring an LDAP authority.

Figure 14 LDAP Admin server and group attributes

Based on this configuration, specify the following values for the LDAP configurationoptions:

l Domain: dc=alberta,dc=emc,dc=coml Hostname: alberta.lss.emc.coml Group Search: One of the following values: top or groupOfUniqueNamesl Group Attribute Name: cn

Specify values in the user search attributeThe following figure provides an example of the value to specify in the user searchattribute.

Figure 15 LDAP Admin user search attribute

Based on this configuration, specify the following values for the LDAP configurationoptions:

l User Search: One of the following objectClass values: top, person,organizationalPerson, or inetOrgPerson

l User Attribute ID: cn

Add an LDAP server to the System TenantThe following figure provides an example of the LDAP configuration window and thevalues that are associated with the LDAP server alberta.lss.emc.com.

Managing Tenants


Figure 16 LDAP configuration window for an LDAP authority

Assign an AD group to the Executive roleThe following figure provides an example of the LDAP Groups to Role window. In thisexample, the * wildcard was used to search for the group name.

Figure 17 LDAP Groups to Role window

Edit an LDAP or AD authority configurationEither the System Tenant Admin or the Security Admin role can edit an LDAP or ADauthority that is assigned to a tenant.

Procedure



3. On the LDAP tab:

Managing Tenants


a. Select the LDAP or AD authority that you want to modify.

b. Click .

4. Edit the LDAP attributes as required.

5. Click Save.

Delete an LDAP or AD authority configurationEither the System Tenant Admin or the Security Admin role can delete an existingLDAP or AD authority configuration. After the configuration is deleted, only local useraccounts can be used for authentication.

Procedure



3. On the LDAP tab:

a. Select the LDAP or AD authority that you want to delete.

b. Click .

Note

When an LDAP or AD server is deleted, all the groups that were mapped aredeleted.

Modify or delete LDAP group-to-role mappingEither the System Tenant Admin or the Security Admin role can modify or deleteLDAP group-to-role mapping.

To modify the role that is assigned to an LDAP group, delete the LDAP group from theGroup to Role Maps table, and then add an LDAP group to the role mapping for thegroup.

Procedure



3. On the LDAP tab:

a. Select the LDAP or AD authority that you want to delete.

b. Click X.

4. On the Remove Group Map window, click OK.

5. Re-create the LDAP group-to-role mapping.

Troubleshooting LDAP configuration issuesThis section provides information about error messages that might appear when youconfigure an external authority for authentication.

For more information about LDAP configuration errors, refer tohttp://wiki.servicenow.com/index.php?title=LDAP_Error_Codes#gsc.tab=0.

Managing Tenants


http://wiki.servicenow.com/index.php?title=LDAP_Error_Codes#gsc.tab=0

User credentials are incorrect

The following message appears when the user credentials that you specified are notcorrect:

org.springframework.ldaps.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, commentL AcceptSecurityContext error, data 52e, v1db1]

To resolve this issue, ensure that the values in the Query User and Query Passwordfields are correct.

Base DN is not correct

The following message appears when Base DN is not correct:

org.springframework.ldap.InvalidNameException: Invalid name: domain_name

To resolve this issue, ensure that the value in the Domain field is correct.

Format of the Name field is not correct

The following message appears when the format of the Name field is not correct:

org.springframework.ldap.UncategorizedLdapException: Uncategorized Exception occurred during LDAP processing; nested exception is javax.naming.NamingException: Cannot parse url: url

To resolve this issue, ensure that you specify the Name field in the following format:

l For an LDAP or AD authority: ldap://hostname_ip_addressl For an LDAPS authority: ldaps://hostname_ip_address

Review tenant complianceYou can use the Tenant Compliance widget to view the rate of compliance to theservice level objectives that were defined for each tenant.

To review tenant compliance, click Main menu > Dashboard > Tenant Compliance.

The compliance rate is calculated based on the last 8 days including the current date,and is color coded according to the legend that appears along the bottom of thewidget, as displayed in the following figure.

Managing Tenants


Figure 18 Compliance by tenant

The following table describes the fields that the Compliance by Tenant widgetdisplays.

Table 28 Compliance by tenant fields

Field Description

Tenant Tenant name

Compliance Rate For this tenant and the associated plan, the calculated value (in percent)for meeting plan objectives over the last 8 days

ObjectiveCompliance

The total number of objectives achieved compared to the total number ofobjectives defined for the plan over the last 8 days

Validated The day the compliance was last determined

Managing Tenants

Review tenant compliance 89

Managing Tenants


CHAPTER 5

Managing Assets


l Asset Groups inventory......................................................................................92l System default asset groups..............................................................................92l Tenant default asset groups...............................................................................92l View asset details...............................................................................................93l Custom asset groups......................................................................................... 94l Associate a storage location to a custom asset group...................................... 100l Asset and asset group tags...............................................................................100l Asset rules........................................................................................................ 104

Managing Assets 91

Asset Groups inventoryThe Asset Groups window provides an enterprise inventory view of the data sources.Only the asset groups that are present in the environment and can be automaticallydiscovered, appear in the list of Asset Groups.

Go to Main menu > Assets. The Asset Groups pane appears where you can view andmanage system default, tenant default, and custom asset groups. You can also searchfor asset groups by name.

System default asset groupsUpon discovery, assets are assigned into one of the following homogenous systemdefault groups:

l SQL Databases

l Oracle Databases

l VMAX Storage Groups

l VMware Virtual Machines

l XtremIO Consistency Groups

System default asset groups display with the icon. Custom asset groups do notdisplay the icon.

For example, VMAX Storage Groups contain only VMAX Storage Group assets.

To assign protection to an asset, move the assets from a system default group to atenant default group, or to a custom group.

When you add a tenant, eCDM creates tenant-specific default groups. Tenant defaultasset groups provides more information.

Note

You cannot assign protection or tenants to a system default group.

Tenant default asset groupsWhen you add a tenant, eCDM creates the following tenant-specific default groups:

l SQL Databases

l Oracle Databases




Default tenant asset groups display with the icon. Custom asset groups do notdisplay the icon.

You can move assets from the system default groups into the tenant asset groups.You can also assign protection against assets with each tenant asset group.

When moving assets to a tenant asset group, note that an asset group can onlycontain assets from the same system default group type.

Managing Assets


View asset detailsYou can view summaries of copies in the system.

Details, such as the name of the storage system containing the copy set, systemusage, location, date the copy was created, date the copy expires, size, and recoverytime, are available to you.

Procedure

1. Go to Main menu > Assets.

All the asset groups in the system appear.You can search for asset groups by name.

2. Select a custom asset group or a default asset group:

System default and default tenant asset groups display with the icon.Custom asset groups do not display the icon.

l To review the entire list of SQL database assets, in the left pane, click SQLDatabases.

l To review the entire list of Oracle database assets, in the left pane, clickOracle Databases.

l To view the list of the VMAX Storage Group assets, in the left pane, clickVMAX Storage Groups.

l To view the list of VMware virtual machines, in the left pane, click VMwareVirtual Machines .

l To view the list of the XtremIO Consistency Group assets, in the left pane,click XtremIO Conistency Groups.

The entire list of assets that are associated with a group appears in the rightpane.

3. To view additional details:

a. Select an asset.

b. At the end of the row, click .

c. Click .

The latest related copies information appears. The copy map consists of theroot node and its child nodes.

l The root node represents an asset, which is the protected storage group orconsistency group. When you click the root node, a dialog box displays thegroup that it belongs to.

l The child nodes represent storage systems. When you click a child node, thedialog box displays the storage systems where the copy is stored, the timethe copy was created, and the size of the copy.

4.To check compliance, click

The Compliance Check window appears.

5. To view a brief summary of each copy, click a node.

Managing Assets

View asset details 93

A dialog box displays a brief summary of the copy.

Custom asset groupsYou can create and use custom asset groups to logically group, manage, protect,recover, and assign assets. When creating a custom asset group, note that a groupcan only contain assets from a default group of the same type.

Upon discovery, assets are assigned into one of the following default groups:

l SQL Databases

l Oracle Databases




Managing custom asset groupsYou can create and use custom asset groups to categorize, manage, protect, recover,and assign assets.

When creating a custom asset group, note that a group can only contain assets from adefault group of the same type.

You can move assets into a custom group independent of the tags that were assignedto the asset.

Upon discovery, assets are assigned to one of the following default groups:

l SQL Databases

l Oracle Databases




Create a custom asset group

You can create custom asset groups by moving assets from one of the followingdefault groups to a custom group:

l SQL Databases

l Oracle Databases




Procedure

1. To create a custom group, perform the following steps:

a. Go to Main menu > Assets.

The Asset Groups window appears.

b. Click + New.

The New Asset Group window appears.

Managing Assets


c. In the Group Name field, type a name for the custom group.

d. In the Tenant field, select a tenant.

e. In the Group Type field, select a default group.

For Data Domain Boost protection of Microsoft SQL or Oracle, if the storageunit has already been registered in the Data Domain Boost agent or will bemanually registered, clear the Send storage location information back tothe asset host checkbox.

f. Click Next.

2. To configure storage, select Storage.

l For XtremIO and VMAX asset groups:

a. In the Storage window, select a vDisk pool. If a group is not selected,eCDM automatically selects a vDisk pool that is based on the location andfree capacity of the pool in the protection plan.

b. Click Next.

l For Data Domain Boost protection of Microsoft SQL or Oracle:

a. In the Asset Group Details window, select Send storage locationinformation back to the asset host, and then click Next. The Storagewindow appears.

b. In the Storage window, select a ddboost storage unit. This step allowseCDM to register the storage unit in the Data Domain Boost agent on theSQL or Oracle host.

c. Click Next

3. To set a different DataDomain preferred data interface for each custom SQL orOracle Databases Group:

a. Click Preferred Data Interface (Optional).

b. In the Preferred Data Interface field, type the IP address or FQDN of thepreferred data interface.

c. Click Next.

4. To review the summary details of the new asset group, click Summary(Optional).

5. Click Save.

The new custom asset group appears in the list of asset groups.

6. To populate a custom group with assets, perform the following steps:

Note

A group can contain assets only from a default group of the same type. Forexample, you cannot populate a SQL or Oracle Databases Group with assetsfrom an XtremIO Consistency Group.

a. Go to Main menu > Assets.


b. Select a default asset group:

l To view the entire list of SQL assets, click SQL Databases.

Managing Assets

Managing custom asset groups 95

l To view the entire list of Oracle assets, click Oracle Databases.

l To view the list of the VMAX Storage Group assets, click VMAX StorageGroups.

l To view the list of VMware virtual machines, click VMware VirtualMachines .

l To view the list of the XtremIO Consistency Group assets, click XtremIOConistency Groups.

c. From the list of assets, select one or more assets.

d. Click Move To.

The list of available custom asset groups appears.

e. Select the custom asset group to which you would like to move the assets.

The selected assets move from the current custom asset group to the newlychosen custom asset group.

Associate a storage location to a custom asset group

Note

You cannot associate an MTree to a VMware Virtual Machines custom group.

Procedure



2. If not already created, create a custom group.

Create a custom asset group provides detailed information.

The list of storage locations appear in the lower pane.

3. From the list, select an MTree.

Edit custom asset groups

Note

If assets have already been assigned to a custom asset group, you cannot change thegroup type or tenant assignment. Custom asset groups cannot contain assets fromdifferent group types.

Procedure


The Asset Group pane appears on the left.

2. Select the custom asset group that you want to edit.

The Asset Group Details pane appears.

3. Click .

4. In the Group Name field, type a new name for the group.

5. In the Group Type field:

Managing Assets


Consider the following information:

l Asset groups are filtered based on the selected default group type. Forexample, if you select the VMAX Storage Group, only VMAX Storage Groupprotection items are included.

l To create and verify copies on a specific Data Domain vDisk pool, ensurethat the vDisk pool is selected. If a group is not selected, eCDMautomatically selects a vDisk pool that is based on the location and freecapacity of the pool in the protection plan.

l For Data Domain Boost protection of Microsoft SQL or Oracle, select Sendstorage location information back to the asset host. This step allowseCDM to register the storage unit in the Data Domain Boost agent on theSQL or Oracle host. If the storage unit has already been registered in theData Domain Boost agent or will be manually registered, clear the Sendstorage location information back to the asset host checkbox.

6. In the Storage pane, make any desired changes. Then click Next or Finish.

7. In the Initial Protection Start Time pane, select Initial Protection Start Timeand select a time from the menu. Then click Next or Finish.

8. In the Summary pane, review your selections.

9. Click Save.

Delete a custom asset group

Note

If assets and protection have already been assigned to a custom asset group, youcannot delete the custom asset group.

Procedure


The Asset Groups pane appears.

2. Select the custom asset group that you would like to delete.

3. At the end of the row, click .

4. Click .

Move assets to and from custom asset groupsYou can move assets from default groups to custom asset groups, from custom assetgroups to default groups, or between custom asset groups.

Additionally, you can move assets by using asset rules. It is particularly useful to useAsset Rules to move a large number of assets. Asset rules on page 104 providesinformation.

Procedure



2. Select a custom asset group or a default asset group:

l To view the entire list of SQL database assets, click SQL Databases.

Managing Assets

Managing custom asset groups 97

l To view the entire list of Oracle database assets, click Oracle Databases.




The entire list of assets that are associated with the group appears.

3. From the list of assets, select one or more assets.

4. Click Move To.

The list of available custom asset groups appears.

5. Select the custom asset group to which you would like to move the assets.

The selected assets move from the current custom asset group to the newlychosen custom asset group.

View custom asset groups

You can view details about custom asset groups, including the name of the customasset group, the number of custom asset groups assigned to an asset, the latestrelated protection copy, and compliance snapshot information.

Procedure


The Assets Groups window appears.

2. To view details about the custom asset group:

a. Select an asset group.

b. At the end of the row, click .

c. Click .


a. Select an asset.

b. Click .

c. Click .


l The root node represents an asset, which is the protected, database, VM,storage group or consistency group. When you click the root node, a dialogbox displays the group that it belongs to.

l The child nodes represent storage systems. When you click a child node, thedialog box displays the storage systems where the copy is stored, the timethe copy was created, and the size of the copy.



Managing Assets


Assign protection to a custom asset groupYou can protect a custom asset group by assigning the group to a protection plan.

Before you begin

The System Tenant Admin role or the Storage Admin role can perform this task.

Note

You can assign only one custom asset group to a protection plan.

If you rename a VMAX storage group asset after you discover it in eCDM, assets withboth names are present throughout, including in compliance results and dashboardaggregation, in eCDM. However, the newly named VMAX asset does not inherit theprotection of the first asset. To protect the newly named VMAX storage group, youmust assign protection to it specifically. For example, if the first VMAX asset wasprotected, reset protection for the newly named storage group asset.

Procedure

1. From the eCDM UI, go to Main menu > Assets.

The list of asset groups appears.

2. Select the custom asset group that you want to assign a protection plan to.

3. To assign protection, click .

The list of protection plans appears.

4. From the list, select a protection plan that you want to assign to the customasset group.

5. Click Save.

vRPA cluster load balancingIn eCDM 2.0, each cluster supports up to 64 virtual machines and, in the case ofmultiple clusters, use of another cluster is not initiated until the current cluster is full.As a result, utilization of available system resources is not optimized.

eCDM 2.1 introduces cluster load balancing, which supports the same number ofvirtual machines per cluster but allocates the virtual machines across all clusters basedon availability. Each added virtual machine gets automatically assigned to the clusterthat contains the least number of virtual machines, with the first registered clusterselected in cases where multiple clusters contain the least number of virtual machines.

Additionally, load balancing will avoid clusters once they are fully utilized, and preventutilization of clusters with errors or configuration issues that might result in failure.Once allocated virtual machines are protected by eCDM, no rebalancing will occur.The load balancing feature also supports adding new clusters in eCDM.

The cluster load balancing feature is the default behavior in eCDM 2.1, and no furtherconfiguration is required.

Managing Assets

Assign protection to a custom asset group 99

Associate a storage location to a custom asset group

Note

You cannot associate an MTree to a VMware Virtual Machines custom group.

Procedure



2. If not already created, create a custom group.

Create a custom asset group provides detailed information.

The list of storage locations appear in the lower pane.

3. From the list, select an MTree.

Asset and asset group tagsYou can create tags and search for tags that are assigned to an asset or asset group.

Tags describe specific details about assets or asset groups. Think of tags as indexwords, they are the metadata that you can use to define assets. You can createcustom tags and choose to include the tags under a new category.

Consider business requirements and future functional expansion when determiningtags and tag categories. The following questions might help you determine thebenefits of tagging assets:

l Is there a business requirement to support local sites such as service centers ordepartments?

l Should specific assets be available to only a specific part of the organization?

Categorized tagsTo help you locate specific details about assets or asset groups, you can organize tagsinto tag categories. The categories hold broad groups of related tagged assets orasset groups.

XtremIO Consistency Group tagsXtremIO Consistency Group tags are imported into eCDM and cannot be modified ordeleted.

When you use XtremIO Consistency Group tags, consider the following facts:

l You can only modify or delete XtremIO Consistency Group tags from the XtremIOManagement Server. If you assign an asset with the XtremIO Consistency Grouptag, and then delete it from the XtremIO Management Server, eCDM loses the tagin rediscovery of the asset.

l If you rename an XtremIO Consistency Group tag in the XtremIO ManagementServer, and then rediscover the XtremIO Consistency Group asset in eCDM, onlythe new tag appears with the asset. However, both the current and previous tagsremain in the list of possible tags.

Managing Assets


l You can assign XtremIO Consistency Group tags to other non-XtremIOConsistency Group assets, for example, Data Domain MTrees. eCDM maintainsthese tags. When you rename a tag on the XtremIO Management Server, manuallyassign the tag to a non-XtremIO Consistency Group asset.

Using tagsUse the following procedures to build, assign, remove, rename, or view tags.

You can create tags and search for tags that are assigned to an asset or asset group.

Tags describe specific details about assets or asset groups. Think of tags as indexwords, they are the metadata that you can use to define assets. You can createcustom tags and choose to include the tags under a new category.

Building tagsTo use a tag, create it under a tag category, and assign the tag to an asset or assetgroup.

