Embed Size (px)
Citation preview
IBM Security Systems Access Management July, 2014
IBM Security Access Manager, Version 8.0, Appliance
Standard Operating Procedures Version 1.2
Author: Martin Schmidt
2 | P a g e
3 | P a g e
Note: Before using this information and the product it supports, read the information in "Notices."
Edition notice
This edition applies to version 8.0 of IBM Security Access Manager and to all subsequent releases and modifications until otherwise indicated in new editions.
© Copyright International Business Machines Corporation 2014.
Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
4 | P a g e
5 | P a g e
Table of Contents 1 Introduction .......................................................................................8
1.1 Resources............................................................................................................................... 8
2 Accessing the appliance and committing changes ..........................8
2.1 Local management interface ............................................................................................... 8
2.2 Command line interface....................................................................................................... 9 2.3 REST APIs ............................................................................................................................ 9
3 Backup Strategy...............................................................................10
3.1 Backing up the virtual appliance ...................................................................................... 10 3.2 Appliance snapshots (Suggested) ...................................................................................... 11
3.3 Importing snapshots........................................................................................................... 13 3.3.1 Network Timeouts ........................................................................................................................................... 13
3.3.2 Uploading the snap file .................................................................................................................................... 14
3.4 Exporting and importing a security policy ...................................................................... 14 3.4.1 Importing ACLs ............................................................................................................................................... 14
3.4.2 Importing objects ............................................................................................................................................. 14
3.5 Backup Integration Example ............................................................................................ 15 3.5.1 Overview.......................................................................................................................................................... 15
3.5.2 PowerShell script ............................................................................................................................................. 16
3.5.3 Simplified bash and curl script ........................................................................................................................ 18
4 Monitoring........................................................................................20
4.1 Notifications ........................................................................................................................ 20
4.2 Monitoring the appliance .................................................................................................. 22 4.3 Monitoring instances.......................................................................................................... 25
4.4 Messages Catalog................................................................................................................ 27
5 Performance & Health ....................................................................27
5.1 Checking the state of the policy server (MGR) ............................................................... 27 5.2 Checking the state of WebSEAL instances ...................................................................... 28
6 Troubleshooting ...............................................................................30
6.1 Support Files....................................................................................................................... 30
6.2 Networking.......................................................................................................................... 30 6.2.1 Using the command line interface ................................................................................................................... 30
6 | P a g e
7 Networking .......................................................................................32
7.1 Managing the M.1 and M.2 interfaces.............................................................................. 32 7.2 Managing the P.1-P.4 application interfaces ................................................................... 32
7.3 Managing network traffic routing .................................................................................... 32 7.4 Hosts File............................................................................................................................. 33
8 Certificate Maintenance..................................................................34
9 Appendix: Useful REST services....................................................35
7 | P a g e
1 Introduction This document is a collection of Standard Operating Procedures (SOP) for the IBM Security Access Manager, Version 8.0, appliance. It documents common tasks and practices for the daily operations and maintenance of a deployment. It shows the tasks performed using the local management interface, command line interface, and REST API whenever possible.
It does not cover deployment or migration.
1.1 Resources The following are a list of resources that are available for managing the appliance.
• Security Access Manager for Web product documentation on the IBM Knowledge Center at http://www-01.ibm.com/support/knowledgecenter/SSPREK/welcome
• Security Access Manager for Mobile product documentation on the IBM Knowledge Center at http://www-01.ibm.com/support/knowledgecenter/SSELE6/welcome
• Videos created by the IBM Security Systems Support team at http://www.youtube.com/playlist?list=PL5VchNLXhuu-wEte77Cb7zBO-8419_tqK
2 Accessing the appliance and committing changes You can access the appliance through three methods basic methods. The appliance uses a modify and commit change model, which means any changes are not effective until committed. The local management interface provides a visual reminder of this fact; the command line interface and REST API do not and requires due diligence.
2.1 Local management interface You can access the local management interface with any web browser either in non-secure (HTTP) or secure (HTTPS) mode. The local management interface requires basic authentication.
The following illustration shows the login screen. The login ID is admin, and the default password is admin.
The following illustration shows the notification panel for a pending change.
9 | P a g e
This one shows the change deploy panel.
