Washington Systems Center - Storage - IBM...IBM WSC DS8000 Offerings Customer Workshops • DS8000...

© Copyright IBM Corporation 2020

Washington Systems Center - Storage

Accelerate with IBM Storage: IBM DS8900F R9.1 Update

Brian Sherman, Craig Gordon, Dennis Robertson, Lisa Martinez, Rick Pekosh – WSC Storage


© Copyright IBM Corporation 2020© Copyright IBM Corporation 2020

Accelerate with IBM Storage Webinars

The Free IBM Storage Technical Webinar Series Continues in 2020...

Washington Systems Center – Storage experts cover a variety of technical topics.

Audience: Clients who have or are considering acquiring IBM Storage solutions. Business Partners and IBMers are also welcome.

To automatically receive announcements of upcoming Accelerate with IBM Storage webinars, Clients, Business Partners and IBMers are welcome to send an email request to [email protected].

Located on the Accelerate with IBM Storage Site: https://www.ibm.com/support/pages/node/1125513

Also, check out the WSC YouTube Channel here: https://www.youtube.com/channel/UCNuks0go01_ZrVVF1jgOD6Q

2020 Upcoming Webinars:

September 17 – Introducing IBM SANnavRegister Here: https://ibm.biz/BdqVhF

September 29 – IBM b-type FICON Virtual FabricsRegister Here: https://ibm.biz/BdqVhX

October 6 – IBM Copy Services Manager UpdateRegister Here: https://ibm.biz/BdqLnr

2

mailto:[email protected]://www.ibm.com/support/pages/node/1125513https://ibm.biz/BdqVhFhttps://ibm.biz/BdqVhXhttps://ibm.biz/BdqLnr



Accelerate with IBM Storage Survey

Please take a moment to share your feedback with our team!

You can access this 5-question survey via Menti.com with code 33 45 00 0 or

Direct link https://www.menti.com/mkg7a2x6q8

Or

QR Code

3

http://menti.com/https://www.menti.com/mkg7a2x6q8



IBM WSC DS8000 Offerings

Customer Workshops

• DS8000 Advanced Functions Virtual Workshop

Demo / Test Drives for IBM/Business Partner skill development and for remote customer demonstrations

• Business Resiliency with Copy Services Manager Demonstration and Test Drive

• DS8900F Demonstration GUI Demonstration and Test Drive

• DS8900F Safeguarded Copy Test Drive

• DS8900F Safeguarded Copy SME lead Demonstration

Studies

• DS8000 Global Mirror Bandwidth Sizing – estimate required network bandwidth for target Recovery Point Objective (“RPO”)

• DS8880 Transparent Cloud Tiering Savings Analysis – calculate CPU savings from TCT cloud offload of HSM host cycles

• DS8000 Safeguarded Copy Sizing – calculate the capacity needed to meet Logical Corruption Protection ("LCP") requirements

IBM WSC – Customer Workshops, Demos & Test Drives and Studies

4



Agenda

• Release 9.1 Summary

• DS8900F Hardware

• Safeguarded Copy and Replication

• Transparent Cloud Tiering (TCT)

• Key Server, GUI, LDAP and Usability

• Safeguarded Copy Sizing

• Miscellaneous Items

5



DS8900F R9.1 – Overview of what’s new

6



DS8900F R9.1 Announcement Summary - Highlights


• 3.4TB Cache

• DS8950F support for 1.9TB Flash

• zHyperLink GM Writes support

• DS8910F integration into z15 T02 and LinuxONE III LT2

• Upgraded Gen2 HMC

• HyperSwap Hardware Reserves

• Safeguarded Copy, Replication and Thin Provisioning

• Dynamically expand Safeguarded Copy capacity

• 4TB Open Volume Replication

• Thin-Provisioning: FB Host Initiated Space Release with CS


• TCT Object Store Compression and Secure Data Transfer (SDT) for Encryption to TS7700

• DFSMSdss Full Volume Dump

• New Key Server Support, GUI, LDAP and Usability

• Capacity Monitoring terminology consistency

• DSCLI hardware queries

• Simplified LDAP configuration, other GUI and NI functions


• ESE Sizing tool

• Miscellaneous Topics

Dates:08/11/2020 Announcement

09/11/2020 General Availability

7



DS8900F R9.1 – Hardware Enhancements

8



DS8950F Increase in Cache Size

• Increase from 2TB to 3.4 TB Cache (1.7x) • Designed to enable more box consolidation of older DS8000’s to DS8950F• Available option on 40-core DS8950F system• NVS size remains the same

Model Processors

per System

Max Sync

IO threads

available

System

Memory

NVDimm

System

NVS

Expansion

Frame

Max HA Max Sync IO

Links

Max HPFE

Gen 2

Max SSD’s

DS8950F - Agility Class (R9.1)

996 20-core 10 512 32 0 16 (64 ports) 6 4 192

996 40-core 20 1024

2048

3400

64

128

128

0 to 1 32 (128 ports) 12 8 384

DS8910F - Flexibility Class Racked (R9.1)

994 16-core 8 192

512

8

32

n/a 16 (64 ports) 4 4 192

DS8910F - Flexibility Class Rack Independent (R9.1)

993 16-core 8 192

512

8

32

n/a 16 (64 ports) 4 2 96

9



DS8950F Support for 1.9TB Flash Drives

• DS8910F/DS8950F AFA Media Options

• Flash – 2.5” in High Performance Flash Tier 0

• 800GB / 1.60 / 3.20TB Flash cards

• Flash – 2.5” High Capacity Flash Tier 1

• 3.84TB Flash cards

• Flash – 2.5” High Capacity Flash Tier 2

• 1.92 / 7.68 / 15.36TB Flash cards

• No changes in R9.1 to the following intermix rules:

• Intermix of three types of high performance flash (800GB / 1.60 / 3.20 TB) in same enclosure pair can be requested via RPQ

