vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If both replicas are lost, writes to the leader hang, due to the semisynchronous replication process not having a follower. For more information, see MySQL's [Semisynchronous Replication](https://dev.mysql.com/doc/mysql-replication-excerpt/8.0/en/replication-semisync.html). This scenario occasionally causes short intervals where your database is unavailable. It can also cause the database to trigger a graceful failover, retry, and reconnect. It takes a short time for the database to determine which member is a replica and which is the leader, so you might also see a short connection interruption. Failovers generally take less than 30 seconds. To minimize interruptions, updates are applied to replicas first, and the leader last.

Your applications must be designed to handle temporary interruptions to the database, implement error handling for failed database commands, and implement retry logic to recover from a temporary interruption.

Several minutes of database unavailability or connection interruption are not expected. If you have time periods longer than a minute with no connectivity, open a [support case](https://cloud.ibm.com/unifiedsupport/cases/add) with details so we can investigate.





 Connection Limits 

Databases for MySQL sets the maximum number of connections to your MySQL database to 200. Leave some connections available, as a number of them are reserved internally to maintain the state and integrity of your database. After the connection limit is reached, any attempts at starting a new connection result in an error. To prevent overwhelming your deployment with connections, use connection pooling, or scale your deployment and increase its connection limit. For more information, see [Managing MySQL Connections](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-managing-mysql-connections).





 High availability, disaster recovery, and SLA resources
Certificate Description How generated Default expiration How to view expiration How to renew Impact if expires What to do if expired 

 Peer enrollment certificate (signcert) The public key that is used to verify that the signatures that nodes attach to communications were generated by the node's private key. Generated when the peer is deployed based on the peer enroll ID and secret that is provided. 1 year Open console peer node and view Enrollment Cert Expiration field. [Automatic renewal](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-auto-renewal) is attempted 30 days before expiration. <br> <br>If automatic renewal fails, [manually update the peer certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-enroll-tls-peer). Production outage <br> <br>Peers can no longer connect to orderers or to each other. [Manually update the peer certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-enroll-tls-peer). 
 Peer TLS certificate (signcert) When TLS is enabled on a network, each node must register a user and enroll an identity with the TLS CA. This is the TLS certificate for the peer from that process and is required for the peer to start. Generated when the peer is deployed. 2.5.x: 15 years <br> <br>2.1.x: 1 year Open console peer node and view TLS Cert Expiration field. [Automatic renewal](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-auto-renewal) is attempted 30 days before expiration. <br> <br>If automatic renewal fails, [manually update the peer certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-enroll-tls-peer).
So far, we have assumed that the user will provide the appropriate value types for the slots. That is not always the case in reality. You can account for times when users might provide an invalid value by adding conditional responses to slots. In this step, you will use conditional slot responses to perform the following tasks:



* Ensure that the date requested is not in the past.
* Check whether a requested reservation time falls within the seating time window.
* Confirm the user's input.
* Ensure that the number of guests provided is larger than zero.
* Indicate that you are replacing one value with another.



To validate user input, complete the following steps:



1. From the edit view of the node with slots, click the Edit slot![Edit slot](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/edit-slot.png) icon for the @sys-date slot.
2. From the Options![More icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) menu in the Configure slot 1 header, select Enable conditional responses.
3. In the Found section, add a conditional response by clicking the Edit response![Edit response](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/edit-slot.png) icon.
4. Add the following condition and response to check whether the date that the user specifies falls before today:



Slot 1 conditional response 1 details

 Condition Response Action 

 `@sys-date.before(now())` You cannot make a reservation for a day in the past. Clear slot and prompt again
After the certificate reaches the end of its lease, it is revoked automatically.

The TTL or validity period that you define on a certificate template can't exceed the maximum TTL value that is defined for the associated CA. For more information, see [Choosing a validity period for your certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-create-certificateschoose-validity-period).
9. Optional: [Select the key algorithm](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-create-certificateschoose-key-algorithm) that you want to use to generate the keys for your generated certificates.
10. Optional: Select the

secret groupsthat you want to assign for your generated certificates.

By selecting one or more secret groups from the list, you restrict the creation of private certificates to those groups only. For more information about secret groups, check out [Organizing your secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups).
11. Optional: Enable advanced options for generated private certificates.



1. Domain settings: Add specific domains, subdomains, or wildcards to apply to your generated private certificates.
2. Certificate roles: Flag your generated private certificates for specific uses.
3. Subject name: Apply Subject Name parameter fields to your generated private certificates.



12. To confirm your selections, click Add.







 Adding a certificate template with the API 

You can create a certificate template for your service instance by calling the Secrets Manager API.

