vania-janet/multiturn-rag-retrieval-data huggingface dataset:
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/rewrap



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Copy the ID of the rotated root key that you used to perform the initial wrap request.

You can retrieve the ID for a key by making a GET api/v2/keys request, or by viewing your keys in the IBM Cloud console.
3. Copy the ciphertext value that was returned during the latest wrap request.
4. Rewrap the key with the latest root key material by running the following cURL command.

curl -X POST 'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/rewrap' -H 'accept: application/vnd.ibm.kms.key_action+json' -H 'authorization: Bearer <IAM_token>' -H 'bluemix-instance: <instance_ID>' -H 'content-type: application/vnd.ibm.kms.key_action+json' -H "x-kms-key-ring: <key_ring_ID>" -H 'correlation-id: <correlation_ID>' -d '{
"ciphertext": "<encrypted_data_key>"
}'

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to rewrap keys in Hyper Protect Crypto Services.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services service instance resides.
* --enabled value specifies whether the secondary zone is enabled.
* -i, --instance value is the instance name or ID. If not set, the context instance specified by ibmcloud dns instance-target INSTANCE is used.
* --output value specifies the output format. Currently, JSON is the only supported format.







 Creating a secondary zone using the API 

To create a secondary zone using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/apidocs/dns-svcsauthentication) with the correct variables.
2. Store the following values in variables to be used in the API command:



* INSTANCE_ID, which is the unique identifier of a service instance.
* RESOLVER_ID, which is the unique identifier of a custom resolver.
* X-Correlation-ID (optional), which uniquely identifies a request.



3. When all variables are initiated, create a secondary zone:



curl -X POST https://api.dns-svcs.cloud.ibm.com/v1/instances/2be5d4a7-78f0-4c62-a957-41dc15342777/custom_resolvers/ddbe7a53-7971-46dc-b021-420335c31562/secondary_zones -H 'Content-Type: application/json' -H 'Authorization: Bearer xxxxxx' -d '{
"description": "secondary zone",
"zone": "example.com",
"enabled": false,
"transfer_from": [
"10.0.0.7"
]
}'
Disk performance (IO operations per second - IOPS) <br><br> * <br><br><br> 80 200 400 400 
 TCP non-persistent message throughput <br><br>[2] 10000 <br>per month 800 <br>per second 1500 <br>per second 3000 <br>per second 6000 <br>per second 
 TCP persistent message throughput <br><br>[3] 10000 <br>per month 50 <br>per second 100 <br>per second 400 <br>per second 1000 <br>per second 
 REST non-persistent message throughput <br><br>[4] 10000 <br>per month 250 <br>per second 450 <br>per second 900 <br>per second 1900 <br>per second 
 REST persistent message throughput <br><br>[5] 10000 <br>per month 50 <br>per second 100 <br>per second 400 <br>per second 1000 <br>per second 
 Maximum concurrent client connections <br><br>[6] 20 30 50 300 1000 





 Benchmark notes 



* The benchmark applications for producing and consuming messages are scaled to drive the maximum concurrent number of connections for the given queue manager size. Single threaded or limited concurrency applications may not be able to reach the maximum capacity of the queue manager
* Applications are deployed in the same cloud region as the queue manager in order to minimise the latency of the connectivity. Applications deployed in different cloud locations or on-premises data centres will result in lower throughput
* Anonymous TLS (server-only) is configured on the MQ channels in order to protect message data and credentials as they flow over the network. Non TLS-enabled channels typically have around 10% higher throughput but are not recommended for security reasons
* Messages of 2KB size are used for the benchmark scenario. To a reasonable approximation IBM MQ throughput has an inverse linear correlation to the size of the message, so a 4KB message size exhibits roughly half the throughput described above





 TCP benchmarks 



* The TCP benchmark applications are written using the IBM MQ C client which uses one client connection per application thread.
* UI
* CLI
* API







 Updating a custom resolver 

You can update custom resolvers in IBM Cloud® DNS Services by using the UI, CLI, or API.



 Updating a custom resolver using the UI 

The custom resolver details view shows the name and status of a custom resolver. It also lists the custom resolver ID, the linked VPC name, the date the resolver was modified, the description, and the enabled toggle that was entered when it was created.

To edit the name and description of the custom resolver, click Edit next to the pencil icon to open the edit view. Click Save to commit the changes, or cancel.

Toggle the Enablement switch to enable or disable the custom resolver.





