IBM Security Guardium Key Lifecycle Manager FAQs

See Multi-Master configuration.

21.

Yes, but not recommended. Ideally all data centers must have their own Multi-Master clusters. Network issues can cause performance issues between two data centers.

No. You do not need to modify any KMIP client to use the Multi-Master feature. Some of the supported KMIP clients are MDE, VSAN, V7000, Spectrum Accelerate/XIV and Lenovo X Series SEDs in SoftLayer.

No. A Multi-Master cluster ensures that keys are synchronized from the primary master server to the standby master servers in real time. Hence, you do not need to perform continuous backups.

A Multi-Master configuration has multiple standby master servers. These standby master servers have the same data as the primary master server. If the primary database goes down for any reason, you can use the databases of the standby master servers because they have the same data. IBM Security Guardium Key Lifecycle Manager takes backup and restores the data to all non-primary master servers once every day. All databases being unavailable at the same time is almost impossible.

Yes, all the master servers in a Multi-Master cluster connect to the same HSM.

You must use the Backup and Restore feature and manually back up the data at regular intervals as a precautionary measure to avoid possible data loss.

You can view the list of all the configured master servers from the GUI (go to Administration > Multi-Master). However, you cannot access the master servers from the GUI.

The data source of the newly added non-HADR master server might still be pointing to the local database. After you add a master server to the cluster, ensure that the data source in its WebSphere® Application Server points to the primary database.

To manually update the server details in the data source:

1. Log in to WebSphere Integrated Solutions Console (https://localhost:9083/ibm/console/logon.jsp).
2. Click Resources > JDBC > Data sources > SKLM DataSource.
3. In the SKLM DataSource page, verify the value in the Server name field under Common and required data source properties section.
4. If the host name of the local server is shown, update the value by specifying the host name of the primary server.
   If the value in the Server name field is already updated with the host name of the primary server, restart WebSphere Application Server and close the page. Else, run the following steps.
5. In the Additional Properties section of the SKLM DataSource page, click the WebSphere Application Server data source properties link.
6. In the Advanced DB2® features section, verify the values in the Alternate server names field.
7. Specify host name of the standby servers as a comma-separated list in the Alternate server names field.
8. Specify port number of the standby servers as a comma-separated list in the Alternate port numbers field.
9. Save the changes.
10. Click Resources > JDBC > Data sources > SKLM scheduler XA Datasource.
11. Repeat the steps from 3 - 8.
12. Restart WebSphere Application Server.

You can check whether synchronization is running between the IBM Security Guardium Key Lifecycle Manager primary and standby master servers by verifying the time difference between PRIMARY_LOG_TIME and STANDBY_LOG_TIME.

Run the following command from the Db2 Command Window:

#db2pd -d <SKLM_DBName> –hadr

For example: #db2pd -d sklmdb31 –hadr

The following output is displayed:

Database Member 0 -- Database SKLMDB31 -- Active -- Up 1 days 21:27:01 -- Date 2018-11-09-20.10.56.059000

                        HADR_ROLE = PRIMARY
                          REPLAY_TYPE = PHYSICAL
                        HADR_SYNCMODE = SYNC
                           STANDBY_ID = 1
                        LOG_STREAM_ID = 0
                           HADR_STATE = PEER
                           HADR_FLAGS = TCP_PROTOCOL
                  PRIMARY_MEMBER_HOST = WIN-DBA2ALEJOC8
                     PRIMARY_INSTANCE = SKLMDB31
                       PRIMARY_MEMBER = 0
                  STANDBY_MEMBER_HOST = WIN-VB479C09AG3
                     STANDBY_INSTANCE = SKLMDB31
                       STANDBY_MEMBER = 0
                  HADR_CONNECT_STATUS = CONNECTED
             HADR_CONNECT_STATUS_TIME = 11/08/2017 23:25:28.730219 (1510212328)
          HEARTBEAT_INTERVAL(seconds) = 30
                     HEARTBEAT_MISSED = 0
                   HEARTBEAT_EXPECTED = 2490
                HADR_TIMEOUT(seconds) = 120
        TIME_SINCE_LAST_RECV(seconds) = 3
             PEER_WAIT_LIMIT(seconds) = 0
           LOG_HADR_WAIT_CUR(seconds) = 0.000
    LOG_HADR_WAIT_RECENT_AVG(seconds) = 0.001541
   LOG_HADR_WAIT_ACCUMULATED(seconds) = 45.835
                  LOG_HADR_WAIT_COUNT = 19538
SOCK_SEND_BUF_REQUESTED,ACTUAL(bytes) = 0, 65536
SOCK_RECV_BUF_REQUESTED,ACTUAL(bytes) = 0, 65536
            PRIMARY_LOG_FILE,PAGE,POS = S0000003.LOG, 4891, 191226150
            STANDBY_LOG_FILE,PAGE,POS = S0000003.LOG, 4886, 191205494
                  HADR_LOG_GAP(bytes) = 0
     STANDBY_REPLAY_LOG_FILE,PAGE,POS = S0000003.LOG, 4886, 191205494
       STANDBY_RECV_REPLAY_GAP(bytes) = 0
                     PRIMARY_LOG_TIME = 11/09/2017 20:10:52.000000 (1510287052)
                     STANDBY_LOG_TIME = 11/09/2017 20:10:20.000000 (1510287020)
              STANDBY_REPLAY_LOG_TIME = 11/09/2017 20:10:20.000000 (1510287020)
         STANDBY_RECV_BUF_SIZE(pages) = 4298
             STANDBY_RECV_BUF_PERCENT = 0
           STANDBY_SPOOL_LIMIT(pages) = 380000
                STANDBY_SPOOL_PERCENT = 0
                   STANDBY_ERROR_TIME = NULL
                 PEER_WINDOW(seconds) = 0
             READS_ON_STANDBY_ENABLED = N

In the output, PRIMARY_LOG_TIME shows the time at which the Db2 transactional logs are updated for primary master server.

STANDBY_LOG_TIME shows the time at which the Db2 Transactional logs are updated for standby master server.

You can ignore the time difference in milliseconds.

The following table provides a description of the icons that show the port status:

Icon	Description
Port is reachable	Port is reachable and serving requests as per the specifications.
Port is not reachable	Port is not reachable. Service on a specific port might be down. Refresh status by using the Refresh option on the UI page.

The following table provides a description of the icons that show the Db2 HADR status:

Icon	Description
Db2 HADR is running	Db2 HADR is in running state. All the HADR masters are connected with each other.
At least one of the master servers in the cluster is unreachable	Db2 HADR is in running state, but at least one of the master servers is unreachable.
Db2 HADR is down	Db2 HADR is down and non-functional.