vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why do I see a VPN client restart message when certificate authentication is used? 

When certificate authentication is enabled on the VPN server, and the certificate that is presented by the VPN client cannot be verified, the VPN server directs the VPN client to restart.

  What’s happening 

The VPN client logs the following message Connection reset, restarting.

  Why it’s happening 

The client certificate cannot pass verification.

  How to fix it 

Follow these steps to resolve this issue:



1.  Use the Linux command openssl x509 -noout -text -in certificate-file-name to get the certificate information.
2.  Check that the issuer of the client certificate is matched with the client root certificate that you chose when you provisioned the VPN server.
3.  Check that the certification extension X509v3 Extended Key Usage is TLS Web Client Authentication.
Using IBM Cloud Databases for PostgreSQL as external metastore 

You can use IBM Cloud Databases for PostgreSQL to externalize metadata outside the IBM Analytics Engine Spark cluster.



1. Create an IBM Cloud Databases for PostgreSQL instance. See [Databases for PostgreSQL](https://cloud.ibm.com/databases/databases-for-postgresql/create).

Choose the configurations based on your requirements. Make sure to choose Both public & private network for the endpoint configuration. After you have created the instance and the service instance credentials, make a note of the database name, port, user name, password and certificate.
2. Upload the Databases for PostgreSQL certificate to an IBM Cloud Object Storage bucket where you are maintaining your application code.

To access Databases for PostgreSQL, you need to provide a client certificate. Get the Base64 decoded certificate from the service credentials of the Databases for PostgreSQL instance and upload the file (name it say, postgres.cert) to a Object Storage bucket in a specific IBM Cloud location. Later you will need to download this certificate and make it available in the IBM Analytics Engine instance Spark workloads for connecting to the metastore
3. Customize the IBM Analytics Engine instance to include the Databases for PostgreSQL certificate. See [Script based customization](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-cust-script).

This step customizes the IBM Analytics Engine instance to make the Databases for PostgreSQL certificate available to all Spark workloads run against the instance through the library set.



1. Upload the customization_script.py from the page in [Script based customization](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-cust-script) to a IBM Cloud Object Storage bucket.
2. Run postgres-cert-customization-submit.json that uses the spark-submit REST API to customize the instance.
All requests to the origin are evaluated for a valid client certificate. The client device sends the client "hello". The access application responds with "hello" and a request for the client certificate.
2. The client returns a valid certificate.
3. Client authentication handshake is completed against the root certificate authority.
4. For chains, there is a check for expired certificates. Chain verification is applicable to certificate validation.
5. When the client certificate is trusted by the root certificate, a signed JSON Web Token (JWT) is generated for the client that allows the request and subsequent requests to proceed. If a request has no valid client certificate, 403 Forbidden returns in the response.
Advanced index creation is an example for using all index types and it takes longer to finish.





 Assigning a base location for data skipping indexes 

Indexes are stored in Cloud Object Storage in a bucket of your choice. Before you start to create indexes, first configure the default location, called base location, for indexes created in your Data Engine instance. When you use Hive tables, you can also configure the index location per Hive table.

To assign your base location, use the following command:

ALTER METAINDEX SET LOCATION <path>

The following command includes a path:

ALTER METAINDEX SET LOCATION cos://us-south/mybucket/mypath/





 Creating data skipping indexes 

When you create a data skipping index on a data set, decide which columns to index, and choose an index type for each column. Your choices depend on your workload and data. In general, index those columns that are queried the most in the WHERE clause. The three supported index types are MinMax, ValueList, and BloomFilter.

The following example creates a data skipping index on the metergen data set that uses three index types:

CREATE METAINDEX
MINMAX FOR temp,
MINMAX FOR lat,
MINMAX FOR lng,
BLOOMFILTER FOR vid,
VALUELIST FOR city
ON cos://us-geo/sql/metergen STORED AS parquet

In the [Cloud Object Storage URI](https://cloud.ibm.com/docs/sql-query?topic=sql-query-sql-referenceCOSURI), specify the top level (the root) of the data set.

It is possible to share indexes across Data Engine accounts. Users who have READ access to the base location of an index can use it by setting their base location. However, it is important to avoid multiple users who write indexes for the same data set to the same base location. Users can avoid sharing indexes by using different base locations.

Data Engine charges for index creation based on the amount of data scanned. Index creation for Parquet files benefits from the availability of schema information and the possibility of column projection to limit the amount of data scanned.
Why does the ESXi server display a message about management network redundancy? 

  What’s happening 

A configuration issue is displayed in the Issues tab of the Monitor tab of the VMware ESXi® server in the vSphere client.

