vania-janet/multiturn-rag-retrieval-data huggingface dataset:
On the client node, run the following command to check whether an out-of-memory exception occurred:

oc logs -l tenant=wd,ibm-es-data=False,ibm-es-master=False -c elasticsearch --tail=-1 | grep "OutOfMemoryError"
13. If an error message is found, excluding INFO messages, increase the memory resource by using the following command:

oc patch wd wd --type=merge --patch='{"spec":{"elasticsearch":{"clientNode":{"maxHeap":"896m","resources":{"limits":{"memory":"1792Mi"}}}}}}'
14. After you run this command, the Elasticsearch client pod is restarted about 20 minutes later. Monitor the "AGE" of the pod by using the following command:

oc get pod -l tenant=wd,ibm-es-data=False,ibm-es-master=False
15. After the pod is restarted successfully, check the new value of ES_JAVA_OPTS and the container memory limit by using the following command:

oc describe $(oc get po -l tenant=wd,ibm-es-data=False,ibm-es-master=False -o name)
16. On the data node, run the following command to check whether an out-of-memory exception occurred:

oc logs -l tenant=wd,ibm-es-data=True,ibm-es-master=False -c elasticsearch --tail=-1 | grep "OutOfMemoryError"
17. If an error message is found, excluding INFO messages, increase the memory resource by using the following command:

oc patch wd wd --type=merge --patch='{"spec":{"elasticsearch":{"dataNode":{"maxHeap":"6g","resources":{"limits":{"memory":"10Gi"},"requests":{"memory":"8Gi"}}}}}}'
* The secondary SAP HANA database is running on NODE2.
* HANA System Replication is activated and in sync.



* The secondary SAP HANA database on NODE2 is running with reduced memory configuration.



* The global_allocation_limit is reduced.
* Preload of column tables is disabled (preload_column_tables = false).



* A nonproduction SAP HANA system ${SID_np}is running on NODE2.







 Test3 - Test procedure 

Crash primary on NODE1 by sending a shutoff system request.

On NODE1, run the following command.

sync; echo o > /proc/sysrq-trigger





 Test3 - Expected behavior 



* NODE1 shuts down.
* The cluster detects the failed node and sets its state to OFFLINE.
* The cluster promotes the secondary HANA database on NODE2 to take over as new primary.



* The cluster stops the nonproduction database ${SID_np} on NODE2.
* During activation, the global_allocation_limit and preload_column_tables parameters of SAP HANA ${SID}are reset.



* The cluster acquires the virtual IP address on NODE2 on the new primary.
* If an application, such as SAP NetWeaver, is connected to a tenant database of SAP HANA, the application automatically reconnects to the new primary.







 Test3 - Recovery procedure 

Log in to the IBM Cloud® console and start NODE1. Wait until NODE1 is available again, then restart the cluster framework.

On NODE1, run the following command.

pcs cluster start

pcs status --full

As cluster resource SAPHana_${SID}_${INSTNO} is configured with AUTOMATED_REGISTER=true, SAP HANA restarts when NODE1 joins the cluster and the former primary is registered as secondary.

Then, rerun the steps in [Test2 - Test the manual move of SAPHana resource to another node](https://cloud.ibm.com/docs/sap?topic=sap-ha-rhel-hana-sr-cost-optimizedha-rhel-hana-sr-co-test2-manual-move) to revert to the initial situation.







 Test4 - Testing failure of the secondary database instance
.rule(policyRule)
.pattern("time-based-conditions:weekly")
.build();

Response<V2Policy> response = service.v2CreatePolicy(options).execute();
V2Policy policy = response.getResult();

System.out.println(policy);

policy_subject = V2PolicyBaseSubject(
attributes=[V2PolicyAttribute(key='iam_id', value=example_user_id, operator='stringEquals')]
)
policy_role = PolicyRole(role_id='crn:v1:bluemix:public:iam::::role:Editor')
account_id_resource_attribute = V2PolicyAttribute(
key='accountId', value=example_account_id, operator='stringEquals'
)
service_name_resource_attribute = V2PolicyAttribute(
key='serviceName', value='iam-groups', operator='stringEquals'
)
policy_resource = PolicyResource(
attributes=[account_id_resource_attribute, service_name_resource_attribute],
)
policy_control = V2PolicyBaseControl(grant=V2PolicyBaseControlGrant(roles=[policy_role]))
policy_rule = V2PolicyBaseRuleV2RuleWithConditions(
operator='and',
conditions=[
V2PolicyAttribute(
key='{{environment.attributes.day_of_week}}', operator='dayOfWeekAnyOf', value=1, 2, 3, 4, 5]
),
V2PolicyAttribute(
key='{{environment.attributes.current_time}}',
operator='timeGreaterThanOrEquals',
value='09:00:00+00:00',
),
pcs resource clear SAPHana_${SID}_${INSTNO}-clone

Verify that the constraint is cleared.

pcs constraint

Check the cluster status.

pcs status --full
3. On NODE2, run the following commands to check that the global_allocation_limitand preload_column_tables are set.

sudo -i -u ${sid}adm -- hdbcons "mm globallimit" | grep limit

grep -E "global_allocation_limit|preload_column_tables" /hana/shared/${SID}/global/hdb/custom/config/global.ini
4. Reactivate the resource for the nonproduction SAP HANA system.

