TSM (Mirror data on tape at JSC)

FZJ provides tape backups on machines in Jülich. The underlying technology is IBM Tivoli Storage Manager (TSM) as a backend to the IBM Spectrum Protect client/framework. The intranet starting point for all further reading is the data backup page of ITS.

From our perspective of a homogeneous Linux (Qlustar) environment in Erlangen/Nürnberg, this is as off-site as it can get (geographically and from the backend technology), however note that this technical independence also means limited interoperability and flexibility.

Manage the backup nodes (for computer backup or archive) at the ITS self-service, category „Datensicherung“, or dedicated page.

;Mention complementary mirroring refer to: gitlab (WHICH selected projects? Bots?) | wiki (SSL?) | internal off-site mirroring

CompFlu archive node: Cold scientific data, long-term mirror for /archive dam → sn-1
CompFlu backup nodes:
- Hot scientific data, user homes: /home-er, /home-nbg
- Operational infrastructure (configs): hn-1, dam, fire
Not included: /data-{er,nbg} (only in-house off-site mirroring), dam:/backups (ancient backups from TU/e et al.)

Start interactive session	`dsmc`	https://www.ibm.com/docs/en/storage-protect/8.1.20?topic=session-process-commands-in-interactive-mode
List node(s)	`dsmc query node` (needs password)
List archive directories	`dsmc query archive “/archive/*”`
List all archived files (recursively)	`dsmc query archive “/archive/*” -subdir=yes`
Restore a file	`dsmc rest <+TBD+>`	https://www.ibm.com/docs/en/storage-protect/8.1.20?topic=uc-restore
Further reading	(official docs are of typical bn$ quality)	https://docs.gz.ro/tsm-client-commands.html

JH7r 2023-10-02: Can't proceed further since it seems that missed certificate chain broke continuity of backup access. Try again tomorrow™.

A machine can participate in the TSM data exchange, when it holds

the TSM/DSM binaries (packages installed, see section below)
a node configuration located in /opt/tivoli/tsm/client/ba/bin/dsm.sys
/opt/tivoli/tsm/client/ba/bin/dsm.opt present (might be empty, but creates warnings if it doesn't exist)
DSM certificates are valid. These must obviously be provided by FZ Jülich (see dsmcert below)

Log 2023-10-02: sn-1 via Qlustar chroot

Obtain DEB packages from https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86_DEB/BA/

# hn-1
wget https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86_DEB/BA/v8120/8.1.20.0-TIV-TSMBAC-LinuxX86_DEB.tar   # 198 MB as of 2023-10-02
cd /apps/chroots/jammy/mnt/           # I have to dump the files here, since NFS mounts or bind-mounts wouldn't be visible from the chroot
bsdtar -xf ~-/8.1.20.0-TIV-TSMBAC-LinuxX86_DEB.tar

# hn-1 chroot-jammy
cd /mnt/
apt install ./tivsm-ba.amd64.deb ./tivsm-api64.amd64.deb ./gskssl64_8.0-55.31.linux.x86_64.deb ./gskcrypt64_8.0-55.31.linux.x86_64.deb     # We don't need to install all of the .deb in that tarball
debfoster
rm -Rf *
cd /usr/lib
ln -s /usr/local/ibm/gsk8_64/lib64/libgsk8{ssl,iccs,km,cms}_64.so .    # FIXME There must be a better way than this.

# sn-1
dsmc

Describe setup of TSM config and how it interoperates with local filesystem (and how to check this (and how everyone can check this (and the steps necessary for a single person to restore something from backup (a backup is only as good as its operation instructions (a backup is only a backup once you have successfully recovered from it.)))))

(Re)gain control over iek11-itb owned tivoli nodes

Note that the client DEBs are not properly organised (like in a Debian repo/PPA), so you have to repeat these steps to update and/or add the TSM client to any machine.

dmscert history/errors

TSM (Mirror data on tape at JSC)

Backup in Daily Routine Operation

Nodes

Interact with the client

TSM Client Setup

Install TSM on a Linux machine

DSM chain of trust, certificate