The following message is displayed in the Issues tab for the ESXi server:

This host currently has no management network redundancy

The message is displayed even though two uplinks are available for the private distributed switch, which provides a redundancy.

  Why it’s happening 

This configuration issue is a VMware® known issue.

  How to fix it 

To resolve the problem, follow the instructions in [ESX/ESXi host displays warning message when test condition is false (2008602)](https://kb.vmware.com/s/article/2008602).
Adding a Gateway 

A gateway can be thought of as a way to identify a particular network or environment. It is what a Secure Gateway Client will use to establish connectivity with the Secure Gateway servers and can contain multiple resource definitions, or destinations.

![Secure Gateway Dashboard](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/newDashboard.png?raw=true)

From the Secure Gateway Dashboard, click the Add Gateway button to open the Add Gateway panel.

![Add Gateway](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/addGateway.png?raw=true)

The only required input on this panel is your Gateway Name. By default, both Require security token and Token Expiration are selected.

By requiring the security token to connect clients, each time you start a Secure Gateway client, you will have to provide both the Gateway ID and the Security Token. If you uncheck the Require security token box, you will only have to provide the Gateway ID to the client when starting the connection to the gateway.

The default expiration date for the Security Token is 90 days from when it is created. To change the expiration date, keep the Token Expiration box checked and edit the text field with the number of days you would like the token to expire in (minimum 1, maximum 365). To create a token that does not expire, uncheck the Token Expiration box.

To finish the creation of your gateway, click Add Gateway. Once the gateway is created, the page will automatically navigate into your new gateway.

!
kubectl create configmap ibp-hsm-config --from-file=ibp-hsm-config.yaml -n <NAMESPACE>

The output looks similar to:

configmap/ibp-hsm-config created







 What's next 

After you have used these instructions to configure your IBM Cloud HSM and build the HSM client image, you are ready to configure your blockchain nodes to use the HSM. When you create a CA, peer, or ordering node, select the [HSM Advanced deployment option](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm-node) to configure the node to use this HSM.

When a node is configured with HSM, a temporary Kubernetes job is started to run this HSM "enrollment" process. Before configuring a node to use HSM, ensure that you have enough resources in your cluster to support this job that takes approximately 0.1CPU and 100M memory.

On the HSM configuration panel, the Use HSM client image toggle is visible. When it is on, you can enter the following values:



* HSM label - Enter the name of the HSM partition to be used for this node.
* HSM PIN - Enter the PIN for the HSM slot.



When the node is deployed, a private key for the specified node enroll ID and secret is generated by the HSM and stored securely in the appliance.
* Ubuntu 18.04 and later: [OpenVPN Connect v3](https://openvpn.net/vpn-client/tab-linux), OpenVPN Connect v2, and OpenVPN command-line client (version 2.4.10 and later)



You can choose other OpenVPN-2.4-compatible client software. However, software that is not listed is not guaranteed to work.





 Step 2: Set up client authentication 

Your VPN server administrator can choose to set up a client certificate, a user ID and passcode, or both types of authentication. Depending on what your administrator instructs you to do, complete one or both of the following procedures.



 Configure a client certificate 

If your administrator provided a client certificate for certificate-based authentication, you must edit the client profile file, and then add the client certificate into the file using any ASCII editor.



1. Save the client profile (<vpn_server>.ovpn) on your system.
2. Open the file in an ASCII editor and add the client certificate to the end of the client profile. For example, use one of the following methods:



* Enter the paths to both the client public key and the client private key:

cert /path/client_public_key.crt
key /path/client_private_key.key



OR



* Wrap client_public_key.crt between the <cert></certs> tags and enclose client_private_key.key between <key></key> as shown.

<cert>
-----BEGIN CERTIFICATE-----
place your VPN client certificate
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
place your VPN client private key
-----END PRIVATE KEY-----
</key>



3.
IBM Cloud Application Load Balancer and Network Load Balancer both integrate with private catalogs to centrally manage access to products in the IBM Cloud catalog and your own catalogs. You can customize your private catalogs to allow or disallow load balancer provisioning to specific users in your account. For more information, see [Customizing what's available in your private catalogs](https://cloud.ibm.com/docs/account?topic=account-restrict-by-user).





 Application load balancer data flow 

A client makes a request by using the FQDN that is registered to the load balancer instance. A DNS server handles the request and distributes the traffic in a round robin fashion to the back-end servers (server instances hosting the application). Eventually the back-end server responds, and the response flows back through the load balancer, then back to the client.

Zoom

![ALB traffic flow](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/alb-datapath.svg)

Figure 1. Application load balancer traffic flow





 Network load balancer data flow 

The client sends the TCP request to the network load balancer. The client source IP is preserved after the network load balancer forwards the request to the back-end target. After the target generates the response, the response is sent directly to the client that uses DSR (Direct Server Return).