 Update a custom resolver using the CLI 

To update a custom resolver using the CLI, run the following command:

ibmcloud dns custom-resolver-update RESOLVER_ID [--name NAME] [--enabled true|false] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* RESOLVER_ID is the ID of custom resolver.
* -n, --name is the name of the custom resolver.
* -d, --description is the descriptive text of the custom resolver.
* --enabled determines whether to enable the custom resolver.
* -i, --instance is the instance name or ID. If this is not set, the context instance specified by dns instance-target INSTANCE is used instead.
* --output specifies output format. Currently, JSON is the only supported format.







 Update a custom resolver using the API 

To update a custom resolver using the API, follow these steps:



1. Set up your API environment with the correct variables.
2. Store the following values in variables to be used in the API command:



* instance_id, which is the unique identifier of a service instance.
* resolver_id, which is the unique identifier of a custom resolver.
* X-Correlation-ID, which is a string that uniquely identifies a request.
To retrieve a key ID, see the [list keys API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysretrieve-keys-api). 
 key_alias Required. A unique, human-readable name for easy identification of your key. Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_). The alias cannot be a version 4 UUID and must not be a Hyper Protect Crypto Services reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. Alias size can be 2 - 90 characters (inclusive).<br><br>Note: You cannot have duplicate alias names in your Hyper Protect Crypto Services instance. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you create a key alias. For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).
9. After you have finished viewing the metrics, and determined whether the issue is related to dashboard or the metrics agent, delete the configurations and resources that you created in the previous steps.



Do not skip this step.



1. Exit the pod.

exit
2. Delete the pod.

kubectl delete pod testpod
3. Delete the clusterRoleBinding.

kubectl delete clusterrolebinding test-metrics-reader
4. Delete the service account.

kubectl delete sa test-sa
5. Delete the cluster role.

kubectl delete clusterrole test-metrics-reader
* (filter: +/-[metric.filter]) provides information about any filters that are defined in the metrics_filter section in the sysdig-agent-configmap.yaml file.





A sample log entry looks as follows:

-[statsd] metric excluded: mongo.statsd.vsize (filter: -[mongo.statsd.])
+[statsd] metric included: mongo.statsd.netIn (filter: +[mongo.statsd.net])

Complete the following steps to configure the log settings:



1. Set up the cluster environment. Run the following commands:

First, get the command to set the environment variable and download the Kubernetes configuration files.

ibmcloud ks cluster config --cluster <cluster_name_or_ID>
2. Edit the sysdig-agent-configmap.yaml file.

Run the following command:

kubectl edit configmap sysdig-agent -n ibm-observe
3. Make changes. Add the log section or update the section and include the configurations that you wish to modify based on the prior descriptions.

For example:

log:
file_priority: warning
console_priority: info
event_priority: warning
metrics_excess_log: true
metricsfile: { location : metrics }
4. Save the changes.



Changes are applied automatically.







 Sample configmap yaml file 

apiVersion: v1
data:
dragent.yaml: 
 Agent tags
 tags: linux:ubuntu,dept:dev,local:nyc


 collector address
 collector: 192.168.1.1
 Collector TCP port
 collector_port: 6666
 Whether collector accepts ssl
 ssl: true
 collector certificate validation
 ssl_verify_certificate: true


k8s_cluster_name: cluster12
collector: ingest.us-south.monitoring.cloud.ibm.com
collector_port: 6443
ssl: true
Create a key ring by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Create a key ring by running the following curl command.

$ curl -X POST "https://<region>.kms.cloud.ibm.com/api/v2/key_rings/<key_ring_id>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "correlation-id: <correlation_ID>"

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to create a key ring with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 key_ring_id Required. The unique identifier for the key ring that you would like to create. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance.
For more information on how to check port availability, see [Troubleshooting](https://cloud.ibm.com/docs/sap?topic=sap-ibm-metrics-collector-for-sap-windowstroubleshooting-win).

The commands that are listed in this section were run in Windows PowerShell 5.1.

Use the following steps to download the IMCS.



1. [Download the IMCS](ftp://public.dhe.ibm.com/cloud/bluemix/sap/windows).
2. Select the appropriate .zip. In most cases, use the current version. Connect as guest.
3. Save the file to your internal Downloads folder and click OK.
4. Move or copy the IMCS .zip file to your VPC virtual server instance.
5. Extract the file and open the extracted folder.
6. Run the install-metric-collector.ps1 file. Right-click on the file and select 'Run with Powershell', or run the following command on the power shell:

.install-metric-collector.ps1
. Paste your [API key](api-key) when prompted. If you don't have an API key, see [Getting an IBM Cloud API key](get-api-key-win).
7. Check to make sure that the IMCS is running after the installation is complete. The service status displays Running when it is ready.

