vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The number of volumes is a link that takes you to a [list of volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-view-policies&interface=uibackup-view-vol-backup-policies) that apply for the policy. 
 Tags for target resources Tags for target Block Storage for VPC volumes that you are backing up. 
 Last run time (local) The most recent time a job ran for the backup policy. If the field is blank, the volumes don't have matching tags for a job to run. 
 Created date (local) Date and time of when the backup was created. 
 Actions menu Click the Actions icon (...) for available actions, such as restore and delete. 







 Viewing details of a backup policy with the UI 

You can view details of a backup policy by using the UI.



1. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Backup policies. By default, the Overview tab is selected.
2. Click a policy name. Table 2 describes the information about the selected backup policy.





Table 2. Backup policy details

 Field Value 

 Actions Actions on this policy: Add auditing and Delete. 
 Policy details 
 <br><br> * Name<br><br><br> Name of the backup policy. Click the pencil icon to edit. 
 <br><br> * Resource group<br><br><br> [Resource group](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-startedresources-and-resource-groups) for the Block Storage for VPC volume. 
 <br><br> * Location<br><br><br> Policies for the selected region. 
 <br><br> * Created date<br><br><br> Date the policy was created.
* UI
* CLI
* API







 Creating virtual server instances with customer-managed encryption volumes 

You can create virtual servers for IBM Cloud VPC that use your own encryption keys to protect data in the block storage volumes that are attached to your instance. When you provision an instance, you can specify customer-managed encryption for the boot and data volumes. Customer-managed encryption uses your customer root key, giving you complete control over your data. You can import your root key to a key management service (KMS) or create one in a KMS. Customer-managed encryption protects your data while in transit and while at rest. For added security, enable the secure import of your root keys by using import tokens.

Before you can create an instance, you need to [create an IBM Cloud VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console).



 Before you begin 

To create virtual server instances and configure customer-managed encryption for boot and data volumes, you must first provision a key management service and create or import your customer root key (CRK). You must also authorize access between Cloud Block Storage and the key management service.

For information and prerequisite steps, see [Prerequisites for setting up customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningbyok-encryption-prereqs).





 Provisioning virtual server instances with customer-managed encryption volumes in the UI 

When you provision a virtual server instance, you can specify customer-managed encryption for your boot volume and any data volumes that you want to add at that time. If you want, you can use a combination of provider-managed encryption and customer-managed encryption for the volumes that are associated with your instance.

Follow these steps to create an instance with a new block storage volume.



1. In [IBM Cloud console](https://console.cloud.ibm.com/vpc), navigate to menu icon !
* UI
* CLI
* API
* Terraform







 Managing snapshots 

You can manage existing snapshots in several ways. Rename existing snapshots to make them simplier to identify. Add user tags to snapshots for use by the VPC backup service. Enable of disable fast restore copies of a snapshot. Delete snapshots that you no longer need and free up space for new snapshots. Verify Cloud Identity and Access Management access. Verify snapshot statuses.



 Naming snapshots 

Consider naming the snapshot to indicate the volume that you copied. For example, my-volume would be my-volume-snapshot1. Also, for quick identification, consider naming boot volumes by adding boot as a prefix, such as boot_my-volume-snapshot1. As your list of snapshots grows, you can quickly identify the name and type of volume from which you created the snapshot.

Snapshot names adhere to the same requirements as volume names. Valid names can include a combination of lowercase alpha-numeric characters (a-z, 0-9) and the hyphen (-), up to 63 characters. Snapshot names must begin with a lowercase letter and must be unique across the VPC. The UI provides name checking as a convenience. For example, if you end a snapshot name with a hyphen (-), the UI notifies you of the error. It also checks for duplicate names.

New

When you create a cross-regional copy of a snapshot, the new snapshot is named [copy]-[source-snapshot-name]. For example, a cross-regional copy of the snapshot my-volume-snapshot1 is automatically named copy-my-volume-snapshot1 when it is placed in the target region. Cross-regional copies of snapshots are independent from the source snapshot and the source volume, and the copies can be managed like any other normal snapshot.





 Renaming a snapshot in the UI 

Use the following steps to rename a snapshot by using the UI.



1. Go to the list of snapshots.
Snapshots, cloning, and restoring 

Power® Systems Virtual Server provides the capability to capture full, point-in-time copies of entire logical volumes or data sets. Using IBM's FlashCopy feature, the Power Systems Virtual Server APIs lets you create delta snapshots, volume clones, and restore your disks.

