IBM. IBM i2 Analyze Linux Deployment Guide. Version 4 Release 1 SC

Transcription

1 IBM IBM i2 Analyze Linux Deployment Guide Version 4 Release 1 SC

2 Note Before using this information and the product it supports, read the information in Notices on page 63. This edition applies to version 4, release 1, modification 1 of IBM i2 Analyze (product number 5725-G22) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2012, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Chapter 1. About this guide Chapter 2. Contacting IBM support... 3 Chapter 3. Deployment planning Physical model Data model i2 Analyze schemas Security model Security Dimensions Security Permissions i2 Analyze principal provider Data acquisition Deployment process Deployment methods Deployment sequence Chapter 4. Software prerequisites Chapter 5. The IBM i2 Analyze deployment toolkit Chapter 6. Example deployments Creating a DB example deployment Creating an example deployment Creating the configuration directory Generating the default values Providing a JDBC driver Specifying credentials Deploying an example deployment Chapter 7. Configuring i2 Analyze Configuring the environment Optional: Setting the IBM HTTP Server properties Optional: Setting the i2 Analyze environment properties Specifying the deployment structure Configuring the applications Specifying a security schema Setting default permissions for items Specifying the i2 Analyze schema and the charting scheme Setting global application properties Chapter 8. Optional: Clearing data from the system Chapter 9. Redeploying i2 Analyze Chapter 10. Setting up WebSphere Application Server Liberty profile security Chapter 11. Migrating i2 Analyze Chapter 12. i2 Analyze clients Opening the Intelligence Portal Connecting Analyst's Notebook Premium to i2 Analyze Chapter 13. Monitor your deployment 47 Deployment toolkit validation Deployment monitoring Logged information Chapter 14. Backup strategy Core components Additional components Backing up your system while it is offline Appendix A. The topology i2 Analyze data sources Databases Applications Appendix B. Indexing Creating a custom alternative term index Appendix C. Setting up a localized deployment Specifying the index language Enabling bi-directional text support Notices Trademarks Copyright IBM Corp. 2012, 2016 iii

4 iv Linux Deployment Guide

5 Chapter 1. About this guide This guide describes how to deploy IBM i2 Analyze. The instructions use the i2 Analyze deployment toolkit, which produces a set of deployment artifacts that make both the initial process and subsequent upgrades easier to manage. The instructions assume that you have access to one of the supported database management systems as well as an i2 Analyze distribution. The following are the supported database management systems: v IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 10.1, or 10.5 Fix Pack 7 v Oracle Database 11g Standard Edition Release 2 (Patch ) or 12c Standard Edition Release 1 (Patch ) Attention: While IBM takes reasonable steps to verify the suitability of i2 Analyze for Internet deployment, this guide covers aspects of a deployment only at the application level. It does not address lower-level issues such as guarding networks against penetration, firewall configurations to avoid DoS or DDoS attacks, load balancing and the like. In deploying i2 Analyze, follow industry-standard practices and recommendations for protection of your systems. IBM accepts no liability for the consequences of such attacks on your systems. Intended audience This guide is intended for readers who are familiar with deploying web services into existing infrastructures that use an application server and one of the supported databases. Furthermore, the guide is aimed specifically at enabling deployments of i2 Analyze on servers that run Red Hat Enterprise Linux. Copyright IBM Corp. 2012,