Create a tag category

You can group tags under a tag category. Categories are meant for broad groupings oftagged protectable assets. Think of categories as general topics for tags. Categoriesare there to help identify, classify, and sort protectable assets.

When using tag categories, consider the following:

l A tag category cannot be renamed.

l If a tag is in use, you cannot remove a tag from a category.

l Tags in one category cannot be moved to another category.

l If a category is being used, you cannot delete the category. To delete a category,

click .

Procedure

1. Click .

The Manage Tags page appears.

2. Click + Category.

3. In the Category name field, type the name of the category that you want tocreate.

Only the following characters are supported in the Category name field:

l Lowercase characters (a-z)

l Uppercase characters (A-Z)

l Numeric characters (0-9)

l All currency symbols, including dollar signs ($), pound signs (£), and eurosigns (€)

l Spaces, periods (.), underscores (_), hyphens (-), and number signs (#)

4. Click .

The new category appears in the Manage Tags page. You can add tags to thecategory.

Managing Assets

Using tags 101

Create a tag

When using tags, consider the following facts:

l If in-use, tags cannot be removed from a category tag

l Tags in one category cannot be moved to another category

Procedure

1. Click .


2. Choose the category in which you want to create the tag.

3. Click + Tag.

The tag name field appears.

4. In the tag name field, type the name of the tag that you want to create.

Only the following characters are supported in the tag name field:

l Lowercase characters (a-z)

l Uppercase characters (A-Z)

l Numeric characters (0-9)

l All currency symbols, including dollar signs ($), pound signs (£), and eurosigns (€)

l Spaces, periods (.), underscores (_), hyphens (-), and number signs (#)

5. Click .

The new tag appears under the designated tag category.

Add a tag to an asset

Procedure


The list of Asset Groups appears.

2. Select the custom asset group that contains the asset that you want to tag.

This list of assets appears.

3. Select an asset, and then click Add Tag.

A list of tags appears.

4. In the find... field:

a. Type the name of the tag that you want to add to the protectable asset.

b. Select the tag from the list. If the tag does not exist, create the tag.

Note

If the tagged Vdisk pool has a different tenant than the protected asset,eCDM chooses another pool that uses the same tenant. If there is more thanone pool that has the same tenant as the protected asset, it might not beclear which pool is used.

Managing Assets


The tag appears in the asset details list.

5. Review the details for the asset:

The icon indicates the name of the tag that was assigned to the asset.

Remove a tag from an asset

Procedure



2. Select a custom asset group that contains the asset that you would like toremove.

This list of assets appears.

3. From the list, select an asset.

4. Select the tag that you want to remove:

a. Click X.

b. At the prompt, click Yes.

View tagsProcedure


The list of Asset Groups appears.

2. Review the details for the asset:

The icon indicates the name of the tag that was assigned to the asset.

Rename a tagProcedure

1. Click the tag icon.


2. To edit a specific tag:

a. Click the tag that you want to rename.

b. Click .

c. In the tag name field, type a new name for the tag.

3. Click .

Delete a tagYou can only delete tags that are not assigned to protectable assets.

To remove a tag that has been assigned to a protectable asset, first remove that tagfrom all protectable assets, and then use this procedure to delete the tag.

Procedure

1. Click .

Managing Assets

Using tags 103


2. Select the tag that you want to delete.

3. Click , and then click .

Asset rulesAsset rules provide you with the ability to automatically organize assets into assetgroups when the assets are discovered.

Automation rules define how eCDM organizes the assets into an asset group.

When you define an automation rules for an asset group, consider the followingrequirements:

l An asset group must exist prior to creating the rule.

l An asset can only belong to one asset group.

l To ensure the protection of homogeneous asset groups, the rule must specify astorage asset type.

Create a rule to organize assets by asset groupTo create a rule to organize an asset into asset groups, create a group assignment. Tocreate a group assignment, build a conditional IF statement. When the result of thestatement is true, the assets is automatically assigned to the asset group that youdefine for the IF statement.

The syntax of the IF statement is If [(asset type)(asset_attribute)] conditionvalue,then assign the asset to asset_group.

The syntax of the EQUALS statement for XtremIO is XtremIO Consistency Group/<tag name> .

For example:

Rule If XtremIO Consistency Groups Tag Names Equals XtremIOConsistency Group/tag, Move to Group XIO AssetsProcedure

1. Go to Main Menu > Rules, and then click + New.

The Add Group Assignment window appears.

2. In the Rule name field, type a descriptive name for the rule.

3. In the Description field, type descriptive text for the rule.

4. To build the syntax of the IF statement, perform the following steps:

a. From the Asset types list, select one of the following options:



l VMware virtual machines

l SQL Databases

l Oracle Databases

b. In the Attribute list, select the attribute that the IF statement compares tothe value that you define.

Managing Assets


The following table summarizes the attributes that are available for eachasset type.

Table 29 Asset attributes

Asset type Available attributes

VMAX Storage Groups l Storage Group Name

l Storage System Name

XtremIO Consistency Groups l Consistency Group Name

l Storage System Name

l Tag Names

VMware virtual machines VM Folder Name

l VM Display Name

l VM Folder Name

l VM Resource Pool

l Datacenter Name

l Datastore Name

l OS Type

SQL Databases l SQL Server Instance Name

l Hostname

l DB Name

l Host Type

Oracle Databases l Oracle Server Instance Name

l Hostname

l DB Name

l Host Type

c. In the Operator list, select one of the following operators:

l Just Contains—Select this option to make the IF statement true whenthe attribute value for the selected asset type contains the string thatyou define in the Value field.

l Equals—Select this option to make the IF statement true when theattribute value for the selected asset type exactly matches the stringthat you define in the Value field.

d. In the Value field, type the string on which to match asset type/assetattribute operand.

e. In the bottom window pane, select the asset group in which to assign thenew asset.

Managing Assets

Create a rule to organize assets by asset group 105

Note

You can only assign rules to custom asset groups, and only custom assetgroups appear in this pane.

By default, the pane sorts each asset group alphabetically by name indescending order.To change the default sort option perform one of the following actions:

l To toggle between ascending and descending order, click the toggle button.

l To sort the asset groups by the date the group was created, click thesort option button, and then select Date Created.

l Search—To filter the assets groups that appear based on a search string,type the string in the Search field.

5. Click Save.

The following figure shows the Add Group Assignment window, which creates thefollowing IF statement:

If [(SQL Databases)(Hostname)] contains sql, then assign theasset to SQL-AG-Daily groupFigure 19 Add Group Assignment window

Edit asset rulesEdit asset rules from the Group Assignments window.

Procedure

1. Go to Main Menu and then select Rules.

The Group Assignments window appears with a list of asset rules.

Managing Assets


2. Filter the list of group assignments that appear in the Group Assignmentswindow, perform one of the following actions:

l To filter the list of group assignments that appear in the GroupAssignments window by asset type, click the Filter button, and then selectthe asset type.

Note

To remove a filter, click the Filter button, and then select None.

l To filter the assets groups that appear in the Group Assignments windowbased on a search string, type the string in the Find field.

Note

To remove the find filter, in the Find field, click the X button.

3. Click the Ellipses button beside the rule, and then click the edit button.

The Edit Group Assignment window appears.

Delete asset rulesDelete asset rules from the Group Assignments window.

Procedure





Note



Note


3. Click the Ellipses button beside the rule, and then click the delete button.

4. On the Confirm Delete window, click OK.

Set asset rule priorityWhen multiple asset rules exist, you can define the priority of the asset rules. Prioritydetermines which rule applies for an asset if an asset matches multiple rules, and thematching rules have conflicting actions. For example, if an asset group assignmentmatches several rules and each rule specifies a different asset group assignment, theasset group is determined by the rule with the highest priority.

Before you begin

Managing Assets

Delete asset rules 107

To set the priority of an asset rule, perform the following actions.

Procedure





Note



Note


3. From the list of group assignment rules, select the group assignment rule thatrequires a change in priority.

4. In the upper right corner of the window, perform one of the following actions:

l To increase the priority of the rule, click the up arrow.

l To decrease the priority of the rule, click the down arrow.

Managing Assets


CHAPTER 6

Creating and Assigning Protection Plans


l Protection plans................................................................................................ 110l Managing and monitoring SLO compliance........................................................110l Create a protection plan (SQL and Oracle Storage Groups)..............................110l Create a protection plan (VMAX Storage Groups)............................................ 114l Create a protection plan (VMware virtual machine)......................................... 126l Create a protection plan (XtremIO Consistency Groups)..................................133l Review protection plans................................................................................... 145l Configure protection plan settings....................................................................146l Assign a tenant to a protection plan .................................................................146l Prerequisites for assigning protection to assets................................................147l Managing protection plans................................................................................149

Creating and Assigning Protection Plans 109

Protection plansProtection plans define sets of objectives that apply to specific periods of time. Theseobjectives drive configuration, active protection, and copy-data-managementoperations that satisfy the business requirements for the specified data. Each plantype has its own set of user objectives.

Users with the System Admin role can create protection plans. Protection plansshould reflect service levels that can be offered to tenants.

You can create the following types of protection plans:

l SQL Databases

l Oracle Databases




After you create a protection plan, you can activate it and establish its level ofservices. You can assign tenants that you want to make the protection plan availableto. These steps can be performed when a protection plan is created or at a later date.

A protection plan can have one of the following states:

l Inactive—The initial state of a plan. The plan has does not contains anysubscriptions and is editable. You can only delete a plan that is inactive.

l Active—The plan does not contain any subscriptions and is read-only.

l Suspended—The plan has subscriptions that are enabled, but the subscriptionsare suspended. The plan is read-only. Only published plans can be suspended.

l Published—The plan has subscriptions and the plan is read-only.

Managing and monitoring SLO complianceYou can use protection plans to manage and monitor SLO compliance, and to organizedata protection into tiers of service.

l To monitor compliance by protection plan, use the eCDM Compliance by PlanDashboard.

l To manage SLO compliance and ensure that all protection copy data is incompliance with SLOs, create protection plans.For example, you can create a separate protection plan for each department, suchas Finance, Accounting, and Human Resources, that defines the SLO for eachdepartment's data requirements.

Create a protection plan (SQL and Oracle Storage Groups)The System Tenant Admin role can create a protection plan.



Set or reuse key chain credentials for SQL and OracleTo set protection plans for SQL and Oracle assets, you must create a set ofcredentials to access the SQL Server lockbox and RMAN catalog credentials.

You can set new credentials in the New Key chain tab or use a previously stored setof credentials, which can be found on the Stored Keychain tab.

Procedure

1. Click main menu > Inventory Sources > SQL Instance Group or ORACLEInstance Group.

You are in the Name and Credentials tab.

2. Specify a credential name and, if you'd like, a credential description.

3. Click the option for Enter database credentials for eCDM initiated backup .

Select this to enter the host database credentials for eCDM-initiated backups.eCDM must know the following:

l MSSQL: Windows host Admin credentials

l Oracle:

n OS Authentication: Oracle user credentials

n Database Authorization: Linux machine specified user credentials

n Wallet: TNS Alias credentials

4. Choose one of the following:

l To set new credentials, click Credentials.

a. Select the appropriate credentials type for your host and configuration,and then enter the credentials.

b. Click Save and Next.

l (Optional) To set RMAN Catalogue credentials, click RMAN Catalogue.

a. Select the appropriate credentials type for your host and configuration,and then enter the credentials.


l To use existing credentials, click Keychains.

a. Select the desired key chain.


Name a protection planBefore you begin

The System Tenant Admin role can perform this task.

Procedure

1. From the eCDM UI, go to Main menu > Protection Plans.

The Protection Plans window appears.

2. To create a protection plan, click + New.

The Plan Details window appears.


Set or reuse key chain credentials for SQL and Oracle 111

3. In the Plan Details window:

a. In the Name field, type the name of the protection plan.

b. In the Choose the asset type this plan will support field, select SQLStorage Groups or Oracle Storage Groups.

c. In the Description field, type a description of the protection plan.

d. Click Next.

The Plan Purpose window appears.

4. In the Plan Purpose window, specify either the Active Plan title anddescription and the Passive title and description.

The plan purpose should be eCDM-initiated Backups & ComplianceMonitoring and Compliance Monitoring Only for DBA-initiatedBackups.

If you select Active plan, the Plan Schedule window appears.

5. In the Plan Schedule window, select the protection schedules:

l By default, eCDM enables Full Protection for Active plans, and you cannotdisable it. Select and adjust the frequency of Full Protection as desired.

l By default eCDM leaves the other protection options enabled. You can leavethem enabled or disable them and adjust the frequency as desired.

l Click Next.

The Retention Objectives window appears.

After you finish

Follow the steps outlined in Validate compliance for application-consistent backups onData Domain

Validate compliance for application-consistent backups on Data DomaineCDM discovers application-consistent backups on Data Domain, and then measurescompliance based on the results. Application-consistent snapshots or copies capturethe contents of storage, pending I/O operations, and all transactions in process. Whenyou restore an application-consistent copy, there is usually no additional work requiredto restore the application data from the copy.

Before you begin


Perform the following steps from the Validate Compliance for Application Backupson Data Domain window.

Procedure

1. Retention compliance represents a backward rolling duration of time whereasset copies that are protected by this plan are retained. Retention complianceallows the objectives in the plan to be used to validate the copies of data duringthe retention compliance window. For example, a retention compliance windowof 7 days allows eCDM to validate compliance for the plan for the last 7 days.

In the Retention Window field:

a. Select a duration.



The duration is determined relative to the current time, which is always thebeginning of the selected duration.

b. Select a timeframe.

The objective rules are applied to the data continuously until you disable theprotection plan. The duration and timeframe structure a period that looksbackward from the current time.

2. The recovery point objective allows eCDM to monitor and measure compliancebased on the duration of time that can elapse between copies. A copy is abackup, regardless of the type of backup that was used to create the copy.

Note

The Recovery Point objective is resource-intensive. The smaller the RecoveryPoint objective setting, the more resources are consumed in the storageenvironment.

In the Recovery Point field:

a. Set the Recovery Point objective to no less than 6 hours for any non-SQLassets.

Six hours is the minimum amount of time that should elapse between copiesfor non SQL assets. 15 minutes is the minimum amount of time that shouldelapse between copies for SQL assets.


If the gap between the number of copies exceeds the set recovery pointobjective, the plan and its assets are out of compliance and the protectioncompliance verification check fails. You can review the compliance results onthe Dashboard and on the Activity Monitor.

3. You can use the location objective to monitor and control where the copies ofassets that are assigned to this plan are stored. Location tags that are added toa Data Domain system are verified for compliance against the list of locationsthat are approved for the plan.

You can add location tags to a Data Domain system to represent its physicalgeographic location. For example, go to Discovery > Inventory Sources >New > Data Domain Management Center.

In the Location field, add a location:

a. Select ON.

b. Click Add Location.

The Locations window appears.

c. Select one or more locations.

d. Click Save.

If copies are found on unapproved Data Domain systems, the plan and its assetsare out of compliance and the protection compliance verification check fails.You can review the compliance results on the Dashboard and on the ActivityMonitor.

4. The maximum copies objective defines the maximum number of copies that isexpected to exist in the defined location. A copy is a backup, regardless of the


Validate compliance for application-consistent backups on Data Domain 113

type of backup that was used to create the copy. Copies include snapshots andreplicas on either protection or primary storage and count towards themaximum number of copies count.

In the Maximum Copies field, set the maximum copies objective:

a. Select ON.

b. Type the maximum number of copies.

If the maximum number of total copies is exceeded, eCDM displays the failuresin Activity Monitor. This objective does not actively delete or create copies.

5. The minimum copies objective defines the minimum number of copies that isexpected to exist in the defined location. A copy is a backup, regardless of thetype of backup that was used to create the copy. Copies include snapshots andreplicas on either protection or primary storage and count towards themaximum number of copies count.

In the Minimum Copies field, set the minimum copies objective:

a. Select ON.

b. Type the minimum number of copies.

c. Ensure that the Recovery Point objective does not create too many copies.

If the minimum number of total copies is not met, eCDM displays the failures inActivity Monitor. This objective does not actively create or delete copies.

6. The retention lock objective causes a retention lock date to be generated andplaced on all copies of assets that are assigned to this plan. This objectiveprevents the deletion of these copies until the retention compliance windowdate has been reached.

To set the retention lock objective, in the Retention Lock field, select ON.

7. The deletion compliance objective allows eCDM to expire copies of assets thatare assigned to this plan and mark them for Data Domain garbage collection. Acompliance failure occurs when expired copies are not marked for deletion.

The Deletion Compliance objective is set by default.

Create a protection plan (VMAX Storage Groups)The System Tenant Admin role can create a protection plan.



Procedure





3. In the Name field, type the name of the protection plan.



4. In the Choose the asset type this plan will support field, select VMAXStorage Groups.

5. In the Description field, type a description of the protection plan.

6. Click Next.


After you finish

Follow the procedure outlined in Define objectives for the protection plan.

Define objectives for the protection planA Service Level Objective defines the objectives that must be achieved within acertain timeframe and frequency. These objectives drive configuration, activeprotection, and data management operations that satisfy the business requirementsfor the specified data.

Before you begin

The System Tenant Admin role can define objectives for protection plans.

In the Plan Purpose window, selection one or more of the following plan objectives forVMAX storage groups.

Procedure

1. To schedule and create crash-consistent snapshots on a regular interval, selectCreate Snapshot Copies on Primary Storage.

The Create Snapshot Copies on Primary Storage objective maintains copieson primary storage, which includes VMAX and XtremIO.

To reduce the overall total cost of ownership and retain long-term copies, youcan set this objective to:

l Ensure that primary storage snapshots are used for data copies.

l Ensure that data copies are moved to Data Domain.

Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations. If a crash-consistent copy is restored in its entirety, the data is inthe same state as it would be if the system crashed at the exact moment thatthe copy was made. If an application can recover from a failure, for example in apower outage or other failure event, the application can recover a crash-consistent copy of its data.

2. To discover all snapshots on primary storage and measure SLO compliance thatis based on what it finds, select Verify Compliance for Snapshot Copies onPrimary Storage.

