vania-janet/multiturn-rag-retrieval-data huggingface dataset:
In this tutorial, the application will be a web server, thus it will only need to allow inbound connections on port 80.

To perform maintenance tasks on these servers such as installing software, performing operating system upgrades, you will go through a bastion host. A bastion host is an instance that is provisioned with a public IP address and can be accessed via SSH. Once set up, the bastion host acts as a jump server allowing a secure connection to instances provisioned in the VPC.

In this section, you will create the VPC and the bastion host.

This tutorial also comes with companion shell scripts and a Terraform template, that can be used to generate the resources that you will create using the UI below. They are available [in this Github repository](https://github.com/IBM-Cloud/vpc-tutorials/tree/master/vpc-public-app-private-backend).



1. Navigate to the [Virtual Private Clouds](https://cloud.ibm.com/vpc-ext/network/vpcs) page and click on Create.
2. Under New Virtual Private Cloud section:



1. Enter vpc-pubpriv as name for your VPC.
2. Select a Resource group.
3. Optionally, add Tags to organize your resources.



3. Uncheck Allow SSH and Allow ping from the Default security group. SSH access will later be added to the maintenance security group. The maintenance security group must be added to an instance to allow SSH access from the bastion server. Ping access is not required for this tutorial.
4. Under Subnets change the name of the Zone 1 subnet. Click the pencil icon:



* Enter vpc-secure-bastion-subnet as your subnet's unique name.
* Select the same Resource group as the VPC resource group.
* Leave the defaults in the other values.
* Click Save



5. Under Subnets change the name of the Zone 2 subnet. Click the pencil icon:
Because this job runs monthly, it is idle most of the time, but consumes a high amount of CPU and memory when it does runs. The batch job needs to integrate with storage to store the results. By using Code Engine, you can integrate the batch job with IBM Cloud Object Storage and are charged only for the resources that the job uses when it is running. When the job is idle, it isn't consuming any resources and therefore is not incurring charges. However, the job might incur costs with the IBM Cloud Object Storage instance.

Bring your workload
: Part of your job is to create images and deploy them. You are experienced with creating container images and with deploying them, but you want to simplify this process so that you can concentrate on other tasks. With Code Engine, you can build images and deploy them directly from the same interface, thus simplifying daily tasks and freeing up time to develop more code.

Testing, proof-of-concepts, or "tire-kicking”
: You are interested in learning more about container-based architecture. Your team developed an application, but wants to test it out before the application is presented to stakeholders. This application is small, so they do not want to pay for even a small, dedicated cluster. In this case, you can test the application and then provide a proof-of-concept of the design to the stakeholders without the cost that a dedicated cluster might require.





 When to use an application or a job 

Applications and jobs are very similar, in the end, they both simply run code. However, there are some key aspects to consider when you decide to structure your code as an app or job,

Does your code need to respond to an event?
: In the context of Code Engine, any incoming HTTP request (even the request to load a web page) or a REST API call is considered an event. The concept of being event-driven is often the key factor when you choose between an app or a job because, by definition, apps are run because of an HTTP request while jobs are run as of result of an invocation.
: If you know that your workload responds to incoming HTTP requests, then app is the right choice. However, if your workload is run and then done, a job is a better fit.
If you reduce the number of requests you need to build a complete picture of a modeled entity, you can present information to your users more quickly.

By using views, you get many of the benefits of normalized data while you maintain the de-normalized version for efficiency.

As an example, in a relational schema, you'd normally represent tags in a separate table and use a connecting table to join tags with their associated documents. This practice allows quick lookup of all documents with a specific tag.

In IBM Cloudant, you'd store tags in a list in each document. You would then use a view to get the documents with a specific tag by [emitting each tag as a key in your view's map function](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-creating-views-mapreduce). Querying the view for a specific key then provides all the documents with that tag.





 How does this help me de-normalize my data? 

It all comes down to the number of HTTP requests that your application makes. There's a cost to opening HTTP connections, particularly HTTPS. While reusing connections helps, making fewer requests overall speeds up the rate that your application can process data.

As a side benefit, when you use de-normalized documents and pre-computed views, you often have the value that your application requires generated ahead of time. Rather than it being constructed while in progress at query time.





 How can I avoid conflicts by using finer-grained documents? 

In conflict with the advice to de-normalize your data is this advice, use fine-grained documents to reduce the chance of concurrent modifications that create conflicts. This practice is somewhat like normalizing your data. There's a balance to strike between reducing the number of HTTP requests and avoiding conflicts.