2.2 Command line interface The command line interface is available with the ssh port and protocol. Use any ssh client to connect to the management interface. You authenticate with the admin user. Even though you use ssh to connect to the appliance, the interface is not a Unix style shell.
Type help to see the list of available commands.
2.3 REST APIs You can call REST with a various tools, which include cURL, Directory Integrator, Microsoft ®Windows® PowerShell™, and others. This document uses the Firefox™ REST Client plugin or other tools as appropriate.
You can find REST API documentation on the appliance under Help.
10 | P a g e
Remember to always set the appropriate header for making a call.
The following illustration shows how to use the REST client to list any pending changes.
3 Backup Strategy Perform backups either on a regular schedule or based on changes in the environment. The appliance creates snapshots, which you can use as part of the change management and backup processes.
3.1 Backing up the virtual appliance You can back up the virtual appliance at the virtualization level (ovf export). This level of backup is a full backup of the appliance with all settings. Make backups at this level before making any major changes in the environment. You must stop and shut down the appliance before an ovf export.
Note: The ovf export is not a VMware snapshot; snapshots are not supported due to the clustering. See
11 | P a g e
http://www-01.ibm.com/support/knowledgecenter/SSPREK_8.0.0.2/com.ibm.amweb.doc_8.0.0.2/admin/concept/con_cluster_backup.html?lang=en
3.2 Appliance snapshots (Suggested) The appliance provides an internal snapshot mechanism, which creates backups of configurations, and restores them as needed. See
http://www-01.ibm.com/support/knowledgecenter/SSPREK_8.0.0.2/com.ibm.amweb.doc_8.0.0.2/admin/task/alps_managing_snapshots.html?lang=en
Snapshots are compressed files that are stored on the system. You can download and then open them with any zip compliant utility, such as WinRAR.
Store only a small number of snapshots on the system. Copy them regularly copied to a safe location and delete them on the appliance.
Follow these steps:
1. Select Manage -> System Settings -> Snapshots. 2. Select New and enter a comment.
3. Select the snapshot and perform the required tasks to download, delete, apply, or edit. 4. Use the following REST APIs to automate this process.
12 | P a g e
Create Snapshot
List Snapshots
Note: The ID field is required for download.
13 | P a g e
Download snapshot
Delete Snapshot
3.3 Importing snapshots When you have large snapshot files, perform the import process with care to accommodate network timeouts and snapshot processing.
3.3.1 Network Timeouts Large snapshot processing can take longer than the specified network timeout. To prevent timeouts, either disable or set a high network timeout on your browser.
Use the following steps to set the timeout in Firefox:
1. Open Firefox and navigate to about:config in the browser bar. 2. Enter a filter of network.http.response.timeout. 3. Set this value to either 0 (no timeout) or a large number of seconds.
14 | P a g e
3.3.2 Uploading the snap file When selecting and uploading the snap file with Browse, you MUST WAIT until Comment is populated.
After Comment is populated, select Save Configuration. Wait on this page until the file shows up in the list.
Note: There is no indicator that processing is taking place. Watch the spinner in the status bar.
3.4 Exporting and importing a security policy Use the Web Portal Manager interface to export and import parts of the security policy to XML. You can create backups of the policy used on a resource and documentation, or you can migrate the policy to another environment.
3.4.1 Importing ACLs 1. Select Secure Web Settings -> Manage -> Policy Administration. 2. Log in with the sec_master password.
3. Select ACL -> Export All ACLs. 4. Do not enter an encryption string. 5. Select Export and save the file. 6. Select Import ACL to load a file.
3.4.2 Importing objects 1. Select Object Space -> Browse Object Space. 2. Navigate to the object you want to export and select it. 3. Select Export.
15 | P a g e
4. Mark Export Object including Children. 5. Do not enter an encryption string.
6. Save the file. 7. Use Import Object to load the file.
3.5 Backup Integration Example When the backup infrastructure does not directly support the invocation of REST API calls, collect the snapshots on a shared drive on Windows or Unix system and then regularly back up this drive*.
The script shown below will create email alerts if any part of the operation fails.
You can schedule the script on a regular basis to create and collect the snapshots.
3.5.1 Overview The following diagram shows the architecture implementing this solution.
A windows based server is used to collect the snapshot file from the appliances. The file is stored on a network drive. The files stored on the network drive are backed up using the existing backup solution.