3. To schedule and create crash-consistent ProtectPoint backups on a regularinterval, select Create and Send Snapshot Copies to Data Domain.

The Create and Send Snapshot Copies to Data Domain objective usesProtectPoint to move data copies to Data Domain.


l Specify where copies are made and where they should reside.

l Maintain copies on low-cost protection storage, including Data Domain.


Define objectives for the protection plan 115

Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations:

l If a crash-consistent copy is restored in its entirety, then the data is in thesame state that it would have been if the system had crashed at the exactmoment that the copy was made.

l If an application can recover from a failure, for example in the occurrence ofa power outage or other failure event, then the application can recover acrash-consistent copy of its data.

4. To discover all snapshot copies on Data Domain, and measure SLO compliancethat is based on what it finds, select Validate Compliance for SnapshotCopies on Data Domain.

5. To discover application-consistent backups on Data Domain, and measure SLOcompliance that is based on what it finds, select Validate Compliance forApplication Backups on Data Domain.

Application-consistent snapshots or copies capture the contents of storage,pending I/O operations, and all transactions in process. When restoring anapplication-consistent copy, no additional work is usually required to restore theapplication data from the copy.

Create snapshots copies on primary storageWith the create snapshots on primary storage objective, eCDM schedules and createscrash-consistent snapshots on a regular interval. Crash-consistent snapshots orcopies capture all data simultaneously.

Before you begin


A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations:

l If a crash-consistent copy is restored in its entirety, then the data is in the samestate that it would have been if the system had crashed at the exact moment thatthe copy was made.

l If an application can recover from a failure, for example in the occurrence of apower outage or other failure event, then the application can recover a crash-consistent copy of its data.

Procedure










Note










a. Select ON.




d. Click Save.


4. The maximum copies objective defines the maximum number of copies that isexpected to exist in the defined location. A copy is a backup, regardless of thetype of backup that was used to create the copy. Copies include snapshots andreplicas on either protection or primary storage and count towards themaximum number of copies count.




a. Select ON.





a. Select ON.








Validate compliance for snapshot copies on primary storageWith the validate compliance for snapshot copies on primary storage objective, eCDMdiscovers all snapshots on primary storage, and measures SLO compliance that isbased on what it finds.

Before you begin


Procedure










Note









a. Select ON.





a. Select ON.






Create and send snapshot copies to Data DomainWith the create and send snapshot copies to Data Domain objective, eCDM schedulesand creates crash-consistent backups to Data Domain on a regular interval. Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistentcopy does not capture the contents of memory or any pending I/O operations. If acrash-consistent copy is restored in its entirety, then the data is in the same state thatit would have been if the system had crashed at the exact moment that the copy wasmade. If an application can recover from a failure, for example in the occurrence of apower outage or other failure event, then the application can recover a crash-consistent copy of its data.

Before you begin


Procedure








Note




6 hours is the minimum amount of time that should elapse between copies.15 minutes is the minimum a


c. To enable eCDM to automatically provision and manage storage, select Iwant eCDM to automatically provision and manage all storage need toachieve this objective.



d. If you are going to manually provision the storage, select I will provision andmanage my own storage.

If the gap between the copies exceeds the set recovery point objective, theplan and its assets are out of compliance and the protection complianceverification check fails. You can review the compliance results on the Dashboardand on the Activity Monitor.




a. Select ON.




d. Click Save.




a. Select ON.





a. Select ON.










Validate compliance for snapshot copies on Data DomainWith the validate compliance for snapshot copies on Data Domain objective, eCDMdiscovers all snapshot copies on Data Domain, and measure SLO compliance that isbased on what it finds.

Before you begin


Ensure that you carry out Create XtremIO Consistency Groups before using eCDM todiscover or validate copies on XtremIO.

Procedure








Note














a. Select ON.




d. Click Save.




a. Select ON.







a. Select ON.







Before you begin



Procedure








Note














a. Select ON.




d. Click Save.




a. Select ON.



5. The minimum copies objective defines the minimum number of copies that isexpected to exist in the defined location. A copy is a backup, regardless of thetype of backup that was used to create the copy. Copies include snapshots and



replicas on either protection or primary storage and count towards themaximum number of copies count.


a. Select ON.






Create a protection plan (VMware virtual machine)The System Tenant Admin role can create a VMware virtual machine protection plan.



Procedure

1. Go to Main menu > Protection Plans.



The New Protection Plan wizard opens on thePlan Name and Type page.

3. On thePlan Name and Type page, complete the Plan Details information:

a. In the Name field, type the name of the protection plan.

b. In the Choose the asset type this plan will support field, select VMwareVirtual Machines.

c. In the Description field, type a description of the protection plan.

4. Click Next.

The Plan Purpose page appears.

After you finish


Define objectives for the protection planA Service Level Objective defines the objectives that must be achieved within acertain timeframe and frequency. These objectives drive configuration, active



protection, and data management operations that satisfy the business requirementsfor the specified data.

Before you begin


On the Plan Purpose page, select one or more of the following plan objectives forVMware Virtual Machine storage groups.

Procedure

1. To create virtual machine backups on Data Domain, select Create VirtualMachine Backups on Data Domain.

eCDM creates crash-consistent snapshot copies on virtual machines directlyfrom the hypervisor to Data Domain. eCDM then validates and enforces theplan objectives for compliance.

2. To validate compliance for backups on Data Domain, select ValidateCompliance for Backups on Data Domain.

eCDM discovers all virtual machine snapshot copies on Data Domain. eCDMthen validates and enforces the plan objectives for compliance.

3. To validate compliance for application backups on Data Domain, select ValidateCompliance for Application Backups on Data Domain.

eCDM discovers application-consistent snapshot copies on Data Domain withina virtual machine. eCDM then validates and enforces the plan objectives forcompliance.

Create virtual machine backups on Data DomaineCDM creates crash-consistent snapshot copies on virtual machines directly from thehypervisor to Data Domain. eCDM then validates and enforces the plan objectives forcompliance.

Before you begin


Procedure










Note










a. Select ON.




d. Click Save.




a. Select ON.







a. Select ON.








After you finish

Upon successful completion of the protection workflow, virtual machine copies willonly be visible in the eCDM UI Asset Group Details window after one of the followinghas occurred.

l Compliance verification is run. For example, if the configured protection workflowis scheduled for every 6 hours under this protection plan, so that a new virtualmachine copy is created for the asset every 6 hours, you must set the plancompliance verification to run immediately after the virtual machine copy iscreated (in this example, every 7 hours).

l A scheduled or manually initiated DDMC discovery. Note, however, that this is notthe recommended method of discovering virtual machine copies, since all virtualmachine copies will be retention-locked only after running compliance.

Validate compliance for backups on Data DomaineCDM discovers all virtual machine snapshot copies on Data Domain. eCDM thenvalidates and enforces the plan objectives for compliance.

Procedure










Note










a. Select ON.




d. Click Save.


4. The maximum copies objective defines the maximum number of copies that isexpected to exist in the defined location. A copy is a backup, regardless of thetype of backup that was used to create the copy. Copies include snapshots and



replicas on either protection or primary storage and count towards themaximum number of copies count.


a. Select ON.





a. Select ON.






Validate compliance for application backups on Data DomaineCDM discovers application-consistent snapshot copies on Data Domain within avirtual machine. eCDM then validates and enforces the plan objectives for compliance.

Before you begin



Procedure










Note










a. Select ON.




d. Click Save.






a. Select ON.





a. Select ON.






Create a protection plan (XtremIO Consistency Groups)The System Tenant Admin role can perform this task.



Procedure





3. In the Name field, type the name of the protection plan.

4. In the Choose the asset type this plan will support field, select XtremIOConsistency Groups.

5. In the Description field, type a description of the protection plan.

6. Click Next.



Create a protection plan (XtremIO Consistency Groups) 133

After you finish


Define objectives for the protection planA Service Level Objective defines the objectives that must be achieved within acertain timeframe and frequency. These objectives drive configuration, activeprotection, and data management operations that satisfy the business requirementsfor the specified data.

Before you begin

The System Tenant Admin role can define objectives for protection plans.

In the Plan Purpose window, selection one or more of the following plan objectives forVMAX storage groups.

Procedure

1. To schedule and create crash-consistent snapshots on a regular interval, selectCreate Snapshot Copies on Primary Storage.

The Create Snapshot Copies on Primary Storage objective maintains copieson primary storage, which includes VMAX and XtremIO.


l Ensure that primary storage snapshots are used for data copies.

l Ensure that data copies are moved to Data Domain.

Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations. If a crash-consistent copy is restored in its entirety, the data is inthe same state as it would be if the system crashed at the exact moment thatthe copy was made. If an application can recover from a failure, for example in apower outage or other failure event, the application can recover a crash-consistent copy of its data.

2. To discover all snapshots on primary storage and measure SLO compliance thatis based on what it finds, select Verify Compliance for Snapshot Copies onPrimary Storage.

3. To schedule and create crash-consistent ProtectPoint backups on a regularinterval, select Create and Send Snapshot Copies to Data Domain.

The Create and Send Snapshot Copies to Data Domain objective usesProtectPoint to move data copies to Data Domain.


l Specify where copies are made and where they should reside.

l Maintain copies on low-cost protection storage, including Data Domain.

Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations:

l If a crash-consistent copy is restored in its entirety, then the data is in thesame state that it would have been if the system had crashed at the exactmoment that the copy was made.



l If an application can recover from a failure, for example in the occurrence ofa power outage or other failure event, then the application can recover acrash-consistent copy of its data.

4. To discover all snapshot copies on Data Domain, and measure SLO compliancethat is based on what it finds, select Validate Compliance for SnapshotCopies on Data Domain.

5. To discover application-consistent backups on Data Domain, and measure SLOcompliance that is based on what it finds, select Validate Compliance forApplication Backups on Data Domain.

Application-consistent snapshots or copies capture the contents of storage,pending I/O operations, and all transactions in process. When restoring anapplication-consistent copy, no additional work is usually required to restore theapplication data from the copy.

Create snapshots copies on primary storageWith the create snapshots on primary storage objective, eCDM schedules and createscrash-consistent snapshots on a regular interval. Crash-consistent snapshots orcopies capture all data simultaneously.

Before you begin


A crash-consistent copy does not capture the contents of memory or any pending I/Ooperations:

l If a crash-consistent copy is restored in its entirety, then the data is in the samestate that it would have been if the system had crashed at the exact moment thatthe copy was made.

l If an application can recover from a failure, for example in the occurrence of apower outage or other failure event, then the application can recover a crash-consistent copy of its data.

Procedure










Note










a. Select ON.




d. Click Save.




a. Select ON.







a. Select ON.








Validate compliance for snapshot copies on primary storageWith the validate compliance for snapshot copies on primary storage objective, eCDMdiscovers all snapshots on primary storage, and measures SLO compliance that isbased on what it finds.

Before you begin


Procedure










Note









a. Select ON.





a. Select ON.




Create and send snapshot copies to Data DomainWith the create and send snapshot copies to Data Domain objective, eCDM schedulesand creates crash-consistent backups to Data Domain on a regular interval. Crash-consistent snapshots or copies capture all data simultaneously. A crash-consistentcopy does not capture the contents of memory or any pending I/O operations. If acrash-consistent copy is restored in its entirety, then the data is in the same state thatit would have been if the system had crashed at the exact moment that the copy was



made. If an application can recover from a failure, for example in the occurrence of apower outage or other failure event, then the application can recover a crash-consistent copy of its data.

Before you begin


Procedure








Note









3. You can use the location objective to monitor and control where the copies ofassets that are assigned to this plan are stored. Location tags that are added to



a Data Domain system are verified for compliance against the list of locationsthat are approved for the plan.



a. Select ON.




d. Click Save.




a. Select ON.





a. Select ON.










Create XtremIO Consistency Groups before using eCDM to discover or validate copies onXtremIO

Create XtremIO consistency groups before you discover or validate copies forProtectPoint products except ProtectPoint File System Agent and ProtectPointDatabase Application Agent. These two products work at the XtremIO volume level

Before you begin

XtremIO Consistency Groups are prerequisites for eCDM to manage them as assetsbefore you carry out the procedure Validate Compliance for Application Backups onData DomainProcedure

1. Identify the XtremIO volumes used by the ProtectPoint products.

2. Log in to the RecoverPoint web interface.

3. Go to Protection > Manage Protection .

4. Identify the RecoverPoint consistency groups used by the ProtectPointproducts.

Refer to the structure of RecoverPoint consistency groups used by theProtectPoint products to determine the number and content of XtremIOConsistency Groups.

5. Obtain the list of XtremIO volumes protected from the content of "ReplicationSets" for the RecoverPoint consistency group.

6. Log in to the XtremIO Storage Management interface.

7. Create one XtremIO Consistency Group for each RecoverPoint consistencygroup.

8. Add the corresponding XtremIO volumes to the XtremIO Consistency Group

Refer to the list of XtremIO volumes protected from the content of "ReplicationSets" obtained in Step 5.

Validate compliance for snapshot copies on Data DomainWith the validate compliance for snapshot copies on Data Domain objective, eCDMdiscovers all snapshot copies on Data Domain, and measure SLO compliance that isbased on what it finds.

Before you begin


Ensure that you carry out Create XtremIO Consistency Groups before using eCDM todiscover or validate copies on XtremIO.

Procedure










Note












a. Select ON.




d. Click Save.

If copies are found on unapproved Data Domain systems, the plan and its assetsare out of compliance and the protection compliance verification check fails.



You can review the compliance results on the Dashboard and on the ActivityMonitor.



a. Select ON.





a. Select ON.







Before you begin



Procedure










Note












a. Select ON.






d. Click Save.




a. Select ON.





a. Select ON.






Review protection plansYou can view details of protection plans that you previously created.

Before you begin


Procedure

1. Go to Main menu > Protection Plans. The Protection Plans window opens.

A list of protection plans along with their status and number of assigned tenantsappear.

2. To view the details of a specific protection plan, click .

The Protection Plans Details window appears.


Review protection plans 145

Configure protection plan settingsBefore you begin


Procedure

1. To keep a protection plan editable after it is created, from the Plan Settingswindow, select Keep this plan Inactive. I am still working on it. This optionsets the protection plan to inactive mode, which allows you to edit the planbefore tenants start using it. By default, new plans are inactive.

If you do not select Keep this plan Inactive. I am still working on it, theprotection plan is automatically activated and the data protection objectives areenforced immediately.

2. To activate this plan, select Make this plan Active.

3. To specify the maximum acceptable amount of time that can elapse betweenobjectives being verified for a copy, in the Validate all plan objectives everyfield, select an option.

4. Click Finish.


Assign a tenant to a protection planAfter you configure the protection plan, complete the following steps to assign atenant to a protection plan.

Before you begin


You can create and activate a plan without assigning a tenant to it, but without atenant, you cannot use the plan. After you assign a tenant to the plan, you can assignassets to the protection plan.

Procedure

1. To assign a tenant to a protection plan, in the left pane, select Tenants or clickNext.

The Tenants window appears.

2. Select one or more tenants.

To select all the tenants, click Select All.

3. To finish creating the protection plan, click Finish.

Results


A list of protection plans along with their status, stages, and number of assigned

tenants appear. The icon indicates the number of tenants that are included in thisprotection plan.



Prerequisites for assigning protection to assetsEnsure that you configure Data Domain, VMAX, XtremIO, and ProtectPoint withRecoverPoint.

Set Data Domain MTree credentialsYou can set the credential for each target Data Domain MTree (or vDisk pool) used forProtectPoint provision and protection.

Consider the following:

l Ensure that you have discovered all the Data Domain Management Centerinventory sources. Discover array primary storage and protection inventorysources on page 40 provides information.

l Ensure that you set the Data Domain MTree credentials before you assign thefollowing to a protection plan:

n VMAX storage groups to a plan with Storage Class Objective Protection.

n XtremIO consistency groups to a plan with Storage Class Objective Protection.

Procedure

1. From the eCDM UI, go to Discovery > Inventory Source [DDMC], select theDDMC Details.

2. Click the Data Domain tab, then Select MTree > Edit > Set MTreecredentials.

3. Locate the MTree that you want to designate as the target of ProtectPointprovision and protection, and then click the Set Credential icon.

4. Select one of the options for saving credentials:

l Click Stored Keychains, select one of the previously saved credentials, andthen click Save.

l Click New Keychain, populate the required fields, select Store in eCDMKeychain, and then click Save.

5. Ensure that you use the same credentials as the Data Domain system usernameand password as the current owner of the MTrees.

Configure Data Domain, VMAX, XtremIO, and RecoverPoint for use withProtectPoint

Refer to the eCDMDeployment Guide for detailed information on supported DataDomain, VMAX, XtremIO, RecoverPoint, and ProtectPoint versions.

Procedure

1. For Data Domain:

a. Install the supported version and licenses.

b. Enable Data Domain Boost and vDisk.

Refer to Data Domain documentation for information.

2. For XtremIO:

a. Install the supported version and license.


Prerequisites for assigning protection to assets 147

b. Register the XtremIO array on RecoverPoint.

c. Create initiator groups on XtremIO for RecoverPoint systems.

Refer to XtremIO documentation for information.

3. For RecoverPoint:

a. Install the supported version and license.

b. Register the Data Domain system and protection pools on RecoverPoint.

Refer to RecoverPoint documentation for information.

Configure XtremIO consistency groups to use ProtectPointWhen you provision ProtectPoint and XtremIO with eCDM, you must associate thesource consistency group information with the destination Data Domain MTreeinformation.

Before you begin

l Ensure that the XtremIO, Data Domain, and RecoverPoint systems areinterconnected by using Fibre Channel and Ethernet as required for ProtectPoint .

Note

eCDM supports RecoverPoint Array to Data Domain connectivity using FibreChannel. The Data Domain array must be registered on the RecoverPoint Arrayusing Fibre Channel. Refer to ProtectPoint documentation for information.

l Ensure that XtremIO Consistency Group volumes are assigned to an appropriateinitiator group to make them visible and available to RecoverPoint.Refer to ProtectPoint documentation for information.

l Ensure that the Data Domain MTrees that you plan to use for protection areregistered with the RecoverPoint systems.

l Ensure that the Data Domain MTrees that you plan to use for recovery are notregistered with the RecoverPoint systems.

