IBM. IBM i2 Analyze Deployment patterns and examples. Version 4 Release 1 SC

Transcription

1 IBM IBM i2 Analyze Deployment patterns and examples Version 4 Release 1 SC

2 Note Before using this information and the product it supports, read the information in Notices on page 25. This edition applies to version 4, release 1, modification 2 of IBM i2 Analyze (product number 5725-G22) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Chapter 1. Contacting IBM support... 1 Chapter 2. Deployment planning Deployment patterns Data model i2 Analyze schemas Security model Security Dimensions Security Permissions i2 Analyze principal provider Data acquisition Deployment process Deployment methods Deployment sequence Connecting to clients Connecting Analyst's Notebook Premium to i2 Analyze Opening the Intelligence Portal Notices Trademarks Chapter 3. Software prerequisites Chapter 4. The IBM i2 Analyze deployment toolkit Chapter 5. Example deployments Creating an example deployment Copyright IBM Corp iii

4 iv Deployment patterns and examples

5 Chapter 1. Contacting IBM support IBM Support provides assistance with product defects, answers FAQs, and helps users to resolve problems with the product. About this task After trying to find your answer or solution by using other self-help options such as technotes, you can contact IBM Support. Before contacting IBM Support, your company or organization must have an active IBM software subscription and support contract, and you must be authorized to submit problems to IBM. For information about the types of available support, see the Support portfolio topic in the Software Support Handbook. Procedure To contact IBM Support about a problem: 1. Define the problem, gather background information, and determine the severity of the problem. For more information, see the Getting IBM Support topic in the Software Support Handbook. 2. Gather diagnostic information. 3. Submit the problem to IBM Support in one of the following ways: a. Online through the IBM Support Portal at support. You can open, update, and view all of your service requests from the Service Request portlet on the Service Request page. b. By phone: For the phone number to call in your region, see the Directory of worldwide contacts web page at Results If the problem that you submit is for a software defect or for missing or inaccurate documentation, IBM Support creates an Authorized Program Analysis Report (APAR). The APAR describes the problem in detail. Whenever possible, IBM Support provides a workaround that you can implement until the APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the IBM Support website daily, so that other users who experience the same problem can benefit from the same resolution. Copyright IBM Corp

6 2 Deployment patterns and examples

7 Chapter 2. Deployment planning Deployment patterns Planning a deployment of i2 Analyze ensures that the system matches the needs of your organization. By understanding your organizational requirements and tailoring the solution before you begin, you can reduce the number of deployment iterations. Before you start a deployment, take time to ensure that you understand the following aspects of the proposed system: v The types of deployment that are possible v The physical architecture into which i2 Analyze is to be deployed v The structure of the data to be analyzed, both existing and planned v The security infrastructure into which i2 Analyze must integrate v The locations of any external data sources that need to be accessed A deployment of i2 Analyze consists of applications that are hosted on a server. Depending on the type of application that is being hosted, different deployment patterns are available. i2 Analyze can be deployed in a number of different patterns. The pattern that you select, depends on the types of operations, and the amount of data that you intend to import. If you would like to search large amounts of centralized data, ingest that data into an Information Store. To store the results of your investigation in a centralized location, or to access data from multiple stores, a system that includes the Analysis Repository might be more suitable. Information Store When you deploy i2 Analyze with an Information Store as the primary data store, data can be accessed through Analyst's Notebook Premium: Copyright IBM Corp

8 The Information Store store can be deployed on IBM DB2, and provides a read-only store for large amounts of data. This data can be searched and items of interest can be charted to aid investigations. Analysis Repository When you deploy i2 Analyze with an Analysis Repository as the primary data store, data can be accessed through both the Intelligence Portal and Analyst's Notebook Premium: The Analysis Repository can be deployed on IBM DB2, Microsoft SQL server, or Oracle databases. This repository stores the items of interest, in addition, a system that contains the Analysis Repository can be connected to third-party data stores. These data stores can be searched for using either the web-based Intelligence Portal or Analyst's Notebook Premium. Information Store and Analysis Repository When you deploy i2 Analyze with both data stores: v Data that is stored in the Analysis Repository can be accessed through both the Intelligence Portal and Analyst's Notebook Premium v Data that is stored in the Information Store can be accessed through Analyst's Notebook Premium 4 Deployment patterns and examples