If any error is encountered during the process, an email is sent to the administrators.
16 | P a g e
3.5.2 PowerShell script You can use the following PowerShell script on the windows server to download the snap file as shown above. ########################################################################## # # A script to create appliance snapshots. # The script will create a snapshot, download it, and remove the # oldest snapshot on the appliance. # If there is an error, an email notification is sent. # ########################################################################## #------------------------------------------------------------------------- # Create directory date string Function getDateString() { $a = Get-Date $d = "" [string]$d = "{0:D4}" -f ($a.Year) + "{0:D2}" -f ($a.Month) + "{0:D2}" -f ($a.Day) return $d } #------------------------------------------------------------------------- # Send notification email. Function alertMail ($body) { $to = "[email protected]" $from = "[email protected]" $srv = "smtp.ibm.com" $sub = "Automated message: SAM Snapshot Alert" Send-MailMessage -To $to -From $from -Subject $sub -SmtpServer $srv -Body $body } #------------------------------------------------------------------------- # Create the basic auth header entry. Function createAuth($name,$pwd) { $authInfo = ("{0}:{1}" -f $name,$pwd) $authInfo = [System.Text.Encoding]::UTF8.GetBytes($authInfo) $authInfo = [System.Convert]::ToBase64String($authInfo) return "Basic {0}" -f $authInfo } Function getSnapshots ($name,$pwd,$target) {
17 | P a g e
$auth = createAuth $name $pwd $headers = @{Accept=("application/json");"Content-Type"=("application/json");Authorization=$auth} $uri = "https://"+$target+"/snapshots" [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $web = New-Object System.Net.WebClient; $web.Headers.add("Accept","application/json"); $web.Headers.add("Content-Type","application/json"); $web.Headers.add("Authorization",$auth); $res = $web.DownloadString($uri); $res = $res | ConvertFrom-Json return $res } Function createSnapshot ($name,$pwd,$target,$desc) { $auth = createAuth $name $pwd $headers = @{Accept=("application/json");"Content-Type"=("application/json");Authorization=$auth} $body = '{"comment":"'+ $desc + '"}'; $uri = "https://"+$target+"/snapshots" [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $res = Invoke-WebRequest -Uri $uri -headers $headers -Method POST -Body $body return $res } Function downloadSnapshot ($name,$pwd,$target,$id,$fn) { $auth = createAuth $name $pwd $headers = @{Accept=("application/json");"Content-Type"=("application/json");Authorization=$auth} $uri = "https://"+$target+"/snapshots/download?record_ids="+$id [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $web = New-Object System.Net.WebClient; $web.Headers.add("Accept","application/json"); $web.Headers.add("Content-Type","application/json"); $web.Headers.add("Authorization",$auth); $fn $uri $res = $web.DownloadFile($uri,$fn); return $res } Function deleteSnapshot ($name,$pwd,$target,$id) { $auth = createAuth $name $pwd $headers = @{Accept=("application/json");"Content-Type"=("application/json");Authorization=$auth} $uri = "https://"+$target+"/snapshots/"+$id [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $res = Invoke-WebRequest -Uri $uri -headers $headers -Method DELETE return $res }
18 | P a g e
Function getLastSnapshotID($name,$pwd,$target) { $sl = getSnapshots $name $pwd $target return $sl[$sl.Count-1].id } Function getFirstSnapshotID($name,$pwd,$target) { $sl = getSnapshots $name $pwd $target return $sl[0].id } # # This function does the work for creating a snapshot and downloading it. Function performSnapshot($name,$pwd,$target,$root) { try { # create the snapshot on the appliance $snap = createSnapshot $name $pwd $target # Get the snapshot ID (always the first one) $bid = getFirstSnapshotID $name $pwd $target # Build the target file name and directory $d = getDateString $dest = $root +"/" + $d + "/" $a = md -Force $dest $dest = $root +"/" + $d + "/" + $target + ".zip" # Download the snapshot downloadSnapshot $name $pwd $target $bid "$dest" # Get the last (oldest) snapshot ID $lastid = getLastSnapshotID $name $pwd $target # Delete the snapshot on the target. deleteSnapshot $name $pwd $target $lastid } catch { #send an email alert if there is an error. alertMail $Error } } # Clear any existing Errors. $Error.Clear(); # Duplicate the below line for any additional appliances. # performSnapshot <adminid> <adminpwd> <appliance> <target Directory> performSnapshot admin admin appliance1.ibm.com c:/temp
3.5.3 Simplified bash and curl script The following script is a simplified version of the PowerShell script for AIX. It uses cURL and bash.