APIs to create snapshot and clone



* [Create a new volumes clone request and initiates the Prepare action](https://cloud.ibm.com/apidocs/power-cloudpcloud-v2-volumesclone-post)
* [Create a PVM Instance snapshot](https://cloud.ibm.com/apidocs/power-cloudpcloud-pvminstances-snapshots-post)



CLIs to create snapshot and clone



* [Create a snapshot](https://cloud.ibm.com/docs/power-iaas-cli-plugin?topic=power-iaas-cli-plugin-power-iaas-cli-referencecreate-snapshot)
* [Create a volume clone for specific volumes](https://cloud.ibm.com/docs/power-iaas-cli-plugin?topic=power-iaas-cli-plugin-power-iaas-cli-referencecreate-volume-clone)





 Taking a snapshot 

The snapshot interface allows you to create a relationship between your source disks and a target disks (target disks are created as part of the snapshot API) at time T1. The snapshot API tracks the delta changes done to the source disk beyond time T1. This enables the user to restore the source disks to their T1 state at later point in time.

There are several use cases for the snapshot feature. For example, an administrator plans to upgrade the middleware on his system but would like to be able to revert to its original state before proceeding with an upgrade. If the middleware fails, the administrator can restore the source disk to its previous state. To accomplish this, the administrator would perform the following steps:



1. Initiate the snapshot API with the source disks where the middleware information resides.
2.
kubectl scale deployment -n kube-system --replicas=1 ibm-file-plugin && kubectl scale deployment -n kube-system --replicas=1 ibm-storage-watcher
2. Optional: Confirm that the plug-in is scaled down. The scale-down is successful when the pods are removed and remain removed even after the master state is changed, such as by a cluster refresh or update.



1. Confirm that the pods are removed.

kubectl get pods -n kube-system -l 'app in (ibm-file-plugin, ibm-storage-watcher)'

Example output

No resources found.
2. Refresh the cluster master.

ibmcloud ks cluster refresh -c <cluster_name_or_ID>
3. Wait a few minutes for the refresh to complete, then repeat sub step 2.a to check that the pods are removed. If the pods are rescheduled, the changes that you made to the File Storage for Classic plug-in configuration file were not properly saved. Make sure that your cluster runs the correct Kubernetes version, and try again.









 Backing up and restoring data 

File Storage for Classic is provisioned into the same location as the worker nodes in your cluster. The storage is hosted on clustered servers by IBM to provide availability in case a server goes down. However, File Storage for Classic is not backed up automatically and might be inaccessible if the entire location fails. To protect your data from being lost or damaged, you can set up periodic backups that you can use to restore your data when needed.

Review the following backup and restore options for your File Storage for Classic.



 Setting up periodic snapshots 

You can [set up periodic snapshots for your File Storage for Classic](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-snapshots), which is a read-only image that captures the state of the instance at a point in time. To store the snapshot, you must request snapshot space on your File Storage for Classic. Snapshots are stored on the existing storage instance within the same zone.
To discover the earliest recovery point through the API, use the [/deployments/{id}/point_in_time_recovery_data](https://cloud.ibm.com/apidocs/cloud-databases-apiget-earliest-point-in-time-recovery-timestamp) endpoint to find the earliest PITR time.

{
"point_in_time_recovery_data": {
"earliest_point_in_time_recovery_time": "2019-09-09T23:16:00Z"
}
}



 Recovery 

Backups are restored to a new deployment. After the new deployment finishes provisioning, your data in the backup file is restored into the new deployment. Backups are also restorable across accounts, but only by using the API and only if the user that is running the restore has access to both the source and destination accounts.

By default the new deployment is auto-sized to the same disk and memory allocation as the source deployment at the time of the backup you are restoring from. Especially in the case of PITR, that might not be the current size of your deployment. If you need to adjust the resources that are allocated to the new deployment, use the optional fields in the UI, CLI, or API to resize the new deployment. Be sure to allocate enough for your data and workload, if the deployment is not given enough resources the restore fails.

While storage and memory are restored to the same as the source deployment, specific instance configurations are not automatically set for the new instance. In this case, rerunning the configuration after a restore might be needed. Any instance modifications should be noted before running the restore (parameters like shared_buffers, max_connections, deadlock_timeout, archive_timeout, and others) to ensure accurate setting for the instance after the restore is complete.

Do not delete the source deployment while the backup is restoring. You must wait until the new deployment is provisioned and the backup is restored before deleting the old deployment. Deleting a deployment also deletes its backups so not only will the restore fail, you might not be able to recover the backup either.



 Point-In-Time Recovery in the UI
On the Block Storage for VPC provisioning page, enter the required information to define the new volume (see Table 2).