Procedure

1. Create a protection plan that specifies a storage class objective with a value ofProtection.

Create a protection plan (XtremIO Consistency Groups) on page 133 providesinformation.

2. If the consistency group has not already been tagged in XtremIO, create a tagfor the source consistency group. Creating a protection plan (XtremIOConsistency Groups) provides more information.

Note

If the source consistency group is tagged in XtremIO, you do not have to tag itagain. XtremIO Consistency Group tags are imported into and propagatedthrough eCDM.

vCenter and vRPA prerequisitesReview the following prerequisites prior to deploying the eCDM vRPA OVA.



l The vCenter server must be running.

l The vCenter and ESXi servers must be version 5.5 or later.

l The vCenter server must have a minimum 16 GB of memory and 4 CPUs

l Configure two ESXi servers in a VMware ESXi cluster. Each ESXi server shouldhave the following:

n A minimum two 10 GB network adapters (one for WAN/LAN and one for data).

n A minimum of 128 GB Memory.

Ensure that all ESXi hosts in the cluster where the vRPAs reside share thedatastore. Note that hosting protected virtual machines on datastore clusters isnot supported for mirror/journal volumes.

l Ensure that the iSCSI adapter is configured on each ESXi host on which thevRPAs will be deployed. In addition, ensure that an iSCSI adapter is configured oneach ESXi host that contains the virtual machines to be protected. This is requiredfor communication between the splitter deployed on the ESX host and the vRPA.

l The virtual environment should have sufficient space on the datastore based onyour configuration.

l If for security reasons you cannot provide the [email protected] user,create an additional user with the same privileges to use during the deployment.

l The Data Domain system must be configured and running DDOS version 6.1.

l Verify that there is no eCDM vRPA already installed on this vCenter.

l Before you install and configure ESX splitters, ensure that the scratch disklocation points to persistent storage.

l

Managing protection plansThe following sections include information about managing protection plans.

For a protection plan, you can perform the following actions:

l Activate or deactivate

l Suspend or resume

l Delete

l Assign or unassign tenants

Assign protection to a custom asset groupYou can protect a custom asset group by assigning the group to a protection plan.

Before you begin

The System Tenant Admin role or the Storage Admin role can perform this task.

Note

You can assign only one custom asset group to a protection plan.

If you rename a VMAX storage group asset after you discover it in eCDM, assets withboth names are present throughout, including in compliance results and dashboardaggregation, in eCDM. However, the newly named VMAX asset does not inherit theprotection of the first asset. To protect the newly named VMAX storage group, you


Managing protection plans 149

must assign protection to it specifically. For example, if the first VMAX asset wasprotected, reset protection for the newly named storage group asset.

Procedure



2. Select the custom asset group that you want to assign a protection plan to.

3. To assign protection, click .

The list of protection plans appears.

4. From the list, select a protection plan that you want to assign to the customasset group.

5. Click Save.

Edit a protection planYou can edit a protection plan when it is in Inactive mode.

Before you begin

The System Tenant Admin role and the Storage Admin role can perform this task.

Procedure



2. Select the protection plan that you want to edit.

3. Ensure that the protection plan is in Inactive mode.

To change the status of the protection plan from Active to Inactive:

a. Click .

The TENANTS window appears.

b. Unassign all tenants from this protection plan.

c. Click Save.

d. Select the protection plan and click .

4. Click . The Plan Details window appears.

Activate a protection plan to make it available to assigned tenantsActivating a protection plan activates plan activity, validation, and protection actions.

Before you begin


Procedure

1. From the eCDM UI, go to Main menu > Protection Plans. The ProtectionPlans window appears.

2. Select the protection plan that you want to activate and make available to alltenants.

3. To activate the protection plan, click .



4. To assign a tenant to this protection plan, click .


a. Select the tenants that you want to assign to this protection plan.

b. Click Save.

The protection plan is now available to all assigned tenants.

Assign or unassign tenants to a protection planYou can assign specific tenants to or unassign them from protection plans. When youunassign a tenant, you revoke access to the protection plan. Revoked tenants cannotassign assets to the protection plan.

Before you begin

Assigning a protection plan allows the System Tenant Admin or Storage Admin togrant a tenant access to specific protection plans. You cannot apply protection plansand drive validation or protection without assigning the protection plan to an asset.

Note

You cannot edit a protection plan that has assigned tenants. To edit a plan withassigned tenants, you must first unassign the tenants and then deactivate the plan.The status of the protection plan changes from Active to Inactive.

Procedure



2. Select the protection plan that you want to assign or unassign a tenant to.

3. Ensure that the protection plan is in Active mode.

4. To assign or unassign a tenant to this protection plan:

a. Click .


b. Select the tenants that you want to assign or unassign to this protectionplan.

c. Click Save.

Results

A protection plan is only available to the tenants to which it has been assigned.The Protection Plans window appears.

A list of protection plans along with their status, stages, and number of assignedtenants appear.

Suspend or resume protection plansSuspending a protection plan suspends plan activity, validation, and protectionactions. You can suspend a protection plan after it is assigned to a tenant.


To suspend a protection plan, click .


Assign or unassign tenants to a protection plan 151

To resume a protection plan, click . Resuming a protection plan resumes planactivity, validation, and protection actions.

Delete a protection planOnly when a plan is inactive to all tenants can you delete the protection plan. Deletinga plan removes it from eCDM. A deleted plan can no longer be assigned to tenants.


Procedure

1. Unassign the plan from the asset group,

Remove a protection plan that is assigned to an asset group on page 152provides information.



3. Remove tenants from the protection plan

Assign or unassign tenants to a protection plan on page 151 providesinformation.

4. Refresh the web browser.

This is in relation to ECDM-30424. You must refresh the web browser beforeyou can complete the procedure in step 5.

5. Deactivate the protection plan.

Edit a protection plan on page 150 provides information.

6. Select the inactive protection plan that you want to delete.

7. Click .

Remove a protection plan that is assigned to an asset groupThe System Tenant Admin role and Storage Admin role can perform this task.

Procedure

1. Go to Main menu > Asset Groups.


2. Select the asset group for which you want to unassign a protection plan.

3. To remove protection, perform either of the following actions:

l Click , the Protection icon.

l Go to Actions > Unassign Protection.

A confirmation message appears.

4. Select Yes.

Protection plan statusThe status describes the protection plan's position in the workflow.


Protection plans support the following statuses:



l Active

l Inactive

l Suspended

Active statusThe Active status indicates that you can assign tenants and assets to a protectionplan.

The protection plan, when assigned to assets and published, drives validation andprotection activities.

Active protection plans are visible to the following users, and can be applied to assets:

l Remote Support

l Executive


l Storage Admin


The following actions are available when the protection plan is in the Active status:

l New

l Deactivate

l Assign and unassign tenants

l View details

Note

You cannot suspend a protection plan that has no assigned tenants.

Inactive statusThe Inactive status indicates that you can edit a protection plan without restriction.

When a protection plan is in an Inactive state, you cannot use the protection plan todrive validation or protection activities.

Note

You cannot view protection plans that are in a suspended or inactive state from theAssets windows.

Inactive protection plans are visible to the following users, and can be applied toassets:

l Remote Support

l Executive


l Storage Admin


The following actions are available when the protection plan is in Inactive status:

l New

l Edit


Protection plan status 153

l Delete

l Activate

l View details

Suspended statusThe Suspended status indicates that the System Tenant Admin can globally suspendprotection plans.

Tenants can suspend protection plans assigned to them. Validation activities aretemporarily paused.

Note

You cannot view protection plans that are in a suspended or inactive state from theAssets windows.

When protection plans are suspended, the protection plans are visible to the followingusers:

l Remote Support

l Executive


l Storage Admin


The following actions are available when the protection plan is in Suspended status:

l New

l Resume

l View details

Note

You cannot suspend a protection plan that has no assigned tenants.



CHAPTER 7

Recovering and Reusing Data


l View protected copy set summaries................................................................. 156l Delete copy sets............................................................................................... 157l Exporting copy sets.......................................................................................... 157l Unexport an exported copy set.........................................................................164l Restore a copy set to an alternate location.......................................................165l Roll a copy back to production..........................................................................167l Restore a virtual machine................................................................................. 168l Considerations and limitations.......................................................................... 180

Recovering and Reusing Data 155

View protected copy set summariesYou can view summaries of protected copy sets in the system. Details such as thename of the storage system that contains the copy set, system usage, location, datethe copy set was created, date the copy set expires, size, and recovery time areavailable to you.

Procedure


All the asset groups in the system appear.You can search for asset groups by name.

2. Select a custom assets group or a default asset group:

l To review the entire list of SQL database assets, click SQL Databases.

l To review the entire list of Oracle database assets, click Oracle Databases.




The entire list of assets that are associated with the group appears in the rightpane.


a. Select an asset.

b. Click .

c. Click .


l The root node represents an asset, which is the protected storage group orconsistency group. When you click >> to display the copy map and selectthe root node in the copy map, eCDM displays information about the sourcestorage group or consistency group storage system and copy locations inthe right pane.

l The child nodes represent storage systems. When you click a child node, theright-hand pane displays the storage systems where the copy is stored, thenumber of copies, and details of each copy including the time the copy wascreated and the size of the copy.





Delete copy setsYou can delete copy sets from the system. However, you must be cautious whendeleting copy sets because all protection copies that are part of the copy set aredeleted from the storage system, and the action cannot be undone.

Before you begin

Users must have System Tenant Admin and Storage Admin roles to delete copy sets.

Procedure


All the asset groups in the system appear.You can search for asset groups by name or assigned tag.





l To view the list of VMware virtual machines, in the left pane, click VMwareVirtual Machines.



3. Select an asset, and at the end of the row, click the icon.

4. Select a copy storage location from the copy map.

The latest related copies information appears.

5. Select a copy, and then click .

A message alerts you that the protection copy set will be deleted.

6. Click Yes.

Exporting copy setsThis section describes how to export copy sets to different arrays. Only users witheither System Tenant Admin or Export and Recovery Admin privileges can performexports.


Delete copy sets 157

Prerequisites for exporting a VMAX copy setBefore you export a VMAX copy set, you must ensure that the following conditionsexist.

l For native VMAX and ProtectPoint VMAX, ensure that Port Groups (PGs), andHosts, which is what VMAX calls Initiator Groups (IGs), exist on the VMAX. ThePGs and IGs must meet the following criteria:

n VMAX Hosts and PGs must have names in the patterns of <hostname>_IGand <hostname>_PG respectively.Where<hostname> is the name of the host that you specify for the copy to beexported to in eCDM Export for Reuse window.

n The World Wide Port Name (WWPN) for the eCDM host that is created orselected must belong to an initiator which is part of the VMAX Host (IG) withthe corresponding name.

l For native VMAX, ensure that storage groups exist with at least as many unusedlocal disks/volumes of the same size as the source Storage Group (SG).For example, if the source SG has 3 volumes of 10 GB each, the target SG musthave at least 3 unused volumes of exactly 10 GB available.

l For ProtectPoint VMAX, you can use the eCDM Create a Storage Group option.Step 5 of Export a VMAX copy set on page 162 below provides more information.

Alternatively, you can select an existing group. Follow the procedure provided in Create a FAST.X device manually on page 158 for more information aboutrequirements.

Note

eCDM does not currently support create a storage group for VMAX for replicationcopies.

l The disks in the storage group that are created or selected for the export remainunavailable for reuse until the export is canceled by unexporting the protectioncopy set.

Create a FAST.X device manually

Before you begin

For ProtectPoint VMAX Restore to Alternate Location and Rollback, you must ensurethat the NSRSnapSG storage group contains enough encapsulated FAST.X vdisks.



Note

eCDM does not automatically create encapsulated FAST.X vdisks for you. The disksare released after being used for the restore or rollback operation.One possible source of these encapsulated disks is the recovery storage group createdby eCDM during ProtectPoint VMAX configuration, named eCDM_<SG name>_Rec.You can add the volumes from this storage group to the NSRSnapSG storage groupfor use in Recover to Alternate and Rollback operations. If you opt for this, considerthe following: If the recovery storage group has been used for an export, the volumesin it will be locked an unavailable for use in Recover and Rollback operations until theexport is cancelled.

You can use the Create a storage group option in the export dialog to create anotherstorage group of encapsulated vDisks to be used as an export target.

Use the Unisphere for VMAX console or SymCLI commands to find the volumes usedin the recovery storage group and add them to the NSRSnapSG SG.

For ProtectPoint VMAX, if you use an existing storage group for the export, thestorage group must contain enough encapsulated FAST.X vdisks.

The encapsulated FAST.X vdisks in both scenarios must meet the following criteria:

l Ensure that the disk is not locked; that is, not already in use.

l Ensure that the disk is equal or greater in number than the source disk to berecovered or rolled back

l Ensure that the disk exactly matches the size and geometry of the source diskthat is to be recovered or rolled back

When you create FAST.X devices for restore operations, ensure that the vDisks thatare encapsulated come from a vDisk pool that is owned by the vDisk user that ownsthe vDisk pool containing the backup vDisks. This pool can be either the same vDiskpool in which the backup devices are located or a different pool as long as the sameuser owns it.

Procedure

1. List the devices that are in your pool. For example, on the Data Domain system,run the following command:

#vdisk device show list pool user1_pool1

Output similar to the following example appears:

Device Device-group Pool Capacity WWN (MiB) ------------ ------------------------------- ------------- -------- -----------------------------------------------vdisk-dev575 eCDM_P1476977925973-user1_sg1 user1_pool1 5120 60:02:18:80:00:08:a0:26:0a:05:7f:31:b9:90:03:52

2. Obtain the details (geometry) for this device, which is the source device for thesnapshot (vdisk static-image) that we will recover. For example, on the DataDomain system run the following command:

#vdisk device show detailed wwn


Create a FAST.X device manually 159


60:02:18:80:00:08:a0:26:0a:05:7f:31:b9:90:03:52Device: vdisk-dev575 GUID: 000008a0260a000d030008a0260a057f31b9900352000d000000023f WWN: 600218800008a0260a057f31b9900352 Device-group: eCDM_P1476977925973-user1_sg1 Pool: user1_pool1 State: read-write Capacity (MiB): 5120 MiB Head count: 15 Cylinder count: 2731 Sectors per track: 256

3. Create a device-group to put a new device in. For example, on the Data Domainsystem, run the following command:

#vdisk device-group create pool user1_pool1 vdisk device-groupcreate pool user1_pool1 user1_rec_dev_group

4. Create a device to encapsulate in the NSRSnapSG SG for VMAX ProtectPointrestores, using the geometry information from the source device.

For example, run the following command:#vdisk device-group create pool user1_pool1 vdisk device createheads 15 cylinders 2731 sectors-per-track 256 pool user1_pool1

Alternatively, you can create disks using size instead of geometry, as long asthe size of the new disk exactly matches the size of the source vdisk.

5. Obtain a list of the access groups on the Data Domain system.

For example, on the Data Domain system, run the following command:#vdisk device-group create pool user1_pool1 scsitarget groupshow list

In this example, because the VMAX 1011 is used, the device was added to thegroup nsm_vmax_1011_scsi_group.


Group Name Service # Initiators # Devices------------------------ ----------- ------------ ---------RP_g015_cluster DD-Boost FC 0 1RP_ledmg010 DD-Boost FC 4 1RP_ledmg015_group DD-Boost FC 4 1RP_ledmg011_group DD-Boost FC 4 1esx_c022_c219_scsi_group VDisk 0 0jr_test_group1 VDisk



0 0ledmc011 VDisk 1 16ledmc018_restore_group VDisk 1 2ledme013_st VDisk 1 0ledme015_restore_group VDisk 1 2ledmf117 VDisk 2 34nsm_vmax1011_scsi_group VDisk 4 418test VDisk 0 0vmax1012_group VDisk 4 200------------------------ ----------- ------------ ---------

6. Expose the device to the VMAX system by adding it to an access group.

For example, run the following command:#vdisk device-group create pool user1_pool1 scsitarget group addnsm_vmax1011_scsi_group device vdisk-dev682 primary-endpoint allsecondary-endpoint all

7. Encapsulate the devices.

For example, run the following command:symconfigure -sid 1011 -cmd "add external_diskwwn=600218800008a0260a057f31b9900352,encapsulate_data=YES;"commit -nop


A Configuration Change operation is in progress. Please wait...

Establishing a configuration change session...............Established. Processing symmetrix 000196701011 Performing Access checks..................................Allowed. Checking Device Reservations..............................Allowed. Initiating COMMIT of configuration changes................Queued. COMMIT requesting required resources......................Obtained. Step 009 of 085 steps.....................................Executing. <snip> Step 232 of 232 steps.....................................Executing. Local: COMMIT............................................Done.

New symdev: 00E0D [TDEV] New symdev: FF89F [DATA device] Terminating the configuration change session..............Done.

The configuration change session has successfully completed.

8. Add the device to the NSRSnapSG storage group. For example, run the symclicommand.


Create a FAST.X device manually 161

At the prompt, type the symcli command:symsg -sid 1011 -sg NSRSnapSG add dev 00E0D

9. Verify which SG the device is in (if any).

For example, run the symcli command:symaccess -sid 1011 list -type storage -dev


00E0D

Storage Group Name --------------------------------NSRSnapSG

Export a VMAX copy setYou can export a protection copy set to a target storage destination for access andmounting via the hosts that are zoned and masked to detect the protected storagedevices that are in the copy set.

Procedure



2. Select a custom VMAX Storage Groups asset group.


3. Select an asset from the list.

4. On the asset, click , and then click .

The Asset Groups Details window appears with the latest related protectioncopy sets and their respective point-in-time (PIT) information.

5. To export a copy set:

a. Create a storage group of encapsulated vDisks from the replication target.

b. Discover the newly created storage group of encapsulated vDisks.

c. Use the PPVmax export Select a storage group option.

a. In the left pane, select source from the copy map.

The list of copy sets display in the right-hand pane.

b. Select a copy set and click .

c. Click the export icon.

The Export for Reuse window appears and displays the list of storagegroups and hosts for exporting copies.

