Hi,

I think activity in this forum is - unfortunately - low, so I thought I spice it up with some challenge.

Customer of ours wants to do proper event-based retention but has a significant investment in NetApp (and SnapLock in conjunction with CPE). This is a contradiction in itself as there is no indefinite retention on the NetApp or (CPE supported) Device Holds which for the bases for such an undertaking.

In doing some research I came across the following paragraph in a NetApp document:

One simple, real-world example is in the context of a healthcare organization that is using an enterprise content management (ECM) solution such as IBM FileNet to manage patient records on a SnapLock enterprise volume. This company is required by HIPAA to retain immutable copies of patient records for seven years after the death of a patient. Although FileNet has been integrated with SnapLock, this type of

business process requires extended integration through NetApp ONTAPI™.

Because the date of death is not known in advance, all patient records are initially set with infinite retention. Seven years after the event has occurred, FileNet executes a delete preprocess that contains the code to remove the patient

data from the SnapLock volume. Within FileNet this is registered as an auditable event. Similarly, within the NetApp storage system, the privileged delete operation is logged to a SnapLock compliance volume that cannot be modified or removed by even the storage administrator. The integration of an ECM application such as FileNet with SnapLock and privileged delete helps companies to satisfy regulatory record retention requirements on a flexible and cost-efficient storage platform.

Big question: How did the achieve this? Where to get the path to the file to delete? What is the exact process?

Kind regards,

/Gerold

Gerold - we don't support indefinite retention with a NetApp Fixed Content Device. So there are two ways to achieve what you want:

Option 1 - Configure the NetApp fixed content device in unaligned mode, then CPE wont send retention settings across to the NetApp device. Now you can use the CPE indefinite retention setting, and when the event occurs update the CPE retention to 7 years from the date of the event. The sweep mechanism in ACCE can be used to make the retention updates, and it can also be used to look for content whose retention has expired and issue the delete request.

Option 2: Configure the NetApp fixed content device in aligned mode. Now the CPE will send any retention settings to the NetApp device. As documents are ingested, set the CPE retention to seven years. This value will be based to the NetApp device. Use sweep in ACCE to regularly check for documents that have reached their seven year retention, but for which the event signaling the final seven years has not occurred, and extend the retention on those documents for another seven years. Likewise use sweep to set the retention to 7 years if the event has occurred. And again, use sweep to delete documents that have reached their seven year retention requirement for which the event has occurred.

More on configuring a NetApp fixed content device is available here: https://www.ibm.com/docs/en/filenet-p8-platform/5.5.x?topic=devices-netapp-snaplock-fixed-content-device

CPE retention options are described here: https://www.ibm.com/docs/en/filenet-p8-platform/5.5.x?topic=objects-retaining

And the sweep mechanism is described here: https://www.ibm.com/docs/en/filenet-p8-platform/5.5.x?topic=objects-handling-bulk-processing-sweeps

Ruth,

thank you for your elaborate explanation. It exactly describes the dilemma the customer is facing.

Option 1 is without the 'additional' protection the customer wants.

Option 2 is not valid in the EU and Switzerland. Data and documents must be deleted if

a. there is no legal requirement any more

b. They have no direct or indirect business purpose

So extending another 7 years can defeat the requirement to delete it in time.

To me event based retention is the only real-life retention. With the so-called fixed retention you are just lucky the know the event right away. E.g. with invoices the event is the document creation date. Apart from very few examples of fixed retention, the rest is event based.

The ONLY way to achieve proper EBR with additional protection is currently ICOS, ECS and HCP in aligned mode. Device holds in my understanding should also work, but I have yet to experiment with it.

Now this customer has a large investment in NetApp (including SnapLock) and still want to make proper retention. Out of the box this is not possible as NetApp does not support event based retention properly (despite their claims in documentation). They just do not have indefinite retention implemented.

So I stumbled over the paragraph in my initial post, where obviously an IBM FileNet customer (a hospital) has implemented a workaround.

This workaround is admittedly ugly and has some flaws (especially error handling comes to my mind) . Still the customer (and I) would like to know how this was achieved to be able to judge if we want to go forward with it or not.

The key technical question (to me at least) is: How to get the path to the file to delete. It must be encoded in the content referral blob. By license I'm not allowed to reverse engineer that code. I searched the API for hours, there is nothing on the content elements that I could find.

The only idea that comes to my mind is to trap the error message that the CPE will undoubtedly throw and which will contain the path to the file it could not delete. Ugly!

Thanks,

/Gerold

Gerold - FileNet supports plenty of storage options that can be used with indefinite retention, so perhaps the customer needs to be looking at one of these other options. The sweep tool can also be used the content from NetApp to the other documentation. While the move occurs, the content stays fully available. You could also encourage your customer to open an enhancement request for NetApp to add support for indefinite retention. The customer should use this site to open the request: https://dba.ideas.ibm.com/ideas