On NODE2, run the following command.

pcs resource manage group_${sid_np}_non_prod

The resource of the nonproduction SAP HANA system ${SID_np} is managed and the nonproduction system starts on NODE2.

pcs status --full









 Test3 - Testing failure of node that is running the primary database 

Use the following information to test the failure of node that is running the primary database.



 Test3 - Description 

Simulate a crash of the node that is running the primary HANA database.





 Test3 - Prerequisites 



* A functional two-node RHEL HA Add-On cluster for HANA system replication.
* Both cluster nodes are active.
* Cluster is started on NODE1 and NODE2.
* Cluster Resource SAPHana_${SID}_${INSTNO} is configured with AUTOMATED_REGISTER=true.
* Check SAP HANA System Replication status:



* The primary SAP HANA database is running on NODE1.
* The secondary SAP HANA database is running on NODE2.
* HANA System Replication is activated and in sync.



* The secondary SAP HANA database on NODE2 is running with reduced memory configuration.



* The global_allocation_limit is reduced.
* Preload of column tables is disabled (preload_column_tables = false).



* A nonproduction SAP HANA system ${SID_np}is running on NODE2.







 Test3 - Test procedure
.pattern("time-based-conditions:weekly")
.build();

Response<V2Policy> response = service.v2CreatePolicy(options).execute();
V2Policy policy = response.getResult();

System.out.println(policy);

Show more

policy_subject = V2PolicyBaseSubject(
attributes=[V2PolicyAttribute(key='iam_id', value=example_user_id, operator='stringEquals')]
)
policy_role = PolicyRole(role_id='crn:v1:bluemix:public:iam::::role:Editor')
account_id_resource_attribute = V2PolicyAttribute(
key='accountId', value=example_account_id, operator='stringEquals'
)
service_name_resource_attribute = V2PolicyAttribute(
key='serviceName', value='iam-groups', operator='stringEquals'
)
policy_resource = PolicyResource(
attributes=[account_id_resource_attribute, service_name_resource_attribute],
)
policy_control = V2PolicyBaseControl(grant=V2PolicyBaseControlGrant(roles=[policy_role]))
policy_rule = V2PolicyBaseRuleV2RuleWithConditions(
operator='and',
conditions=[
V2PolicyAttribute(
key='{{environment.attributes.day_of_week}}', operator='dayOfWeekAnyOf', value=1, 2, 3, 4, 5]
),
V2PolicyAttribute(
key='{{environment.attributes.current_time}}',
operator='timeGreaterThanOrEquals',
value='09:00:00+00:00',
),
ibmcloud iam trusted-profile-rule-create Profile-b2f13064-2b8c-4e4b-9181-c1973a408e3c               --name NewRule4VSI --type Profile-CR --cr-type VSI                --conditions "claim:vpc_id,operator:EQUALS,value:r206-1db73eed-b0fb-b04f-bb57-4d3a3c2dff9d"









 Conditions in v2 access policies 

Time-based conditions for IAM access policies use /v2/policies syntax. Policies that use /v1/policies syntax aren't eligible to add time-based conditions. For more information, see [Access policy version limitations](https://cloud.ibm.com/docs/account?topic=account-known-issuespolicy-version-limit).

To view the new schema for policies, see [/v2/policies](https://cloud.ibm.com/docs/account?topic=account-known-issues&interface=uiv2-policies).



 Time-based conditions 

The following table lists the operators available for creating time-based conditions for access policies.



Table 6. The operators available to time-based conditions for access policies.