6. In the Export for Reuse window, make the selections:

a. Select a storage group , or select Create a Storage Group and type a namefor the storage group to be selected.



For VMAX primary copies (SnapVX copies), the selected storage group mustcontain volumes of the same size and number as the source storage group.

For ProtectPoint copies, the selected storage group must containencapsulated vDisks of the same size and number as the source storagegroup. The storage group created by eCDM when a ProtectPoint VMAXconfiguration is created, named "eCDM_<SG name>_Rec" is such a storagegroup.

b. (Optional) To add a new host or host to share the device group on thestorage network, click New Host.

c. From the Export Host list, select a host.

7. In the Export for Reuse window, click Export.

Note

Export requests are handled asynchronously and might take a significantamount of time to complete. When the export processing completes, thesystem generates a notification that indicates whether the export wasperformed successfully. During the export processing, the exported copy isvisible in the user interface. If you try to cancel an export during the exportprocess, a message that indicates the resource is locked displays, and theoperation is not permitted.

Export an XtremIO copy setYou can export a copy set to a target storage destination, for access and mounting viathe hosts that are zoned and masked to detect the protected storage devices that arecontained in this copy set. ProtectPoint XtremIO exports are carried out directly fromthe DDR vdisk, not from an XtremIO consistency group.

Before you begin

For RecoverPoint exports, ensure that you specify an eCDM host with WWPNs, whichare part of an existing scsitarget group. You can configure or verify this by using theDDR CLI with the scsitarget group command. Refer to Data Domaindocumentation for information. For information about existing scsitarget groups andinitiators, on the Data Domain console, access the Hardware > Fibre Channel andclick the Access Groups tab.

eCDM does not currently support export of XtremIO from replicated copies.

Procedure



2. Select a custom XtremIO Consistency Groups asset group.


3. Select an asset from the list.

4. On the asset, click , and then click .

The Asset Groups Details window appears with the latest related protectioncopy sets and their respective point-in-time (PIT) information.


Export an XtremIO copy set 163

5. To export a copy set:

a. In the left pane, source from the copy map.

The list of copy sets displays in the right-hand pane.

b. Select a copy set and click .

c. Click .

The Export for Reuse window appears and displays the list of storagegroups or consistency groups and hosts for exporting copies.

6. In the Export for Reuse window, make the selections:

a. (Optional) To add a host or host to share the device group on the storagenetwork, click New Host.

b. From the Export Host list, select a host.

7. In the Export for Reuse window, click Export.

Note

Export requests are handled asynchronously and might take a significantamount of time to complete. When the export processing completes, thesystem generates a notification that indicates whether the export wasperformed successfully. During the export processing, the exported copy isvisible in the user interface. If you try to cancel an export during the exportprocess, a message that indicates the resource is locked displays, and theoperation is not permitted.

Unexport an exported copy setAfter you have finished using an exported copy set, you can unexport it by cancellingthe export.

Note

Unmount the LUNs at the host before you run an unexport operation, and ensure thatthe devices are offline.

Procedure












3. Select an asset, and at the end of the row, click the icon.

The copy map appears in the left-hand pane. The latest related copiesinformation appears.

4. Select a copy source.

Select V for VMAX primary copies.

Select X for XtremIO primary copies

Select DD for ProtectPoint or RecoverPoint XtremIO copies

5. Go to the existing export that you want to unexport, and then click thehighlighted hostname.

An Export Details dialog box appears.Figure 20 Export Details

6. Click Cancel Export.

The copy set is unexported.

Note

Unexport requests and unexport processing are handled asynchronously andmight take a significant amount of time to complete. When the unexportprocessing completes, the system generates a notification that indicateswhether the unexport was performed successfully. During the unexportprocessing, the unexported copy is visible in the user interface. If you try tocancel an unexport during the unexport process, a message that indicates theresource is locked displays, and the operation is not permitted.

Restore a copy set to an alternate locationYou can redirect recovery of a selected copy set to an alternate target destination.Only users with System Tenant Admin or Export and Recovery Admin privileges can


Restore a copy set to an alternate location 165

perform a recovery to an alternate location. Note that If you are using ProtectPointfor XtremIO, you cannot recover snapshots to an alternate location.

Before you begin

l For ProtectPoint VMAX, ensure that the NsrSnapSG storage group contains asmany unused FAST.X vDisks of the same size as the source disks. Create aFAST.X device manually on page 158 provides information.

l For native VMAX and ProtectPoint VMAX:

n Ensure that a storage group exists with at least as many unused local disks andvolumes of the same size as the source SG.For example, if the source SG has 3 volumes of 10GB each, the target SG musthave at least 3 unused volumes of exactly 10 GB available.

n Ensure that all LUNs in the target storage group are unmounted from all hosts.

l For XtremIO, the target Storage Group must be empty for the initial restore toalternate location, or be a consecutive restore of a copy set from the sameprotection copy set (asset).

Procedure









3. Select an asset that you want to recover to an alternate location, and then clickthe refresh/export icon.

The copy map appears in the left-hand pane.


The list of copies appears in the right-hand pane.

5. Select a copy to recover, click >>, and then click Recover to Alternate.

The Recover to Alternate Location window appears with the latest relatedprotection copy sets and their respective point-in-time (PIT) information.

6. In the Recover to Alternate Location window, make the required selections:

a. Select the storage system and devices to recover to.

The storage groups are automatically discovered for the storage system.

b. Select the storage container to export the copy to.

7. Click Save.



Roll a copy back to productionYou can roll a copy back to production, which is the same as recovering a copy back toits original location and which overwrites the current data on the source devices. Onlyusers with System Tenant Admin or Export and Recovery Admin privileges canperform a rollback to production.

Before you begin

l Unmount all the source LUNs from all hosts before performing a rollback toproduction.

l For ProtectPoint VMAX:

n Before performing a rollback, ensure that the VMAX storage group,NsrSnapSG, contains a sufficient number of FAST.X encapsulated vDisks fromthe Data Domain server that contains the static images.

n Ensure that they are equal or greater in number and the same size. TheseFAST.X devices are used only during the rollback operation and are releasedafter the operation is complete. Create a FAST.X device manually on page 158provides information.

eCDM does not currently support rollback to production for XtremIO for replicationcopies.

Procedure










3. To roll back to production, select an asset.

The copy map appears in the left-hand pane.


The list of copies appears in the right-hand pane.

5. Select a copy to recover, click >> , and then click Rollback.

The Rollback to Production window appears with the latest related protectioncopy sets and their respective point-in-time (PIT) information.


Roll a copy back to production 167

6. To overwrite all data on the specified device, select the confirmation option.

The summary for the rollback appears.

7. Click Save.

Note

Restore operations are performed asynchronously. On completion of therestore, a system notification is generated indicating whether the restore wasperformed successfully.

Restore a virtual machineWhen virtual machines are protected within an asset group in eCDM, you can performimage-level recoveries of these virtual machines.

eCDM provides two options for virtual machine recovery—restore to the originallocation, or restore to an alternate location.

Prerequisites to restore a virtual machineReview the following requirements before you restore a virtual machine to its originalor alternate location.

l Users who want to perform a virtual machine restore must have the followingcredentials:

n Export and Recovery Admin privileges

n System Tenant Admin privileges (to restore to an alternate location)Go to Main menu > Tenant Management > Roles and review the user profileto ensure that the user has these roles selected.

l Ensure that you have discovered the Data Domain Management Center (DDMC)and vCenter server and that the discovery of virtual machine copies from DDMCcompleted successfully.To check, go to Main menu > Discovery > Inventory Sources.

l Ensure that protection of the virtual machines completed successfully.

l If performing a restore to the original location, verify that the virtual machine wasnot deleted from its original location.

l If performing a restore to an alternate location, ensure that sufficient space isavailable on the target datastore.

l Verify that the virtual machine copy that is selected for restore has not expired.

l For restore to the original location only, if a restore is initiated while a consistencygroup is in a state that indicates the group is busy with other activities (such asSuspended or Paused), the restore fails.Verify that the consistency group status is healthy (typically a SNAP_IDLE orPaused by System state) by using GET /v2/protectPointVmConfigurationInfo APIunder primaryProtectionInfo, as shown in the following example.

Example 3 Setting group status to SNAP_IDLE for virtual machine restore operations



Example 3 Setting group status to SNAP_IDLE for virtual machine restoreoperations (continued)

Figure 21 SNAP_IDLE group status

Enable app admins to use Application Agents to rollback application data inguest virtual machine

If you plan to use Application Agents (including File System Agent) for virtual machinerestore, perform the following additional configuration to enable the app admin usersto rollback application data in the guest virtual machine. These steps will create aseparate NFS share on the Data Domain storage unit that was created by eCDM andregistered for use with vRPA, and this share will be used as a temporary staging areaby vRPA for the application data rollback.

Procedure

1. Create a new folder under the eCDM storage unit for a NFS share and give 777permissions. For example:

a. On a Data Domain, share the eCDM storage unit as the NFS share so thatyou can create subdirectories and change permissions by typing thefollowing:

nfs add /data/col1/eCDM-SU-1502223103046 <any-client-name>

b. On the client where you give NFS access to the storage unit specified in theprevious step, type mount <dd-host>:/data/col1/eCDM-SU-1502223103046 /ecdm

c. Type mkdir /ecdm/apps_nfs

d. Type chmod 777 /ecdm/apps_nfs

e. Type umount /ecdm

f. On the Data Domain, type nfs add /data/col1/eCDM-SU-1502223103046/apps_nfs *

2. For the folder created in step one, create a new datastore on the vCenterserver using NFS v3. If vRPA is deployed in a vCenter that is different from theone where the protected virtual machines reside, create this datastore in bothvCenter servers.


Enable app admins to use Application Agents to rollback application data in guest virtual machine 169

3. On the client that has a network access to the vRPA cluster (for example, theclient specified in step 1a), run the following curl command to obtain the vRPAcluster UID and Data Domain UID, as shown in the following example.

curl --insecure --user 'admin:<password>' -XGET -H "Content-Type:application/json" "https://10.5.172.164/fapi/rest/5_1/clusters/array_management_providers/settings" -o rp-settings.log ; grep -o '\<DDSU.*arrayUID.*DATA_DOMAIN\>' rp-settings.log

ArraySettings","name":"DDSU","serialNumber":"AUDVBZM3HBSAPR-eCDM-SU-1522766831918","arrayUID":{"id":655567751274215288,"clusterUID":{"id":1484290726399595392}},"type":"DATA_DOMAIN

Note

In the above example:

l 10.5.172.164 is the vRPA cluster IP.

l 1484290726399595392 is the vRPA cluster UID, retrieved from the abovecommands.

l 655567751274215288 is the Data Domain UID, retrieved from the abovecommands.

You must change these values based on your environment.

4. To register the NFS share to vRPA, on the same client create aregisternfs.json file using the UIDs retrieved from step 3, and then usethe file to run the vRPA REST call, as shown in the following example.

#wget --post-file=registernfs.json https://10.5.172.164/fapi/rest/5_1/clusters/1484290726399595392/arrays/resource_pools --no-check-certificate --header="Content-type:application/json" --http-user=admin --http-password=admin

#more registernfs.json{"innerSet": [{ "storageResourcePoolId": "/apps_nfs", "arrayUid": { "id": 655567751274215288, "clusterUID": {"id": 1484290726399595392} }, "resourcePoolType": "NFS_SHARE", "resourcePoolUID": { "storageResourcePoolId": "/apps_nfs", "arrayUid": { "id": 655567751274215288, "clusterUID": { "id": 1484290726399595392} } }, "resourcePoolPurposeTypeSet": [] }]}



Note

In the above example:

l 10.5.172.164 is the vRPA cluster IP.

l 1484290726399595392 is the vRPA cluster UID, obtained from step 3.

l 655567751274215288 is the Data Domain UID, obtained from step 3.

l /apps_nfs is the name of the NFS share folder created in step 1.

You must change these values based on your environment.

Restore a virtual machine backup to the original locationA restore to the original location will recover the virtual machine backup to its originallocation on the vCenter.

Before you begin

Review Prerequisites to virtual machine restore before you perform the followingprocedure.

Procedure


The Asset Groups window displays all of the asset groups in the system.Figure 22 Asset groups

You can search for asset groups by name or assigned tag.

2. To view a list of VMware virtual machines, select the virtual machine assetgroup that contains the protected virtual machines.

Individual protected virtual machine assets might also appear in this view. Theyare identified with a VM icon.When you select an asset group, the entire list of assets that are associatedwith the group appears in the right pane.


Restore a virtual machine backup to the original location 171

Figure 23 Virtual machine assets within asset group

3. To view the available copies for a virtual machine:

a. Select the virtual machine in the right pane.

b. Click ....

c. Click Details.

The Copies page provides a map view in the left pane and copy details in theright pane.

When a virtual machine is selected in the map view, the virtual machine namedisplays in the right pane with the copy locations underneath. When you click ona specific location in the right pane to view the copies, for example, on a DataDomain system, the copies on that system display in the right pane.

4. Highlight the copy that you want to recover, click ..., and then click theRestore icon to restore this copy to the original location.



Figure 24 Restore virtual machine asset to original virtual machine

The Restore VM to original location dialog box appears, requestingconfirmation that you want to restore this virtual machine.

5. Click OK.

The Restore Started dialog box appears. You can now monitor the progress ofthe restore operation in the Activity Monitor

6. To exit this dialog box and return to the Asset Groups window:

a. Click OK.

b. Go to Main menu > Activity Monitor > Tasks.

7. In the Tasks window, click the Export/Reuse tab.

A Restore VM to Production job appears with a progress bar and start time.


Restore a virtual machine backup to the original location 173

Figure 25 Monitor virtual machine asset restore progress

Restore a virtual machine backup to an alternate locationYou can redirect recovery of a virtual machine to an alternate target destination.

Before you begin

Review Prerequisites to virtual machine restore before you perform the followingprocedure.

Procedure


The Asset Groups window displays all of the asset groups in the system.Figure 26 Asset groups



You can search for asset groups by name or assigned tag.

2. To view the list of VMware virtual machines:

l Click Protected VMs for a group that is already created.

l Click the VMware Virtual Machines default group.

When you select an asset group the entire list of assets that are associated withthe group appears in the right pane.Figure 27 Virtual machine assets within asset group

3. To view the available copies for an asset:

a. Select the virtual machine in the right pane.

b. Click ....

c. Click Details.

The Copies page provides a map view in the left pane, and copy details in theright pane.

When a virtual machine is selected in the map view, the virtual machine namedisplays in the right pane with the copy locations underneath. When you click aspecific location in the right pane to view the copies, for example, on a DataDomain system, the copies on that system display in the right pane.

4. To restore this copy to a different location:

a. Highlight the copy that you want to recover.

b. Click ....

c. Click the Recover to Alternate icon.


Restore a virtual machine backup to an alternate location 175

Figure 28 Restore virtual machine asset to an alternate virtual machine

The Recover VM Alternate Location wizard appears.

5. On the VM Name, vCenter, and Data Center page, make the requiredselections:

a. Provide the name of the new virtual machine. If the virtual machine islocated in a different folder than the original location, you can use the samename that was used previously.

b. In the vCenter list box, select a vCenter server that has been discovered byusing the Inventory Source window.

You can also use the Search field to search for a vCenter by name.

c. Highlight the destination data center.

When you select a vCenter server, available data centers appear.

d. Click Next.



Figure 29 Restore VM Alternate Location wizard

6. On the Restore Location page, select the location that you want to restore towithin this data center.

For example, select a specific cluster, and then select a host within the cluster.Click Next.

7. On the Host page:

l If you did not select a specific host in the previous step, select a host that isconnected with the cluster, and then click Next.

l If you selected a host in step 6, this page indicates that a host is alreadyselected and you can click Next to proceed.

8. On the Configuration File Datastore page:

a. Select the datastore where you want to recover the configuration files foryour virtual machine.

b. Click Next.

9. On the Disk Files Datastore page, select a datastore location.

By default, the checkbox is selected to store the disks in the same datastorethat you selected in Step 8.

l To restore the disks to the same datastore as the configuration files:

a. Leave the checkbox selected.

b. Click Next.

l To map to another datastore:

a. Clear the checkbox. The Disks pane appears.

b. Select a disk in the left pane.

c. Select a datastore in the right pane.

d. Click Next.


Restore a virtual machine backup to an alternate location 177

10. On the Options page:

l If you want to power on the virtual machine after recovery:

a. Select Power On VM once recovery is complete. Selecting thischeckbox automatically selects the Reconnect NIC checkbox as well.

b. Click Next.

l If you do not want to automatically reconnect NIC after powering on thevirtual machine:

a. Clear the checkbox.

b. Click Next.

11. On the Summary page:

a. To ensure that the details are correct, review the information.

b. Click Finish.

The Restore Started dialog box appears. You can now monitor the progress ofthe restore in the Activity Monitor.

12. To return to the Asset Groups window:

a. Click OK.

b. Go to Main menu > Activity Monitor > Tasks.

13. In the Tasks window, click the Export/Reuse tab.

A Restore VM to Alternate job appears with a progress bar and start time.

Troubleshooting virtual machine restoresThe following topics provide information on troubleshooting virtual machine restorefailures.

Virtual machine protection copy does not display under available copiesIf a virtual machine protection copy does not display under the available copies ineCDM, verify the following:

l Ensure that protection of the virtual machine completed successfully.

l Check that the desired copy has not expired according to the eCDM protectionplan.

l Ensure that static-images appear in the Data Domain system by running vdiskstatic-image show detailed pool <vDiskPoolName>.

l Run a discovery of the Data Domain Management Center (DDMC) and ensure thatdiscovery completed successfully.

l Check the discovery logs for any exceptions or errors that might have occurredduring discovery.

Virtual machine restore fails with name resolution errorA virtual machine restore might fail with the following error due to network issuesbetween Data Domain and eCDM, the vRPA cluster, or the vCenter/ESXi:

com.emc.brs.vmdm.http.HttpsConnector - null: Temporary failure in name resolutionjava.net.UnknownHostException : null: Temporary failure in name resolution

Ensure that you have proper name resolution between Data Domain and the vRPAcluster/eCDM /vCenter/ESX.