• Intermix of 3 types of high capacity flash (1.92 / 3.84 / 7.68 / 15.36 TB) in same enclosure pair can be requested via RPQ

• No intermix in same flash enclosure of high performance flash and high capacity flash

• If both are installed in the same DS8900F, they must be installed in separate flash enclosures

HPFE Gen2

10



IBM zHyperLink Evolution

• DS8880 R8.3.1 and inherently supported on DS8900F R9.0+

• Db2 V12 Read Support (Batch and Transactions)

• Synchronous Db2 database reads – 4K CI/page sizes

• Ability to turn zHyperLink on and off at the Dataset level

• Via Storage Class policy or via VARY SMS command

• DS8880 R8.5.1 and inherently supported on DS8900F R9.0+

• Db2 Active Log Support

• zHyperLink Write exploitation; supports Metro Mirror with zHyperWrite and full duplex

• APAR PH05030 (available since January 2019)

• z/OS APAR OA56575 (available since March2019)

• Db2 V11 Read Support

• Instrumentation for zBNA tool is available

• VSAM Read Support (Batch and Transactions)

• APAR OA52941 (available since 29th of April 2019)

• All VSAM record type data sets (i.e. KSDS, ESDS, RRDS, VRRDS) support zHyperLink, along with all types of access, except NSR Sequential

z/OS

IBM z14/z15

zHyperLink ExpressSAN

DFSMS

Db2 / VSAM

11



IBM zHyperLink GM Write Support

• DS8900F R9.1• zHyperLink Write with GM primary volume support

• MGM/MTMM also supported when MM is using zHyperWrite

• Software levels required:• z/OS is for V2R2 with ++APARs

• OA56723 is required. Current levels are:

• A subsequent change will require a DFSMS ++APAR

• 2.2 (HBB77A0) - KA56723 RW20109

• 2.3 (HBB77B0) - BA56723 RW20109

• 2.4 (HBB77C0) - CA56723 RW20109

• IBM Z Batch Network Analyzer (zBNA) • Top Data Set Candidate List for zHyperLink

• Able to filter the data by time

• Ability to estimate the benefit of zHyperLink activities

• Generate customer reports with text and graphs to show zHyperLink benefit

• Available from IBM Z WSC CPS Tools team• IBMers: http://w3.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS5126

• BP’s: https://www.ibm.com/partnerworld/wps/servlet/mem/ContentHandler/tech_PRS5133

• Customers: http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS5132

z/OS

IBM z14/z15

zHyperLink ExpressSAN

DFSMS

Db2 / VSAM

12

http://w3.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS5126https://www.ibm.com/partnerworld/wps/servlet/mem/ContentHandler/tech_PRS5133http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/PRS5132



0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

zHyperLink zHPF

Response T

ime (

ms)

Overhead of 4KB Log Writes

No Mirroring

MM

GC

GM

zHyperLink with Global Mirror Performance

13



0

0.05

0.1

0.15

0.2

0.25

0

50

100

150

200

250

300

350

400

450

500

FICON zHyperLink Write

Res

po

nse

Tim

e (

ms

)

Th

rou

gh

pu

t (K

IOP

s)

Global Mirror with zHyperLink WritesMixed Workload (Random/Sequential read & write) with DB2 log-Emulation

Overall Throughput Log-Emulation Throughput

Overall Average Response Time Log-Emulation Response Time

CG Formation Time for both cases of zHyperLink and FICON is 1.1 sec

4x Response Time reduction for

DB2 Log-Emulation


14



0

0.05

0.1

0.15

0.2

0.25

0.3

0

100

200

300

400

500

600

700

zHyperLink Write zHyperLink Write + Read

Res

po

nse

Tim

e (

ms

)

Th

rou

gh

pu

t (K

IOP

s)

Global Mirror with zHyperLink Writes + ReadsMixed Workload (Random/Sequential Read & Write)

with DB2 log-Emulation + zHyperLink Reads

Overall Throughput non-zHL Throughput Log-Emulation Throughput zHyperLink Read Throughput

Overall Average Response Time non-zHL Response Time Log-Emulation Response Time zHyperLink Read Response Time

CG Formation Time for both cases is 1.1 sec


15



zHyperLink Eligibility and Enablement

• Eligibility designed to show potential benefit, even before zHyperLink Enablement

• Maintenance stream captures Eligibility, even if actual function disabled because of

• Caller, Lack of Infrastructure, DFSMS Storage Class Granularity by default everything disabled (OA54822)

• Once zHyperLink enabled Eligibility may still be utilized

• DFSMS Storage Class Granularity – by default everything “disable”

• Blocksize >4096

• Or Once zHyperLink enabled zHPF may still occur

• Even “intra data set” with zHyperLink Enabled – E.g. Db2 Synchronous Reads and Prefetch Reads

• zHyperLink™ Read Misses (not a “Success”)

Eligibility Callers

• Db2 v12 Sync Reads

• Db2 v11 Sync Reads

• VSAM Reads ++APARs

• Db2 Log Writes

Media Manager

Yes to all ?

