vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Learning about IBM Cloud Monitoring architecture and workload isolation 

Review the following sample architecture for IBM Cloud Monitoring, and learn more about the workload isolation level that the service offers in the cloud.



 IBM Cloud Monitoring architecture 

IBM Cloud Monitoring is a highly available, multi-tenant, regional service that is available in IBM Cloud. You can use it to monitor your applications, platform resources, and infrastructure.

![IBM Cloud Monitoring](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/core/images/Monitoring-arch.png)

The API server component provides a web and an API interface to the monitoring service.

The collector component ingests data that monitoring agents forward to the monitoring service.

The datastore component stores all metrics, metadata, events, instance credentials, and environmental data.

You can use monitoring agents to monitor and collect metrics and events from hosts such as a Kubernetes cluster or a Linux system. A monitoring agent connects to 1 monitoring instance. The agent forwards data to the instance that is connected.

Platform metrics are collected automatically for monitoring-enabled services in each region. The data is forwarded to the IBM Cloud Monitoring service instance that is enabled to collect and monitor platform metrics in a region.

The monitoring UI is the front-end component where users can monitor and manage hosts through dashboards, alerts, and events.





 IBM Cloud Monitoring workload isolation 

Each regional deployment of the IBM Cloud Monitoring service serves multiple tenants that are identified by the IBM service instance.



* There is 1 deployment of the IBM Cloud Monitoring service per region that is responsible for running user workloads in the region.
* The IBM Cloud Monitoring service in a region is [highly available](https://cloud.ibm.com/docs/monitoring?topic=Monitoring-with-monitoring-endpoints).
* The monitoring data that is collected and processed by the IBM Cloud Monitoring service is associated with the monitoring instance and not visible to the other service instances by virtue of this association.
[IBM Cloud Messages for RabbitMQ](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-getting-started) IBM Cloud Messages for RabbitMQ is a managed RabbitMQ service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. [Platform metrics](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-monitoring) 
 [IBM Cloud Databases for EnterpriseDB](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=databases-for-enterprisedb-getting-started) IBM Cloud Databases for EnterpriseDB is a managed service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. [Platform metrics](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=databases-for-enterprisedb-monitoring) 
 [IBM Cloud® Data Engine](https://cloud.ibm.com/docs/services/sql-query?topic=sql-query-gettingstarted) IBM Cloud® Data Engine is a fully-managed service that lets you run SQL queries (that is, SELECT statements) to analyze, transform, or clean up rectangular data. [Platform metrics](https://cloud.ibm.com/docs/services/sql-query?topic=sql-query-metrics) 
 [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-gettingstarted) Hyper Protect DBaaS for MongoDB is a highly secure MongoDB service that is hosted in the IBM Cloud and integrated with other IBM Cloud services. [Platform metrics](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-monitor)
Name and location of the RAID monitoring daemon 

IBM Cloud® primarily uses Adaptec and Broadcom RAID cards with a few exceptions for traditional hardware. The following table outlines the RAID manager locations, monitor locations, configurations, and RAID alert settings.

You can configure RAID alerts to bypass the monitoring process by changing the SMTP server and notification email destination in the configuration for a RAID card. If you change these configurations, IBM cannot notify, or automatically track the problem until resolution. Do not alter the provided configuration unless you are aware of the risks.



Table 1. RAID configurations and settings

 RAID setting Broadcom Linux Broadcom Windows Adaptec Linux Adaptec Windows 

 Manager name Broadcom MegaRAID Storage Manager Broadcom MegaRAID Storage Manager Adaptec Storage Manager Adaptec Storage Manager 
 Manager location /opt/MegaRAID/storcli C:Program Files (x86)MegaRAID Storage Manager /usr/StorMan C:Program FilesAdaptecAdaptec Storage Manager 
 Monitor name MR_Monitor MRMonitor Adaptec Event Manager Adaptec Event Manager 
 Monitor location /opt/Broadcom/mrmonitor/bin/mrmonitord C:Program Files (x86)BroadcomMRMonitor /usr/StorMan C:Program FilesAdaptecAdaptec Storage Manager 
 Process Name /opt/Broadcom/mrmonitor/bin/mrmonitord 
 Log location Default message log location for OS such as /var/log/messages GUI only /usr/StorMan/RaidEvtA.log GUI only 
 Notification email destination [hwraid@softlayer.com](mailto:hwraid@softlayer.com) [hwraid@softlayer.com](mailto:hwraid@softlayer.com) [hwraid@softlayer.com](mailto:hwraid@softlayer.com) [hwraid@softlayer.com](mailto:hwraid@softlayer.com)
* There is 1 deployment of the IBM Cloud Monitoring service per region that is responsible for running user workloads in the region.
* The IBM Cloud Monitoring service in a region is [highly available](https://cloud.ibm.com/docs/monitoring?topic=Monitoring-with-monitoring-endpoints).
* The monitoring data that is collected and processed by the IBM Cloud Monitoring service is associated with the monitoring instance and not visible to the other service instances by virtue of this association.
* Data for all tenants is co-located in the same data stores and segmented by the tenant-specific metric tags that are associated with each metric to enforce access control policies.