#!/usr/bin/bash # -x # # Bash script that uses curl to backup a ISAM appliance. # # # A script to create appliance snapshots. # The script will create a snapshot, download it, and remove it # from the appliance. #
19 | P a g e
#------------------------------------------------------------------------- # The root directory for the backups. TODAY=`date +%Y%m%d` BACKDIR="/BACKUP/DEV/${TODAY}/" DOMAIN=".ibm.com" #------------------------------------------------------------------------- function getSnapshots { curl -H "Accept:appliaction/json" --user "$1" "https://$2/snapshots" 2>>/dev/null } #------------------------------------------------------------------------- function getLastSnapshotID { sl=`getSnapshots $1 $2` echo $sl | sed 's/,/ \ /g' | grep "\"id\":" | tail -1 | sed 's/.*":"//' | sed 's/"//' } #------------------------------------------------------------------------- function getFirstSnapshotID { sl=`getSnapshots $1 $2` echo $sl | sed 's/,/ \ /g' | grep "\"id\":" | head -1 | sed 's/.*":"//' | sed 's/"//' } #------------------------------------------------------------------------- function createSnapshot { data="{\"comment\":\"$3\"}" curl -H "Accept:appliaction/json" -d "$data" --user "$1" "https://$2/snapshots" 2>>/dev/null } #------------------------------------------------------------------------- function createGetSnapshot { r=`createSnapshot $1 $2 "$3"` echo $r | sed 's/,/ \ /g' | grep "\"id\":" | sed 's/.*":"//' | sed 's/"//' } #------------------------------------------------------------------------- function downloadSnapshot { curl -H "Accept:appliaction/json" --user "$1" "https://$2/snapshots/download?record_ids=$3" > "$4" 2>>/dev/null } #------------------------------------------------------------------------- function deleteSnapshot { curl -H "Accept:appliaction/json" -X DELETE --user "$1" "https://$2/snapshots/$3" 2>>/dev/null } #========================================================================= function takeShot { sid=`createGetSnapshot $1 "$2${DOMAIN}" "Created by backup script"` if [ -z "$sid" ]; then echo "ERROR Trying to backup $2" echo "ERROR Trying to backup $2" | mail -s "Backup Error" [email protected] else `downloadSnapshot $1 "$2${DOMAIN}" $sid "${BACKDIR}${2}.zip"` `deleteSnapshot $1 "$2${DOMAIN}" $sid ` Fi } #========================================================================= # Main program. R=`mkdir -p ${BACKDIR}` takeShot 'admin:admin' appmgr01 takeShot 'admin:admin' appweb01
20 | P a g e
exit 0
4 Monitoring You can monitor the appliance for system alerts with the methods documented at
http://www-01.ibm.com/support/knowledgecenter/SSPREK_8.0.0.2/com.ibm.amweb.doc_8.0.0.2/admin/task/alps_configuring_system_alerts.html?lang=en
You can also use third-party monitoring tools for REST API queries to obtain the system’s state information and perform actions based on predefined criteria.
4.1 Notifications The notifications panel in the Home Dashboard provides a quick view of the appliance’s health. It includes:
• Certificates that are due to expire. • Reverse proxy instances that are not currently running. • Notices that:
o The disk space utilization exceeded the warning threshold. o The database size reached the warning threshold, which is 80% capacity. o The CPU utilization exceeded the warning threshold.
You can configure the following thresholds from Manage Systems Settings -> System Settings -> Advanced Tuning Parameters. The following list shows the defaults:
• sys.notifications.disk.usage_warning_percentage = 80 • sys.notifications.disk.usage_alert_percentage = 90 • sys.notifications.cpu.usage_warning_percentage = 80 • sys.notifications.cpu.usage_alert_percentage = 90 • sys.notifications.cert.expiration_date_warning_days = 30 • sys.notifications.cert.expiration_date_alert_days = 14 • sys.notifications.hvdb.usage_warning_percentage = 80 • sys.notifications.hvdb.usage_alert_percentage = 90
In the following example, the value was set to 2 to show the resulting message:
The following illustrations shows the resulting notifications with the instances stopped.