• zHyperLink Infrastructure

• Caller Enabled

• DFSMS Enabled

•



Integration of IBM DS8910F into z15 and LinuxONE III single frame solutions

• IBM z15 T02/LT2 with smaller I/O configurations and single-phase power only can implement the 16U Reserved space for IBM DS8910F

• A co-located DS8910F solution that can be utilized in the z15 T02/LT2 16U Reserved space

• Previously a formal SOD by IBM Z

• The DS8910F must be purchased, installed and configured separately

• This creates the opportunity to create an all-in-one server/storage solution based on the most current IBM technology innovations

• Bill of materials includes

• T02/LT2 16U Reserved Space (#0151) will provide additional power ports in redundant power distribution units (PDUs), along with weight ballast and air flow filters

• C20 to c13 power cables needed to attach to the z15 PDUs

• Model 993 does not share the keyboard display of the z15

17



DS8900F Gen2 HMC Refresh

• Hardware enhancements

• Upgraded Processor (Skylake vs Haswell on Gen1)

• Increased Memory (32GB vs 8GB on Gen1)

• Increased Internal Storage (250GB vs 120GB on Gen1)

• Relocated USB and ethernet ports

• Removed SDHC card

• Both DSCLI (lshmc) and GUI (System Health) will display new hardware characteristics

• Not orderable / not a Feature

• Gen2 ship after GA on new DS8900s with R9.0.3 or R9.1

• FRU Replacement

• Like-for-Like FRU replacement until Gen1 stock depleted

• Gen2 can be used as FRU for Gen1 (requires R9.0.3 or higher)

• No current applications require Gen2 but does allow for potential future expansion / exploitation

• Encryption Key Server

• Storage Insights Data Collector

1 = Power On/Off2 = USB Port3 = SDHC card

Polywell Gen2 HMC

18



IBM Z, DS8900F and HyperSwap Integration

⚫ Hardware reserves are not currently allowed on z/OS volumes in HyperSwap environments

⚫ R9.1 enables Hardware Reserves to be used with HyperSwap

⚫ GDPS support planned to be released as a SPE on GDPS 4.3

⚫ No additional CSM support required beyond z/OS PTF’s

⚫ z/OS PTFs are also required

⚫ SDM APAR OA57209

⚫ When the DS8000 detects loss of connectivity to the host, there is a new timer and if set, the DS8000 will hold the reserve for the amount of time specified via the timer

⚫ This will give the host time to perform the HyperSwap before losing serialization

⚫ The new timer is customizable by PFE via pokeable settings

⚫ The default for the timer will be zero to prevent any impact to non-HyperSwap environments

⚫ Recommended value for HyperSwap environments will be two minutes to match the Extended Long Busy (ELB) timer default

IBM Z Hardware

z/OS (IOS, etc.), z/VM,

Linux on Z

DFSMSdfp: Device Services,

Media Manager, SDM

DFSMShsm, DFSMSdss

Db2, IMS, CICSGDPS,

CSM

DS8900F

19



DS8900F – Safeguarded Copy and Replication Enhancements

20



Fixed Block - New support for 4TB LUNS with Replication

Fixed Block

• All Copy Services Functions supported

• ESE and Standard volumes

Note: Prior to R9.1 was 2TB with Copy Services functions

CKD

• 1TB volumes are supported with Replication (No change)

21



Support For Space Release

• Release 8.2

• Release space on Metro Mirror primary when full duplex

• Release 8.3

• Propagate release space commands to Metro Mirror secondary when full duplex

• Release space on suspended primary

• Release space on secondary during PPRC resume

• Release 8.5

• Asynchronously propagate release space commands to Global Mirror and Global Copy secondary

• Release 9.1

• Release space supported on volumes configured in Safeguarded Copy relationship

22



Space Release Background and Implications

Background

• Space Efficient volumes allocate storage on an extent basis

▪ May use either small or large extents

• z/OS host utility is used to release space

▪ DFSMSdss SPACEREL

▪ Finds track ranges which are not allocated to any dataset

▪ Sends one or more Release Space commands with a list of track ranges

▪ The DS8000 may release space for the extents corresponding to the track ranges.

Implications of Different Extent Sizes

• The SPACEREL command does not attempt to understand extent boundaries▪ Commands contain only a list of unused track

ranges▪ These tracks may have no relationship to the

DS8000 extents

• If a track range does not span at least one extent, no space is released

• The Primary and Secondary volumes may have different extent sizes

• Space might be released for one volume of a pair, but not the other.

23



Safeguarded Copy and Space Release Bitmap

Safeguarded Copy

• Space is reclaimed asynchronously

• The current backup must expire before eligible to be reclaimed.

• If a release is pending, subsequent release space commands :

• During the same backup as original release space –accepted

• After the formation of the next backup – rejected.

• Safeguarded Copy can be used as:

• Production

• Metro Mirror / Global Mirror / Global Copy Primary and Secondary

• Volumes in a FlashCopy relationship will be rejected, except in case of Global Mirror secondary

Space Release Bitmap (SRBM)

• The SRBM records track ranges eligible to be

released

• Enables asynchronous space release

processing• Allows a Release Space command to be

accepted even when it is not possible to immediately release the space

• Accumulates multiple Release Space commands for later processing

• Implementation:• Bits are set in SRBM for track ranges specified in

the Release Space command• Multiple Release Space commands just set more

bits• A write to a track resets the bit to indicate that

the space for that track can no longer be released

• Backup sequence number kept in metadata24



Safeguarded Copy Space Release and Global Mirror

Safeguarded Copy

• Release Space received:

• Check for another release space pending

• In SRBM set bits and backup sequence number

• Start a timer task started to batch up multiple Release Space commands

• If another Release Space command is received during the same backup, the additional bits are set, and the timer restarted

• Writes reset bits in the SRBM

• Indicates that space cannot be released

Global Mirror Secondary and Safeguarded Copy

• A Release Space sent to a Global Mirror

secondary has a flag instructing the secondary

to not release space yet.

• The secondary records the tracks in its SRBM

• When the primary is ready for the secondary to

release space, it includes an indication in the

FlashCopy Commit command

• Only when a FlashCopy commit is received with

this new bit AND the backup has rolled off, will

the secondary use the SRBM to release space.

Implications for Global Mirror

• May require several Consistency Groups after

the Safeguarded backup has expired before all

space is released

• If GM is not forming CGs, then space does not

get released on the secondary

25



Fixed Block - Space Release

• Space Efficient volumes allocate storage on an extent basis

• May use either small (16MB) or large (1GB) extents. Small extents are more efficiently reclaimed from a host perspective than large extents.