6 2 Linux Deployment Guide

7 Chapter 2. Contacting IBM support IBM Support provides assistance with product defects, answers FAQs, and helps users to resolve problems with the product. About this task After trying to find your answer or solution by using other self-help options such as technotes, you can contact IBM Support. Before contacting IBM Support, your company or organization must have an active IBM software subscription and support contract, and you must be authorized to submit problems to IBM. For information about the types of available support, see the Support portfolio topic in the Software Support Handbook. Procedure To contact IBM Support about a problem: 1. Define the problem, gather background information, and determine the severity of the problem. For more information, see the Getting IBM Support topic in the Software Support Handbook. 2. Gather diagnostic information. 3. Submit the problem to IBM Support in one of the following ways: a. Online through the IBM Support Portal at support. You can open, update, and view all of your service requests from the Service Request portlet on the Service Request page. b. By phone: For the phone number to call in your region, see the Directory of worldwide contacts web page at Results If the problem that you submit is for a software defect or for missing or inaccurate documentation, IBM Support creates an Authorized Program Analysis Report (APAR). The APAR describes the problem in detail. Whenever possible, IBM Support provides a workaround that you can implement until the APAR is resolved and a fix is delivered. IBM publishes resolved APARs on the IBM Support website daily, so that other users who experience the same problem can benefit from the same resolution. Copyright IBM Corp. 2012,

8 4 Linux Deployment Guide

9 Chapter 3. Deployment planning Physical model Planning a deployment of i2 Analyze ensures that the system matches the needs of your organization. By understanding your organizational requirements and tailoring the solution before you begin, you can avoid multiple deployment iterations. Before you start a deployment, take time to ensure that you understand the following aspects of the proposed system: v The physical architecture into which i2 Analyze is to be deployed v The structure of the data to be analyzed, both existing and planned v The security infrastructure into which i2 Analyze must integrate v The locations of any external data sources that need to be accessed A deployment of i2 Analyze consists of an application that is hosted on a server running IBM WebSphere Application Server Liberty profile. The application provides the functionality for clients to create, edit, delete, visualize, and analyze information. Users can interact with i2 Analyze by using the Intelligence Portal or IBM i2 Analyst's Notebook Premium. A deployment of i2 Analyze also contains a data store, called the Analysis Repository, that is hosted in a compatible database management system. The server that hosts the i2 Analyze application must have an HTTP server that acts as a proxy server for client requests. When you deploy i2 Analyze by following all the instructions in this guide, the physical architecture matches this diagram: Copyright IBM Corp. 2012,

10 Note: Before you begin deployment, you need to know the network address of the server that is intended to host i2 Analyze. This information is required during the deployment procedure. Data model i2 Analyze models data in terms of entities, links, and properties (ELP). When you deploy i2 Analyze, you must decide how your information can be represented by entities, links, and properties of different types. ELP makes up the basic concept in the i2 Analyze data model. Entities and links can be named collectively as items. v An entity represents a real-world object, such as a Person or a Car. v A link associates two entities with each other. For example, a Person entity might be associated with a Car entity through an Owns link. v A property stores a value that characterizes an entity or a link. For example, a Person entity might have properties that record their given name, surname, date of birth, and hair color. Starting from these basic concepts, the i2 Analyze data model is designed to support rich analytical abilities. When you deploy i2 Analyze, you specify a schema that expresses your data in ELP terms. A well-designed schema allows users to request effective searches, view properly aligned results, and perform valuable results analysis. 6 Linux Deployment Guide

11 Security model i2 Analyze schemas The i2 Analyze schema describes the items that users interact with when they use your deployment. The schema also defines the relationships that can exist between items of different types, and therefore the structure of the data in the Analysis Repository. Your deployment of i2 Analyze must have a schema that is appropriate for the information in your domain. The schema fulfills the following roles: v It describes the data that i2 Analyze users interact with in terms of entity types, link types, property types, and property group types. v It defines what types of links are allowed between entities of particular types, aiding analysis and data quality. v It specifies what entities and links look like when they are visualized as results on charts. Note: The last role is the responsibility of a charting scheme. An i2 Analyze schema defines the item types that you identify in your data. Every deployment requires a schema, and there are three ways to choose or create one. v The i2 Analyze deployment toolkit includes example schemas that target particular domains: commercial insurance, law enforcement, and military intelligence. If one of the supplied schemas matches your requirements, you can use it without modification. v Alternatively, one of the supplied schemas might contain some of the entity and link types that you need. If you can meet your requirements by expanding or modifying the existing types, then you can edit the schema to make it fit for purpose. v If none of the supplied schemas is appropriate, then you can create your own schema that precisely matches the data in your organization. You can view, edit, and create i2 Analyze schemas with Analysis Repository Schema Designer, which is a tool that IBM provides with i2 Analyze. Analysis Repository Schema Designer displays the structure of your schema, and ensures that the schema files that you create are compatible with i2 Analyze. The i2 Analyze security model enables i2 Analyze to determine the rights of individual users to manipulate the items that they are working with. When you deploy i2 Analyze, you provide a security schema that categorizes users, and defines how those categories affect their access to information. The i2 Analyze security model bases its behavior on the interaction between security dimension values that items have, and the security permissions that user groups have. Chapter 3. Deployment planning 7