You can also make the following REST call.
21 | P a g e
Note: Any non-null return triggers an alert.
This following illustration shows an empty result.
The following Powershell script shows how to use the REST APIs. #------------------------------------------------------------------------- # Convert epoch to a nice date Function get-epochdate ($epochdate) { [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($epochdate)) } #------------------------------------------------------------------------- # Create the basic auth header entry. Function createAuth($name,$pwd) { $authInfo = ("{0}:{1}" -f $name,$pwd) $authInfo = [System.Text.Encoding]::UTF8.GetBytes($authInfo) $authInfo = [System.Convert]::ToBase64String($authInfo) return "Basic {0}" -f $authInfo } Function getNotifications ($name,$pwd,$target) { $auth = createAuth $name $pwd $headers = @{Accept=("application/json");"Content-Type"=("application/json");Authorization=$auth}
22 | P a g e
$uri = "https://"+$target+"/isam/widgets/notifications.json" [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $web = New-Object System.Net.WebClient; $web.Headers.add("Accept","application/json"); $web.Headers.add("Content-Type","application/json"); $web.Headers.add("Authorization",$auth); $res = $web.DownloadString($uri); $res = $res | ConvertFrom-Json return $res } Function alertMail ($body) { $to = "[email protected]" $from = "[email protected]" $srv = "smptp.ibm.com" $sub = "Automated message: SAM Alert" Send-MailMessage -To $to -From $from -Subject $sub -SmtpServer $srv -Body $body } Function checkNotifications ($u,$p,$t) { $r = getNotifications $u $p $t if ($r.items) { $r.items | % { get-epochdate $_.timestamp $_.message alertMail($_.message); } } else { "No messages" } } checkNotifications "admin" "admin" "labsamweb01m1.tivlab.austin.ibm.com"
4.2 Monitoring the appliance Monitor the appliance from the local management interface dashboard for the following items:
• Notifications • Disk Space • Memory • CPU Usage • Certificate Life time • Events
The following illustration shows the dashboard.
23 | P a g e
Use the following REST APIs to collect similar information:
Hard Drive space
The values of interest are the root entries for size, used, and avail.
24 | P a g e
CPU Usage
Memory Usage
25 | P a g e
Certificates lifetime
The result requires post processing to:
• Extract the expiry. • Convert from epoch to an actual date or compare to the current epoch + Xdays. • Raise an alert if any are lower.
Event Log
4.3 Monitoring instances Monitor various WEB instances for:
• Status • Instance Log File
26 | P a g e
Status
Any health value that is not 0 denotes an issue.
Instance Log File
Retrieve the last 300 lines of the msg__webseald-xxx.log file. See the following example URL:
https://<server>/wga/reverseproxy_logging/instance/Test/msg__webseald-Test.log?options=line-numbers&size=300
27 | P a g e
4.4 Messages Catalog The following table contains the more common messages. Use the message codes to filter these for special processing. (Note that some messages are Warnings as well as Errors!)
Code Message
WGASY0002W Certificate expires in <d> days: <name>
WGASY0002E Certificate expires in <d> days: <name>
WGASY0003E Certificate expired: <name>
WGASY0004E Reverse Proxy is not running: <name>
GLGRS1003I The CLI operator <name> has shut down the appliance.
WGASY0000W High CPU utilization: <cpu>%
WGASY0000E High CPU utilization: <cpu>%
GLGPL1001I The LMI operator, <name>, has modified the System Alerts settings.
5 Performance & Health This section describes how to monitor the performance and health of the appliance and instances. Do this task after you apply changes to the system or end users experience problems. In general, access patterns for resources do not change unless there are changes in the environment.
5.1 Checking the state of the policy server (MGR) You can check the following files for the current state of the policy server.
1. Select Monitor -> Application Log Files ->isam_runtime -> policy_server.
28 | P a g e
5.2 Checking the state of WebSEAL instances You can check the following files for the current state of the WebSEAL instances.