• FB hosts can issue the UNMAP or Write Same with UNMAP commands to release space for a logical block address (LBA) range. The DS8K will release space internally.

• Like previous simplex support, the DS8000 may release space for the extents corresponding to the LBA ranges if a full extent is covered.

• For Example, Linux host users can use the fstrim and/or sg_unmap commands.

• Other host operating system commands may exist that users can take advantage of space reclamation. For proper usage, the user needs to consult their operating system contacts/documentation.

NOTES:

1. VMware Hosts are not supported with Copy Services. Space release will not be processed with these host types when CS relationships exist (simplex still supported).

2. The DS8K also does not currently support IBM i in simplex or with CS relationships.

26



Dynamically Expand Safeguarded Copy Backup

Prior to R9.1

• Safeguarded Copy Backup Capacity is created using dscli or dsgui

• Number of copies (retention) and change rate should be considered

• Using management software like CSM or GDPS, the backups are created

• Expanding Backup Capacity is disruptive to Safeguarded when larger backup capacity is needed

• Must delete all backups

R9.1

• Safeguarded Copy Backup Capacity is user

initiated

• dscli and dsgui are supported

• dsgui uses a multiplier

• dscli uses either a multiplier or size

• Capacity can only be increased

• After expansion command completes, use of

new space may be delayed

27



Use Cases for Safeguarded Copy Backup Expansion

1. Current capacity isn’t sufficient

• Backups are being rolled off before retention period is reach

2. Change in retention policy

• Retain backups longer

• Increase frequency of backups

28



Safeguarded Copy Capacity

• Safeguarded Copy Capacity keeps backups in a circular buffer

• Expanded area cannot be used until backup consuming the last original extent has been expired

• Example below, backup 23 needs to expire before using expanded area.

Backup 24

Backup 25

Backup 21

Backup 22

Backup 23

Unused

Unused

Backup 24

Backup 25

Backup 21

Backup 22

Backup 23

Unused

Unused

New Extent

New Extent

New Extent

New Extent

Original Backup Expanded Backup

29



DS GUI expanding Backup capacity

• Need to expand Backup Capacity

• Select the volume and Expand…

• Enter new multiplier

30



Warning Message and SGC Volume expansion

Changes SGC Policy intervals or retention period

cannot be made until after the expand process ends.

Volume capacity expanding in GUI. Can be

monitored with CSM or GDPS.

31



CSM Expanding State

• CSM shows which backups need to expire before expansion is complete

Volume backup deletion pending Volume expansion complete

32



dscli commands for SGC volumes

• In addition to using the DS GUI, the dscli can also be used for displaying and managing SGC volumes

dscli commands

• Show

• showckdvol

• showfbvol

• Manage

• manageckdvol

• managefbvol

33



DS8900F – Transparent Cloud Tiering (TCT) Enhancements

34



Agenda

➢ TCT Compression to TS7700 as an Object Store

➢ TCT Secure Data Transfer (“EDiF”) to TS7700 as an Object Store

➢ DFSMSdss Full Volume Dump Support (new Use Case for TCT)

35



TCT with TS7700 Object Store

DS8000 CEC

TS7700 Data

Movement Engine

TS7700

TS7700 Data Server

TS7700 Filesystem

IBM DS8000 IBM TS7700

Ethernet / GRID Links

• TS7700 Filesystem

• Object Partition

• Container

• Objects

• Customer Data

Object

• Dataset Metadata

➢ Co-existence of FICON Tape and TCT Object workloads to the same TS7700 cluster

➢ Data flows from DS8000 to TS7700 via GRID network links

➢ Utilizes logical partitions to allocate storage from resident cache (CP0) specifically dedicated to TCT objects

➢ Supports data redundancy via writing to two TS7700 clusters within the same GRID. This is known as “forking” the writes.

36



TCT with TS7700 Object Store

DS8000 CEC

TS7700 Data

Movement Engine

TS7700

TS7700 Data Server

TS7700 Filesystem

IBM DS8000 IBM TS7700

Ethernet / GRID Links

• TS7700 Filesystem

• Object Partition

• Container

• Objects

• Customer Data

Object

• Dataset Metadata

➢ Co-existence of FICON Tape and TCT Object workloads to the same TS7700 cluster

➢ Data flows from DS8000 to TS7700 via GRID network links

➢ Utilizes logical partitions to allocate storage from resident cache (CP0) specifically dedicated to TCT objects

➢ Supports data redundancy via writing to two TS7700 clusters within the same GRID. This is known as “forking” the writes.

37



Support for DS8000 TCT with TS7700 as an Object Store

➢ DS8880 and DS8900F supported (all models)✓ TCT is part of the zSynergy License Bundle

✓ DS8880 R8.5 SP4 minimum level

✓ DS8900F R9.0 minimum level

✓ Ethernet connections – 1 Gbit (default) or 10 Gbit (optional) 10 Gbit highly recommended

➢ TS7760 (“VEC”) and TS7770 (“VED”) supported✓ Requires code level R5.0 or higher

✓ Requires Feature Code “5282 – DS8000 Object Store”

✓ TS77X0T tape attached, TS77X0C cloud attached, TS77X0 tapeless supported (where ‘X’ is either ‘6’ or ‘7’)

✓ Uses existing GRID adapters and will share TCP/IP traffic with the GRID

➢ z/OS V2R3 (“2.3”) and V2R4 (“2.4”) supported

✓ APARs required to enable ”TAPE-OBJECT” type in SMS Cloud Construct/Network Connection panel

38



Agenda






TCT Compression with TS7700 as an Object Store

➢ Support requires DS8900F R9.1 microcode and z/OS APARS✓ No co-req with TS7700 microcode nor additional feature codes on it✓ Will not be ported to DS8880s

➢ Only supported when TS7700 is configured as the Object Store✓ Compression to cloud object storage not supported (future)