Virtual machine restore fails with error "Unable to get CG reports from thevRPA"A virtual machine restore might fail with the following error due to a time differencebetween the vRPA, Data Domain, eCDM, vCenter and ESXi:

com.emc.brs.vmdm.pp4vm.service.RestoreToOriginalService - getReportsAll: Unable to get CG reports from the VRPA, response code :401

Ensure that times and time zones match between the vRPA, Data Domain, eCDM,vCenter, and ESXi.

DD NFS share not removed after restore to originalThe DD NFS share might not get removed after a successful virtual machine restore tooriginal. When this occurs, the restore hangs and the following DD NFS clients appearenabled in Data Domain.Figure 30 DD NFS clients still enabled after restore

If you encounter this issue, you can wait 24 hours for eCDM to clean up the DD NFSshares, or you can stop the restore and clean up the DD NFS clients manually byperforming the following steps.

1. Restart the VMDM service by typing /usr/local/brs/lib/vmdm/bin/vmdmrestart.

2. Clean up DD NFS clients by typing nfs del <Path> <Client>.

3. In the vSphere Client's Configuration tab, manually unmount the EMC-vProxy-vm-qa-xxxxx DDNFS datastore that is mounted on the ESXi host.

Virtual machine restore fails with error due to vProxy corruptionA virtual machine restore might fail with the following error due to corruption of thevProxy that is running in eCDM:

com.emc.dpsg.vproxy.client.VProxyManager - Error(createSession): javax.net.ssl.SSLException:Unrecognized SSL message, plaintext connection

Ensure that the vproxyd service is running in eCDM by typing the following command.

ps xa | grep vproxyEnsure that the vproxy rpm is installed as expected in eCDM by typing the followingcommand.

rpm -qa | grep vProxyWhen logged in as the root user, restart the vproxyd service on eCDM by typing thefollowing command.

systemctl restart vproxydVirtual machine restore fails with error "Unable to create NAS Datastore"A virtual machine restore might fail with the following error when a change is made tothe DD restore user role in Data Domain:

Unable to create NAS Datastore: Unable to create NFS export at 'irv-dd9500-skyline1.asl.lab.emc.com:/data/col1/eCDM-SU-1497653922167/vProxy-vm-qa-1084.asl.lab.emc.com-abfd110d-cdfa-4517-9485-27767ef75d35':


Troubleshooting virtual machine restores 179

Ensure that the DD user performing the restore has the admin role. You can changethe user's status in Data Domain by identifying the Data Domain user that starts withecdmsu-admin and using the following commands:

To check the user's status, type user show listTo change the role of the user, type user change role < ecdmsu-admin-xxxxxxxxxxxxx> adminVirtual machine restore fails with error "User UserEARA does not have properprivileges"A virtual machine restore fails with the error "User UserEARA does not have properprivileges" when the user does not have adequate privileges to perform the restoreoperation.

Ensure that the eCDM user performing the restore belongs to System Tenant and hasfollowing roles that are assigned:



Virtual machine restore fails with error "Enable image access failed" when usingunsupported vRPAA virtual machine restore fails with the following error when running an unsupportedvRPA version:

Enable image access failed: 400 - Unrecognized field xxxxxxxxx (Class com.emc.fapi.version5_1.commons.ImageAccessVMParameters), not marked as ignorable

Check the eCDM support documentation to verify that the vRPA version in use issupported by eCDM.

Virtual machine restore fails when the previous restore of this virtual machine isin progress or did not completeA virtual machine restore fails with the following error if the previous restore operationfor the same virtual machine is still in progress or did not complete successfully:

Error : There is another running restore operation that conflicts with this request.

If the previous restore operation for this virtual machine is still in progress, monitor theprogress in eCDM until the restore completes. If the virtual machine restore iscomplete but the task stops responding, then you must manually cancel the restore ineCDM by restarting the VMDM service. You can restart the VMDM service bytyping /usr/local/brs/lib/vmdm/bin/vmdm restart.

Considerations and limitationsBefore you perform an Export, Restore, or Rollback to Production operation, reviewthe following items:

l

l A virtual machine restore operation to the original location cannot be performed ifthe virtual machine has been deleted from the original location.

l A virtual machine restore operation to the original location cannot be performed ifthe virtual machine contains VMware snapshots.



l Any changes to the disk size and the number of attached disks will remainunchanged after a restore to the original operation.

l A virtual machine restore operation to the original location does not supportrestores from replicated copies.

l You cannot perform a virtual machine restore to the original location if the planassociated with the virtual machine is changed or the virtual machine isunprotected.

l If the virtual machine disk (VMDK) is deleted from the virtual machine, then theconsistency group must be modified to allow for the creation of continuoussnapshots.

l All required SAN connections and visibility between each of the arrays and targethosts are in place.

l The virtual RecoverPoint Appliance (vRPA) creates system snapshots as staticimages in some scenarios. These static images might appear on the Data Domaindevice during troubleshooting, and eCDM ignores them. Images might be createdin the following scenarios:

n During an initial sweep

n When a change occurs in the consistency group configuration

n When system bookmarks get created every 24 hours as part of the protectionplan

n When the change rate is greater than 20%.

n After a successful restore to original operation.

l Due to Data Domain limitations, eCDM only supports the following characters indevice-group provisioning names:

n lower-case letters (“a”–“z”)

n upper-case letters (“A”–“Z”)

n digits (“0”–“9”)

n underscore (“_”)

n dash (“–”)

All other characters are not supported.

l When you export from VMAX or Data Domain systems, ensure that the WWPNsthat you use for the export operations are present in an initiator group. eCDMdoes not create initiator groups on the VMAX or Data Domain.

l ProtectPoint VMAX operations use the FAST.X devices in the NsrSnapSG storagegroup for the restore and restore to alternate location operations.

l For ProtectPoint VMAX operations, the same Data Domain user must own alldevice groups that are involved in the operation. These groups include the backupdevice group and the device groups used for instantiating the static images

l For ProtectPoint XtremIO operations, the device group that is used to instantiatestatic images for restore and export can be owned by a different Data Domainuser. However, it is recommended that the device groups are owned by the sameData Domain user as the backup device group.


Considerations and limitations 181

CHAPTER 8

Using the Dashboard


l The eCDM Dashboard.......................................................................................184l eCDM Dashboard capacity monitoring..............................................................185l View the License in the Dashboard................................................................... 186l Monitor Compliance in the Dashboard.............................................................. 187l eCDM Health.................................................................................................... 190

Using the Dashboard 183

The eCDM DashboardThe eCDM Dashboard provides at-a-glance insight into key product informationoperational behavior. The Dashboard is divided into quadrants with each quadrantdisplaying unique information in up to three widgets. The eCDM user can customizethe Dashboard from a selection of compliance and key indicators.

For example, a system administrator logging into eCDM might be presented with aDashboard that shows summary information such as the following:

l Asset Compliance

l Tenant Compliance

l Plan Compliance

l License

l Primary Storage Protection

l Protection Storage

The following table lists the icons available in the Dashboard.

Table 30 eCDM UI, Dashboard, and quadrant icons

Icon Description

Main menuBrowse to anywhere in the UI.

Expand/Collapse aquadrant

Expands or collapses any specific Dashboard quadrant to fullscreen.

Quadrant controlsExpands the available quadrant widgets or controls.

Begin CycleThe quadrant cycles through all widgets configured for thespecific quadrant at a 60-second interval.

Reset to DefaultResets the widgets in that specific quadrant to the originaldisplay settings.

Clear QuadrantRemoves all widgets from the quadrant.

Lock QuadrantPrevents any changes to widgets (addition or removal of) inthe quadrant.

View widgets Displays the available widgets. You can drag widgets fromhere to any location on the Dashboard to change the display.

Day/Night icon Toggle the UI display between a light and dark background.

LogoffLog off from the eCDM UI.

Widget settingsAccess the widget settings for any quadrant.

Additional infoDisplays a pop-up window with additional information aboutthe contents of a widget.

Using the Dashboard


Dashboard widgetsThe following widgets are available in the eCDM UI.

l Asset Compliance

l Tenant Compliance

l Plan Compliance

l License

l Primary Storage Protection

l Protection Storage

l eCDM Health

To change the display, you can drag widgets to any location on the Dashboard:

l To display available widgets, click on the right side of the Dashboard.

l To modify the display, drag widgets to any quadrant in the Dashboard.

lTo change the Dashboard view from day to night, click .

l To collapse the list of widgets, click .

eCDM Dashboard capacity monitoringThe eCDM Dashboard can display the available capacities of your protection storagesystems to help you ensure that the systems do not reach capacity and therebyimpact the availability of eCDM services.

Widgets available from the eCDM Dashboard display the current total globalprotection storage.

Review primary storage protectionYou can use the Primary Storage Protection widget to view front-end capacityinformation at the system level through a single resource. This resource includes thedata source capacity that is protected by one or more eCDM protection plans, totaldiscovered data source capacity, and total used capacity.

To review Primary Storage Protection, go to Main menu > Dashboard > PrimaryStorage Protection.

This widget allows you to calculate the amount of unprotected capacity. When you login as a specific tenant user, the widget provides the capacity for protection plans anddata sources that are assigned to that tenant and all its child tenants. When you log inas a user with system administrative privileges, the widget displays the capacity forplans and data sources for the entire system.

Using the Dashboard

Dashboard widgets 185

Figure 31 Primary Storage Protection widget

Reviewing protection storage capacity informationYou can use the Protection Storage widget to view capacity information for back-endstorage.

To review Protection Storage, go to Main menu > Dashboard > Protection Storage.

The Protection Storage widget breaks down information on available storage and usedstorage. Additionally, the widget displays information on the average deduplicationrate across all Protection Storage systems.

The following figure displays a Data Domain system with 150 TB total capacity andcurrent statistics for deduplication.

Figure 32 Protection Storage widget

View the License in the DashboardThe License quadrant on the eCDM UI Dashboard allows you to view the type oflicense that is applied, along with status details, such as expiry date and capacityusage.

To review the license, go to Main menu > Dashboard > License.

The following list provides information about the license types:

Using the Dashboard


l Trial license—Applied automatically on installation of eCDM and allows full use ofthe product without applying a license key for up to 90 days. When the trail periodends, eCDM continues to operate with full functionality, so you can apply apermanent license.

Note

You can add or manage an EMC Secure Remote Services gateway only with anFETB license.

l Front-end protected capacity by terabyte or FETB—The primary model ofeLicensing, which is based on the actual capacity that you want to protect. Forexample, you can purchase a 100 TB license, which allows you to protect up to 100TB of actual data.

Monitor Compliance in the DashboardThe Compliance quadrant on the eCDM UI Dashboard provides you with a graphicalrepresentation of compliance, which enables you to quickly identify compliance issuesand compliancy trends that might require further investigation.

The dashboard provides three types of compliance bar graphs:

l Asset compliance

l Plan compliance

l Tenant compliance

Asset complianceDisplays a percentage of compliant and non-compliant assets in an asset group, byday. By default, the dashboard displays compliance information about the assets in allasset groups over the last 8 days. Use the widget settings to filter by an asset groupor to change the number of days that are displayed in the graph.To display information that pertains only to a specific compliance result on a specificday, click the line on the bar graph. The Asset Compliance window appears anddisplays compliance information for the selected day.

Plan complianceDisplays a percentage of all compliant and non-compliant assets in all plans, by day. Bydefault, the dashboard displays information about all assets in all plans over the last 5days. Use the widget settings to change the number of days that are displayed in thegraph.To display information that pertains only to a specific compliance result on a specificday, click the line on the bar graph. The Plan Compliance window appears anddisplays compliance information for the selected day.

Tenant complianceDisplays a percentage of all compliant and non-compliant assets in a tenant, by day.By default, the dashboard displays compliance information about the assets in alltenants over the last 5 days. Use the widget settings to filter by a tenant name or tochange the number of days that are displayed in the graph.To display information that pertains only to a specific compliance result on a specificday, click the line on the bar graph. The Tenant Compliance window appears anddisplays compliance information for the selected day.

You can hover over a graph to change the focus of the quadrant and select a bar onthe graph to display compliancy information for a specific day.

Using the Dashboard

Monitor Compliance in the Dashboard 187

Review asset complianceYou can use the Asset Compliance widget to view individual assets within protectionplans to help you determine why a protection plan is out of compliance. The rate ofcompliance is calculated according to the service level objectives defined for thoseplans. A lower percentage indicates a plan with multiple assets out of compliance.

To review asset compliance, click Main menu > Dashboard > Asset Compliance.Figure 33 Asset Compliance widget in the Dashboard

You can filter the results to only show assets in a specific group, or all groups. Click anentry in the bar graph to view more details for assets by group.

The following table describes the fields that the Asset Compliance widget displays.

Table 31 Compliance by asset fields

Field Description

Asset Asset name

Compliance For this asset and the associated plan, the calculated value (in percent)for meeting plan objectives over the last 8 days

ObjectiveCompliance


Validated The compliance rate is calculated based on the last 8 days including thecurrent date.

Review tenant complianceYou can use the Tenant Compliance widget to view the rate of compliance to theservice level objectives that were defined for each tenant.

To review tenant compliance, click Main menu > Dashboard > Tenant Compliance.

The compliance rate is calculated based on the last 8 days including the current date,and is color coded according to the legend that appears along the bottom of thewidget, as displayed in the following figure.

Using the Dashboard


Figure 34 Compliance by tenant

The following table describes the fields that the Compliance by Tenant widgetdisplays.

Table 32 Compliance by tenant fields

Field Description

Tenant Tenant name

Compliance Rate For this tenant and the associated plan, the calculated value (in percent)for meeting plan objectives over the last 8 days

ObjectiveCompliance


Validated The day the compliance was last determined

Review protection plan complianceYou can use the Plan Compliance widget to view protection plans that are most outof compliance. The rate of compliance is calculated according to the service levelobjectives defined for those plans. A lower percentage indicates a less compliant plan.

To review protection plan compliance, go to Main menu > Dashboard > Complianceby Plan.

Each plan that is identified as out of compliance lists the number of tenants that areusing this protection plan, as displayed in the following figure.

Using the Dashboard

Review protection plan compliance 189

Figure 35 Compliance by Plan

Compliance by Plan is displayed according to the following.

Table 33 Compliance by Plan fields

Field Description Setting

TimeInterval

The period of time over which thecompliance rate is calculated.

By default, the time interval isbased on the last 8 days up to thecurrent date.

Plans todisplay

The number of plans to display in the widget. A minimum of one, to a maximumof eight. By default, the widgetshows the top five out-of-compliance plans, starting withthe least compliant.

Only showactiveplans

Display only plans currently in use, or displayall protection plans.

On or off.

eCDM HealthYou can use the eCDM Health widget to view appliance information at-a-glance, aswell as a specific breakdown of the state of each eCDM service, similar to theOverview tab under the Settings window.

To review eCDM Health, go to Main menu > Dashboard > eCDM Health.

Within the initial eCDM Health widget view, you can determine the following data:

l The overall appliance status, for example, Operational, Maintenance, or Quiesce.

l The amount of space currently in use on the disks, calculated as a percentage.

You can then click the i badge in the top-right corner of the widget to view moredetails. The widget expands to reveal the following details:

l Current appliance status (for example, operational, maintenance mode, quiesce).

l Name and version of the appliance.

Using the Dashboard


l Uptime, which provides the number of days since the last appliance reboot.

l An indicator that backups are scheduled to run, if applicable.

l The amount of time in days since the last backup.

l The amount of time in days since the last update or patch.

l More specific capacity details for used and total space as well as any critical diskpartitions (those which are more than 90% used).

Additionally, the lower pane provides a breakdown of each eCDM Service and itscurrent state.

Using the Dashboard

eCDM Health 191

Using the Dashboard


CHAPTER 9

Monitoring the System


l Activity Monitor window...................................................................................194l Monitoring protection plan compliance in the Plan Compliance tab.................. 194l Monitoring tasks by activity or plan in the Tasks tab.........................................197l Monitoring events in the Events tab................................................................. 198l View notifications............................................................................................. 198l Monitoring system state and system health......................................................198

Monitoring the System 193

Activity Monitor windowTo access the eCDM Activity Monitor window, go to Main menu > Activity Monitor.

The Activity Monitor window is separated into three tabs that allow you to monitorsystem information according to the following categories.

l Plan Compliance

l Tasks

l Events

Monitoring protection plan compliance in the PlanCompliance tab

The Plan Compliance tab allows you to monitor protection plans in the system forcompliance according to your service level objectives, and display information aboutcompliancy issues that were observed in the Asset Compliance quadrant on theDashboard.

You can use the Plan Compliance tab to get a historical overview of plan compliance,determine whether a plan is active or inactive, and review compliance details. ThePlan Compliance tab displays the following three panes.

OverviewThe Overview pane displays status information about compliance issues that occurredover the last 24 hours.

Compliance History paneThe Compliance History pane contains a bar graph that displays historical informationabout the plan compliance.

Summary of Plan Compliance paneThe Summary of Plan Compliance pane appears below the Compliance Historypane. Ths pane displays the plans in groups based on compliance status over the last24 hours.

A plan is assigned one of the following compliance statuses:

l Critical—When the percentage of assets that are compliant in a the plan is in the0-73% range.

l Warning—When the percentage of assets that are compliant in a the plan is in the74-94% range.

l Passing—When the percentage of assets that are compliant in a the plan is in the95-100% range.

The menu bar provides the following tools to control the information that appears inthe pane:

l Filter views—By default, the pane displays all protection plans regardless of thestatus of the plan. To filter based on plan status, click the Filter button, andthen select a status.

l Sort—By default, the pane sorts each plan alphabetically by name in descendingorder. To sort the plans differently, click the Sort option button, and thenselect on of the following sort options:



n # of Assets OOC—To sort the status section based on the number of assetsthat are out of compliance.

n # of Assets—To sort the status section by the number of assets that a plancontains.

Note

To switch between ascending and descending order, click the toggle button.

l Search—To filter the plans that appear based on a search string, type the string inthe Search field.

Monitoring asset complianceTo view detailed information in the Plan Compliance tab about the compliance of allassets in a protection plan, click the name of the protection plan in the status sectionof the Summary of Plan Compliance pane.