For example, see the medical record that includes a list of operations:

{
"_id": "Joe McIllness",
"operations": [
{ "surgery": "heart bypass" },
{ "surgery": "lumbar puncture" }
]
}
* The initiator.name field includes information about who has requested to update the service ID.
* The target.name field includes information about the service ID that is changed.
* The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI. When the field is set to IBM Cloud CLI, the request originates at the command line.





 Lock and unlock a service ID 

The following field includes extra information:



* In requestData, the lock field is set to true when the service ID is locked, and to false when it is unlocked.







 Add or modify a description 

When a request to change a description generates an event, the following fields include information that can help you determine this action:



* In requestData, the lock field is set to false.
* In requestData, the prev_instance_name field and the instance_name field are set to the same value.







 Change the name of a service ID 

The following fields include extra information:



* In requestData, the lock field is set to false.
* In requestData, the instance_name field includes the new name of the API key.
* In requestData, the prev_instance_name field includes the name of the API key before it was changed.









 Update a user API key or a service ID API key 

When an action to update an API key is requested, you get an event in the account with one of the following actions:



* To update a user API key, the action is iam-identity.user-apikey.update.
* To update a service ID API key, the action is iam-identity.account-serviceid.update.



The following fields include extra information:



* The initiator.name field includes information about who has requested to update the API key.
* The target.name field includes information about the API key that is changed.
* The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI.
Settings 



 Overview 

You can use the Settings page to change the basic system settings in the Data Security Broker Manager.



1. Log into the Data Security Broker Manager.
2. Navigate to the Settings icon in the left navigation
3. Click the Edit icon to change the system settings. Modify the Organization name, and domain settings, and click Save.







 HTTPS Certificate 

HTTPs Certificate allows you to enable SSL for the Data Security Broker Manager console. This ensures that you have secure access to the Data Security Broker Manager web interface.

When you try to log into the Data Security Broker Manager after the set up, you get a warning: Untrusted certificate browser warning.

The warning appears when you have not uploaded an HTTPS certificate. HTTPS certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection.

Upload an HTTPS certificate by following the instructions in [Adding HTTPS certificate](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_https) section.





 SMTP 

The SMTP configuration is required when you need to add a new user to the Data Security Broker Manager.

Complete the following steps to configure the SMTP credentials for the Data Security Broker Manager:



1. In the Settings page, click SMTP + to configure the mail server credentials for the Data Security Broker Manager.

Zoom

![SMTP in Setttings](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/smtp.svg)

SMTP in Setttings
2. Specify the following credentials to authenticate to the SMTP server, and click Save.

Host name: The address where your SMTP server resides Port: The port number which is used by your server. Usually, the port number is 587 or 2525. Username and Password: The credentials for accessing your SMTP server.

Zoom

!
If you reduce the number of requests you need to build a complete picture of a modeled entity, you can present information to your users more quickly.

By using views, you get many of the benefits of normalized data while you maintain the de-normalized version for efficiency.

As an example, in a relational schema, you'd normally represent tags in a separate table and use a connecting table to join tags with their associated documents. This practice allows quick lookup of all documents with a specific tag.

In IBM Cloudant, you'd store tags in a list in each document. You would then use a view to get the documents with a specific tag by [emitting each tag as a key in your view's map function](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-creating-views-mapreduce). Querying the view for a specific key then provides all the documents with that tag.
* How does this help me de-normalize my data?

It all comes down to the number of HTTP requests that your application makes. There's a cost to opening HTTP connections, particularly HTTPS. While reusing connections helps, making fewer requests overall speeds up the rate that your application can process data.

As a side benefit, when you use de-normalized documents and pre-computed views, you often have the value that your application requires generated ahead of time. Rather than it being constructed while in progress at query time.
* How can I avoid conflicts by using finer-grained documents?

In conflict with the advice to de-normalize your data is this advice, use fine-grained documents to reduce the chance of concurrent modifications that create conflicts. This practice is somewhat like normalizing your data. There's a balance to strike between reducing the number of HTTP requests and avoiding conflicts.

For example, see the medical record that includes a list of operations:

{
"_id": "Joe McIllness",
"operations": [
{ "surgery": "heart bypass" },
{ "surgery": "lumbar puncture" }
]
}
The root password for your server is also displayed. Click Show Password to see it.





 Partitioning and file systems 

For the three-tier example, a 192 GB database server with one logical disk (on RAID10) and a 32 GB application server with one logical disk (on RAID 1) were ordered. Both servers come with one large root file system that is equal to the total size of disk (with some space that is used for /boot).

For the 32 GB server, create the /usr/sap/ file system. The file systems sapmnt1 and /usr/sap/trans are created on the database server. The Network File System (NFS) is exported from the database server, which also hosts the Advanced Business Application Programming (ABAP) SAP Central Service [(A)SCS] instance.