9 Regardless of which type of deployment pattern you select, the server that hosts the i2 Analyze application must have an HTTP server that acts as a proxy server for client requests. In addition, before you begin deployment, you need to know the network address of the server that is intended to host i2 Analyze. This information is required during the deployment procedure. Data model i2 Analyze models data in terms of entities, links, and properties (ELP). When you deploy i2 Analyze, you decide how your information can be represented by entities, links, and properties of different types. ELP makes up the basic concept in the i2 Analyze data model. Entities and links can be named collectively as items. v An entity represents a real-world object, such as a Person or a Car. v A link associates two entities with each other. For example, a Person entity might be associated with a Car entity through an Owns link. v A property stores a value that characterizes an entity or a link. For example, a Person entity might have properties that record their given name, surname, date of birth, and hair color. Starting from these basic concepts, the i2 Analyze data model is designed to support rich analytical abilities. When you deploy i2 Analyze, you specify a schema that expresses your data in ELP terms. A well-designed schema allows users to request effective searches, view properly aligned results, and perform valuable results analysis. i2 Analyze schemas The schema describes the items that users interact with when they use your deployment. The schema also defines the relationships that can exist between items of different types, and therefore the structure of the data in the Analysis Repositoryand the Information Store. Your deployment of i2 Analyze must have a schema that is appropriate for the information in your domain. The schema fulfills the following roles: v It describes the data that you interact with in terms of entity types, link types, property types, and property group types. v It defines what types of links are allowed between entities of particular types, aiding analysis and data quality. v It specifies what entities and links look like when they are visualized on charts. Note: The last role is the responsibility of a charting scheme. Depending on the type of chart that you are creating, different charting schemes might be appropriate. As such, you can associate multiple charting schemes with the same schema, but these must be stored in the same file. An i2 Analyze schema defines the item types that you identify in your data. Every deployment requires a schema, and there are three ways to choose or create one. Chapter 2. Deployment planning 5

10 Security model v The i2 Analyze deployment toolkit includes example schemas that target particular domains: commercial insurance, law enforcement, and military intelligence. Note: The example configuration directories that are included with the toolkit are configured to use the Law Enforcement Schema. v Alternatively, one of the supplied schemas might contain some of the entity and link types that you need. If you can meet your requirements by expanding or modifying the existing types, then you can edit the schema to make it fit for purpose. v If none of the supplied schemas is appropriate, then you can create your own schema that precisely matches the data in your organization. You can view, edit, and create i2 Analyze schemas with Analysis Repository Schema Designer, which is a tool that IBM provides with i2 Analyze. Analysis Repository Schema Designer displays the structure of your schema, and ensures that the schema files that you create are compatible with i2 Analyze. The i2 Analyze security model enables i2 Analyze to determine the rights of individual users to manipulate the items that they are working with. When you deploy i2 Analyze, you provide a security schema that categorizes users, and defines how those categories affect their access to information. The i2 Analyze security model bases its behavior on the interaction between security dimension values that items have, and the security permissions that user groups have. Security Dimensions Items in i2 Analyze are categorized with the security dimensions that are used to define what kind of data the item consists of. The security dimensions are defined in the security schema. There are two types of security dimension: v An access security dimension affects whether a user with particular permissions can see an item at all; and if they can, whether they can edit it. v A grant security dimension affects whether a user can change the security classification of an item. Each security dimension contains a set of dimension values to classify the items within that dimension. For example, the access security dimensions might have values as follows: Dimension name Security Level Security Compartment Dimension values Controlled, Unclassified Human Informants, Open Source Intelligence Each item in i2 Analyze must be given a dimension value from each access security dimension that is defined in the security schema. In some dimensions (such as Security Level), the dimension values are ordered to form a sequence from which each item is given a single dimension value. In such 6 Deployment patterns and examples