12 Security Dimensions Items in i2 Analyze are categorized with the security dimensions that are used to define what kind of data the item consists of. The security dimensions are defined in the security schema. There are two types of security dimension: v An access security dimension affects whether a user with particular permissions can see an item at all; and if they can, whether they can edit it. v A grant security dimension affects whether a user can change the security permissions of an item. Each security dimension contains a set of dimension values to classify the items within that dimension. For example, the access security dimensions might have values as follows: Dimension name Security Level Security Compartment Dimension values Controlled, Unclassified Human Informants, Open Source Intelligence Each item in i2 Analyze must be given a dimension value from each access security dimension that is defined in the security schema. In some dimensions (such as Security Level), the dimension values are ordered to form a sequence from which each item is given a single dimension value. In such cases, the dimension values are considered to be levels, where each value encompasses all the values below it. In the example, if an item is categorized as "Unclassified", it is accessible by users who have "Controlled" and "Unclassified" access. In dimensions where the dimension values are not ordered (such as Security Compartment), items are given only one value. In the example, an item is either categorized as "Human Informants" or "Open Source Intelligence". The display name of a dimension value is displayed in the Intelligence Portal on an item. Security Permissions Security permissions define the level of access that groups of users have to items in i2 Analyze. The security permissions for any deployment of i2 Analyze are defined in the security schema for that deployment. A security permission is made up of group permissions. Each group permission defines the security dimensions and access levels that are attributed to that group of users. For a particular deployment of i2 Analyze, there might be several different ways of distinguishing the permissions of users, which result in multiple group permissions. For example: v Users might be distinguished according to their clearance to see items of different security dimensions. v Users might be distinguished according to their job titles. 8 Linux Deployment Guide

13 The group permissions are made up of permissions that map to a security dimension. Within the permissions, there are permission elements that map to a dimension value and define the access level. To continue the example, groups to distinguish users by job titles might have the following values: Group Permissions name Permissions dimension Permission dimension value and level Analyst Security Compartment Human Informants - update, Open Source Intelligence - read_only Clerk Security Compartment Human Informants - read_only, Open Source Intelligence - update For example, the security dimension value for an item might dictate that the item is in the "Human Informants" dimension. If the permissions of the "Analyst" group specify the "Human Informants" update permission, a user that is a member of the "Analyst" group can view and edit the item. If the permissions of the "Clerk" group specifies the "Human Informants" read only permission, a user that is a member of the "Clerk" group can only view the item. Every user of an i2 Analyze deployment must be a member of enough groups such that they are assigned a dimension value and level from each access security dimension. A user does not require a mapping to a grant security dimension. i2 Analyze principal provider In a deployment of i2 Analyze, the security schema defines the available security dimensions and the security permissions of users. All deployments have a custom security schema that reflects their particular requirements. To complete the security model, i2 Analyze also needs a mechanism that can associate security permissions from the security schema with particular users. This task is the responsibility of a principal provider, which you specify during deployment. The i2 Analyze deployment toolkit includes a principal provider that interacts with the user and group management function in WebSphere Application Server Liberty profile. The groups that users are in determine the level of access that they receive for items in i2 Analyze. More information about permissions can be found in the IBM i2 Analyze Security White Paper. Chapter 3. Deployment planning 9