 Operator Description Example 

 dayOfWeekAnyOf The days of the week that the client can use the policy. <br>1 - Monday <br>2 - Tuesday <br>3 - Wednesday <br>4- Thursday <br>5 - Friday <br>6 - Saturday <br>7 - Sunday See [example](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uidayOfWeekAnyOf-timeGreaterThanOrEquals-timeLessThanOrEquals). 
 timeGreaterThanOrEquals The time that the condition begins granting access. Time is calculated by <time>±<time_zone_offset>.
"psk": "VPNDemoPassword",
"local_cidrs": [ "'$Vpc1Subnets'" ],
"peer_cidrs": [ "'$Vpc2Subnets'" ]
}'

Sample output:

{
"id": "0738-a252d380-0784-45ff-8fc0-c2b58e446b4d",
"name": "vpn-connection-to-vpn-gateway-2",
"href": "https://us-south.iaas.cloud.ibm.com/v1/vpn_gateways/0738-7fd72524-6e2d-49a6-b975-0071efccd89a/connections/0738-a252d380-0784-45ff-8fc0-c2b58e446b4d",
"local_cidrs": [
"192.168.100.0/24"
],
"peer_cidrs": [
"192.168.0.0/24"
],
"peer_address": "169.61.161.150",
"admin_state_up": true,
"psk": "VPNDemoPassword",
"dead_peer_detection": {
"action": "none",
"interval": 30,
"timeout": 120
},
"created_at": "2018-07-06T19:50:49.252072Z",
"route_mode": "policy",
"authentication_mode": "psk",
"status": "down"
}





 Step 4. Create a VPN connection from the second VPN gateway to the first VPN gateway 

When you create the connection for the VPN gateway of VPC 2, set local_cidrs to the subnets on VPC 2 and peer_cidrs to the subnets on VPC 1.
Prepare the secondary database by using the Backup-SqlDatabase and Restore-SqlDatabase commands to create a backup of the TestDatabase on <hostname1> on TempShare on <file_share_host>, the SQL server instance that hosts the primary replica. Restore the backup to <hostname2>, which hosts the secondary replica. The NoRecovery restore parameter must be used.

$sqldb01 = "<hostname1>"
$sqldb02 = "<hostname2>"
$filesharehost = "<file_share_host>"
$backupfiledata = "\" + $filesharehost +"TempShareTestDatabase.bak"
$backupfilelog = "\" + $filesharehost +"TempShareTestDatabase.trn"
Backup-SqlDatabase -Database "TestDatabase" -ServerInstance $sqldb01 -BackupFile $backupfiledata -CopyOnly
Backup-SqlDatabase -Database "TestDatabase" -BackupFile $backupfilelog -ServerInstance $sqldb01 -BackupAction Log -CopyOnly
Restore-SqlDatabase -Database "TestDatabase" -BackupFile $backupfiledata -ServerInstance $sqldb02 -NoRecovery
Restore-SqlDatabase -Database "TestDatabase" -BackupFile $backupfilelog -ServerInstance $sqldb02 -RestoreAction Log -NoRecovery



The new secondary database is in the RESTORING state. Until it is joined to the availability group, it is not accessible.





 Create an availability group 

Databases added to an availability group are known as availability databases. When adding databases, the database must be an online, read-write database and exist on the server instance that will hosts the primary replica in the WSFC. When added, the database joins the availability group as a primary database and remains available to clients. No secondary database exists until backups of the primary database are restored to the server instance that will become the secondary replica. The new secondary database is in the RESTORING state until it is joined to the availability group.
"description": "Extended description for my secret.",
"expiration_date": "2030-04-01T09:30:00Z",
"id": "a6972127-35ad-b36f-aac8-0223f0475cb6",
"labels": [
"dev",
"us-south"
],
"last_update_date": "2020-12-15T22:34:53Z",
"name": "test-arbitrary-secret-in-group",
"secret_data": {
"payload": "secret-data"
},
"secret_group_id": "339c026a-ac0f-1ea1-3d43-99adf871b49a",
"secret_type": "arbitrary",
"state": 1,
"state_description": "Active",
"versions": [
{
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2020-12-15T22:34:53Z",
"id": "a7f55e6f-b068-977b-062e-4de644633982"
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to create an arbitrary secret in an existing secret group returns the following response:

{
"request_id": "8c047529-de3a-a79d-7c2f-c382a8e75312",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
* A functional two-node RHEL HA Add-On cluster for HANA system replication.
* Both cluster nodes are active.
* Cluster is started on NODE1 and NODE2.
* Cluster Resource SAPHana_${SID}_${INSTNO} is configured with AUTOMATED_REGISTER=false.
* Check SAP HANA System Replication status:



* The primary SAP HANA database is running on NODE1.
* The secondary SAP HANA database is running on NODE2.
* HANA System Replication is activated and in sync.



* The secondary SAP HANA database on NODE2 is running with reduced memory configuration.



* The global_allocation_limit is reduced.
* Preload of column tables is disabled (preload_column_tables = false).



* A nonproduction SAP HANA system ${SID_np}is running on NODE2.