11 cases, the dimension values are considered to be levels, where each value encompasses all the values below it. In the example, if an item is categorized as "Unclassified", it is accessible by users who have "Controlled" and "Unclassified" access. In dimensions where the dimension values are not ordered (such as Security Compartment), items are given only one value. In the example, an item is either categorized as "Human Informants" or "Open Source Intelligence". The display name of a dimension value is displayed on an item. Security Permissions Security permissions define the level of access that groups of users have to items in i2 Analyze. The security permissions for any deployment of i2 Analyze are defined in the security schema for that deployment. A security permission is made up of group permissions. Each group permission defines the security dimensions and access levels that are attributed to that group of users. For a particular deployment of i2 Analyze, there might be several different ways of distinguishing the permissions of users, which result in multiple group permissions. For example: v Users might be distinguished according to their clearance to see items of different security dimensions. v Users might be distinguished according to their job titles. The group permissions are made up of permissions that map to a security dimension. Within the permissions, there are permission elements that map to a dimension value and define the access level. To continue the example, groups to distinguish users by job titles might have the following values: Group Permissions name Permissions dimension Permission dimension value and level Analyst Security Compartment Human Informants - update, Open Source Intelligence - read_only Clerk Security Compartment Human Informants - read_only, Open Source Intelligence - update For example, the security dimension value for an item might dictate that the item is in the "Human Informants" dimension. If the permissions of the "Analyst" group specify the "Human Informants" update permission, a user that is a member of the "Analyst" group can view and edit the item. If the permissions of the "Clerk" group specifies the "Human Informants" read only permission, a user that is a member of the "Clerk" group can only view the item. Every user of an i2 Analyze deployment must be a member of enough groups such that they are assigned a dimension value and level from each access security dimension. A user does not require a mapping to a grant security dimension. Chapter 2. Deployment planning 7

12 i2 Analyze principal provider In a deployment of i2 Analyze, the security schema defines the available security dimensions and the security permissions of users. All deployments have a custom security schema that reflects their particular requirements. To complete the security model, i2 Analyze also needs a mechanism that can associate security permissions from the security schema with particular users. This task is the responsibility of a principal provider, which you specify during deployment. The i2 Analyze deployment toolkit includes a principal provider that interacts with the user and group management function in WebSphere Application Server Liberty profile. The groups that users are in determine the level of access that they receive for items in i2 Analyze. More information about permissions can be found in the IBM i2 Analyze Security White Paper. To use the supplied principal provider, the group names in your security schema must match the names of user groups in the application server. The deployment toolkit contains an example security schema that illustrates the approach, including some security dimension and permission definitions. However, a production deployment always requires you to create your own security schema. 8 Deployment patterns and examples

13 Data acquisition As a part of an investigation, data can be acquired from a number of different locations. Depending on your requirements, data can be accessed directly from the original source or loaded into one of the supplied data stores. How you intend to interact with data from external sources should be a key decision point in selecting the deployment pattern that you would like to use for your starting point. If you are working in an environment where you can import all the data into a centralized location, ingest that data into an Information Store. For data that must be left in the original data source, using the application connected to an Analysis Repository provides you with several mechanisms for interacting with data that comes from outside the system: Acquisition type Description Suitable data File import Data load direct Data load ELP stage Data access on-demand Use the Analyst's Notebook Premium importer or the Analyst's Notebook Premium chart item uploader to add smaller amounts of data from text files, spreadsheets, or charts to the Analysis Repository. Use a custom application to add a larger amount of data to the Analysis Repository in a one-off operation. This method is appropriate for data that is not going to be updated in the original source. Use a custom application to add data to a secondary repository that is hosted on a separate server. This method is appropriate for data that is not subject to rapid changes, but is not yet static. Use a custom i2 Analyze service to connect directly to data that is still being updated regularly in its original source. Custom services can be deployed alongside a standard i2 Analyze deployment. A record of the telephone calls between two individuals that are being investigated. The records of a closed investigation. The records of an active investigation that is nearing prosecution. The records of an active investigation. Deployment process When a data acquisition solution requires a custom configuration of i2 Analyze, you can deploy it at the same time as i2 Analyze or modify an existing deployment. For more information about data acquisition solutions, see i2 Analyze Developer Essentials on GitHub. Before you start a deployment of i2 Analyze, it is important to understand the process that is used. Use the following information to ensure that you choose the correct deployment method for your system. Deployment methods The i2 Analyze setup script provides a number of methods to deploy i2 Analyze. This flexibility is included so that you can build up a configuration incrementally to match your production environment. To build up your environment, create an example deployment first. The example deployment demonstrates a running system, which enables you to verify that your Chapter 2. Deployment planning 9