14 Data acquisition To use the supplied principal provider, the group names in your security schema must match the names of user groups in the application server. The deployment toolkit contains an example security schema that illustrates the approach, including some security dimension and permission definitions. However, a production deployment always requires you to create your own security schema. i2 Analyze is not limited to operating on data that users enter through the Intelligence Portal. i2 Analyze supports several mechanisms for interacting with data that comes from outside the system, some of which have implications for deployment. Depending on the type, the format, and the intended use of external data, i2 Analyze can acquire it in different ways. You can arrange for data to be imported directly, or you can configure i2 Analyze to connect to external systems and retrieve data when it is requested. Acquisition type Description Suitable data File import Use the Analyst's Notebook Premium importer or the Analyst's Notebook Premium chart item uploader to add smaller amounts of data from text files, spreadsheets, or charts to the Analysis Repository. A record of the telephone calls between two individuals that are being investigated. 10 Linux Deployment Guide

15 Acquisition type Description Suitable data Data load direct Data load ELP stage Data access on-demand Use a custom application to add a larger amount of data to the Analysis Repository in a one-off operation. This method is appropriate for data that is not going to be updated in the original source. Use a custom application to add data to a secondary repository that is hosted on a separate server. This method is appropriate for data that is not subject to rapid changes, but is not yet static. Use a custom i2 Analyze service to connect directly to data that is still being updated regularly in its original source. Custom services can be deployed alongside a standard i2 Analyze deployment. The records of a closed investigation. The records of an active investigation that is nearing prosecution. The records of an active investigation. Deployment process When a data acquisition solution requires a custom configuration of i2 Analyze, you can deploy it at the same time as i2 Analyze or modify an existing deployment. For more information about data acquisition solutions, see i2 Analyze Developer Essentials on GitHub. Before you start a deployment of i2 Analyze, it is important to understand the process that is used. Use the following information to ensure that you choose the correct deployment method for your system. Deployment methods The i2 Analyze setup script provides a number of methods to deploy the i2 Analyze. This flexibility is included so that you can build up a configuration incrementally to match your production environment. To build up your environment, it is suggested that you create the example deployment first. The example deployment can demonstrate a running system, and verify that your prerequisites are set up correctly. The example deployment uses default configuration property values with an example security mechanism, schema, and charting scheme. The deployment configures the application server to use a basic user registry that contains a demonstration user account. After you deploy the example system, additional configuration can be carried out to create a test system that matches the requirements of your organization. At this stage, you can redeploy i2 Analyze after every change so that you can continually test the deployment. You can clear any data from the system, at any time, before you redeploy i2 Analyze. After you complete the configuration of your deployment, and you are satisfied that the system matches your requirements, you can deploy i2 Analyze with the tested configuration in a production system. For a production system, you must configure the application server security for the users in your environment. Chapter 3. Deployment planning 11

16 12 Linux Deployment Guide The following flowchart shows the suggested workflow for deploying i2 Analyze in a production environment:

17 Deployment sequence Use the i2 Analyze deployment toolkit to complete the actions for the deployment. By building up the deployment incrementally, you can tailor i2 Analyze to the individual requirements of your organization, before you deploy into a production environment. Create an example i2 Analyze deployment The following list is an outline of the steps that you follow to deploy an example i2 Analyze deployment, from preparing the environment to connecting the first user: 1. Install the prerequisite software. 2. Create the configuration directory. 3. Generate the default values. 4. Provide the JDBC driver. 5. Provide the user names and passwords that the deployment process requires. 6. Create the example deployment. 7. Connect to i2 Analyze by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the i2 Analyze application can be accessed. An example deployment demonstrates whether your prerequisites are set up correctly, and provides an opportunity to demonstrate the Intelligence Portal without the need for further configuration. Configure i2 Analyze You can use the i2 Analyze deployment toolkit from the example deployment as a starting point for creating a custom configuration. After you have an example deployment, customize the configuration files to match your requirements: 1. Configure the environment. 2. Create an i2 Analyze security schema for your environment. 3. Set the default permissions for new items. 4. Select or create an i2 Analyze schema and charting scheme for your data. 5. Set the i2 Analyze application global properties. 6. Configure the application server security for your environment. 7. Connect to i2 Analyze by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the i2 Analyze application can be accessed. At this stage, i2 Analyze can be redeployed after every change, so that you can test the deployment. If you want to make changes to the structure of your data, or the permissions that are used to access that data, you must clear the data and the search indexes before you redeploy. Chapter 3. Deployment planning 13