The following example shows a query that you can use to create a certificate template and associate it with an existing intermediate certificate authority that is configured for your instance.

curl -X POST
--H "Authorization: Bearer {iam_token}" --H "Accept: application/json" --H "Content-Type: application/json" --d '{
"config_type": "private_cert_configuration_template",
"name": "test-certificate-template",
AC-11 - Session Lock 



  Control requirements 

The information system:

AC-11 (a)
:   Prevents further access to the system by initiating a session lock after [IBM Assignment: fifteen (15) minutes] of inactivity or upon receiving a request from a user; and

AC-11 (b)
:   Retains the session lock until the user reestablishes access using established identification and authentication procedures.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for AC-11 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID  Rules                                                                                                                                                                

 AC-11 (a)       <br><br> *  Check that sign out due to inactivity is set to # seconds or less for IBM Cloud accounts<br><br><br>  
 AC-11 (b)       <br><br> *  IBM Cloud retains the session lock until access is reestablished by signing in<br><br><br>            







  NIST supplemental guidance 

Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of information systems but do not want to log out because of the temporary nature of their absences. Session locks are implemented where session activities can be determined. This is typically at the operating system level, but can also be at the application level. Session locks are not an acceptable substitute for logging out of information systems, for example, if organizations require users to log out at the end of workdays.
The default value is 60000 milliseconds. When the timeout is reached, the action is terminated.

--web yes|true|raw|no|false
: Treat the action as a web action, a raw HTTP web action, or as a standard action. Specify yes or true for a web action, raw for a raw HTTP web action, or no or false for a standard action. To secure your web action, also include the --web-secure option.

--web-secureSECRET
: Secure the web action. The VALUE for SECRET can be true, false, or any string. This option can be used only with the --web option.





 Example 

ibmcloud fn action update hello folder/hello_world.js









 Activation commands 

Get metadata, list IDs, find logs, and list results for specific activations.

To see CLI help for the activation command, run ibmcloud fn activation.



 ibmcloud fn activation get 

Get metadata that describes a specific activation.

ibmcloud fn activation get [ACTIVATION_ID] [FIELD_FILTER] [--last] [--summary]



 Command options 

ACTIVATION_ID
: The ID for a specific activation. Use ibmcloud fn activation list to retrieve a list of available IDs. This value is required, unless the --last or -l option is specified..

FIELD_FILTER
: A field in the metadata to display information from. For example, to display the logs field, run ibmcloud fn activation get ACTIVATION_ID logs. This value is optional.

--last, -l
: Display the metadata for the most recent activation. This flag is optional.

--summary, -s
: Display the result response only from the activation details. This flag is optional.





 Example 

ibmcloud fn activation get 8694a4501be6486a94a4501be6886a1e --summary







 ibmcloud fn activation list 

List all the activation IDs for all the actions in a package.
Not all default caching behaviors are strictly RFC-compliant. Setting Origin Cache Control by means of page rules uses a newer set of caching rules that seeks to adhere more closely to RFCs, primarily with respect to revalidation. For example, our default behavior with max-age=0 is to not cache at all, whereas setting Origin Cache Control caches, but it always revalidates.

The following example sets a page rule to cache everything found in the /images folder. Cached resources expire in 30 minutes in the user's browser, and they expire after one day in the IBM CIS data centers.



* URL match = .example.com/images/
* Enabled = On
* Rule behavior settings:





 Setting Set as 

 Cache level Cache everything 
 Browser Cache TTL 30 minutes 
 Edge Cache TTL 1 day 
 {: caption="Table 1. Rule behavior settings to cache everything in /images" caption-side="bottom} 



Serve Stale Content serves pages from our cache, even when your server goes down. Visitors see a limited version of your site, with a message that they are in offline browsing mode.

This feature returns an HTTP status 503. When servers are online again, CIS seamlessly takes visitors to regular browsing.

If the requested page is not in the cache, the visitor sees an error page that informs them the page they are requesting is offline. If a Cache Everything page rule is enabled with expiration times set lower than the caching frequency, the Serve Stale Content is purged in the corresponding interval.
* UI
* Terraform







 Setting limits for login sessions 

Improve the security of your account by requiring account users to enter their login credentials at customized intervals. As an account owner or user assigned the administrator role for the Identity service, you can select the time that a user's active session can last before they need to enter their credentials again. You can also choose the duration that a user is inactive before they are signed out of their session and are required to enter their credentials again.

To review and end active sessions to help maintain the security of your account, see [Monitoring login sessions](https://cloud.ibm.com/docs/account?topic=account-end-user-sessions).



 Before you begin 

If you have the following access, you can update the settings for login sessions:



* Account owners
* Editor or administrator role on all account management services
* Editor or administrator role on IAM identity service



If a user is a member of multiple accounts, the lowest value of each setting is applied to their session. For example, let's say a user is a member of two accounts: dev account and test account. If dev account has a 15 minute inactivity timeout, and test account has a 30 minute inactivity timeout, the 15 minute inactivity timeout is applied to both accounts.

Before you can set limits for login sessions by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).
Also, the rules may not take effect immediately due to synchronization and resource availability.

After creating rules, you can also [update](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-updatecontext-restrictions-update-rules) and [delete](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-removecontext-restrictions-remove-rules) them.







 Next steps 

Users who attempt to access your resources outside of the defined zones will receive HTTP error 401 when the appropriate rules have been established.

