Automate, Protect, Recover:  How IBM Copy Services Manager is great for DS8000 mainframe and Cyber Vault Solutions

If you're already a user of DS8000, or you just purchased one of the new DS8A systems, you might already be familiar with IBM Copy Services Manager (CSM). 

You might know about it's built in sessions and how easy it is to setup, manage, monitor and use. 

And you might even be aware that now starting with the DS8A (R10 release), CSM is entitled to all users that have the copy services features enabled!!!  Making it even easier to setup and use.  

But...did you know that it can be used for SO much more!!!

Beyond being a single pane of glass to manage your 2, 3, 4, 5 or even 6 site solutions, including Safeguarded copy backup creation....CSM can be used to build a highly resilient disaster recovery and cyber vault solution!

How you ask?   Through Automation!

Why is Automation Key When Designing a Resiliency Solution?

So before I dig into what CSM can do in terms of automation, I think I should cover why Automation is important and...well....what exactly I mean be automation.  

Let's start with the latter.  What do I mean by Automation.  In today's world, we are in a constant flux.  Especially with the introduction of AI, new technology is constantly popping up across not only storage system solutions like I mention in DS8000 above, but in servers, applications, networks....the entire framework of an enterprise business.  We are no longer in a world where we can rely on a "one size fits all"....or in this context "one solution fits all" strategy.  Customers adapt to new technologies at different rates, or have different interpretations of exactly what their particular needs are when it comes to creating a resilient environment.  In other words, two customers might be using the same underlying product (such as DB2), but they may be using them entirely different ways. There are for sure commonalities in how they use them....but differences non-the-less. 

So when I talk about Automation, I'm not only talking about taking manual steps out of day to day processes, I'm talking about the ability to build on an Automation framework that can quickly adapt to individual needs.  And as those needs change, the ability to quickly modify the solution.  Cause let's face it, whether it's due to internal or external (like the government), definitions of what it means to be resilient are constantly changing. 

Having an Automation framework that you build on, adapt with, as well as easily learn (as a newer workforce emerges) is...well, as I put it in the sub-title...key. 

Does CSM provide an Automation framework that you can build on, adapt with and easily learn?

You bet it does!   Would probably have been a big build up to a let down if I had answered that question as no right?  haha  

When CSM was first created, we realized that while a lot of customers did things similar...they still ended up creating unique solutions.  So while CSM has a number of "canned solutions" we call sessions, we built the product so that these sessions could be used to create unique solutions.

We also realized that attempting to manage these solutions at an application level might "lock us in" to certain aspects that wouldn't be adaptable for customers.  To say it a little more bluntly...we saw that trying to manage the solutions at the application level might result in numerous requests from customers for support that we might find difficult to deliver on in a timely manner.  And if we can't deliver it in a timely manner....that breaks the customers ability to adapt to the ever changing set of requirements I discussed previously. 

So instead..CSM focused on making CSM robust and adaptable enough to make it easy to integrate it into any solution. 

There are two main components to this:  CSM Scheduled Tasks and the CSM APIs.

What is a CSM Scheduled Task?

CSM scheduled tasks were originally designed to be a simple scheduler that could kick of Safeguarded Copy backups for DS8000 storage systems at a given interval.  But since they're initial creation they've grown to be SO much more.

Scheduled tasks can be be comprised of a set of actions which can help you automate commands, health checks, etc, across one or more sessions.  You can think of it as a way to build a unique set of automation steps within CSM, without having to do any scripting.  These actions you can setup include the following:

• • • Run a given command against a session
    • Wait for the session to reach a certain state
    • Wait for a role pair to reach a given percent complete in the copy
    • Validate the consistency of a role pair
    • Validate the RPO for GM on a given session
    • Run an external script to coordinate CSM with other external tasks

The above actions can be put together in any fashion so that you can simply schedule it....or click a button to run through those steps instead of having to do it manually.  

For example, you could use this solution to create an application consistent Safeguarded Backup of your data in a DS8000 environment at a Recovery Site by creating a Scheduled Task with the following actions:

• • • Check RPO of the Global Mirror leg to make sure it's under a certain threshhold
    • Issue 'Suspend' to the Global Mirror session
    • Wait for the session to reach a Suspended state
    • Issue 'Backup' to the Safeguarded Copy session 
    • Issue 'ResumeGM' to the Global Mirror session
    • Wait for the Global mirror session to get back to a Prepared state

Or you can use go one step further and not only take a Backup but Recover that backup, and invoke and external script to validate the backup as well!!! (Such as IPL a z system using zAnsible).  

• • • Check RPO of the Global Mirror leg to make sure it's under a certain threshhold
    • Issue 'Suspend' to the Global Mirror session
    • Wait for the session to reach a Suspended state
    • Issue 'Backup' to the Safeguarded Copy session 
    • Issue 'ResumeGM' to the Global Mirror session
    • Wait for the Global mirror session to get back to a Prepared state
    • Issue 'Recover' command to Safeguarded Copy session (will recover the 'last backup' to the recovery volumes)
    • Issue 'External Task' that will invoke a script to validate the backup...such as IPL the system 

A scheduled task can also not only be scheduled on a hourly or daily/weekly basis....but if can be configured so that it can be invoked remotely via our APIs. 

And finally, Scheduled Tasks in CSM even have the ability to run other tasks on a successful execution or a different ask on a failed execution.  Meaning you can build if then else type logic within the scheduled tasks without having to write a single line of code!!!

What are the CSM APIs?