➢ Only Customer Data is compressed✓ Metadata Objects are not compressed✓ Data lands in TS7700 compressed and is only uncompressed when

recalled back into the DS8900F

➢ Hardware accelerated compression is done within the DS8900F✓ Uses the NX842 compression engine (off-chip) in POWER9✓ Compression engine is LZ4-like (Lempel-Ziv✓ Will not impact host I/O nor Copy Services performance

➢ DFSMS controls the use of compression✓ Will avoid compression if the dataset is host compressed/encrypted✓ z/OS APARs: OA59465, OA59466, OA59467, OA59468, OA59469, OA59470, OA59471

DS8900F POWER9 CECwith NX842 (off-chip)

compression engine

Metadata Objects

Customer Data

VTSGRID

40











compression engine

Metadata Objects

VTSGRID

Customer Data

41




compression engine

Metadata Objects

VTSGRID








Customer Data

42




compression engine

Metadata Objects

VTSGRID






➢ Hardware accelerated compression is done within the DS8900F✓ Uses the NX842 compression engine (off-chip) in POWER9✓ Compression engine is LZ4-like (Lempel-Ziv)✓ Will not impact host I/O nor Copy Services performance


Customer Data


compression engine

43








➢ Hardware accelerated compression is done within the DS8900F✓ Uses the NX842 compression engine (off-chip) in POWER9✓ Compression engine is LZ4-like (Lempel-Ziv)✓ Will not impact host I/O nor Copy Services performance



compression engine

Metadata Objects

VTSGRID

Customer Data

44



Agenda






➢ TCT Secure Data Transfer to TS7700

✓ Only encrypts the data in flight (decrypted at the TS7700 cluster)

✓ Does NOT require an external key manager

✓ If using encryption of data-at-rest then data will be re-encrypted on the media

➢ TCT Encryption to cloud object storage

✓ Client Side Encryption (data lands in object storage encrypted)

✓ Data is decrypted when it is recalled by DS8900F

✓ Requires an external key manager (e.g., SKLM, Gemalto SafeNet, etc.)

✓ Configured with DSCLI using mkkeymgr, mkkeygrp, mkcloudserver

TCT Secure Data Transfer to TS7700 as an Object Store

Encryption of Data-in-Flight to/from DS8900F & TS7700 when used as an Object Store

Is it NOT the same as TCT Encryption to cloud object storage

46



➢ TCT Secure Data Transfer to TS7700

✓ Only encrypts the data in flight (decrypted at the TS7700 cluster)

✓ Does NOT require an external key manager

✓ If using encryption of data-at-rest then data will be re-encrypted on the media

➢ TCT Encryption to cloud object storage

✓ Client Side Encryption (data lands in object storage encrypted)

✓ Data is decrypted when it is recalled by DS8900F

✓ Requires an external key manager (e.g., SKLM, Gemalto SafeNet, etc.)

✓ Configured with DSCLI using mkkeymgr, mkkeygrp, mkcloudserver

Encryption of Data-in-Flight to/from DS8900F & TS7700 when used as an Object Store

Is it NOT the same as TCT Encryption to cloud object storage


47



➢ Support requires DS8900F R9.1 microcode✓ No co-req with newer TS7700 microcode (R5.0) or z/OS APARS✓ Requires Feature Code “5281 – Secure Data Transfer” installed

on the TS7700(s)

➢ Uses the SDT capability in the GRID movement engine embedded within the DS8900F✓ AES256 bit TLS 1.2 Encryption over Ethernet via TCP/IP✓ Hardware accelerated via POWER9 crypto

engine to offload CPU cycles from DS8900F

➢ Encryption of Data-in-Flight (“EDiF”) only✓ Decrypted when it arrives in the TS7700 cluster✓ Encrypts all data, whether compressed or host encrypted

Encrypted TS7700 Grid

network

IBM DS8900F

TCP/IP

TCT


48




on the TS7700(s)





network

TCP/IP


TCT

IBM DS8900F 49




on the TS7700(s)





network

TCP/IP


TCT

IBM DS8900F 50



DS8000 DSCLI configuration for TCT Secure Data Transfer with TS7700

➢ Prior to Secure Data Transfer enablement, the mkcloudserver command looked like this:

mkcloudserver -type TS7700 -primary7700IPs 1.1.1.1 [-secondary7700IPs] [-syscaloc] -nossl cloud_name

Indicates that EDiF(Secure Data Transfer) is not in use. i.e., not

using SSL protocol

51




➢ To enable Secure Data Transfer use mkcloudserver without “-nossl” parameter:


which looks like this:

mkcloudserver -type TS7700 -primary7700IPs 1.1.1.1 [-secondary7700IPs] cloud_name

✓ The DS8000 will use the default TS7700 certificate to establish an encrypted link

52









➢ If the default Management Interface (“MI”) certificate has been replaced by a user supplied certificate then use “–syscaloc” parameter with the path to local copy of the certificate


mkcloudserver -type TS7700 -primary7700IPs 1.1.1.1 –syscaloc /home/user/usercert.pem cloud_name

53









➢ If the default Management Interface (“MI”) certificate has been replaced by a user supplied certificate then use “–syscaloc” parameter with the path to local copy of the certificate


mkcloudserver -type TS7700 -primary7700IPs 1.1.1.1 –syscaloc /home/user/usercert.pem cloud_name

➢ If the TS7700 is already being used as an Object Store & you want to begin using Secure Data Transferthen issue a rmcloudserver followed by a mkcloudserver command in the appropriate format

✓ This is how the ‘change’ cloudserver is effected and has no impact on the objects stored on the TS7700. Remember, this only concerns Encryption of Data-in-Flight