Get-Service Telegraf
Status Name DisplayName
------ ---- -----------
Running Telegraf Telegraf Data Collector Service







 Verifying data collection 

After the installation completes and the service is started, it can take time for the IMCS begins collecting metrics. Wait at least 2 minutes after the installation before you expect full and accurate metrics.



1. Open the browser of your choice.
2. Open the following link: http://localhost:18181/sap/metrics

<metrics>
9. After you have finished viewing the metrics, and determined whether the issue is related to dashboard or the metrics agent, delete the configurations and resources that you created in the previous steps.



Do not skip this step.



1. Exit the pod.

exit
2. Delete the pod.

oc delete pod testpod
3. Delete the clusterRoleBinding.

oc delete clusterrolebinding test-metrics-reader
4. Delete the service account.

oc delete sa test-sa
5. Delete the cluster role.

oc delete clusterrole test-metrics-reader
(https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-route_rules_definitions)







 Saving a copy of your account settings 

Run the following command to save a copy of your account settings to a file.

ibmcloud metrics-router setting get --output JSON > ACCOUNT_settings.json

Where ACCOUNT is a unique indicator for your account.





 Saving a copy of your route configuration 

Run the following command to save a copy of your route configuration to a file.

ibmcloud metrics-router route ls --output JSON > ACCOUNT_routes.json

Where ACCOUNT is a unique indicator for your account.





 Saving a copy of your target configuration 

Run the following command to save a copy of your target configuration to a file.

ibmcloud metrics-router target ls --output JSON > ACCOUNT_targets.json

Where ACCOUNT is a unique indicator for your account.
To create a key alias, you must be assigned a Manager or Writer service access role. To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Create a key alias by running the following curl command.

$ curl -X POST "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/aliases/<key_alias>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.key+json" -H "correlation-id: <correlation_ID>"

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to create a key alias with the Hyper Protect Crypto Services API

 Variable Description 

 region Required. The region abbreviation, such as us-south, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The identifier for the key that you would like to associate with an alias. To retrieve a key ID, see the [list keys API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysretrieve-keys-api). 
 key_alias Required. A unique, human-readable name for easy identification of your key. Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_).
: Action defines whether IBM Cloud® Metrics Routing includes or excludes metrics on the route. Two actions are supported: send and drop. If not specified, the default action is to send the metrics.

send
: Metrics are sent, based on the routing rule, on the defined route.

drop
: Metrics are excluded, based on the routing rule, when metrics are sent on the defined route.

operand
: Operand is the name of the property on which the operator test is run. The following operands are supported: location,service_name,service_instance,resource_type, and resource.

operator
: Two operators are supported: in and is.

in
: The value of the operand property is compared to a list of values.

You can define up to 20 values.

is
: The value of the operand property is compared to a single value.

When using is, only 1 value can be specified.

values
: A string, or an array of strings, to be compared with the operand property to determine whether the metric is routed or not. When the isoperator is used, values must include a single string. When the inoperator is used, values can include multiple strings in an array.

Valid values depend on the operand.

location
: Any location where [IBM Cloud Metrics Routing is available.](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-regions)

service_name
: The CRN service name of an [IBM Cloud service that generates metrics managed through [IBM Cloud Metrics Routing](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-cloud-services-mr)

service_instance, resource_type, and resource
: Values appropriate to an [IBM Cloud service that generates metrics managed through [IBM Cloud Metrics Routing](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-cloud-services-mr)

--rules RULES
It can take up to 10 minutes for the metrics-server to detect the change and roll out a new set of pods based on the updated settings.





 Restore the default settings 

To restore the metrics-server to the default settings, delete the config map. It is recreated within a few minutes.

kubectl delete cm metrics-server-config -n kube-system







 Determining which resources to tune 

Use the kubectl describe pod command to get the pod definition, state information, and recent events:

kubectl get pod -n kube-system -l k8s-app=metrics-server
NAME READY STATUS RESTARTS AGE
metrics-server-9fb4947d6-s6sgl 3/3 Running 0 2d4h

kubectl describe pod -n kube-system metrics-server-9fb4947d6-s6sgl

Example output

Containers:
metrics-server:
Container ID: containerd://fe3d07c9a2541242d36da8097de3896f740c1363f6d2bfd01b8d96a641192b1b
Image: registry.ng.bluemix.net/armada-master/metrics-server:v0.4.4
Image ID: registry.ng.bluemix.net/armada-master/metrics-server@sha256:c2c63900d0e080c2413b5f35c5a59b5ed3b809099355728cf47527aa3f35477c
Port: 4443/TCP
Host Port: 0/TCP
Command:
/metrics-server
--metric-resolution=45s
--secure-port=4443
--tls-cert-file=/etc/metrics-server-certs/tls.crt
--tls-private-key-file=/etc/metrics-server-certs/tls.key
State: Running
ibmcloud metrics-router route create --name ROUTE_NAME ( --rules RULES | --file RULES_DEFINITION_JSON_FILE ) [--output FORMAT] [--force]



 Command options 

--name ROUTE_NAME
: The name to be given to the route.