CSM does have a traditional CLI.  Automation can be created using that CLI.  But anyone that has built automation on a CLI knows there are some drawback to doing so.  The CLI typically has to be installed on the server with the automation.  This means that it also has to be maintained.  When the server is updated the CLI should be updated as well.  Which could lead to compatibility issues etc if it isn't. 

My focus for CSM Automation instead is on what I'll refer to as a 3 tier API framework.

The CSM automation framework all starts with a robust REST interface.  CSM's REST interface gives the customer the ability to issue any command to the CSM session.  Click here to see the CSM REST documentation.

CSM also provides a python library called pyCSM.  This can be installed in a python environment with pip and uses the CSM REST API to allow customers to write python scripts against a CSM server.  Click here for the pyCSM documentation. 

And finally, CSM provides a CSM Ansible collection.  This Ansible collection is built on the pyCSM library which uses the CSM REST API.  Click here to get to the CSM Ansible collection. 

This 3 tier framework gives customers the flexibility to development automation to any of the layers that they feel fit best in their environment.  If a customer users Ansible...great!  But if they'd prefer python or REST...it's there as well.  Here's a visual representation of the framework.  It's ALL about flexibility!!!

It's this framework in CSM that has made it so easy to integrate it into IBM i and PowerHA CyberVault solutions!!! 

It's also this framework that has helped lead Technology Expert Labs to drives customer solutions using CSM for their Cyber Vault solutions!!!!

Summarized Reasons to use CSM with DS8000 for Powerful, Customized Solutions!!!    

For those that like a nice summarized list of reasons why CSM is great for your DS8000 implementations....here are some key things to consider.

Powerful Scheduling Capabilities   

The CSM scheduled tasks are extremely powerful.  Not only can it schedule at hourly or daily times, but it can be setup to create unique solutions that combine different session types together.  Don't see a session that does exactly what you want?  Build it!   

Automation that's Easy to Learn and Setup 

CSM Scheduled tasks are extremely easy to setup and with the run task on success/failure options, can be setup to create solutions without having to know the intricacies of a CLI, scripting language, etc.  This makes it extremely easy to not only maintain...but to teach.  So when those new college hires come in to help manage your storage, they can pick it up quickly!

Always in line with DS8000 features and quick to respond to customer requests

The CSM team is constantly working to stay on top of the latest and greatest that DS8000 has to offer.  As they keep innovating for you...we keep making it easy for you to manage those innovations!  And we're quick to react to customer requests through the IDEA portal.

Extreme Flexibility and Adaptability  

Other solutions can help you manage your replication or Safeguarded Copy backups, but does it support all the features you need?  Does the canned solutions cover your unique requirements?  Not only does CSM stay on top of the latest DS8000 features, but the architecture I described above makes it ideal for helping you create unique solutions....including application level management!!!   

CSM works closely with IBM Technology Expert Labs and can help work with you no matter WHAT application you use.  Scheduled Tasks can invoked external scripts for virtually any application or environment!   When your business decides to pickup a newly hyped application...you can quickly adapt it into your existing solution.

Distributed and Mainframe support

While this post is directed at Mainframe customers....are you a distributed customer that also has a mainframe environment?  Having a central strategy across your Distributed and Mainframe storage may be a key selling point.  Building a Cyber Vault architecture that can be implemented for your unique customer requirements across your entire business may be a critical!

Security by Design and Multi-tenancy support

CSM has built in User Roles including customizable user roles which allow the customer to setup security in their environment based on their unique security or externally regulated requirements.  These user roles include the ability to separate user access for Multi-tenancy support, so that application admins can do their own work against their sessions without affecting the sessions of other application admins. In addition, CSM provides Dual Control support so that customers can further lock down their Safeguarded Environment knowing that at least two people are needed to issue certain commands. 

Built in Migration Solutions

Did you just buy a DS8A00 and need to move from a DS8900 to the DS8A?   Great!   CSM has both primary and secondary storage system migration solutions to help you move between DS8000 systems!!!  

Easy to Use, See, Monitor and Manage

I've mentioned it before but CSM is extremely easy to use and manage.  While the automation framework is great, the CSM GUI interface provides real time ways to manage and monitor your environment.  With Dynamic Pictures and warning prompts you can tell what's going on with a simple glance.  Or receive SNMP or email alerts when you're not watching!

Resiliency within the Resiliency

It's not enough to have a resiliency solution on just the storage side.  You need to have resiliency within the product that is giving you're resiliency solution as well.  CSM has active and standby server support so that you can be assured that even if CSM is involved in your disaster, you can quickly take over any actions or scheduled tasks on the standby server.  

In addition CSM creates automatic backups of it's own database which can be used to restore a server or migrate to a new physical server!

React to Threat Detection Events 

DS8A R10.1 just added the threat detection engine into the Flash Core Modules which will help customers receive alerts when an anomaly is detected.  And Threat Detection for z is now available for catching anomalies on the z System itself!   While you can easily setup a SIEM listener that receives these events and then calls a Scheduled Task to run on the CSM server....soon the CSM server itself will receive the events which you can setup to react to as well!  

As you can see...CSM can be a powerful tool in creating an Resilient, Flexible and Easy to maintain solution for your business needs. 

Please reach out if you have any additional questions on IBM Copy Services Manager and how it can help you build out a resilient solutions.

Randy Blea - CSM Architect <blead@us.ibm.com>

And to reach out for more details on how IBM Technical Expert Lab services can help you use CSM to build a Resilient Solution, reach out in the following link

https://www.ibm.com/account/reg/signup?formid=MAIL-consult
For example you can reach out and ask about "“Services to implement application consistent SGCs in CSM”.

#DS8000

#IBMCopyServicesManager

#CyberVault

#txc2025session