The Detailed Plan Compliance window appears with the three panes:

Asset Compliance StatusLocated in the upper left pane and provides the status of a plan's asset compliance, asa percentage. There are three asset compliance statuses:

l Passed

l Completed with Exceptions

l Out of Compliance

Compliance HistoryLocated in the upper right pane and provides the history of the asset compliancestatus by day in a bar graph.

Note

To view tasks that are tied to protection plan, click the link.

Asset Summary paneThe Asset Summary pane appears below the Compliance History pane and providesan overview of the Asset Group the asset resides, the in assets in a plan, whichincludes a summary of the number of passed objectives and the name of the tenantthat is associated with the asset. Use the toggle button to switch between a tiledor list view.

The Asset Summary pane provides you with options to change the information thatappears in the pane. The menu bar, provides three tools:

l Filter by result—By default, the pane displays all assets regardless of results. Tofilter the list of assets that are based on a result, click the Filter button , andselect Success, Partial Success, Failed, or Canceled.

l Sort—By default, the pane sorts each asset alphabetically by name in descendingorder. To sort the assets by compliance result, click the Sort option button ,and then select Compliance Result.

Note



Monitoring asset compliance 195

l Search—To filter the assets that appear based on a search string, type the stringin the Search field.

Monitoring objective complianceTo view information about the objective compliance for an asset, in the Detailed PlanCompliance window, click the name of the asset.

The Objective Compliance window appears and displays information about objectivecompliance.

The Objective Compliance pane provides you with options to manipulate theinformation that appears in the pane. The menu bar, provides three tools:

l Filter by result—By default, the pane displays all assets regardless of results. Tofilter the list of assets based on a result, click the Filter button , and selectSuccess, Partial Success, Failed, or Canceled.

l Sort—By default, the pane sorts each asset alphabetically by name in descendingorder. To sort the assets by compliance result, click the Sort option button ,and then select Compliance Result.

Note


l Search—To filter the assets that appear based on a search string, type the stringin the Search field.

The Objective Compliance pane display compliance information in two panes:

l Compliance History—Located in the upper right pane of the window and providesasset compliance status by day in a bar graph.

l Detailed Objective Compliance History— Located below the Compliance Historypane and provides list of objectives for the asset, and the objective status. Bydefault, the Detailed Objective Compliance History pane displays objectcompliance information since the last compliance check.To view specific compliance information for a specific day, for example, failedobjectives only, select the bar in the graph. The Detailed Objective ComplianceHistory pane provides you with the following tools that allow you to manipulatethe information that you see:

n Click the result summary header to display detailed information for theobjective.

n Click Show All to display information about all compliant and non-compliantobjectives on the selected day.

n Click Show Latest to display information about objectives since the lastcompliance check.



Monitoring tasks by activity or plan in the Tasks tabThe Tasks tab in the Activity Monitor window provides you with ability to monitortasks by activity or by plan .

Monitor tasks by activityThe Tasks tab of the Activity Monitor window allows you to the monitor tasks thatare associated with various system activities.

Procedure

1. Go to Main menu > Activity Monitor, and then select the Tasks tab.

By default all tasks for the last 8 days with All Status and All Results appear.

2. To search for a task, in the Search box type the name of the task.

The tasks that are based on the search criteria appear in the lower half of thepane.

3. To filter tasks by number of days or hours, status, or results, click theirrespective Filtered Views button.

The items that are based on the selection, display in the lower half of thescreen.

4. To view the details of a task, click the task.

The task details display on the right side of the screen.

Note

Some tasks do not have additional details and information does not appear onthe right side of the screen.

Monitor tasks by planWhen you are reviewing asset compliance, you can view detailed information aboutthe tasks that are associated with a plan.

Procedure

1. Go to Main menu > Activity Monitor.

The Activity Monitor window opens on the Plan Compliance tab.

2. On the Asset Summary pane, select an asset.

The Detailed Plan Compliance window appears.

3. To view tasks that are associated with the asset, click the Associated Task link.

The Tasks window appears.

4. To view information about the subtasks that are associated with a task, clickthe task.

The Subtasks window appears.


Monitoring tasks by activity or plan in the Tasks tab 197

Monitoring events in the Events tabThe Events tab in the Activity Monitor window allows you to monitor events forvarious areas of the system.

To view events, go to the Main menu, select Activity Monitor, and then select theEvents tab.

The Events tab provides you with options to manipulate the information that appears.The menu bar provides three tools:

l Filter by time—By default, the tab displays all events for the last 8 days. To filter based on other time criteria, click the Filter by time button, and thenselect Last 48 hours or Last 24 Hours.

l Filter by Status—By default, the window displays all events regardless of status.To filter events to display a specific status, click the filter by status button,and then select the status.

l Search—To filter the events messages that appear based on a search string, inthe Search field, type the string.

View notificationsThe notifications center allows you to view notifications for tasks and events.

Procedure

1. To access the notifications center, in the upper right corner of the window,click . The number indicates the number of unacknowledged notifications inthe system.

The Notifications pane displays on the right side of the window.Notifications are grouped according to age (Today, Previous 7 Days, andOlder). New notifications are denoted by a red dot beside the name.

2. To filter the notification pane, in the Search field, type the choice.

The notifications appear.

3. To acknowledge notifications, you can perform one of the following actions:

l To acknowledge a single notification, click the status icon. The status iconchanges from an empty circle to a check mark.

l To acknowledge all notifications, click Acknowledge All.The status icon for all unacknowledged notifications changes from an emptycircle to a circle with a horizontal line. The red dot beside all the newnotifications disappears.

Monitoring system state and system healthThrough the Settings window, you can monitor the state of the appliance and thehealth of each system component. The Overview tab also provides you with the ability



to change the overall state of the appliance from Operational to Maintenance, or fromMaintenance to Operational.

On the Overview tab, you can display the overall health of the eCDM appliance, in theHealth panel. On the Health panel, you can click the View Services icon, which opensthe Services Status window, and displays the state of each system component.

Note

The Dashboard also provides a Health widget that you can use to review system healthinformation.

Monitor and change the state of the applianceOn the Overview tab, you can display the overall health of the eCDM appliance, in theHealth panel. The state of the appliance appears as an icon and is determined by thestate of all system components. For example, if one system component is not in aRunning state, the overall state of the appliance is Partially Operational. On theinterface, a summary of the state of each system component appears under the stateof the appliance.

The following table summarizes each appliance state.

Table 34 Appliance states

Icon State

Operational—This state appears when the appliance is accessible with fullfunctionality.When the state of the appliance is operational, the state of each systemcomponent is also operational.

Quiesce—This state appears during a quiesce of the appliance.

Failed—This state appears when the appliance cannot successfully changestates.When you see this state, contact Support for assistance.

Maintenance—This state appears when the appliance is in maintenancemode. You can access and manage the appliance but with limitedfunctionality.You must put the appliance in Maintenance mode for some configurationchanges, for example, to change the network settings or to upgrade theappliance. When configuration changes or an update completes, you mustmanually change the state of the appliance from Maintenance toOperational.

Partially operational—This state appears when one or more of the systemcomponents are not in an Up state.

View the System Health window to determine that state of eachappliance component.


Monitor and change the state of the appliance 199

Change the state of the applianceBefore you can put the appliance in maintenance mode, allow all tasks to complete.You cannot put the appliance in maintenance mode when there are in-progress tasks.

Before you begin

Changing the state of an appliance requires the Manage System Settings privilege.

Connect to the UI with a user that has System Tenant Admin, Security Admin, or theRemote support role, and then perform the following actions.

Procedure



2. On the Overview tab, use the Maintenance mode toggle to change the systemstatus.

3. To enable Maintenance Mode, perform the following steps:

a. Change the Maintenance mode toggle from OFF to ON.

The Maintenance mode window appears with a summary of tasks.

b. Click Begin Maintenance Mode to start the change of the system status.

A Confirmation window appears.

4. To take the appliance out of Maintenance Mode, change the Maintenancemode toggle from ON to OFF.

Monitor system component healthThrough the Settings window, you can monitor the state of the appliance and thehealth of each system component. To view the health of the system components,click the Main menu icon and select Settings. The system health information appearsin the Health panel.When you select the View Services icon in the Health panel, theView Services window appears.

The View Services window displays system health components in four groups—Management, Infrastructure, Core, and Protection. The state of each componentappears beside the name of the component.The following table provides a summary of each component state.

Table 35 Component states

Icon State

Running—This state appears when the associated service or component isrunning with full functionality. When all components are in running state, thestate of the appliance is operational.

Quiesce—This state appears during a quiesce of the associated service orcomponent.

Maintenance—This state appears when the associated service is inmaintenance. In the maintenance state, components have limited functionality.Infrastructure services do not go into maintenance state. When othercomponents are in maintenance, the appliance state is also maintenance.



Table 35 Component states (continued)

Icon State

Note

You must put the appliance in Maintenance mode for some configurationchanges, for example, to change the network settings or to upgrade theappliance. When configuration changes or an update completes, you mustmanually change the state of the appliance from Maintenance to Operational.

Initializing— This state appears when the component is starting. When thecomponent successfully starts, the state changes to Running.

Shutting down— This state appears when the service that is associated withthe component is stopping.

Shut down— This state appears when the service has stopped.

No response— This state appears when the service that is associated with thecomponent is running, but the service is not responding.

Business Service componentsThe following table summarizes the business services health components.

Table 36 Business Service components


Application Data Management Service Provides the status of the Application DataManagement Service.

Common Business Service Provides the status of the Common BusinessService.

Storage Manager Provides the status of the Storage Manager.

VMDM Provides the status of the VMDM service.

Core Service system health componentsThe following table summarizes the core services system health components.

Table 37 Core system health component


Authentication Provides the status of the Authentication Service.

Catalog Provides the status of the Catalog.

ComplianceVerification

Provides the status of the Compliance Verification service.

DatabaseManagement

Provides the status of the Database Management service.

Event Provides the status of the Event Service.



Table 37 Core system health component (continued)


Log Manager Provides the status of the Log Manager service.

Server DisasterRecovery

Provides the status of a system disaster recovery

System Manager Provides the status of the System Manager.

Task Manager Provides the status of the Task Manager service.

Infrastructure Service system health componentsThe following table summarizes the Infrastructure system health components.

Table 38 Infrastructure system health component


API Gateway Provides the status of the API Gateway service.

Catalog Store Provides the status of the Catalog database.

CommonInfrastructureService

Provides the status of the Common Infrastructure Service.

HTTP Proxy Provides the status of the HTTP Proxy service.

Message Bus Provides the status of the Message Bus.

Secrets Manager Provides the status of the Secrets Manager service.

Service Manager Provides the status of the Service service.

Service Registry Provides the status of the Service Registry service.

UI Provides the status of the User Interface service.

UI Store Provides the status of the UI database.

Web Server Provides the status of the Tomcat service.

Workflow Database Provides the status of the Workflow database.

Management Service system health componentsThe following table summarizes the Management system health components.

Table 39 Management system health components


Dashboard Provides the status of the Dashboard service.

Historical Provides the status of the Historical Data Service.

License Manager Provides the status of the License Manager service.

Scheduler Provides the status of the Scheduler service.

Workflow Manager Provides the status of the Workflow Manager service.



Protection Service system health componentThe following table summarizes the Protection system health component.

Table 40 Protection system health component


Discovery Provides the status of the Discovery Service.



CHAPTER 10

Protecting the eCDM server

This section describes how to create a disaster recovery plan and perform disasterrecoveries of the eCDM appliance, and includes the following topics:

l Manage system backups.................................................................................. 206l Perform a disaster recovery............................................................................. 210

Protecting the eCDM server 205

Manage system backupsThe eCDM system protection service provides you with the ability to protect thepersistent data of an eCDM system from catastrophic loss by creating a series ofsystem backups.

Each backup is considered a “full” backup although it is created in an incrementalmanner. The persistent data that is saved in a backup includes the Lockbox andElasticsearch databases. The backup operation creates a point-in-time snapshot ofthe database while the system is in a quiesced state. While the system is quiesced, theeCDM limits user functionality. After the snapshot completes, and while eCDM copiesthe snapshots to the Data Domain storage unit, full user functionality is restored. Ifthe system fails to quiesce, eCDM still takes a backup. It simply is marked as "crashconsistent" insted of "application consistent."

To store system backups, you must configure and assign a private Data Domainstorage unit for an eCDM system. The eCDM system protection service enables youto manage the frequency and start time of an automated system backup, perform on-demand backups, and define the length of time that the system backups are availablefor recovery.

Configure the Data Domain systemBefore you begin

Before you can use the Data Domain to protect the appliance, configure NFS and theMTree that the appliance uses on the Data Domain system. The setup on Data Domainrequires addition of the eCDM client with no_root_squash.

Procedure

1. Use a web browser to log in to the Data Domain System Manager as thesystem administrator user.

2. In the Summary tab, Protocols pane, select NFS exported > create export.

The Create NFS Exports window appears.

3. In theCreate NFS Exports window:

a. In the Export Name field, specify the name of the Data Domain MTree.

b. If you have not yet created the Data Domain MTree, follow the prompts tocreate the MTree and click Close.

c. In the Directory path field, specify the full directory path for Data DomainMTree that you created. Ensure that you use the also use the same name fordirectory.

d. Click OK.

A message appears to indicate that the NFS export configuration save is inprogress and then complete.

e. Click Close.



Configure the appliance system protectionConfigure disaster recovery protection for the appliance the and the appliancemetadata.

Before you begin

Configure a DD Boost Storage Unit that is dedicated to the appliance, and ensure thatthe appliance has client access privileges to DD Boost.

Procedure



Note


2. In the login window, specify the following values, and then click Login.

Note

The values in each field are case sensitive.

a. In the User field, type an account, which is assigned to the System tenantadmin role, for the appliance. For example, admin.

b. In the Password field, type the password for the sysadmin account.

The default password is admin.



4. Select the System Protection tab.

The System Protection window appears.

5. Click Edit.

6. In the Data Domain System field, specify the FQDN of the Data DomainSystem. For example, bu-idd-ecdm.emc.com

7. In the DD Boost Storage Unit field, specify the full path that you defined forthe storage unit. For example, /data/col1/ecdm

8. In the Backup Schedule section, to enable the backup schedule, select theInactive toggle, and then choose the backup frequency.

l If you select Daily, select the time to start the backup each day.

l If you select Hourly, specify the backup interval.

Note

You cannot change the start time when you choose an hourly backup.

9. In the Backup Retention section, define how the appliance retains systembackups.


Configure the appliance system protection 207

a. In the Minimum number of backups to retain field, specify the minimumnumber of server backups to retain on the system.

The smallest supported value is 2.

b. In the Maximum number of backups to retain field, type the maximumnumber of server backups to retain on the system.

Specify a value that is greater than or equal to the Minimum number ofbackups to retain value and less than or equal to 360.

c. In the Keep System DR backup until field, specify the retention time for aserver backup.

The minimum supported retention time is 2 day and the maximum supportedretention time is 10 years.

10. Click Save.

Troubleshooting backup configuration issuesThe following section provides a list of error messages that might appear when youconfigure an appliance backup configuration.

Data Domain storage unit mount command failed with error: 'Cannot mount fullpath: Access is denied'This error message appears when an NFS export does not exist on the Data DomainSystem for the full path to the DD Boost Storage Unit.

To resolve this issue, ensure that you have configured an NFS export for the full pathof the DD Boost storage unit and that the appliance is and Export client.

Data Domain storage unit mount command failed with error: 'Cannot resolveFQDN: The name or service not known'This error message appears when the appliance cannot contact the Data DomainSystem by using the specified FQDN. To resolve this issue, ensure that you canresolve the FQDN and IP address of the Data Domain System.

Perform manual (ad-hoc) appliance backupIf you need to perform a backup outside of the backup schedule, you can manuallyback up the system on-demand (ad-hoc) by using the Back Up Now functionality inthe eCDM UI.

Procedure

1. Use the Chrome web browser to log in to the appliance management interface.



The System Protection window appears. The System Protection windowdisplays information about any scheduled and ad-hoc backups that have alreadybeen performed, in addition to the Data Domain system and storage unit usedfor Back Up Now functionality.

4. Click Back Up Now.

The Ad-hoc System Backup Confirmation dialog appears.

5. Specify a name that will allow you identify the backup, and then click Confirm.



Figure 36 Ad-hoc System Backup Confirmation

Note

If you do not specify a name for the backup, a default system-generated namewith a timestamp is used, for example, UserDR-timestamp.

Results

After a few moments, the System Protection window updates with an entry for thebackup, indicating that the backup is Active. Additionally, the Activity Monitor allowsyou to monitor the progress of the system backup. Monitoring system protectionactivities provides more information. When the backup completes, the SystemProtection window displays a summary of the backup.

Monitor system protection activitiesPerform the following steps to monitor the progress of a system backup.

Procedure

1. From the Main menu, select Activity Monitor.

2. Click Tasks, and then select System task type.

Results

The Activity Monitor window displays a list of system protection tasks and theprogress of each task.

The following figure provides an example of the Activity window with the status oftwo system tasks: the system backup task and the workflow task associated with thesystem backup.


Monitor system protection activities 209

Figure 37 System tasks in the Activity Monitor window

Manually delete system backupsYou can delete a system backup before the end of the retention period, only when thenumber of existing backups is greater than the value defined in the Minimum Numberof Backups to Retain field.

Procedure

1. Use the Chrome web browser to log in to the appliance management interface.



The System Protection window appears. The System Protection windowdisplays information about any scheduled and ad-hoc backups that have alreadybeen performed, in addition to the Data Domain system and storage unit usedfor Back Up Now functionality.

4. Select the backup that you want to delete, and the click the Trash Can iconlocated to the right of the backup.

5. To permanently delete the server backup, on the Confirm window, clickContinue .

Perform a disaster recoveryTo restore the data from a system backup in the event of a disaster, you must deploya new appliance from an OVA, and then select the system backup to restore. Thepersistent data in the selected backup replaces the persistent data on the newappliance.

Perform a eCDM disaster recoveryPerform a disaster recovery to restore a point-in-time configuration of an appliancefrom a backup.

Before you begin

Before you perform the disaster recovery, you must:

l Deploy a new appliance.