You can use IBM Cloud Identity and Access Management (IAM) to control which users see, create, use, and manage resources in your service instance. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=Monitoring-with-monitoring-iam).



* To grant access to manage the IBM Cloud Monitoring in IBM Cloud, you can assign platform roles that define users levels of access for completing platform management tasks and accessing account resources.
* To grant access to manage the monitoring instance and its resources, you can assign service roles that define users levels of access for viewing data and managing features such as dashboards, teams, and alerts.



Within a monitoring instance, you can define teams to group users and control what data and resources are available for members of a team.



* Adding users to a team is managed through IAM policies. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=Monitoring-with-monitoring-iamiam_policies_team).
* User access to view, manage, and monitor data is granted through IAM policies.
<br><br> * Configure Monitoring<br><br><br> IBM Cloud Monitoring is a cloud-native, and container-intelligence management system that you can include as part of your IBM Cloud architecture. Use it to gain operational visibility into the performance and health of your applications, services, and platforms. It offers administrators, DevOps teams, and developers full stack telemetry with advanced features to monitor and troubleshoot, define alerts, and design custom dashboards. Learn more about [getting started with Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started). 
 <br><br> * Configure monitoring agent<br><br><br> Depending on the compute resource type that you are monitoring, follow these guides to configure the monitoring agent in classic infrastructure or VPC infrastructure:<br><br><br><br> * [Working with the Kubernetes agent](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent_Kube)<br> * [Working with the Red Hat OpenShift on IBM Cloud agent](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent_openshift)<br> * [Working with the Linux agent](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent_linux).<br> * [Working with the Docker agent](https://cloud.ibm.com/docs/monitoring?topic=monitoring-agent_docker).<br><br><br> 
 <br><br> * Configure streaming of IBM Cloud Monitoring<br><br><br> You can use IBM Cloud Monitoring to push a set of selected metrics to a Kafka service such as IBM® Event Streams for IBM Cloud®. For more information, see [Streaming metrics to a Kafka service](https://cloud.ibm.com/docs/monitoring?topic=monitoring-data_streaming). 







 Streamline access management with identities, groups, and policies 

Use the following checklist to create user and service identities in your accounts.
Complete the following steps to remove a monitoring agent on Linux:



* To uninstall the agent from Debian and Ubuntu Linux distributions, run the following command as the sudo user from a terminal:

sudo apt-get remove draios-agent
* To uninstall the agent from RHEL, CentOS, and Fedora Linux distributions, run the following command as the sudo user from a terminal:

sudo yum erase draios-agent







 Viewing the logs of an agent 

To see the latest monitoring agent logs, go to the directory /opt/draios/logs and check the log file draios.log.

To look for errors, you can run the following command:

grep error /opt/draios/logs/draios.log





 Verifying the state of the agent 

Check that the monitoring agent is running. Run the following command:

ps -ef | grep sysdig
Monitor App Configuration service metrics with IBM Cloud Monitoring 

Use IBM Cloud Monitoring to gain operational visibility into the performance and health of your applications, services, and platforms. It offers administrators, DevOps teams, and developers full stack telemetry with advanced features to monitor and troubleshoot, define alerts, and design custom dashboards.



 Set up your IBM Cloud Monitoring service instance 

To get started, you need to [provision IBM Cloud Monitoring](https://cloud.ibm.com/catalog/services/ibm-cloud-monitoring?callback=/observe/monitoring/create) instance on your IBM® account. For more information, see [Provisioning an instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provision).

Currently, IBM Cloud Monitoring integration is available for App Configuration service deployments in the following regions:



Table 1. Deployment and monitoring regions

 Deployment region Monitoring region 

 Dallas Dallas 
 Washington DC Washington DC 
 London London 
 Sydney Sydney 



Before you can start using App Configuration monitoring metrics, you must first opt in and [enable platform metrics](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).

You can configure only one instance of the IBM Cloud Monitoring service per region to collect platform metrics.