Table 2. Values for defining a Block Storage for VPC volume

 Field Value 

 Location The geography, region, and zone are inherited from the VPC (for example, North America, Dallas, Dallas-1). You can select a different zone in your location from the menu by clicking the pencil icon. 
 Name Specify a meaningful name for your volume. For example, provide a name that describes your compute or workload function. The volume name can be up to 63 lowercase alpha-numeric characters and include the hyphen (-), and must begin with a lowercase letter. Volume names must be unique across the entire VPC infrastructure. You can later edit the name. 
 Resource Group Specify a [resource group](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-startedresources-and-resource-groups). 
 Tags Specify [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about&interface=uistorage-about-user-tags) to organize your resources and for use by [backup policies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about). 
 Access management tags Specify [access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about&interface=uistorage-about-mgt-tags) that were created in IAM to help you manage access to your volumes. 
 Snapshot Optionally, click Select snapshot to create the volume with data from the selected snapshot. You can create data volumes with Nonbootable snapshots, and boot volumes with Bootable snapshots. For more information, see [Create a stand-alone Block Storage for VPC volume from a snapshot](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-vol-from-snapshot-ui).
To discover the earliest recovery point through the API, use the [/deployments/{id}/point_in_time_recovery_data](https://cloud.ibm.com/apidocs/cloud-databases-api/cloud-databases-api-v5getpitrdata) endpoint to find the earliest PITR time.

{
"point_in_time_recovery_data": {
"earliest_point_in_time_recovery_time": "2019-09-09T23:16:00Z"
}
}



 Recovery 

Backups are restored to a new deployment. After the new deployment finishes provisioning, your data in the backup file is restored into the new deployment. Backups are also restorable across accounts, but only by using the API and only if the user that is running the restore has access to both the source and destination accounts.

By default the new deployment is auto-sized to the same disk and memory allocation as the source deployment at the time of the backup that you are restoring from. Especially in the case of PITR, that might not be the current size of your deployment. If you need to adjust the resources that are allocated to the new deployment, use the optional fields in the UI, CLI, or API to resize the new deployment. Be sure to allocate enough for your data and workload, if the deployment is not given enough resources the restore fails.

While storage and memory are restored to the same as the source deployment, specific instance configurations are not automatically set for the new instance. In this case, rerunning the configuration after a restore might be needed. Note any instance modifications before running the restore (parameters like shared_buffers, max_connections, deadlock_timeout, archive_timeout, and others) to ensure accurate setting for the instance after the restore is complete.

It is crucial that you do not delete the source deployment while the backup is restoring. Wait until the new deployment is provisioned and the backup is restored before deleting the old deployment. Deleting a deployment also deletes its backups, so not only will the restore fail, you might not be able to recover the backup either.



 In the UI
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

 How to fix it 

To resolve the issue, be sure that your identity provider NameID is formatted as an email address. Verify that all the users in your identity provider registry have a valid email address format. Then, verify that the NameID field is correctly defined so that a valid email is always returned - even if users in your registry have multiple emails.





 Failure to decrypt the response 

 What’s happening 

You receive one of the following error messages in response to your authentication request.

Error message 1:

Unexpectedly received an encrypted assertion. Please enable response encryption in your {{site.data.keyword.appid_short_notm}} SAML configuration.

Error message 2:

Could not decrypt SAML assertion. Ensure your SAML provider is configured with the {{site.data.keyword.appid_short_notm}} encryption.

 Why it’s happening 

If your identity provider is configured to encrypt, App ID must be configured to sign the SAML authentication requests (AuthnRequest). Then, your identity provider must be configured to expect the corresponding configuration. You might receive these errors for one of the following reasons:



* App ID is not configured to expect that the identity provider SAML response is encrypted.
* App ID cannot correctly decrypt your assertions.



 How to fix it 

If you receive error message 1, verify that your SAML configuration is set to expect an encrypted response. By default, App ID does not expect the response to be encrypted. To configure encryption, set the encryptResponse parameter to true by using [the API](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Identity%20Providers/mgmt.set_saml_idp).

If you receive error message 2, ensure that your certificate is correct.
Enabling queue manager Advanced Message Security (AMS) 



 What is IBM MQ Advanced Message Security? 

IBM® MQ Advanced Message Security expands IBM MQ security services to provide encryption at the 'message' level to protect sensitive data, such as high-value financial transactions and personal information. There are two approaches to IBM MQ AMS, which we will refer to as [Application AMS](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_app_ams) and Queue Manager AMS. This tutorial focuses on Queue Manager AMS.

Queue Manager AMS provides the following functions:



* Comprehensive security without writing complex security code or modifying or recompiling existing applications
* Support for encryption and digital signing of messages
* Public Key Infrastructure (PKI) technology to provide authentication, authorization, confidentiality, and data integrity services for messages







 Tutorial Overview 

![Image showing messages stored on a queue on the queue manager are encrypted using queue manager AMS.](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_diagram.png)

Diagram: Queue Manager AMS ensures message data has not been modified between when it is placed on a queue and when it is retrieved.

This tutorial passes messages in plain text over the network to the queue manager. In a production system, it is recommended that you use a TLS enabled channel in order to protect the message in transit.