54



Agenda






TCT Use Case Overview

➢ Primary use case today is archive of inactive data

✓ Using DFSMShsm Migrate/Recall to/from lower cost storage

➢ Use cases for backup of active data using TCT are available, but limited

✓ e.g., dataset level FlashCopy active data and copy off to lower cost storage

➢ DFSMSdss Full Volume Dump expands possible use cases for backup of active data using TCT

✓ Enables storage administrators to dump/recover z/OS volumes to/from an object storage cloud

✓ Supported for both TS7700 as an Object Store as well as traditional “S3” object stores

✓ Utility commands, list and delete, added to assist in managing full volume dumps

56












57












58



Support for DFSMSdss Full Volume Dump

➢ DS8880 and DS8900F supported (all models)

✓ TCT is part of the zSynergy License Bundle

✓ DS8880 R8.5 SP6 minimum level

✓ DS8900F R9.1 minimum level

✓ Ethernet connections – 1 Gbit (default) or 10 Gbit (optional) 10 Gbit highly recommended

➢ TS7760 (“VEC”) and TS7770 (“VED”) supported

✓ Requires code level R5.0 or higher

✓ Requires Feature Code “5282 – DS8000 Object Store”

➢ z/OS V2R3 (“2.3”) and z/OS V2R4 (“2.4”) supported

✓ PTFs for APAR OA57526

59



Archive Inactive Data – DFSMShsm Migrate / Recall

DFSMShsm

z/OS data sets

TCT

z/OS 2.3 or 2.4

TS7700

DS8000Current Primary Use Case – Archive Inactive Data

➢ Archive Inactive Data via DFSMShsm Migrate / Recall

➢ Utilize the IBM Power servers within the DS8000 for Migrate / Recall & reduce z/OS CPU utilization

➢ Automatic Migration driven by Management Class

Notes

➢ Migrate / Recall through ethernet is currently slower than FICON to virtual tape

➢ Target datasets for which a slower recall will not impact an application’s SLA

60



Archive Inactive Data – DFSMShsm Migrate / Recall

DFSMShsm

z/OS data sets

TCT

z/OS 2.3 or 2.4

TS7700

DS8000Current Primary Use Case – Archive Inactive Data

➢ Archive Inactive Data via DFSMShsm Migrate / Recall

➢ Utilize the IBM Power servers within the DS8000 for Migrate / Recall & reduce z/OS CPU utilization

➢ Automatic Migration driven by Management Class

Notes

➢ Migrate / Recall through ethernet is currently slower than FICON to virtual tape

➢ Target datasets for which a slower recall will not impact an application’s SLA

61



Archive Active Data – e.g., Db2 FlashCopy Image Copies

DFSMSdss

Db2 Source Objects

DFSMShsmTCT

Db2 Image Copies

z/OS 2.3 or 2.4 DS8000Current Secondary Use Case – Archive Active Data

➢ Create Point-in-Time Db2 Image Copies using DFSMSdss & FlashCopy

➢ DFSMShsm command-based migration to migrate storage group

Notes

➢ multiple image copy backups archived to cloud without data ever going through the host

➢ For now, manual recall required before DSS FlashCopy Restore

➢ Not limited to Db2, any DFSMSdss FlashCopybackup

FlashCopy1

Dump to Cloud 2

62



Archive Active Data – Db2 FlashCopy Image Copies

DFSMSdss

Db2 Source Objects

DFSMShsmTCT

Db2 Image Copies

z/OS 2.3 or 2.4 DS8000Current Secondary Use Case – Archive Active Data

➢ Create Point-in-Time Db2 Image Copies using DFSMSdss & FlashCopy


Notes

➢ multiple image copy backups archived to cloud without data ever going through the host

➢ For now, manual recall required before DSS FlashCopy Restore

➢ Not limited to Db2, any DFSMSdss FlashCopybackup

FlashCopy

63



Today’s Use Case – Full Volume Dumps

z/OS Prod Volumes

DSS Dump Datasets

Volume FlashCopies

FlashCopy

Compressed by zEDC

DFSMSdss

z/OS 2.3 or 2.4

DFSMSdss

DFSMShsmTCT

Full Volume Dump – using current method

➢ Create Point-in-Time Volume Copies using DFSMSdss & FlashCopy with “DumpConditioning”

➢ Create Volume Dumps to disk using DFSMSdssand zEDC Compression


Notes

➢ This is still a valid use case when targeting IBM COS since TCT compression is only supported for TS7700 as an Object Store

➢ For now, manual recall is required before DSS Restore, then you can FlashCopy restore back into production

1

64




z/OS Prod Volumes

DSS Dump Datasets

Volume FlashCopies

FlashCopy

Compressed by zEDC

DFSMSdss

z/OS 2.3 or 2.4

DFSMSdss

DFSMShsmTCT





Notes



2

65




z/OS Prod Volumes

DSS Dump Datasets

Volume FlashCopies

FlashCopy

Compressed by zEDC

DFSMSdss

z/OS 2.3 or 2.4

DFSMSdss

DFSMShsmTCT





Notes



3

66




z/OS Prod Volumes

DSS Dump Datasets

Volume FlashCopies

FlashCopy

Compressed by zEDC

DFSMSdss

z/OS 2.3 or 2.4

DFSMSdss

DFSMShsmTCT





Notes



67



New Use Case – Support for Native Full Volume Dump

DFSMSdss

z/OS Prod Volumes

Volume FlashCopies

z/OS 2.3 or 2.4 DS8000

DFSMSdssTCT

Full Volume Dump – DFSMSdss Dump to Cloud


➢ DFSMSdss command-based dump to cloud

✓ Volume dump in cloud looks as if the dump was taken directly from the z/OS production volumes (not the intermediate volume)

FlashCopy1

Dump to Cloud

Data gets compressed when using TS7700 as an Object Store

68




DFSMSdss

z/OS Prod Volumes

Volume FlashCopies

Data gets compressed when using TS7700 as an Object Store

z/OS 2.3 or 2.4 DS8000

DFSMSdssTCT

Full Volume Dump – DFSMSdss Dump to Cloud


➢ DFSMSdss command-based dump to cloud

✓ Volume dump in cloud looks as if the dump was taken directly from the z/OS production volumes (not the intermediate volume)