Zoom

![Network load balancer traffic flow](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/nlb-datapath.png)

Figure 2. Network load balancer traffic flow





 Related links 



* [Load balancer API reference](https://cloud.ibm.com/apidocs/vpclist-load-balancers)
Otherwise, the device is either returned to the party specified in the request, or the device is destroyed onsite.
* Can a device for data transfer be sent internationally?

Hardware can be sent both domestically and internationally to any of the IBM Cloud® data centers. However, you as the Client are responsible for the meeting the following requirements.



* Ensuring that no import or export license is required to ship the Device to the IBM® data center, or to return it to Client (if applicable).
* Ensuring that Client or any Client user whose data is included in the Content is not subject to any US Government order that revokes or denies their US export privileges. You must notify IBM® immediately if your enterprise or any such user becomes subject to any such order.
* Obtaining all licensing, shipping, and customs clearance for the Device, including paying any duties, taxes, and shipping costs to and from (if applicable) the IBM® data center.
* Complying with all applicable laws, including privacy, import and export, which are associated with delivery and return of the Device, and the transfer of Content to the IBM® data center.
* Having proper agreements in place, and obtaining all required permissions, with Client’s user for any user data Client transfers to the hardware.



Include a pre-paid return-shipping label and all appropriate export documents with your shipment. IBM Cloud® packages the device for return by using the label and documents that you provided. If return isn't requested, the device is destroyed.
* What types of devices can be sent with a data transfer request?

Use the following Hardware Requirements guidelines when you select a device to submit for data transfer.



* Power supply must be 208v/220v compatible.
* Power plug must fit a standard 120v socket (NEMA 5-15P).
* Device must be USB 2.0 or USB 3.0 compatible.
* Provide a USB A male connector (standard USB plug that fits most computers).

Encrypted USB devices that require support for proprietary encryption software are not supported for data transfer.



* Can the device be sent back sooner or can it stay longer than two weeks?

Yes, your hardware can be returned at any time or can stay connected longer, if necessary.
Content-Length: 533

The 'queen' bee is developed from larvae selected by worker bees and fed a
substance referred to as 'royal jelly' to accelerate sexual maturity. After a
short while the 'queen' is the mother of nearly every bee in the hive, and
the colony will fight fiercely to protect her.

Example response

HTTP/1.1 200 OK
Date: Thu, 25 Aug 2016 18:30:02 GMT
X-Clv-Request-Id: 9f0ca49a-ae13-4d2d-925b-117b157cf5c3
Accept-Ranges: bytes
Server: Cleversafe/3.9.0.121
X-Clv-S3-Version: 2.5
x-amz-request-id: 9f0ca49a-ae13-4d2d-925b-117b157cf5c3
ETag: "3ca744fa96cb95e92081708887f63de5"
Content-Length: 0

--------------------







 Get an object's headers 

A HEAD given a path to an object retrieves that object's headers.

The Etag value returned for objects encrypted using SSE-KP is the MD5 hash of the original decrypted object.

Not all operations are supported in Satellite environments. For details, see [supported Satellite APIs](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-apis-cos-satellite)

Syntax

HEAD https://{endpoint}/{bucket-name}/{object-name} path style
HEAD https://{bucket-name}.{endpoint}/{object-name} virtual host style

Example request

HEAD /apiary/soldier-bee HTTP/1.1
Authorization: Bearer {token}
Type the current default gateway and subnet mask in CIDR format.
3. Scroll down and click Stretch to begin the network stretch workflow.





Network progress is monitored in the vCenter client tasks pane.





 Concepts and best practices for network stretching 

The glue that bridges the client-side network to the cloud side VXLAN is a sophisticated multitunnel VPN that consists of proprietary HCX technology. It is not based on NSX, but does work with NSX and extend its capability. This process is controlled by the client-side vCenter web user interface and automates the deployment and starting of both endpoints on the client and cloud side. Selecting the network to stretched is done individually or in batch.

Additionally, as part of the network stretching workflow, NSX on the cloud side is authorized to build a VXLAN. The VXLAN is then connected to an interface created on the specified cloud side L3 device (DLR or ESG left in an unconnected state) and the cloud side Network Extension appliance.

Typically, when you migrate a particular application, all the networks in use by the applicable virtual machines (VMs) must get stretched across the IBM Cloud® instance.

Why typically and not always? It can be advantageous to disconnect certain traffic from the client side after the VM is migrated. For example, VM guest backup clients, which might cause high-bandwidth use when moved to the cloud. The in-guest backup client is not required when the VM is migrated as it is automatically picked up by a more modern block level backup on the cloud side.