18 Migrate i2 Analyze When you have completed customizing the deployment, you can migrate i2 Analyze to a production system by completing the following sequence: 1. Install the prerequisite software. 2. Copy the deployment toolkit from the test system to the production system. 3. Change the host names and any other specific settings for the production environment. 4. Run the script to deploy i2 Analyze. 5. Configure the application server security for your environment. 6. Connect to i2 Analyze by using the Intelligence Portal and Analyst's Notebook Premium as a user, and test that the i2 Analyze application can be accessed. Important: When you run the deployment script, ensure that you have permission to read, write, and execute files in the directories that WebSphere Application Server Liberty profile and IBM HTTP Server are installed. By default, the directories are /opt/ibm/i2analyze/deploy/wlp and /opt/ibm/httpserver. 14 Linux Deployment Guide

19 Chapter 4. Software prerequisites IBM i2 Analyze has prerequisite software that you must install before you can deploy i2 Analyze itself. For i2 Analyze, the prerequisites are: v The i2 Analyze version distribution. v One of the supported database management systems: IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 10.1, or 10.5 Fix Pack 7 Note: IBM DB is included with i2 Analyze. You must upgrade to Fix Pack 7 separately. Oracle Database 11g Standard Edition Release 2 (Patch ) or 12c Standard Edition Release 1 (Patch ) v An HTTP server that supports a reverse proxy. The deployment toolkit can automatically configure an IBM HTTP Server instance on the server where the i2 Analyze application is deployed to act as a reverse proxy. To support this approach, you must install the following software: IBM HTTP Server Web Server Plug-ins for WebSphere Application Server Note: IBM HTTP Server and the Web Server Plug-ins version are included with i2 Analyze. You must upgrade to Fix Pack 8 separately. Installing prerequisite software When you install the prerequisite software, you must do so according to the following specifications. IBM i2 Analyze To install the i2 Analyze software package, complete the following instructions: 1. Extract the product files from your downloaded distribution. 2. Navigate to the location of the extracted files and install IBM Installation Manager. The installation files for IBM Installation Manager are in the installation-manager directory. 3. Run IBM Installation Manager and install the i2 Analyze software package. v The installation repository location that IBM Installation Manager requires is the i2analyze-repository directory. This directory is in the location where you extracted or copied the product files. After the package is installed, the files that you use to deploy i2 Analyze are present in the installation directory. The default installation directory is /opt/ibm/i2analyze. Important: Ensure that all users have access to the installed distribution, and that you have read, write, and execute permissions on the toolkit directory. Copyright IBM Corp. 2012,

20 IBM DB2 Enterprise Server, Advanced Enterprise Server, Workgroup Server, or Advanced Workgroup Server editions at version 10.1, or 10.5 Fix Pack 7 Install DB2 by using a custom setup. Accept the default settings, with the following exceptions: 1. On page 5 of the installer, set the installation directory to /opt/ibm/db2/db2 version. Note: In the installation directory, ibm is changed to IBM. 2. On page 6, do not install Tivoli System Automation for Multiplatforms. 3. On pages 7, 10, and 13, keep the default user names, and provide each user with an appropriate password. Make a note of the user names and passwords. 4. On page 13, do not set up notifications. Note: During setup, DB2 creates an Administration Server user (dasadm1), an instance-owning user (db2inst1), and a fenced user (db2fence1). Oracle Database 11g Standard Edition Release 2 (Patch ) or 12c Standard Edition Release 1 (Patch ) If you choose to use the Oracle database management system, you can use all of the default settings, except that you must set the character set to Unicode (AL32UT8). On Oracle 12c, you must also clear the Create as a container database check box. Oracle database creation is not currently handled by the deployment scripts, so you must create the database manually, and the database must be configured to use a unique user. To work with the example values given in this guide, you must create the database on the server that hosts the i2 Analyze application, and it must be of type WriteStore. Note: Regardless of the database management system, the user that you use to run the deployment scripts must have permission to create and modify the database. IBM HTTP Server and Web Server Plug-ins for WebSphere Application Server An i2 Analyze deployment requires a reverse proxy server that routes client requests to the appropriate destination. Your environment might already contain a server that fulfills (or can be made to fulfill) this role. If it does not, the deployment toolkit can automatically configure an IBM HTTP Server instance to act as a reverse proxy. To support this approach, you must install IBM HTTP Server as follows: For IBM HTTP Server, you must install the server and the plug-ins with their default settings. The user that you use to run the deployment scripts must have write permissions on the /opt/ibm/httpserver/conf/httpd.conf file. 16 Linux Deployment Guide