Dump to Cloud

FlashCopy

2

69




z/OS Prod Volumes

z/OS 2.3 or 2.4 DS8000

Data gets uncompressed when using TS7700 as an Object Store

Full Volume Dump – DFSMSdss Recall from Cloud

➢ Data can be recovered directly to production volumes

✓ No more manual recall before the restore

Recall from Cloud

DFSMSdssTCT

1

70



Managing Full Volume Dumps as Objects

DFSMSdss does not provide automatic expiration/deletion of objects. The ‘List’ & ‘Delete’ cloud utility commands were added to assist with managing full volume dump expiration/deletion. Storage admins will need to add delete logic to the jobs used to create new dumps.

➢ CLOUDUTILS LIST command

✓ Lists all the containers in a cloud, all the dumps or a subset of dumps within a container

✓ List function requires appropriate credentials

❖ Need at least read access to STGADMIN.ADR.CLOUDUTILS facility class profile

➢ CLOUDUTILS DELETE command

✓ Deletes one or more dumps in a container or entire containers

✓ Delete & Delete Force functions require appropriate credentials, too

❖ CLOUDUTILS DELETE requires at least read access to STGADMIN.ADR.CLOUDUTILS.DELETE facility class profile

❖ Deleting non-empty containers with CLOUDUTILS DELETE FORCE requires at least read access to STGADMIN.ADR.CLOUDUTILS.FORCE facility class profile

71














72














73



DS8900F – Key Manager, GUI, LDAP and Usability Enhancements

74



Key Manager Support for DS8900F

75

New Support for KMIP Key Manager

• Thales Vormetric Data Security Manager

• Data at rest encryption

• Transparent Cloud Tiering

• Configure DS8K as “hosts” that sharethe keys in the same domain

Currently Supported Key Managers

• IBM Security Key Life Cycle Manager (SKLM)

• IBM Security Key Lifecycle Manager for z/OS (ISKLM)

• Gemalto Safenet KeySecure



.

Native LDAP

Pain Points

⚫ LDAP hard to set up

⚫ Different implementations in storage products

⚫ Certificates management

⚫ Need for a third party

•Functions:

⚫ Native LDAP in both DSGUI and DSCLI

⚫ Easier certificate management

⚫ Exporting & importing capability

76



.

New Options when configuring LDAP

77



.

Configuring LDAP servers

78



.

Completed configuration of LDAP

79



DSGUI Capacity Monitoring

80

New!



DSGUI New Capacity Graph for the DS8900F

81



Viewing capacity graphs for pools

82

or

Pools > Arrays by Pools Monitoring > Performance : Create new chart



New Performance Metrics for Capacity

83

•System: Capacity

⚫ Used IBM z capacity (Mod1)

⚫ Used IBM z capacity by volume type (Mod1)

⚫ Provisioned capacity for IBM z (Mod1)

⚫ Provisioned IBM z capacity by volume type (Mod1)

⚫ Used Open Systems capacity (GiB)

⚫ Used Open Systems capacity by volume type (GiB)

⚫ Provisioned capacity for Open Systems (GiB)

⚫ Provisioned Open Systems capacity by volume type (GiB)

Pool: Capacity

⚫ Used capacity (Mod1 / GiB)

⚫ Used capacity by volume type (Mod1 / GiB)

⚫ Provisioned capacity (Mod1 / GiB)

⚫ Provisioned capacity by volume type (Mod1 / GiB)



.

New dscli commands

New Command:

• lsdrives

• lsstgenclosure

• lshacard

• lsdacard

• lspnode

• lshmc

• lsioenclosure

• lspciecard

84

Output from Command:

List drives

List storage enclosures

List host adapter cards

List device adapter cards

List processor nodes

List HMCs

List I/O Enclosures

List PCIE cards

Replaces:

• lsddm

• lsstgencl

• lshba

• lsda



DS8900F – Safeguarded Copy Sizing

85



Safeguarded Copy and ESE FlashCopy Sizing

• For Safeguarded Copy (SGC) or ESE FlashCopy (FC) it is important to do an accurate capacity sizing.

• Various methods exist to estimate capacity requirements but these can over-estimate or under-estimate the capacity as the metrics used do not precisely match the actual operation

• An ESEsizer tool was created to help provide more accurate sizings. This uses a new Write Monitoring bitmap added to DS8880/DS8900F microcode

• For SGC sizing, the results will be used for physical capacity requirements and for virtual multiplier recommendations

• For ESE FlashCopy, the bitmaps are mapped to extents (large or small), to be used for physical capacity requirements

• Now that the Write Monitoring bitmap is available for DS8880/DS8900F the next step will be to integrate the monitoring functionality into CSM removing the requirement for a separate tool.

86



Write Monitoring Bitmap

• The Write Monitoring bitmap tracks all writes to a volume but has no other function beyond this

• The bitmap can be started, stopped, reset and queried

• These commands are only exposed through use of CSM today so no GUI or DSCLI or TSO support

• The bitmap is started with all bits set to zero and acts as a Change Recording bitmap with the first update to a track setting the bit to one.

• The reset will set all bits back to zero.

• The query will provide the entire bitmap which can then be parsed to understand the changed tracks, small extents or large extents

87



Safeguarded Copy and ESE FlashCopy Sizing

• The ESE sizer tool is a bundle of perl and Java code

• The sizing tool requires a CSM instance to issue the commands to the DS8000(s) but this does not need an active license and can be the CSM on an HMC

• The process that will be performed when running the sizing tool is as follows:

• Start write monitoring bitmap on the identified volumes

• Loop for a number of iterations

• Sleep for a defined interval

• Query the bitmap and output results

• Reset the bitmap

• Stop the write monitoring bitmap

• The output files are CSV-Files that can be handled with Excel.