The client’s backup network adapter is not being accessed because it would mean accessing each VM to shut off the in-guest client backup schedule. Therefore, if a backup network is used, the backup might fail. This situation is temporary until all the VMs can be reached post migration to disable the in-guest backup client.

Bandwidth of a single network extension is theoretically 4 Gbps. However, this value can be the limit for all stretched networks within a single network extension pair and is not achievable by a single stretched network.
When a VPN connection is set up, an encrypted tunnel is created over the internet to the VPN server. The VPN connection appears as a virtual network interface to the computer in addition to the existing LAN interface. You can now use both interfaces simultaneously by sending the private traffic destined to the VPC inside the VPN tunnel and the public traffic (internet traffic) over the other interface (outside the VPN tunnel). When the traffic is split between the VPN interface and other interfaces, split tunneling is said to be in use. When split tunneling is not in use, all the traffic uses the VPN interface, resulting in the internet traffic being sent into the VPN tunnel, which is full-tunnel.

Other considerations:



* Use full-tunnel (default) mode if you have a security concern when the client accesses the internet without a VPN tunnel. Full-tunnel is usually necessary for compliance with regulatory standards; however, this approach can be costly and also increases the load of the VPN server.
* In split-tunnel mode, routes are pushed to the VPN client by the VPN server. This way, the OpenVPN client knows which traffic should be sent into the VPN tunnel. You should be careful when adding routes and avoid routing loops. For example, if the VPN server's public IP address is 3.3.3.3, then you cannot add a route 3.3.3.0/24 because this route would send traffic to 3.3.3.3 that should not go through the VPN tunnel. Ideally, you should configure the private subnet only as a route destination, such as a VPC subnet, a CSE subnet, an on-premises private subnet, and so on.
* The VPN route is pushed to your VPN client. If your VPN client already has a route with the same destination, the route "push" fails and the traffic cannot reach your VPN server. You must address the route conflict and then re-connect the VPN client. A common issue is if you add a VPN route with destination 0.0.0.0/0 on a split-tunnel-mode VPN server, and this route needs to be pushed to your VPN client.
Why is there a delay when restoring my IBM Cloud® Databases for MySQL deployment? 

  What’s happening 

You're experiencing a long delay when restoring your IBM Cloud® Databases for MySQL deployment.

  Why it’s happening 

Restoring a backup can be delayed if your configurable variables aren't optimized, or if you aren't using the appropriate tools.

  How to fix it 



*  Check your configurable variables at [Migrating to Databases for MySQL](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-migrating).
*  You can restore a backup using [mysqldump](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-migratingmigrating-mysqldump) or [mydumper](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-migratingmigrating-mydumper). mysqldump, the native MySQL backup client, is effective for databases smaller than 10 GB, whereas mydumper is effective with larger databases. Use the tool that best suits your needs.
Logging for watsonx.data 

After you provision IBM Log Analysis to add log management capabilities to your IBM Cloud architecture, you can enable platform logs to view and analyze IBM® watsonx.data logs.



  Platform logs 

Platform logs are logs that are exposed by logging-enabled services and the platform in IBM Cloud. Configure a Log Analysis instance in a region to monitor these logs.

For more information, see [Configuring IBM Cloud platform logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_svc_logs).





  Viewing logs 

watsonx.data instances generate platform logs in the same region where they are available. You can view, monitor, and manage logs through the IBM Log Analysis instance that is marked as platform logs in the region.

To launch the Log Analysis web UI to view these logs, see [Navigating to the web UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-launch).

For more information about the locations where watsonx.data logs are available, see [Service locations](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-cloud_services_locations).





  Log field records 

The following table describes the log records that are generated by the watsonx.data service



Table 1. Log field records

 Field              Description                                                               

 logSourceCRN       watsonx.data instance CRN from which the log is published.                
 messageID          ID that indicates the type of log message.                                
 saveServiceCopy    Defines whether IBM saves a copy of the record for operational purposes.  
 message            Description of the log that is generated.                                 
 ts                 Timestamp of the log that is generated.                                   
 level              Severity level of the log.                                                
 app                Internal application from where the log is generated.                     
 caller             Internal caller that generates the log.                                   







  Log messages 

The following table describes a few example log messages that are generated by the watsonx.data service



Table 2. Log messages

 Message ID         Description                           

 lakehouse.0012E    Engine creation request is failed.    
 lakehouse.3001I    Metastore is started.                 
 lakehouse.1041I    Engine user is created successfully.  
 lakehouse.0612E    Table deletion request is failed.