14 prerequisites are set up correctly. The example deployment uses default configuration values, example security, an example schema and charting scheme, and uses a basic user registry that contains a demonstration user account. After you deploy the example system, additional configuration can be carried out to create a system that matches the requirements of your organization. At this stage, you can redeploy i2 Analyze after every change so that you can continually test the deployment. You can clear any data from the system, at any time, before you redeploy i2 Analyze. After you complete the configuration of your deployment, and you are satisfied that the system matches your requirements, you can deploy i2 Analyze with the tested configuration on to a production system. For a production system, you must configure the application server security for the users in your environment. The following flowchart shows the suggested workflow for deploying i2 Analyze: 10 Deployment patterns and examples

15 Chapter 2. Deployment planning 11

16 Deployment sequence Use the i2 Analyze deployment toolkit to complete the actions for the deployment. By building up the deployment incrementally, you can tailor i2 Analyze to the individual requirements of your organization, before you deploy into a production environment. Create an example i2 Analyze deployment The following list is an outline of the steps that you follow to deploy an example i2 Analyze deployment, from preparing the environment to connecting the first user: 1. Install the prerequisite software. 2. Create the configuration directory. 3. Provide the user names and passwords that the deployment process requires. 4. Create the example deployment. 5. Connect to i2 Analyze as a user, and test that the application can be accessed. An example deployment demonstrates whether your prerequisites are set up correctly, and provides an opportunity to demonstrate the system without the need for further configuration. Configure i2 Analyze You can use the i2 Analyze deployment toolkit from the example deployment as a starting point for creating a custom configuration. After you have an example deployment, customize the configuration files to match your requirements: 1. Configure the environment. 2. Create an i2 Analyze security schema for your environment. 3. Select or create an i2 Analyze schema and charting scheme for your data. 4. Set the i2 Analyze application global properties. 5. Configure the application server security for your environment. 6. Connect to i2 Analyze as a user, and test that the application can be accessed. At this stage, i2 Analyze can be redeployed after every change, so that you can test the deployment. If you want to make changes to the structure of your data, or the permissions that are used to access that data, you must clear the data and the search indexes before you redeploy. 12 Deployment patterns and examples

17 Migrate i2 Analyze When you have completed customizing the deployment, you can migrate i2 Analyze to a different system by completing the following sequence: 1. Install the prerequisite software. 2. Copy the deployment toolkit from the original system to the new system. 3. Change the host names and any other specific settings for the new environment. 4. Run the script to deploy i2 Analyze. 5. Configure the application server security for your environment. 6. Connect to i2 Analyze as a user, and test that the application can be accessed. Chapter 2. Deployment planning 13

18 14 Deployment patterns and examples

19 Chapter 3. Software prerequisites IBM i2 Analyze has prerequisite software that you must install before you can deploy i2 Analyze itself. A full list of the prerequisites for i2 Analyze can be found on the IBM support portal: softwarereqsforproduct.html In summary, the prerequisites are: v The i2 Analyze version distribution. v A supported database management system. To deploy the preconfigured examples, you will need IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 10.5 Fix Pack 7 Note: IBM DB is included with i2 Analyze. You must upgrade to Fix Pack 7 separately. v An HTTP server that supports a reverse proxy. The deployment toolkit can automatically configure an IBM HTTP Server instance on the server where the i2 Analyze application is deployed to act as a reverse proxy. To support this approach, you must install the following software: IBM HTTP Server Web Server Plug-ins for WebSphere Application Server Note: IBM HTTP Server and the Web Server Plug-ins version are included with i2 Analyze. You must upgrade to Fix Pack 8 separately. Installing prerequisite software When you install the prerequisite software, you must do so according to the following specifications. IBM i2 Analyze To install the i2 Analyze software package, complete the following instructions: 1. Extract the product files from your downloaded distribution. 2. Navigate to the location of the extracted files and install IBM Installation Manager. The installation files for IBM Installation Manager are in the installation-manager directory. 3. Run IBM Installation Manager and install the i2 Analyze software package. v The installation repository location that IBM Installation Manager requires is the i2analyze-repository directory. This directory is in the location where you extracted or copied the product files. After the package is installed, the files that you use to deploy i2 Analyze are present in the installation directory. The default installation directory is C:\IBM\i2analyze. Copyright IBM Corp