21 Chapter 5. The IBM i2 Analyze deployment toolkit The i2 Analyze deployment toolkit contains scripts and components that you need to deploy and maintain i2 Analyze. Configuring components within the toolkit allows you to consistently deploy to the same locations with the same settings. Directories The deployment toolkit contains files in several directories. On most occasions, you need to interact with only two of the directories: Directory configuration scripts Contents The configuration directory contains files that you must update with information specific to your deployment. The scripts directory contains the setup script that you use to create, deploy, and upgrade i2 Analyze. The configuration directory contains files that you must update with information specific to your deployment. When you have provided this information, you can use the setup script to administer your i2 Analyze deployment. The setup script The setup script completes specific actions that are called tasks. For a list of available tasks and other information, on the i2 Analyze server, at a shell prompt, navigate to toolkit/scripts, then run one of the following commands:./setup -h The -h argument displays the usage, common tasks, and examples of use for the setup script../setup -a The -a argument displays the same content as when you use -h, and a list of additional tasks../setup -dh The -dh argument displays the help information for data access points. Copyright IBM Corp. 2012,

22 18 Linux Deployment Guide

23 Chapter 6. Example deployments An example deployment demonstrates a working i2 Analyze system. An example user is created so that you can log in and create, edit, delete, visualize, and analyze information. In an example deployment, i2 Analyze runs with the example security schema and matching WebSphere Application Server Liberty profile security groups and users. The example user has the following credentials: v The user name is Jenny v The password is Jenny An example deployment uses the law-enforcement-schema.xml schema as the i2 Analyze schema with the associated law-enforcement-schema-chartingschemes.xml. For more information on the i2 Analyze schema, see Specifying the i2 Analyze schema and the charting scheme on page 31. If you are using DB and it is installed in the default location, you can follow the instructions in Creating a DB example deployment. If you are using a different database management system, or DB is not installed in the default location, follow the instructions in Creating an example deployment on page 20. Creating a DB example deployment Create an example deployment that uses DB as the database management system. The deployexample task generates the default values, provides the JDBC driver, and deploys the platform. Before you begin You must have installed the software prerequisites according to the instructions in Chapter 4, Software prerequisites, on page 15. Procedure 1. Create the configuration directory: a. Navigate to the /opt/ibm/i2analyze/toolkit directory. b. Make a copy of the configuration-example directory in the same location, and name it configuration. 2. Specify the credentials: a. Using a text editor, open the toolkit/configuration/environment/ credentials.properties file. b. Enter the user name and password to use with the database. c. Enter the password to use to encrypt LTPA tokens. d. Save and close the credentials.properties file. 3. Run the setup script to create the example deployment. a. On the i2 Analyze server, open a command prompt and navigate to the toolkit/scripts directory. b. To deploy the example, run the following command: Copyright IBM Corp. 2012,