Follow the creation or modification of any zones or rules with adequate testing to ensure access and availability.
[Guided Setup](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/editGateway.png?raw=true)

When the security token is expired, it will not affect the connecting Secure Gateway Client, since the security token is only used when start/restart a Secure Gateway Client. However, you will not able to configure the destinations until you regenerate the security token.

There is no way of extending the expiration of the existing security token, when the security token is expired, you will need to regenerate it, once the Secure Gateway Client restart, it will need to use the latest security token.

To regenerate the security token, you will need to click the Regenerate Token link. The Token Expiration will only take effect when you click the Regenerate Token link, but not the Save button. Please check the Current Token Expiring after you regenerate the security token.





 Reactivate gateway 

![Manage Activity](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/manageActivity.png?raw=true)

When you [downgrade the plan](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-secure-gateway-service-planschanging-plans), it will update all gateways to be [inactive](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-sg-faqstates-answer-non-functional), all provisioned cloud port of the destinations will be reset. By clicking the wrench button !
Updating a user's status 

The status for a user depends on if the user accepted their invitation to join the account, if they're a VPN-only user, or if the administrator set the user as a disabled classic infrastructure user.

If you have the following access, you can update the status of another user:



* An Identity and access management (IAM) policy with Editor or higher role on the User management service.
* You are an ancestor in the classic infrastructure hierarchy for the user and you have the Manage users classic infrastructure permission assigned



All account users are assigned a status that describes their user state. A user's status is displayed on the User details page.



Table 1. User status

 User state Description 

 Active The user accepted the invitation and has the assigned access to work within the account. 
 Disabled classic infrastructure The account owner or a user with sufficient permissions can set another user as disabled so that the user can no longer access classic infrastructure resources. The user can continue to log in to the console and access platform resources or support cases. 
 Invalid A user's IAMid is deleted, and they can't access IAM-enabled resources. The user retains VPN access and can still use their classic infrastructure API key, but can't log in to the console. 
 Pending A state in which a user is invited but hasn't accepted the invitation or joined the account by creating an IBM Cloud account. 
 Processing A rarely viewed state in which the user is added to an invite, the system creates the first instance of the user, but the invite hasn't been sent. 
 Suspended The account owner or a user with sufficient permissions can set another user as suspended, which is a temporary alternative to removing a user. Access grants that are associated with the user through policies, access groups, or trusted profiles are not removed. Suspended users can't log in to the console or use the CLI to access the account. They might still be able to access resources in your account. 
 VPN-only A user that is created in the account, but is restricted to VPN access only for devices. This type of user doesn't have access to log in to the console.
If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.<-- </section "id="section-en-notice-add-term" "> --><-- <section "id="section-en-notice-term" "> --> 8. Termination You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.Moreover, your license from a particular copyright holder is reinstated permanently if the copyright older notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.<-- </section "id="section-en-notice-term" "> --><-- <section "id="section-en-notice-accept" "> --> 9.
"requestWaitTime": "1500ms",
"responseWaitTime": "2s",
"aliveTimeInterval": "5s",
"aliveExpirationTimeout": "25s",
"reconnectInterval": "25s",
"election": {
"startupGracePeriod": "15s",
"membershipSampleInterval": "1s",
"leaderAliveThreshold": "10s",
"leaderElectionDuration": "5s"
},
"pvtData": {
"pullRetryThreshold": "60s",
"transientstoreMaxBlockRetention": 1000,
"pushAckTimeout": "3s",
"btlPullMargin": 10,
"reconcileBatchSize": 10,
"reconcileSleepInterval": "1m",
"reconciliationEnabled": true,
"skipPullingInvalidTransactionsDuringCommit": false
},
"state": {
"enabled": true,
"checkInterval": "10s",
"responseTimeout": "3s",
"batchSize": 10,
"blockBufferSize": 100,
"maxRetries": 3
}
},
"authentication": {
"timewindow": "15m"
},
"BCCSP": {
"Default": "SW",
"SW": {
"Hash": "SHA2",
"Security": 256,
"FileKeyStore": {
"KeyStore": null
}
},
"PKCS11": {
"Library": null,
"Label": null,
"Pin": null,
"Hash": null,
"Security": null,
"FileKeyStore": {
We can handle this using step conditions.

When a step asks for information from the user, the user's response is stored as an action variable. By referring to the action variables stored by previous steps, you can construct step conditions based on your customer's previous responses.



1. Click New step.
2. In the Step 2 is taken field, select with conditions. The Conditions section expands.

Zoom

![Action editor: specifying conditions](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/action-editor-conditions.png)

Conditions
3. By default, a condition is automatically created based on the action variable that is stored by the previous step (Withdraw from which account?). However, by default it is checking for a value of Savings, which is not what we want. Click the value field and select Checking instead.

Zoom

![Editing a condition to select Checking as the value to check for](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/action-condition-edit.png)

Edit condition
4. In the Assistant says field, type Withdrawals from checking accounts might incur a fee. Do you want to continue?
5. Click Define customer response and select Confirmation, which has the choices Yes and No.

Click Apply to save the customer response.
6. Because we want to make sure the customer always agrees explicitly, click the Settings icon to open Customer response settings, then select Always ask for this information, regardless of earlier messages.

Zoom

!