1. Select Secure Web Settings -> Reverse Proxy. 2. Mark the instance. 3. Select Manage -> Logging.
4. Use the following additional local management interface pages to check the state of the junctions: a. Select Monitor ->Logs -> Reverse Proxy Log Files.
b. Select Monitor -> Network Graphs -> Application Interface Statistics.
29 | P a g e
c. Select Monitor -> Reverse Proxy Graphs -> Reverse Proxy Traffic.
d. Select Monitor -> Reverse Proxy Graphs -> Reverse Proxy Throughput.
30 | P a g e
6 Troubleshooting This section describes some common troubleshooting steps.
6.1 Support Files The appliance has a built in function to create and manage support file snapshots.
1. Select Manage -> System Settings -> Support Files. 2. Use this page to create and download support snap files.
3. Delete the files when you no longer need them.
6.2 Networking You have several tools for evaluating network issues. If you cannot access the appliance, use either the attached or virtual console.
6.2.1 Using the command line interface 1. Log in to the command line interface or the console, if you cannot access the server cannot through the
network. 2. Enter tools. 3. Use the ping and nslookup commands to determine network connectivity.
a. Ping the appliance and the appliance gateway. b. If neither works, make sure the appliance networking (vlan) is set correctly.
4. Get current network setting for M.1
31 | P a g e
5. From the top, enter the following: a. management b. interfaces c. show
6. If the configuration values are incorrect, you can use the set command to make changes. It performs the
same steps as documented for the initial appliance configuration.
32 | P a g e
7 Networking This section details steps for network- related operations.
7.1 Managing the M.1 and M.2 interfaces 1. Select Management -> Network Settings -> Management Interfaces.
2. Use the tabs to set the system related network settings, DNS, and the interface settings.
7.2 Managing the P.1-P.4 application interfaces 1. Select Management -> Network Settings -> Application Interfaces.
2. Use the tabs and operations to set the interface settings. 3. Use the Test button to validate networking with a ping operation.
7.3 Managing network traffic routing Manage the network traffic routing on the appliance. By default all traffic is routed through the M.1 interface, which means all network outgoing traffic goes through it.
1. Select Management -> Network Settings -> Routing.
33 | P a g e
2. Add static routes as needed.
7.4 Hosts File The appliance has a host file that is managed with the following interface.
1. Select Management -> Network Settings -> Hosts File.
2. Use this interface to manage the hosts file entries.
Note: To add entries to an existing IP, make sure the IP is highlighted before you select New.
34 | P a g e
8 Certificate Maintenance The appliance greatly simplified the maintenance of the SSL certificates.
The home page Certificate Expiry panel shows a list of certificates listed by expiration date. Inspect it regularly and renew or replace certificates as they are about to expire.
In addition, the home page notification panel displays any expired certificates.
1. Select Manage -> Secure Settings -> SSL Certificates 2. Select the Certificate Database. 3. Select Manage -> Edit SSL Certificate Database. 4. Find the expired certificate and delete them. 5. Import new certificates or create certificate requests as needed.
35 | P a g e
9 Appendix: Useful REST services The following are some useful REST services.
Get EPOCH
Gets current time on the appliance as an epoch.
36 | P a g e
37 | P a g e
Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A.
For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:
Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan, Ltd. 19-21, Nihonbashi-Hakozakicho, Chuo-ku Tokyo 103-8510, Japan
The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law :
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A.
Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee.
The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.
Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems.
38 | P a g e
Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.
All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.
All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary.
This information is for planning purposes only. The information herein is subject to change before the products described become available.
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.
COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM's application programming interfaces.
Each copy or any portion of these sample programs or any derivative work, must include a copyright notice as follows:
© IBM 2014. Portions of this code are derived from IBM Corp. Sample Programs. © Copyright IBM Corp 2014. All rights reserved.
If you are viewing this information in softcopy form, the photographs and color illustrations might not be displayed.
Trademarks
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information at ibm.com/legal/copytrade.shtml.
Statement of Good Security Practices
IT system security involves protecting systems and information through prevention, detection and response to improper access from in and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
39 | P a g e
© International Business Machines Corporation 2014
International Business Machines Corporation New Orchard Road Armonk, NY 10504
Produced in the United States of America 07-2014
All Rights Reserved
References in this publication to IBM products and services do not imply that IBM intends to make them available in all countries in
40 | P a g e
which IBM operates.