20 IBM DB2 For windows deployments, you can use all of the default settings, except that it is not necessary to set up a response file and you must install the Spatial Extender. You can also turn off DB2 notifications. During setup, DB2 creates a Windows user account (db2admin), and two Windows groups (DB2ADMNS, DB2USERS). To work successfully with DB2, ensure that your Windows user account is a member of the DB2ADMNS Windows group. For linux deployments, install DB2 by using a custom setup. Accept the default settings, with the following exceptions: 1. On page 5 of the installer, set the installation directory to /opt/ibm/db2/db2 version. Note: In the installation directory, ibm is changed to IBM. 2. On page 6 of the installer: v Do not install Tivoli System Automation for Multiplatforms v Ensure that the Spatial Extender server support is installed v Ensure that the Spatial Extender client is installed 3. On pages 7, 10, and 13, keep the default user names, and provide each user with an appropriate password. Make a note of the user names and passwords. 4. On page 13, do not set up notifications. Note: During setup, DB2 creates an Administration Server user (dasusr1) and group (dasadm1), an instance-owning user (db2inst1) and group (db2iadm1), and a fenced user (db2fenc1) and group (db2fadm1).to work successfully with DB2, ensure that the user that runs the deployment script is a member of the dasadm1 and db2iadm1 groups. Note: In all scenarios, the user that you use to run the deployment scripts must have permission to create and modify the database. IBM HTTP Server and Web Server Plug-ins for WebSphere Application Server An i2 Analyze deployment requires a reverse proxy server that routes client requests to the appropriate destination. Your environment might already contain a server that fulfills (or can be made to fulfill) this role. If it does not, the deployment toolkit can automatically configure an IBM HTTP Server instance to act as a reverse proxy. To support this approach, you must install IBM HTTP Server as follows: Windows Install IBM HTTP Server version and Web Server Plug-ins for WebSphere Application Server version For IBM HTTP Server, you must change the installation location from the default setting to shorten the path length and avoid spaces, for example C:\IBM\HTTPServer. All the other options can use the default settings. For the Web Server Plug-ins, you must change the installation location from the default setting to shorten the path length and avoid spaces, for 16 Deployment patterns and examples

21 Linux example C:\IBM\WebSphere\Plugins. Also, you must install the IBM 32-bit WebSphere Runtime Environment for Java feature. All the other options can use the default settings. Finally, in addition to installing the prerequisite software, you must ensure that Microsoft Internet Information Server is either inactive or not present on the i2 Analyze server. For IBM HTTP Server, you must install the server and the plug-ins with their default settings. The user that you use to run the deployment scripts must have write permissions on the /opt/ibm/httpserver/conf/httpd.conf file. Chapter 3. Software prerequisites 17

22 18 Deployment patterns and examples

23 Chapter 4. The IBM i2 Analyze deployment toolkit The i2 Analyze deployment toolkit contains scripts and components that you need to deploy and maintain i2 Analyze. Configuring components within the toolkit allows you to consistently deploy to the same locations with the same settings. Directories The deployment toolkit contains files in several directories. On most occasions, you need to interact with only two of the directories: Directory configuration scripts Contents The configuration directory contains files that you must update with information specific to your deployment. The scripts directory contains the setup script that you use to create, deploy, and upgrade i2 Analyze. The configuration directory contains files that you must update with information specific to your deployment. When you have provided this information, you can use the setup script to administer your i2 Analyze deployment. The setup script The setup script completes specific actions that are called tasks. For a list of available tasks and other information, on the i2 Analyze server, open a command prompt and navigate to toolkit\scripts, then run one of the following commands: setup -h The -h argument displays the usage, common tasks, and examples of use for the setup script. setup -a The -a argument displays the same content as when you use -h, and a list of additional tasks. setup -dh The -dh argument displays the help information for data access points. Note: On Linux, whenever you run the setup script from the toolkit\scripts directory, you must prefix the script with./. For example,./setup -t deploy. Copyright IBM Corp