24 ./setup -t deployexample c. To start the WebSphere Application Server Liberty profile server, run the following command:./setup -t startliberty Creating an example deployment d. Start, or restart, the HTTP server that hosts the reverse proxy. Modify the configuration to create an example deployment that uses different default values, or a different database management system. Before you begin You must have installed the software prerequisites according to the instructions in Chapter 4, Software prerequisites, on page 15. Procedure To create an example deployment, complete the following steps: 1. Create the configuration directory. Create the configuration directory that the deployment toolkit script uses to deploy i2 Analyze. For more information, see Creating the configuration directory. 2. Generate the default values. The i2 Analyze deployment toolkit can generate many of the required environment properties to default values. These values can be modified to suit your system. For more information, see Generating the default values on page Provide the JDBC driver. The JDBC driver for DB2 is copied to the deployment when the example is deployed. If you are not using DB2, you must manually provide the JDBC driver for your database management system. For more information, see Providing a JDBC driver on page Specify the credentials by following the instructions in Specifying credentials on page 22. The database in a deployment of i2 Analyze secures content with a user name and password. The script that interacts with these components use credentials that are stored in the credentials.properties file. 5. Deploy the example by following the instructions in Deploying an example deployment on page 24. Run the deployexample task to deploy the example i2 Analyze. Creating the configuration directory All i2 Analyze deployments rely on settings from files in the deployment toolkit's configuration directory. Create the configuration directory that the deployment toolkit script uses to deploy i2 Analyze. About this task The deployment toolkit script uses information in the toolkit/configuration directory. However, the configuration directory does not exist in the toolkit by default so that when you install a new version of i2 Analyze, your configuration is 20 Linux Deployment Guide

25 not overwritten. Instead, a new installation of the deployment toolkit contains a directory with the name configuration-example. The configuration-example directory contains further directories that store settings files for each server type, and a common directory that stores files that are used across the system. You must make a copy of configuration-example to use as the working configuration directory. Procedure 1. Navigate to the toolkit directory. 2. Make a copy of the configuration-example directory in the same location, and name it configuration. Results The configuration directory is your working area for the rest of the deployment procedure. The configuration directory can be transferred to other i2 Analyze 4.1.1, or later, deployment toolkits. Do not modify files in the configurationexample directory, as the directory remains as a store for clean configuration files. Generating the default values The i2 Analyze deployment toolkit can generate many of the required environment properties to default values. Before you deploy the example, ensure that any generated values are suitable your system. Before you begin You must have created the configuration directory according to the instructions in Creating the configuration directory on page 20. About this task Use the setup script to generate default values in the properties files that are listed. The default installation directories that are used by IBM Installation Manager match the values that are set by the script. If a prerequisite is not installed in the default directory, you must manually set the value of the corresponding property. The script also sets the directory to install WebSphere Application Server Liberty profile and IBM Java SDK. The script interacts with the following files: v configuration/environment/http-server.properties v configuration/environment/i2analyze/environment.properties v configuration/environment/topology.xml v db2jcc4.jar Note: The default values for DB2 assume that you are using DB If you are not using DB2 10.5, you must manually set the DB2 properties and copy the db2jcc4.jar file. For more information, see Providing a JDBC driver on page 22. Procedure 1. To change the database management system, copy the version of topology.xml that is specific to the database management system you are using from the examples directory into toolkit/configuration/environment. The topology files Chapter 6. Example deployments 21

26 are in the following location: toolkit/configuration/examples/topology/ database management system type/topology.xml. If you are using Oracle, you must populate the instance-name attribute. 2. On the i2 Analyze server, at a shell prompt, navigate to toolkit/scripts. 3. To set the default values, run the following command:./setup -t generatedefaults 4. Check the default values in each file to ensure that they match your environment, and modify them if required. What to do next Before you deploy i2 Analyze, you must complete the instructions in Specifying credentials. Providing a JDBC driver The application server requires a JDBC driver to enable communication with the database. If you provide the driver to the deployment toolkit, the toolkit can deploy it to the correct location in i2 Analyze. Before you begin You must have created the configuration directory according to the instructions in Creating the configuration directory on page 20. About this task Depending on the type of database management system that you have installed, the steps for providing a JDBC driver differ. Select the steps that relate to the database management system that you have installed. Procedure 1. Locate the JDBC driver for your database management system. v v If you are using DB2, locate the /opt/ibm/db2/db2 version/java/db2jcc4.jar file. If you are using Oracle, locate the /app/oracle/product/11.2.0/dbhome_1/ jdbc/lib/ojdbc6.jar file. 2. Copy the relevant driver file for your database management system to the toolkit/configuration/environment/common/jdbc-drivers directory. 3. Optional: To use a JDBC driver.jar file that has a custom name, you must add the following attribute to the <database> element in your topology.xml file: jdbc-driver="custom_name.jar" Where custom_name is the name of the.jar file in the toolkit/configuration/ environment/common/jdbc-drivers directory. Specifying credentials To allow the deployment toolkit to set up authentication across the system, you must provide user names and passwords. You provide the user names and passwords in the credentials.properties file. 22 Linux Deployment Guide