• Initiating a study of this type should be coordinated through your IBM rep or Business Partner

88



Requirements for using Bitmap Monitor Tool

• Laptop or virtual machine that will support running a Perl script (Windows or Linux, typically)

• Needs network connection to the CSM server

• IP-Port 9559-9562 must be

open

• Needs IBM provided Perl script with customization for the environment

• Will collect bitmap statistics for the retention period so typically needs to run for some days

• CSM 6.2.7 or higher instance

• No CSM license required

• Can use existing CSM instance,

or can be configured on the

DS8000 HMC

• Network connectivity and

authentication to login and

monitor the DS8000(s)

• No CSM session required

• DS8900F running 9.1 code (or R9.0.2 with additional poke applied by IBM PFE to activate bitmap monitoring)

• DS8880 running 8.5.4 code or higher

89



DS8900F – Misc

90



Enhanced Flash Drive and RAID Management

• Freed/unallocated/initialized space on RAID arrays to be zeroed with the Write Same with UNMAP command instead of writing zeros

• Free pages go back to the free pool of capacity within the drive

• Saves additional Program / Erase cycles when extents are freed and reallocated

• In thin provisioning environments, this improves the wear life/endurance of the flash drives

• This can have some benefits with internal flash drive performance (garbage collection and free page management for sustaining new writes)

• This task is managed in the background as part of dirty extent cleanup and for allocated dirty CKD extents during Quick Initialization

• Faster rebuild for partially allocated RAID arrays

• If a parity stripes is not mapped, no rebuild of this stride is necessary

• Prevents additional writes (P/E cycles) of zeroed data to the target drive in a rebuild

• Prevents allocation of entire capacity within the target drive during a rebuild

91



Quiesce / Resume Improved Behavior

• During a concurrent code load, each Power processor, in turn, goes through a Quiesce and then Resume process as the new microcode is loaded

• Pre-R9.1 behavior is that at Resume on each node, the cache is empty and is only populated via subsequent host read and write activity

• Improved behavior will result in better cache hit ratios, benefitting host I/O response time during these Quiesce/Resume events

• R9.1 during Quiesce will build Most Recently Used list, for the remaining node to populate up to 40% of its cache with current data

• R9.1 during Resume will take a Most Recently Used list from the active node to populate up to 90% of its cache with current data

92



DS8900F R9.1 Announcement Summary - Highlights


• 3.4TB Cache

• DS8950F support for 1.9TB Flash

• zHyperLink GM Writes support

• DS8910F integration into z15 T02 and LinuxONE III LT2

• Upgraded Gen2 HMC

• HyperSwap Hardware Reserves

• Safeguarded Copy, Replication and Thin Provisioning

• Dynamically expand Safeguarded Copy capacity

• 4TB Open Volume Replication

• Thin-Provisioning: FB Host Initiated Space Release with CS


• TCT Object Store Compression and Secure Data Transfer (SDT) for Encryption to TS7700

• DFSMSdss Full Volume Dump

• New Key Server Support, GUI, LDAP and Usability

• Capacity Monitoring terminology consistency

• DSCLI hardware queries

• Simplified LDAP configuration, other GUI and NI functions


• ESE Sizing tool

• Miscellaneous Topics93



Questions

94



Announcements:

• Innovation and synergy with IBM Storage for Mainframe (Apr 12)

• Powerful new storage for your mission-critical hybrid multicloud (Sep 12)

• IBM Systems helps you build the cloud you want – with the privacy and

security you need BP Blog by Jose Castano & Eric Herzog (Sep 12)

Marketing Collateral:

• IBM DS8900F Data Sheet

• IBM DS8910F 3D interactive demo

• IBM DS8950F 3D interactive demo

• IDC: IBM's Enterprise storage refresh white paper

• IBM DS8900F Advanced HA/DR white paper

• IBM DS8900F for Cyber Resiliency video

Redbooks

• IBM DS8900F Architecture and Implementation

• IBM DS8900F Product Guide

• IBM DS8900F Fibre Channel Endpoint Security

• IBM DS8900F Encryption for data at rest, Transparent Cloud Tiering, and

Endpoint Security

• IBM DS8900F High-Performance Flash Enclosure Gen2

IBM Storage / 3Q 2020 / © IBM Corporation

IBM DS8900F Key Links

95
http://www.ibm.com/blogs/systems/innovation-synergy-ibm-storage-mainframeshttps://www.ibm.com/blogs/systems/powerful-new-storage-mission-critical-hybrid-multicloud/https://www.ibm.com/blogs/business-partners/ibm-systems-helps-you-build-the-cloud-you-want-with-the-privacy-and-security-you-needhttps://www.ibm.com/downloads/cas/3Q6P3M0Qhttps://apps.kaonadn.net/4882011/product.html#13/1322;C947https://apps.kaonadn.net/4882011/product.html#13/1323;C947https://www.ibm.com/downloads/cas/PMLVX701https://www.ibm.com/downloads/cas/EMKGY2WAhttps://youtu.be/Bzalqvr5K58https://www.redbooks.ibm.com/redbooks/pdfs/sg248456.pdfhttps://www.redbooks.ibm.com/redpapers/pdfs/redp5554.pdfhttps://www.redbooks.ibm.com/redbooks/pdfs/sg248455.pdfhttps://www.redbooks.ibm.com/redpapers/pdfs/redp4500.pdfhttps://www.redbooks.ibm.com/redpapers/pdfs/redp5422.pdf

Washington Systems Center - Storage - IBM...IBM WSC DS8000 Offerings Customer Workshops • DS8000...

Documents

Transcript of Washington Systems Center - Storage - IBM...IBM WSC DS8000 Offerings Customer Workshops • DS8000...