The following file system layout is one possible approach. For production use, you might follow the sizing information for your system as other layouts might better meet your needs or SAP requirements, or you might use quotas.

Use the following commands to create the required directories for installing the SAP software, /sapmnt, /usr/sap, and /db2:

[root@ sdb192 ] mkdir /sapmnt
[root@ sdb192 ] mkdir /usr/sap
[root@ sdb192 ] mkdir /db2





 Preparing your network for a three-tier setup 

If you are planning to install a three-tier setup, the network needs to be set up correctly. In the example, a 192 GB database server (named "sdb192") and a 32 GB application server (named "e2e1270") are deployed. The database server also hosts the (A)SCS instance. Adding the IP addresses on the private network to your /etc/hosts helps with the upcoming steps and ensures that SAP internal network traffic goes through the right network.

Zoom

![Figure 1.
You need to remember the MSP ID for your applications or when using the SDK to submit transactions.
* The MSP display name. This is an informal name that is given to your organization, which is used to identity your MSP in the console.
* The Admin certificates of your Organization Admin identities. These certificates are passed to the ordering service and are used to verify which identities in your organization are allowed to create or edit channels. When you use your console to create an ordering node or peer, the admin certificates inside the MSP are deployed within the new node, making your organization admin identities your peer or orderer admins as well. You can use these identities to operate your node, such as by installing a smart contract on a peer or joining a peer to a channel, from your console or a client application.







 Managing MSPs in the console 

Navigate to the Organizations tab. You can use this tab to [create an MSP definition](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-create-msp) by using a Certificate Authority that exists in your console. You can also use this tab to [import an MSP](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-import-msp) that was created by another organization.

You can view all of the MSPs that you created or imported under Available organizations. You can use the MSP definitions in the organizations tab for important functions within your console:



* If you are creating peer or ordering nodes, the MSP of your organization is used to identify the organization that the node belongs to.
* MSPs are used by organizations to verify the signatures of actions by other organizations. For this reason, you should export your MSP to every organization in the channel and likewise import the MSP of every organization.
Recommended Reliable Scalable Cluster Technology (RSCT) package levels for imported AIX images 

RSCT is a set of software components that together provide a comprehensive clustering environment for AIX®, Linux®, Solaris, and Windows® operating systems. RSCT is the infrastructure that is used by various IBM products to provide clusters with improved system availability, scalability, and ease of use. For the Power Systems Virtual Server offering, RSCT 3.2.1 is the minimum package level that is required for an imported AIX image (provides IPv6 support). However, the Power Systems Virtual Server development team recommends you use [RSCT 3.2.6.2](https://www.ibm.com/support/knowledgecenter/SGVKBA_3.2/navigation/welcome.html) for optimal performance.

The RSCT nodeid is not rebuilt if you are deploying an AIX VM from a network installation management (NIM) server without cloud-init, and RSCT is installed.



 Resource Management Control (RMC) 

The [RMC subsystem](https://www.ibm.com/support/knowledgecenter/SGVKBA_3.2/admin/bl503_undrmc.html) is the scalable backbone of RSCT that provides a generalized framework for managing resources within a single system or a cluster. Its generalized framework is used by cluster management tools to monitor, query, modify, and control cluster resources. RMC provides a single monitoring and management infrastructure for both RSCT peer domains and management domains.

The AIX VM's RMC status is presented in the Power Systems Virtual Server dashboard as a health status. The RMC health status can be either OK or Warning. Warning statuses happen when the RMC subsystem between your VM and the management system is not connected.

The RMC connection between your VM and the system management service is configured when you create the AIX VM. When you deploy an AIX VM, the IPv6 management interface is injected into the VM. If you remove or overwrite this interface, an RMC connection is not possible. The following procedures can cause the injected IPv6 management interface to be lost after you deploy the AIX VM:
Wait for a verification email. The email is delivered to the address that you entered in step 5. Click the link in the email to verify domain ownership.
8. After confirming domain ownership, the SSL Certificate is delivered to the email address that is connected to your account.
9. If either the verification email or the SSL Certificate email take longer than half an hour to arrive, please contact the Support Team.







 Installing and testing 

After the ordering and validating process is complete, you receive an email from the certificate authority that includes your certificate, as well as any necessary intermediate certificates. The method for installation depends on the software you are using. After you complete the installation, to go to http://host.yourdomain.com to confirm the presence of the SSL padlock in the browser address bar that signals an encrypted session. If you get a warning, take any indicated steps to resolve it.