Do not include any personal identifying information (PII) in any resource names.

--file RULES_DEFINITION_JSON_FILE
: A JSON file that contains the definition of the rules for route. The file needs to be formatted as follows:

[
{
"targets": {"id":"ID1"},{"id":"ID2"}]
}
]

Where targets is a comma-separated list of target IDs.

The rule definition can optionally also include inclusion filters. For example,

[{
"action": "send",
"targets": {
"id":"11111111-1111-1111-1111-111111111111"
}],
"inclusion_filters":
{
"operand": "service_name",
"operator": "in",
"values":
"appconnect",
"cloudant",
"containers-kubernetes"
]
},
{
"operand": "location",
"operator": "in",
"values":
"us-south",
"eu-de"
]
}
]
}]
Show more

Where:

action
: Action defines whether IBM Cloud® Metrics Routing includes or excludes metrics on the route. Two actions are supported: send and drop. If not specified, the default action is to send the metrics.

send
: Metrics are sent, based on the routing rule, on the defined route.

drop
: Metrics are excluded, based on the routing rule, when metrics are sent on the defined route.

operand
(https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-regions)

service_name
: The CRN service name of an [IBM Cloud service that generates metrics managed through [IBM Cloud Metrics Routing](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-cloud-services-mr)

service_instance, resource_type, and resource
: Values appropriate to an [IBM Cloud service that generates metrics managed through [IBM Cloud Metrics Routing](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-cloud-services-mr)

--output FORMAT
: If JSON is specified, output is returned in JSON format. If JSON is not specified, output is returned in a tabular format.

--force
: Run the command without prompting for confirmation. This flag only applies when the resulting route discards platform metrics.

help | --help | -h
: List options available for the command.







 ibmcloud metrics-router route update 

Use this command to update a route to IBM Cloud Metrics Routing targets. Any specified value that is different from when the route was originally created is updated to the value specified in the command.

Targets must be IBM Cloud Monitoring instances.

ibmcloud metrics-router route update --route ROUTE [--name ROUTE_NAME] ( --rules RULES | --file RULES_DEFINITION_JSON_FILE ) [--output FORMAT] [--force]



 Command options 

--route ROUTE
: The existing name or ID of the route.

--name ROUTE_NAME
: The updated name to be given to the route (optional).

Do not include any personal identifying information (PII) in any resource names.

--file RULES_DEFINITION_JSON_FILE
: A JSON file that contains the definition of the rules for route. The file needs to be formatted as follows:

[
{
* UI
* CLI
* API







 Adding custom resolver locations 

The task of the resolver location instance is to provide DNS resolver functions based on the forwarding rules that you configure. Add resolver locations to manage where your custom resolver deploys.



 Adding a resolver location using the UI 

To add a custom resolver location, from the custom resolver details page:



1. From the Resolver locations tab, click Add location.
2. Select the subnet from the list menu in the row that appears.

Each custom resolver can have a maximum of three locations within the same subnet, or in different subnets. Also, to achieve high availability, you must configure custom resolvers with a minimum of two resolver locations.



The location is added when the subnet selection is made.





 Adding a resolver location using the CLI 

To add a resolver location using the CLI, run the following command:

ibmcloud dns custom-resolver-location-add RESOLVER_ID --subnet SUBNET_CRN [--enabled true|false] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* RESOLVER_ID is the ID of custom resolver.
* --subnet is the CRN of the subnet.
* --enabled determines whether to enable the resolver location.
* -i, --instance is the instance name or ID. If this is not set, the context instance specified by dns instance-target INSTANCE is used instead.
* --output specifies output format. Currently, JSON is the only supported format.







 Adding a resolver location using the API 

To add a custom resolver location using the API, follow these steps:



1. Set up your API environment with the correct variables.
2. Store the following values in variables to be used in the API command:



* instance_id, which is the unique identifier of a service instance.
* resolver_id, which is the unique identifier of a custom resolver.
* X-Correlation-ID, which is a string that uniquely identifies a request.