24 20 Deployment patterns and examples

25 Chapter 5. Example deployments An example deployment demonstrates a working i2 Analyze system. An example user is created so that you can log in. In an example deployment, i2 Analyze runs with the example security schema and matching WebSphere Application Server Liberty profile security groups and users. The example user has the following credentials: v The user name is Jenny v The password is Jenny An example deployment uses the law-enforcement-schema.xml schema as the i2 Analyze schema with the associated law-enforcement-schema-chartingschemes.xml. Creating an example deployment Create an example deployment that uses DB2 as the database management system. The deployexample task generates the default values, provides the JDBC driver, and deploys the platform. Before you begin You must have installed the software prerequisites according to the instructions in Chapter 3, Software prerequisites, on page 15. Procedure 1. Create the configuration directory: a. Navigate to the \toolkit\examples\ directory. b. Select the directory that matches the deployment type that you would like to deploy: information-store This directory contains the preconfigured files that you require to deploy a system that uses the information store to store data. The data can be accessed using Analyst's Notebook Premium as a rich desktop client. analysis-repository This directory contains the preconfigured files that you require to deploy a system that uses the analysis repository to store data. The data can be accessed using both the Intelligence Portal as a thin web client and Analyst's Notebook Premium as a rich desktop client. c. Copy the relevant configuration directory to the root of the toolkit. For example: C:\IBM\i2analyze\toolkit\configuration 2. Specify the credentials: a. Using a text editor, open the toolkit\configuration\environment\ credentials.properties file. b. Enter the user name and password to use with the database. c. If you are deploying the Information Store, enter the user name and password to use with the Solr index. Copyright IBM Corp

26 Connecting to clients d. Enter the password to use to encrypt LTPA tokens. e. Save and close the credentials.properties file. 3. Run the setup script to create the example deployment. a. On the i2 Analyze server, open a command prompt and navigate to the toolkit\scripts directory. b. To deploy the example, run the following command: setup -t deployexample c. To start the WebSphere Application Server Liberty profile server, run the following command: setup -t startliberty d. Start, or restart, the HTTP server that hosts the reverse proxy. 4. Optional: If you chose the Information Store example, you can populate your system with the example data that is included in the example. To populate your Information Store with the example data, run the following command: setup -t ingestexampledata When your example deployment has completed, you can connect to your data store using one of the supported clients. Before you begin v You must have at least one user set up within the application server that has permission to access items in i2 Analyze. v You must have started i2 Analyze. Connecting Analyst's Notebook Premium to i2 Analyze When your deployment of i2 Analyze is complete, you can connect to it through Analyst's Notebook Premium. Procedure 1. Depending on whether Analyst's Notebook Premium is already installed, proceed with one of the following options: v v If Analyst's Notebook Premium is not installed, install Analyst's Notebook Premium and use the custom option to ensure that the check box for the Local Analysis Repository is cleared. If Analyst's Notebook Premium is installed, use Programs and Features in Windows Control Panel to uninstall the IBM i2 Local Analysis Repository. 2. Start Analyst's Notebook Premium. 3. When prompted, enter a name to identify your deployment of i2 Analyze in the user interface, and the URL of the Intelligence Portal. Note: If several Analyst's Notebook Premium clients connect to the same deployment of i2 Analyze, use the same name for the deployment in all cases. What to do next Test the connection between Analyst's Notebook Premium and i2 Analyze. 22 Deployment patterns and examples

27 Opening the Intelligence Portal If you select the Analysis Repository example, you can connect to it and test it through the Intelligence Portal. You can open the Intelligence Portal from any client computer with access to the HTTP server that hosts the reverse proxy. Procedure 1. Open a web browser, and navigate to (where host_name is the fully qualified domain name or IP address of the HTTP server). i2 Analyze displays a login dialog. 2. Enter the name and password of a user who is registered in the application server. What to do next Create, browse, and search for data, to ensure that the application is running. Note: When you create test items, ensure that the permissions are set up so that you have access to view them. Chapter 5. Example deployments 23

28 24 Deployment patterns and examples

29 Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM United Kingdom Limited Hursley House Hursley Park Winchester, Hants, SO21 2JN UK Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. Copyright IBM Corp

30 The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs. If you are viewing this information softcopy, the photographs and color illustrations may not appear. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information at Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. 26 Deployment patterns and examples

31 Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Other company, product, and service names may be trademarks or service marks of others. Notices 27