 Next steps 

After testing successfully, you can access your SSL certificates in the IBM Cloud console to [update](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-viewing-and-updating-ssl-certificatesviewing-and-updating-ssl-certificates), [download](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-downloading-ssl-certificate-detailsdownloading-ssl-certificate-details), [delete](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-deleting-ssl-certificatesdeleting-ssl-certificates), or [import](https://cloud.ibm.com/docs/infrastructure/ssl-certificates?topic=ssl-certificates-importing-ssl-certificatesimporting-ssl-certificates) existing SSL certificates into the tool.
[External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://watson-developer-cloud.github.io/doc-tutorial-downloads/knowledge-studio/documents-new.csv) file to your computer. This file contains example documents suitable for uploading.
2. Click Rule-based Model > Rules.
3. Click the Add a document icon, which is next to the Documents page heading.
4. Click the Upload CSV file tab.
5. Click to browse for the documents-new.csv file that you downloaded to your computer earlier, and then click Upload.

A set of documents is displayed in the main Documents page.

![Shows three of the fourteen documents that were added to the rule editor. Shows the document title and an excerpt from the beginning of each document. There is also a delete icon next to each document that you can use to delete the document.](https://cloud.ibm.com/docs-content/v1/content/148d3bd95f946aa1bb53ea1540475f522e6b61c9/watson-knowledge-studio-data/images/rule-doc-add3.png)









 Lesson 3: Creating classes 

In this lesson, you will learn how to define classes that you will use when you define a rule.



 About this task 

For more information about classes, see [Rules](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-rule-annotator).





 Procedure 



1. From the Rules page of your workspace, click the Add a class icon next to the Class heading in the right side panel.
2. Enter DictMonth as the class name, and then click Add.

The new class is displayed in the Class side panel.









 Lesson 4: Associating a dictionary with a class 

In this lesson, you will learn how to use a dictionary in the rule editor.
This update means that you get a fully supported IBM Node.js runtime when you specify the latest stable Node.js runtime for your app, v0.10.31. With a fully supported Node.js runtime, the customers receive a consistent support experience.



* The buildpack contains an improved service framework. Specifically, it works better when binding the Monitoring and Analytics service and provides more diagnostic information if the service fails.







 28 August 2014 

Updated Liberty Buildpack v1.3-20140818-1538
: The buildpack contains an updated version of the [Liberty Profile](https://developer.ibm.com/wasdev/) with the latest fixes and improvements.



* This version of the buildpack fixes support for the JAVA_OPTS environment variable for passing additional JVM options to the app runtime.
* It also fixes a problem that prevented deployment of stand-alone Spring-based apps.
* It is now possible to generate and download IBM JVM snap traces using the IBM Cloud UI. See the [Troubleshooting topic](https://www.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.lnx.70.doc/troubleshooting.html) in the IBM JVM documentation to learn more about the snap traces or other diagnostic information that is generated by the JVM.



Updated Node.js buildpack v1.3-20140821-1143
: The newest Node.js buildpack now comes with IBM SDK for Node.js v1.1.0.6. This update means you will get a fully supported IBM Node.js runtime when you specify the latest stable Node.js runtime, v0.10.30, for your app. This runtime fixes the [V8 Memory Corruption vulnerability](https://nodejs.org/en/blog/vulnerability/v8-memory-corruption-stack-overflow/).

The buildpack also includes improvements and bug fixes to the Monitoring and Analytics service extension, allowing you to diagnose performance and error conditions through the service.





 29 July 2014
Connecting with psql 

You can access your PostgreSQL database directly from its command-line client, psql. You can use psql for direct interaction and monitoring of the data structures that are created within the database. It is also useful for testing and monitoring the queries and performance, installing and modifying scripts, and other management activities.

The admin user comes with the PostgreSQL default role [pg_monitor](https://www.postgresql.org/docs/10/static/default-roles.html), allowing access to PostgreSQL monitoring views and functions. By default, the admin user does not have permissions on objects that are created by other users.

You must set the admin password before you use it to connect to the database. For more information, see the [Setting the Admin Password](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-admin-password) page.



 Installing psql 

Install the command-line client for PostgreSQL, psql. To use psql, the PostgreSQL client tools need to be installed on the local system. They can be installed with the full PostgreSQL package that is provided from [postgresql.org](https://www.postgresql.org/download/), or as a [package from your operating system's package manager](https://www.compose.com/articles/postgresql-tips-installing-the-postgresql-client/).

For more information about psql, see the [PostgreSQL documentation](https://www.postgresql.org/docs/current/static/app-psql.html).





 psql Connection Strings