Note

The IP family for the appliance must match the IP family at the time of backup.

l Ensure that the new appliance has access to the Data Domain System thatcontains the server backups.



l Have knowledge of the following environmental information:

n FQDN of the Data Domain system that contains the server backup.

n DD Boost Storage Unit that contains the server backup.

n The lockbox password set at the time of the backup.

Procedure



Note


2. On the Install Options window, select Recover from backup, and then clickNext.

3. In the View Network Settings window, review the network settings and thenclick Next.

Note

You can use the dashboard to change the values that are displayed in the ViewNetwork Settings window after you complete the initial configuration.

4. On the OS password window, in the Password and Confirm password fields,specify a password for the root, admin, support and lockbox accounts, and thenclick Next.







~!@#$%^&*()_+`-={}|[]\:'";,./<>?

5. On the Set the System Time Zone window, select the time zone and then clickNext.

6. On the Recover Settings window, perform the following steps to configure theData Domain System:

a. In the Data Domain System field, specify the FQDN of the Data Domainsystem.

b. In the DD Boost Storage Unit field, specify the full path that you definedfor the storage unit.

c. To display a list of server backups, click Browse.


Perform a eCDM disaster recovery 211

d. Select the server backup from which you want to recover, and then clickRecover.

The Backup List displays the name you set for the backup, the version ofthe appliance software used for the backup, and the consistency state of thebackup.

Note

You can only restore the appliance configuration from a backup when theversion of eCDM used for the backup matches the version currently in use.For example, if the eCDM version is 2.2.0 and Server DR backups wereperformed using version 2.1.0, these backups are invalid for the appliance, ornot available for restore. In this case, you would be required to deploy the2.1.0 eCDM OVA to restore the backup, and then apply the 2.2.0 upgradeafter performing the restore.

e. In the Lockbox password field, specify the lockbox password that wasconfigured for the appliance at the time of the selected server backup.

f. Click Recover.

Results

The Recovery Progress window appears and once the recover operation completes, asystem reboot occurs. After the reboot and component start up completes, theDashboard appears.

Troubleshoot disaster recoveries

ERROR 500: Cannot resolve hostname: Name or service not known. Ensure thatyou can resolve the FQDN and IP address of the Data Domain System.This error message appears on the Recover Settings page when the appliance cannotcontact the Data Domain System by using the specified FQDN.

To resolve this issue, ensure that you can resolve the FQDN and IP address of theData Domain System.

Data Domain storage unit mount command failed with error: 'mount.nfs:mounting hostname/path failed, reason given by server: No such file or directoryThis error message appears on the Recover Settings page when the appliance cannotaccess the path that you specified the in DD Boost Storage Unit field.

To resolve this issue, confirm that the path to the DD Boost Storage Unit exists and isaccessible on the Data Domain system.

Lockbox authorization failed. This may occur when the specified passphrase isnot correct.This error message appears when you specify a passphrase value that does not matchthe passphrase used at the time of the server backup.

To resolve this issue, specify the correct passphrase value.



CHAPTER 11

Logs and Troubleshooting

This section contains the following topics related to log configuration and enabling theEMC Secure Remote Services (ESRS) gateway:

l Logs..................................................................................................................214l Collecting logs to troubleshoot issues...............................................................217l Create a log bundle on a vRPA cluster.............................................................. 219l Register the EMC Secure Remote Services gateway....................................... 221l Troubleshooting Microsoft Application Agent discoveries on Windows 2008 and

Data Domain Boost...........................................................................................224l Troubleshooting SMIS/VMAX discoveries....................................................... 224l Time synchronization required between eCDM and the systems it interfaces with

.........................................................................................................................225

Logs and Troubleshooting 213

LogsFor users who require more information to troubleshoot issues, in the Logs window,you can change the logging levels for any eCDM related component and export logbundles on demand.

You can access the Levels and Exports tabs in the Logs window from the eCDMSettings window. Go to Main Menu > Settings, and then click Logs. By default, Logsopens on the Levels tab.Figure 38 Log Levels window

Log levelsThe Levels tab allows you to set the log level for individual components, or use thesame level for all components. By default, each eCDM component is initially set toInfo.

Note

The Levels tab only displays the eCDM supporting components for which can you setlog levels.

Components are categorized under the following services:

l Business Service

l Core

l Protection

l Management

You can set each component to one of the following log levels:



l Error

l Warn

l Info

l Debug

l Trace

To set the log level for individual components, use the slider next to the component.

To change all components to the same log level, drag the Set all levels to slider to theright, and then select the log level from the list box.

The following figure illustrates how to set the same log level for all components.

Figure 39 Choose Log level for all components

Export logsUse the following procedure to generate and download a log bundle.

Procedure

1. From the eCDM UI, go to Main Menu > Settings > Logs > Export.

The Exports window appears.

2. Set the date range by using the slider.

The range can be a maximum period of 7 days up to the current date. The rangemust be a minimum of 1 day.

The following figure displays the available dates for log bundle generation.


Export logs 215

Figure 40 Available Dates for log bundle generation

3. Click the Create Bundle button.

The new Log bundle displays in the Log Exports table, with a status of Building.

4. When the status changes to Completed, download and view the log bundle byclicking the link for the entry in the table.

5. To cancel or delete the log bundle entry, click next to the log bundle.

When a bundle is canceled or a bundle generation fails, an entry appears in thetable until that entry is deleted.

The following figure illustrates how to cancel or delete a log bundle entry.

Figure 41 Log bundle link

After you create the first log bundle, subsequent log bundles that are createdwithin the available specified dates will provide an estimated generation time(Estimated Completion) and an estimated size (Estimated Current Bundle).



Note

The Used space that is indicated in pink in this window displays a minimum of 33 MB.eCDM requires this space for file overhead.

Collecting logs to troubleshoot issuesThe following table provides information on how to collect the logs for each eCDMcomponent to diagnose common problems.

Table 41 Log collection by eCDM component

Component Problem type Logs toCollect

How to collect

All components Any encountered problemacross components

eCDM Log in to the eCDM UI and go to Settings >

Logs > Exports.If installation has not yet been performed,ssh using default administrator credentialsand collect the entire /var/logs/brsfolder and its directories.

XMS/XtremIO protectioncopies

l Problems DiscoveringXtremIO XMS

l Problems taking XtremIOProtectPoint snapshots

l Problems with XtremIOcompliance

l Problems with XtremIOProtectPointconfiguration

l Problems with export/delete/recovery withXtremIO ProtectPointcopies

XtremIO XMS For version 4.2.x:

1. Log in to the XMS UI and select

Administration.

2. Select CLI Terminal > create-debug-info.

For version 6.x, ssh into xmcli> create-debug-info.

RecoverPointClassic

Log in to the RecoverPoint UI and go to

Admin > System Analysis Tools >

Collect System Information, or ssh intoboxmgmt> Diagnostics> Collectsystem information.

Data DomainManagementConsole(DDMC)

Log in to the DDMC UI and click the Settingicon, and then go to Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.

Data DomainOperatingSystem(DDOS)

Log in to DDOS UI and go to

Maintenance > Support > SupportBundles > Generate Support Bundle,or ssh into ddcli> support bundlecreate default

XMS/XtremIO primary copies l Problems DiscoveringXtremIO XMS

XtremIO XMS For version 4.2.x:

1. Log in to the XMS UI and select

Administration.


Collecting logs to troubleshoot issues 217

Table 41 Log collection by eCDM component (continued)


How to collect

l Problems taking XtremIOPrimary snapshots

l Problems with XtremIOPrimary compliance

l Problems with export/delete/recovery withXtremIO primary copies

2. Select CLI Terminal > create-debug-info.

For version 6.x, ssh into xmcli> create-debug-info.

SMI-S/virtual machineAXprotection copies

l Problems DiscoveringSMI-S

l Problems taking virtualmachineAX ProtectPointsnapshots

l Problems with virtualmachineAX compliance

l Problems with virtualmachineAX ProtectPointconfiguration

l Problems with export/delete/recovery withvirtual machineAXProtectPoint copies

SMI-S Log in to the SMI-S host and collect all logsfrom /opt/emc/ECIM/ECOM/logand /var/symapi/log.


Login to DDMC UI and click the Settingicon, and then go to Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.


Log in to the to DDOS UI and go to

Maintenance > Support > SupportBundles > Generate Support Bundle,or ssh into ddcli> support bundlecreate default.

SMI-S/virtual machineAXprimary copies

l Problems DiscoveringSMI-S

l Problems taking virtualmachineAX Primarysnapshots

l Problems with virtualmachineAX Primarycompliance

l Problems with export/delete/recovery withvirtual machineAXprimary copies

SMI-S Log in to the SMI-S host and collect all logsfrom /opt/emc/ECIM/ECOM/logand /var/symapi/log.

Hypervisor Direct (VirtualMachine Data Management)

l Problems deployingPP4virtual machines andregistering in eCDM (onlyRP logs required)

l Problems discoveringvirtual machinewarevirtual machines andcopies

l Problems takingPP4virtual machinebackups

vRPA ssh boxmgmt@<vRPA IP>:Diagnostics> Collect systeminformation.

VMwarevCenter server

Log in to the vSphere Web Client:

1. Go to vCenter Inventory Lists >

vCenter Servers.

2. Select the vCenter server.

3. Click the Monitor tab.

4. Select System Logs.



Table 41 Log collection by eCDM component (continued)


How to collect

l Problems with PP4virtualmachines configuration

l Problems with virtualmachineware virtualmachines compliance

l Problems with virtualmachine copy deletion/recovery

ESXi Log in to the vSphere Web Client:

1. Go to Hosts and Clusters.

2. Select the ESXi host.

3. Click Actions > Export System Logs.

Repeat this for all the ESXi hosts thatcontain your vRPAs or protected virtualmachines that are problematic.


Log in to the DDMC UI and click the Settingicon, and then go to Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.


Log in to the DDOS UI and go to

Maintenance > Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.

SQL l Problems with agentregistration

l Problems with discoveryof instances/DBs/copies

l Problems with SQLcompliance

DDBEA logs All .log files from: C:\Program Files\DPSAPPS\MSAPPAGENT\ADM Agent\binon the SQL host.All .log files from C:\Program Files\DPSAPPS\MSAPPAGENT\logs on the SQL

host.

DDMC Logs Log in to the DDMC UI and click the Settingicon, and then go to Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.

DDOS Logs Log in to the DDOS UI and go to

Maintenance > Support > SupportBundles > Generate Support Bundle, orssh into ddcli> support bundlecreate default.

Create a log bundle on a vRPA clusterPerform the following steps to collect vRPA logs and bundle those logs on a vRPAcluster.

Procedure

1. Log into the eCDM UI.


Create a log bundle on a vRPA cluster 219

2. Use SSH keys to run the following commands:

ssh-agent bashssh-add ~admin/.ssh/ssh_id_rsassh boxmgmt@{vrpa-mgmt-ip}

3. Once you are connected to the vRPA, run through the following sequences:

** Main Menu **[1] Installation[2] Setup[3] Diagnostics[4] Cluster operations[5] Shutdown / Reboot operations[Q] QuitPP4VM_86 RPA 1: 3 ** Diagnostics **[1] IP diagnostics[2] SAN diagnostics[3] Synchronization diagnostics[4] Collect system information[5] Run internal command[M] Main Menu[B] Back[Q] QuitPP4VM_86 RPA 1: 4

4. Enter the dates and times to start and stop collecting information.

5. Select the log collection method you want to perform. The available optionsinclude full log collection and partial (custom) log collection. The defaultmethod is full log collection.

6. Provide the following answers to these questions:

a. For Do you want to unite all logs to one tar on localcluster (Default 'y') (y/n)? , type y.

b. For Do you want to copy the output file to a remote FTPserver (y/n)? type n.

c. For Do you want to include core files in the collectionprocess (Default 'y') (y/n)? type y.

7. Select the RPAs, separated by commas, that you want to include in the RPA logcollection process. By default, all RPAs are included.

The System component connectivity status and Systemcomponent collection results display for the specified RPAs.

8. Once the specified system information has been successfully collected, thefollowing information appears, along with a URL, to collect the logs. Specify theboxmgmt user credentials to log in and download the logs.

Results

The log collection results appear in the ic_report file, also available at this URL.Log collection URLThe specified system information has been successfully collected. Browse to thefollowing links to retrieve the output file:



Table 42 Example log collection URL

Cluster URL

<clusterName> https://<IP>/info

Register the EMC Secure Remote Services gatewayEMC Secure Remote Services (ESRS) allows a System Tenant Admin user to registerthe eCDM appliance with a gateway host IP address for remote access. You canregister only one ESRS gateway for an eCDM appliance. After the eCDM appliance isregistered, Technical Support Engineers can remotely connect to an eCDM applianceto troubleshoot issues, and you can upgrade the eCDM appliance by using ESRSversion 3.20.10.08 or later.

Before you begin

Apply a valid license to the gateway and associate your customer service account(credentials) with the gateway site.

Use the following procedure to register or manage the ESRS gateway.

Procedure

1. From the eCDM UI:

a. Go to Main Menu > Settings > Overview > Secure Remote Services(ESRS).

b. Cick the Edit icon within the pane.

A dialog box appears.

Figure 42 ESRS panes in Settings window

2. In the dialog box, type the gateway hostname or IP address.


Register the EMC Secure Remote Services gateway 221

Figure 43 Register the gateway hostname or IP

3. Click Save to complete registration of the ESRS gateway.

Note

Currently, you can use only an IPv4 address for the gateway. IPv6 is notsupported.

4. After you click Save, an Edit icon appears next to the gateway hostname field,which allows you to update the hostname or IP address of the gateway to whichthe device is already registered. When you update the hostname, eCDMoverwrites the previous entry but does not unregister this gateway, and there isno option within the Settings window to delete the previous entry. Tounregister the previous gateway address, you must use a curl command.

Note

You can only add or manage an ESRS gateway when you apply a front-end terabyte(FETB) license. If you are using a trial license, the Edit icon is disabled.

The following message displays in the ESRS pane.



Figure 44 ESRS Gateway disabled for trial license

CallhomeWhen you register an ESRS gateway, you also enable the Callhome feature, whichallows Technical Support Engineers to collect data related to troubleshooting deviceand eCDM appliance issues. Callhome does not collect any personal information.

The following table lists the types of information that Callhome collects.

Table 43 Information collected by Callhome


eCDM appliance l Date of the last upgrade

l Any applied patches

l Version of the appliance

l Uptime (in days) since the last appliance reboot

Data Domaininventory

l Number of Data Domain systems

l Data Domain operating system version and system ID

l Mtrees per Data Domain system

l Data Domain system capacity

VMAX inventory l Number of VMAX systems

l VMAX operating system version and system ID

l Protected asset list of LUNS and storage groups with size

XIO inventory l Number of XIO clusters

l XIO operating system version

eCDM operationalinventory

l Asset information (number of assets, asset groups, assetsprotected versus unprotected)

l Protection plans (number of plans, plans instances per tenant)

l Tenants (number of tenants)


Callhome 223

Table 43 Information collected by Callhome (continued)


l Tags (number of tags and tag categories)

l Active plan details (assets and their types, objectives for eachstage)

Usage l Amount of data that is protected

Licensing l Status of the applied license

Storage managers l Number of Unisphere instances in inventory

l Unisphere hostnames and versions

l Number of DDMC instances in inventory

l DDMC hostnames and versions

Troubleshooting Microsoft Application Agent discoveries onWindows 2008 and Data Domain Boost

When you perform a Microsoft Application Agent discovery on Windows 2008 oneCDM and Data Domain Boost versions 4.5 and 4.6, the eCDM agent uses thewmic.exe command to discover the installed programs. The default eCDM agentinstallation on Windows 2008 R2 produces an error in the ecdmagent log, anddiscovery fails.

In Some Windows 2008 environments, the wmic.exe command does not workproperly when you run it from the local user or local system account, and it causes thefollowing error: Failed to run wmic: ERROR: error running command`wmic.exe product where name like 'DDBEA and ProtectPointMicrosoft app agent' or name like 'Microsoft Application agent'get Name, Version /format:csv`: exit status 44210To avoid the error and ensure that Microsoft Application Agent discoveries onWindows 2008 and Data Domain Boost succeed, run the wmic.exe command asdomain administrator instead of local administrator.

Troubleshooting SMIS/VMAX discoveriesWhen you perform a SMIS/VMAX discovery in eCDM, the status might display assuccessful but show that 0 systems have been found.

To fix the issue and ensure that SMIS can detect the arrays, perform the followingprocedure.

1. On the SMIS host, stop the ecom service under services.msc.

2. Delete or rename the symapi_db.bin file under C:\Program Files\EMC\SYMAPI\db.

3. From the symcli, run symcfg discover.

4. Run symcfg list and verify that all of the arrays appear.



5. Restart the ecom service.

6. After a few minutes, run the curl command (which command? Do you mean curl -k-i -H?) to verify that SMIS can detect the arrays, and then retry the discovery ineCDM.

Example 4 Example curl command output

The following example shows a successful curl command output:

admin@lava66154:~> curl -k -i -H "Accept:application/atom+xml" -H "Content-Type:application/atom+xml" -u "admin:#1Password" https://10.7.66.151:5989/ecom/edaa/root/emc/instances/Symm_StorageSystem/CreationClassName::Symm_StorageSystem,Name::SYMMETRIX-%2B-000196801156/relationships/Symm_InventorySoftwareIdentityHTTP/1.1 200 OKSet-Cookie: ECOMSecurity=z0tubnf7zvcoty31f677----------------X-Frame-Options: SAMEORIGINContent-Type: application/atom+xmlContent-Length: 20659Transfer-encoding: chunked

Time synchronization required between eCDM and thesystems it interfaces with

The eCDM system time is synchronized with the ESXi host system time. It is critical toeCDM operation that the eCDM system time matches the systems that it interfaceswith. Otherwise, compliance check will fail.

Dell EMC recommends that the ESXi host, and all of the systems that the ESXi hostinterfaces with, be configured to use a NTP server.


Time synchronization required between eCDM and the systems it interfaces with 225

dell emc ecdm · 2020-05-06 · dell emc ecdm version 2.1 administration and user guide 302-004-944...

Documents