* To configure the IBM Cloud Monitoring instance, you must turn on the platform metrics configuration setting.
* If a monitoring instance in a region is already enabled to collect platform metrics, metrics from enabled-monitoring services are collected automatically and available for monitoring through this instance. For more information about enabled-monitoring services, see IBM Cloud® services.



To monitor platform metrics, check that the IBM Cloud Monitoring instance is provisioned in the same region where the IBM Cloud instance is provisioned.





 Viewing metrics 

To monitor App Configuration metrics, you must launch the IBM Cloud Monitoring web UI instance that is enabled for platform metrics in the region where your App Configuration instance is available.



 Launch IBM Cloud Monitoring web UI from the App Configuration dashboard 



1. Log in to IBM Cloud. The IBM Cloud dashboard opens.
2. Click View all in the Resource summary section of the dashboard.
3.
London (eu-gb) sudo logdna-agent -s LOGDNA_LOGHOST=logs.eu-gb.logging.cloud.ibm.com sudo logdna-agent -s LOGDNA_LOGHOST=logs.private.eu-gb.logging.cloud.ibm.com<br><br>export LDLOGHOST=logs.private.eu-gb.logging.cloud.ibm.com 
 Tokyo (jp-tok) sudo logdna-agent -s LOGDNA_LOGHOST=logs.jp-tok.logging.cloud.ibm.com sudo logdna-agent -s LOGDNA_LOGHOST=logs.private.jp-tok.logging.cloud.ibm.com<br><br>export LDLOGHOST=logs.private.jp-tok.logging.cloud.ibm.com 
 Sydney (au-syd) sudo logdna-agent -s LOGDNA_LOGHOST=logs.au-syd.logging.cloud.ibm.com sudo logdna-agent -s LOGDNA_LOGHOST=logs.private.au-syd.logging.cloud.ibm.com<br><br>export LDLOGHOST=logs.private.au-syd.logging.cloud.ibm.com 
 Washington (us-east) sudo logdna-agent -s LOGDNA_LOGHOST=logs.us-east.logging.cloud.ibm.com sudo logdna-agent -s LOGDNA_LOGHOST=logs.private.us-east.logging.cloud.ibm.com<br><br>export LDLOGHOST=logs.private.us-east.logging.cloud.ibm.com 



5. Define more log paths to be monitored. Run the following command:

sudo logdna-agent -d /path/to/log/folders

By default, /var/log is monitored.
6. Optionally, configure the logging agent to tag your hosts.
7. Start the logging agent.

sudo /etc/init.d/logdna-agent start
Monitoring the lifecycle of encryption keys 

IBM® Key Protect for IBM Cloud® follows the established security guidelines per [NIST SP 800-57 for key states](https://www.nist.gov/publications/recommendation-key-management-part-1-general-0).



 Key states and transitions 

Cryptographic keys often transition through several states that are a function of how long the keys have been in existence and whether they are currently being used to encrypt data.

Key Protect provides a graphical user interface and a REST API for tracking keys as they move through several states in their lifecycle. The following diagram shows how a key passes through states between its generation and its destruction.

Although this diagram shows keys in a "pre-activation" state, a state defined in NIST standards, from a technical point of view, "pre-active" defines a state before a key exists. Keys that do not yet exist cannot, obviously, have a state. Nevertheless, it is shown here for conceptual completeness. The "purged" state of a key, in which the key material has been permanently shredded a certain period of time after the key has been moved into a Destroyed state, is not shown in this diagram and is similarly a state of nonexistence.

Zoom

![Key states diagram.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/key-states.svg)

Figure 1. Key states and transitions.



Table 1. Describes key states and transitions.

 State Integer mapping Description 

 Active 1 Keys move immediately into the Active state on the activation date. This transition marks the beginning of a key's cryptoperiod. Keys with no activation date become active immediately and remain active until they expire or are destroyed. 
 Suspended 2 A key moves into the Suspended state when it is [disabled for encrypt and decrypt operations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys).
To identify the CRN for a location, look for the location's ID at the end of the CRN. 
 saveServiceCopy Set to true so that a copy of the log record is sent to IBM for monitoring and alerts. 
 Details The detailed information for log. 
 Details.message The current error message for the location, including any troubleshooting steps or documentation links. 
 Details.errorDetails Other details for the current error, such as specific causes or issues with certain components. These details are used by IBM site reliability engineers to manage alerts, but can help provide more details about the issue while you troubleshoot. 
 Details.messageID The error message's R00XX identifier. 