 Test1 - Test procedure 

Crash SAP HANA primary by sending a SIGKILL signal as user ${sid}adm.

On NODE1, run the following command.

sudo -i -u ${sid}adm -- HDB kill-9





 Test1 - Expected behavior 



* SAP HANA primary instance on NODE1 crashes.
* The cluster detects the stopped primary HANA database and marks the resource as failed.
* The cluster promotes the secondary HANA database on NODE2 to take over as new primary.



* The cluster stops the nonproduction database ${SID_np} on NODE2.
* During activation, the global_allocation_limit and preload_column_tables parameters are reset to default.



* The cluster releases the virtual IP address on NODE1, and acquires it on the new primary on NODE2.
* If an application, such as SAP NetWeaver, is connected to a tenant database of SAP HANA, the application automatically reconnects to the new primary.



On NODE2, run the following commands to check that the global_allocation_limitand preload_column_tables are unset.

sudo -i -u ${sid}adm -- hdbcons "mm globallimit" | grep limit
* A functional two-node RHEL HA Add-On cluster for HANA system replication.
* Both nodes active.
* Cluster is started on NODE1 and NODE2.
* Check SAP HANA System Replication status.



* Primary SAP HANA database is running on NODE2
* Secondary SAP HANA database is running on NODE1
* HANA System Replication is activated and in sync









 Test2 - Test procedure 

Crash primary on NODE2 by sending a shutoff system request.

On NODE2, run the following command.

sync; echo o > /proc/sysrq-trigger





 Test2 - Expected behavior 



* NODE2 shuts down.
* The cluster detects the failed node and sets its state to OFFLINE.
* The cluster promotes the secondary HANA database on NODE1 to take over as new primary.
* The cluster acquires the virtual IP address on NODE1 on the new primary.
* If an application, such as SAP NetWeaver, is connected to a tenant database of SAP HANA, the application automatically reconnects to the new primary.







 Test2 - Recovery procedure 

Log in to the IBM Cloud® Console and start the NODE2 instance. Wait until NODE2 is available again, then restart the cluster framework.

On NODE2, run the following command.

pcs cluster start

pcs status --full

As cluster resource SAPHana_${SID}_${INSTNO} is configured with AUTOMATED_REGISTER=true, SAP HANA restarts when NODE2 rejoins the cluster and the former primary reregisters as a secondary.







 Test3 - Testing the failure of the secondary database instance 

Use the following information to test the failure of the secondary database instance.



 Test3 - Description 

Simulate a crash of the secondary HANA database.





 Test3 - Prerequisites 



* A functional two-node RHEL HA Add-On cluster for HANA system replication.
* Both nodes are active.
* Cluster is started on NODE1 and NODE2.
* Cluster Resource SAPHana_${SID}_${INSTNO} is configured with AUTOMATED_REGISTER=true.
* Check SAP HANA System Replication status:



* Primary SAP HANA database is running on NODE1
: Health check UUID.

-i, --interval INTERVAL
: Seconds between checks [2-60].

-r,--retry COUNT
: Number of times before marking as DOWN [1-10].

-t, --timeout TIMEOUT
: Seconds to wait for a connection [1-59].

-u, --url URL
: URL path for HTTP/HTTPS checks.





 Examples 

ibmcloud sl loadbal health-edit --lb-id 123456 --health-uuid 27204f2c-1853-4fd2-9c97-1654cd536edd -i 2







 ibmcloud sl loadbal l7member-add 

Add an L7 pool member:

ibmcloud sl loadbal l7member-add (--pool-uuid L7POOL_UUID) (--address IP_ADDRESS) (--port PORT)



 Command options 

--port-uuid UUID (required)
: UUID for the load balancer pool.

--address IP_ADDRESS (required)
: Backend servers IP address.

--port PORT (required)
: Backend servers port.





 Examples 

ibmcloud sl loadbal l7member-add --pool-uuid 27204f2c-1853-4fd2-9c97-1654cd536edd --address 10.0.0.1 --port 80







 ibmcloud sl loadbal l7member-delete 

Remove a load balancer member:

ibmcloud sl loadbal l7member-delete (--pool-uuid L7POOL_UUID) (--member-uuid L7MEMBER_UUID)



 Command options 

--pool-uuid UUID (required)
: UUID for the load balancer pool.

--member-uuid UUID (required)
: UUID for the load balancer member.





 Examples
To delete resources, run ./terraform destroy.







 What's next? 

Verify that the resources are created.