This tutorial will guide you through the steps to configure queue manager AMS for encryption on an IBM MQ queue on an IBM Cloud queue manager. You will begin by putting and getting plain text messages to confirm that the messages sit on the queue in plain text. You will then enable queue manager AMS encryption, thus ensuring that messages on the queue are encrypted. You will then demonstrate that messages on the queue are now encrypted, ensuring the message data cannot be accessed or modified by unauthorised users or applications.
Connecting to IBM tools 

You can connect IBM command-line interfaces, applications, and tools to your Db2 Warehouse on Cloud database.



 Data integration 



 InfoSphere DataStage 

These instructions explain how to define a connection without SSL between IBM® InfoSphere® DataStage® and a Db2 Warehouse on Cloud database by cataloging the database and defining a connection object, or how to create a connection with SSL by using a digital certificate that is issued by a third party.



 Prerequisites 

It is advised that you update DataStage to the most recent version so that you can take advantage of external tables to load your data into Db2 Warehouse on Cloud.

If you don’t already have a data server client that is installed, download and install the IBM Data Server Client that is appropriate for your client machine’s operating system: [IBM Data Server Client](https://www.ibm.com/marketing/iwm/iwm/web/preLogin.do?source=swg-idsc97).

To make connections with the SSL protocol, download and install the 32-bit GSKit V8. Click the OS tab that is appropriate for your client machine’s operating system: [GSKit V8 - Install, Uninstall and Upgrade instructions](http://www.ibm.com/support/docview.wss?uid=swg21631462). For the following operating systems, ensure that you add the GSKit installation directory path to the OS-specific path environment variable:



* AIX®: LIBPATH



* /usr/opt/ibm/gsk8/lib



* Linux: LD_LIBRARY_PATH



* /usr/local/ibm/gsk8/lib



* UNIX: LD_LIBRARY_PATH



* /opt/ibm/gsk8/lib



* Windows: PATH



* <installation_directory>gsk8bin
* <installation_directory>gsk8lib
Connecting to IBM tools 

You can connect IBM command-line interfaces, applications, and tools to your Db2 on Cloud database.



 Data integration 



 InfoSphere DataStage 

These instructions explain how to define a connection without SSL between IBM® InfoSphere® DataStage® and a Db2 on Cloud database by cataloging the database and defining a connection object, or how to create a connection with SSL by using a digital certificate that is issued by a third party.



 Prerequisites 

It is advised that you update DataStage to the most recent version so that you can take advantage of external tables to load your data into Db2 on Cloud.

If you don’t already have a data server client that is installed, download and install the IBM Data Server Client that is appropriate for your client machine’s operating system: [IBM Data Server Client](https://www.ibm.com/marketing/iwm/iwm/web/preLogin.do?source=swg-idsc97).

To make connections with the SSL protocol, download and install the 32-bit GSKit V8. Click the OS tab that is appropriate for your client machine’s operating system: [GSKit V8 - Install, Uninstall and Upgrade instructions](http://www.ibm.com/support/docview.wss?uid=swg21631462). For the following operating systems, ensure that you add the GSKit installation directory path to the OS-specific path environment variable:



* AIX®: LIBPATH



* /usr/opt/ibm/gsk8/lib



* Linux: LD_LIBRARY_PATH



* /usr/local/ibm/gsk8/lib



* UNIX: LD_LIBRARY_PATH



* /opt/ibm/gsk8/lib



* Windows: PATH



* <installation_directory>gsk8bin
* <installation_directory>gsk8lib





Before attempting to connect to your Db2 on Cloud database, verify that you have the [prerequisites](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-connect_ovprereqs).
When you create a toolchain, you must protect it by using a root key for encryption that is enabled.

 How to fix it 

Use one of the following methods to enable the root key for encryption:



* [Enable the root key for the IBM® Key Protect for IBM Cloud® instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-root-key) that is associated with your Continuous Delivery service, in the region where you want to create a toolchain.
* [Enable the root key for the IBM Cloud® Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-ui) that is associated with your Continuous Delivery service, in the region where you want to create a toolchain.







 Why can't I view the service instances that I created on the Toolchains page when the root key is disabled? 

 What’s happening 

When you open your toolchain, the following notification is displayed: The root key of the key management service instance that was used to encrypt this toolchain is disabled.

 Why it’s happening 

Because the information that is required to view the toolchain's service instances is decrypted when you open a toolchain, you must ensure that the root key for encryption is enabled.

 How to fix it 

Use one of the following methods to enable the root key for encryption:



* [Enable the root key for the IBM® Key Protect for IBM Cloud® instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-root-key) that is associated with your Continuous Delivery service, in the region where you want to view the toolchain.
* [Enable the root key for the IBM Cloud® Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-ui) that is associated with your Continuous Delivery service, in the region where you want to view the toolchain.