 Enablement of resource deployment logs 

Enablement of resource deployment logs report the current status of whether resources such as hosts, clusters, or Satellite-enabled IBM Cloud service instances can be changed or deployed in your location, and the reason for this status. For example, resource deployment might be set to false due to one or more location errors.

Example log

{"logSourceCRN":"crn:v1:bluemix:public:satellite:us-south:a/f601ad712b0dd981276cf3b995554afc:c1hk4ek107l5au5mq8hg::","saveServiceCopy":true,"message":"Enablement of resource deployment in the location is set false due to R0012: The location control plane does not have hosts in all 3 zones. Add available hosts to your location for the control plane. R0025: The Satellite location has OpenShift clusters in critical health."}



Pre-defined fields of logs for the status of deployment enablement

 Log field Description 

 logSourceCRN The CRN of the Satellite location. To identify the CRN for a location, look for the location's ID at the end of the CRN. 
 saveServiceCopy Set to true so that a copy of the log record is sent to IBM for monitoring and alerts. 
 message The status of whether resource deployment is currently enabled (true or false).
* <SECRET_NAME> is the name of the secret.
* <MONITOR_API_TOKEN> contains the [Monitor API token](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token).
* <PROMETHEUS_NAMESPACE> is the namespace where you have Prometheus server running in your cluster.



For example, run the following command to create the secret monitor-api-token in the namespace prometheus. This command assumes Prometheus server is running in the proemtheus namespace:

kubectl create secret generic monitor-api-token --from-literal=monitor-api-token="<MONITOR_API_TOKEN>" -n <PROMETHEUS_NAMESPACE>





 Step 2. Configure the Prometheus server remote write feature 

You can choose any of the following options to configure the Prometheus remote write feature to send metrics to an IBM Cloud Monitoring instance:



* Configure the Prometheus server by updating the Kubernetes ConfigMap
* Configure the Prometheus server that is managed by Prometheus Operator
* Configure the Prometheus server by using Helm



Choose one of the following methods to configure the Prometheus server remote write feature:



 Prometheus config map 

Complete the following steps to modify the Prometheus config map:



1. Configure your Prometheus deployment or statefulSet to mount the Kubernetes Secret that you have created in step 1.

For example, get the name of the deployment by running the following command:

kubectl get deployment -n <PROMETHEUS_NAMESPACE>

Configure a Prometheus deployment:

kubectl edit deployment prometheus-deployment -n <PROMETHEUS_NAMESPACE>

Add the following sections to the deployment config file:

apiVersion: apps/v1
kind: Deployment
...
spec:
replicas: 1
...
spec:
containers:
- name: prometheus-server
args:
* [Enabling platform logs](https://cloud.ibm.com/docs/satellite?topic=satellite-healthenable-la)
* [Viewing logs for your Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-healthview-la)
* [Analyzing logs for your Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-healthanalyze-la)
* [R00XX error logs](https://cloud.ibm.com/docs/satellite?topic=satellite-healthlogs-error)
* [Enablement of resource deployment logs](https://cloud.ibm.com/docs/satellite?topic=satellite-healthlogs-deploy)
* [Endpoint health status logs](https://cloud.ibm.com/docs/satellite?topic=satellite-healthlogs-link)



* [Setting up Activity Tracker for Satellite location events](https://cloud.ibm.com/docs/satellite?topic=satellite-healthsetup-at)
* [Setting up logging for clusters](https://cloud.ibm.com/docs/satellite?topic=satellite-healthsetup-clusters-logging)



* [Enabling a logging instance in your cluster](https://cloud.ibm.com/docs/satellite?topic=satellite-healthenable-clusters-logging)





[Monitoring for Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-monitormonitor)



* [Understanding what is logged and monitored by default](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorhealth-default)



* [Auditing events for Satellite actions](https://cloud.ibm.com/docs/satellite?topic=satellite-monitoraudit-events)
* [IBM monitoring to resolve and report location alerts](https://cloud.ibm.com/docs/satellite?topic=satellite-monitormonitoring-default)
SI-4 - Information System Monitoring 



 Control requirements 

The organization:

SI-4 (a)
: Monitors the information system to detect:



1. Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and
2. Unauthorized local, network, and remote connections;



SI-4 (b)
: Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods];

SI-4 (c)
: Deploys monitoring devices:



1. Strategically within the information system to collect organization-determined essential information; and
2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;



SI-4 (d)
: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

SI-4 (e)
: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

SI-4 (f)
: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

SI-4 (g)
: Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles][Selection (one or more): as needed; [Assignment: organization-defined frequency]].





 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for SI-4 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 SI-4 (a) <br><br> * Check whether Flow Logs for VPC are enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br>