* [Launch the Observability UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-launch) and check the instance has been created.
* [Launch Access (IAM)](https://cloud.ibm.com/iam/overview). Select Service IDs and look for the resource key.
* [Review the user assigned access in the console](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesreview-your-access-console).
list GET /albums 200 OK list_albums Retrieve a collection of albums 
 create POST /albums 201 Created create_album Create a new album 
 get GET /albums/{id} 200 OK get_album Retrieve the album identified by {id} 
 update PATCH /albums/{id} 200 OK update_album Update the album identified by {id} 
 delete DELETE /albums/{id} 204 No Content delete_album Delete the album identified by {id} 







 Resource replacement operations 

The following conventions for operations to replace one or more resources SHOULD be used where applicable.



Operations for a resource replacement

 Verb Example method and path Success status code Recommended operation ID Description 

 replace PUT /symptoms/{id} 200 OK replace_symptom Replace the symptom identified by {id} 
 replace PUT /symptoms 200 OK replace_symptoms Replace all symptoms in a collection 







 Resource binding operations 

The following conventions for operations on bindings between resources SHOULD be used where applicable.

The verbs unset and remove MUST NOT be used except for an operation that is trivially reversible.

The noun in a resource binding operation SHOULD match the related resource type as it's represented in the binding context. For example, even if PUT /accounts/{id}/administrator accepts a payload identifying a user, the operationId would be replace_account_administrator.

Typically, the modeling of a binding intrinsically defines only a single direction of cardinality. For example, if an account's binding to an administrator is modeled as /accounts/{id}/administrator, it can be inferred that a given account has a single administrator. However, depending on other factors, the user might be restricted to be the administrator for just that account, or may be allowed to also be an administrator for other accounts.



 A resource's required binding to one other resource 

The following convention SHOULD be used where a resource has a required binding to exactly one other resource. In the example used, a club must have exactly one treasurer.



Operations for a required binding to one other resource

 Verb Example method and path Success status code Recommended operation ID Description 

 replace PUT /clubs/{id}/treasurer 200 OK replace_club_treasurer Replace an existing binding with one between a treasurer identified in the request body and the club identified by {id}
To delete resources, run ./terraform destroy.







 What's next? 

Verify that the resources are created.



* [Launch the Observability UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch) and check the instance has been created.
* [Launch Access (IAM)](https://cloud.ibm.com/iam/overview). Select Service IDs and look for the resource key.
* [Review the user assigned access in the console](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesreview-your-access-console).
Must not be provided for trusts established to Compute Resources (type = Profile-CR).

--output FORMAT
: Specify output format. Only 'JSON' is supported.

-f, --force
: Force failure if multiple rules are found.

-q, --quiet
: Suppress verbose output.





 Examples 

Update rule ClaimRule-test-id in profile my-profile with new name test-rule:

ibmcloud iam trusted-profile-rule-update my-profile ClaimRule-test-id --name test-rule

Update Profile-SAML rule my-rule in profile my-profile with new realm name https://www.example.org/my-nice-idp:

ibmcloud iam trusted-profile-rule-update my-profile my-rule --realm-name https://www.example.org/my-nice-idp

Update rule conditions and expiration time for Profile-SAML rule ClaimRule-a448e998-311f-4e23-8af8-66b855c5da11 in profile my-profile:

ibmcloud iam trusted-profile-rule-update my-profile ClaimRule-a448e998-311f-4e23-8af8-66b855c5da11 --conditions claim:cn,operator:EQUALS,value:my_user --expiration 1200

Update rule conditions and compute resource type for Profile-CR rule ClaimRule-cb8e3a2c-2d16-422b-b691-8791355b53bc in profile my-profile:

ibmcloud iam trusted-profile-rule-update my-profile ClaimRule-cb8e3a2c-2d16-422b-b691-8791355b53bc --conditions claim:crn,operator:EQUALS,value:crn:v1:bluemix:public:containers-redhat:us-south:a/test:: --cr-type ROKS_SA







 ibmcloud iam trusted-profile-rule-delete 

Delete a rule for a trusted profile:
print('nupdate_resource_instance() response:n',
json.dumps(resource_instance, indent=2))

parameters := map[string]interface{}{"exampleProperty": "exampleValue"}
updateResourceInstanceOptions := resourceControllerService.NewUpdateResourceInstanceOptions(
instanceGUID,
)
updateResourceInstanceOptions = updateResourceInstanceOptions.SetName(resourceInstanceUpdateName)
updateResourceInstanceOptions = updateResourceInstanceOptions.SetParameters(parameters)

resourceInstance, response, err := resourceControllerService.UpdateResourceInstance(updateResourceInstanceOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(resourceInstance, "", " ")
fmt.Printf("nUpdateResourceInstance() response:n%sn", string(b))

getAccountUsage(params)