27 About this task For each database that is identified in topology.xml, you must specify a user name and a password in the credentials.properties file. The setup script uses this information to authenticate with the database. When you deploy i2 Analyze, the passwords in the credentials.properties file are encoded. The credentials.properties file stores database credentials in the following format: db.identifier.user-name=user name db.identifier.password=password The name of each database credential has three parts, two of which are variable: Part identifier user-name or password Description The database identifier Indicates whether the value is a user name or a password For example: db.write1.user-name=admin db.write1.password=password In addition to the database credentials, you also need to provide a value for the ltpakeys.password property. This value is used by the system to encrypt LTPA tokens. v For a standalone deployment of i2 Analyze, you can specify any value as the password v For a deployment of i2 Analyze that uses LTPA tokens to authenticate with other systems, you must specify the same password that those systems use Procedure The deployment toolkit includes an example credentials.properties file that contains blank placeholders for a standard deployment of i2 Analyze. 1. Optional: Add blank placeholders for the credentials required for each component that is defined in topology.xml to the credentials.properties file through the setup script: a. Open a command prompt, and navigate to toolkit/scripts. b. Run the following command to add the blank credentials:./setup -t generatecredentialsfile 2. Using a text editor, open the toolkit/configuration/environment/ credentials.properties file. 3. Enter the user name and password to use with the database. Note: The user that you specify must have privileges to create and populate databases in the database management system. 4. Enter a value for the ltpakeys.password property. 5. Save and close the credentials.properties file. Chapter 6. Example deployments 23

28 Results The credentials.properties file is now ready for use by the setup script. Deploying an example deployment Deploy an example i2 Analyze deployment. Successfully deploying the example indicates that the prerequisites are configured correctly, providing a level of confidence before you can carry out further customization. In addition, an example deployment can also be used to investigate the features of i2 Analyze. Before you begin You must have a valid credentials.properties file according to the instructions in Specifying credentials on page 22. About this task To deploy an example, the setup script performs the following actions: v Sets the default property values. v Deploys i2 Analyze. v Creates and populates an example WebSphere Application Server Liberty profile basic user registry. Procedure 1. On the i2 Analyze server, at a shell prompt, navigate to toolkit/scripts. 2. To deploy the example, run the following command:./setup -t deployexample 3. To start the WebSphere Application Server Liberty profile server, run the following command:./setup -t startliberty 4. Start, or restart, the HTTP server that hosts the reverse proxy. Results The i2 Analyze example deployment is complete. To test the platform, log in to i2 Analyze through the Intelligence Portal as the example user by following the instructions in Opening the Intelligence Portal on page 45. What to do next Configure the example deployment to match your organizational needs. At a minimum, complete the following steps: v Create a security schema for your environment v Set the default permissions for new items v Select or create a schema and charting scheme for your data v Configure the global application properties for your environment v Redeploy i2 Analyze v Configure WebSphere Application Server Liberty profile security for your environment 24 Linux Deployment Guide

29 A deployment can be further configured in many ways, including the following: v Use a different database management system v Configure the prerequisites in different ways v Change the deployment language v Configure single sign-on Chapter 6. Example deployments 25

30 26 Linux Deployment Guide

31 Chapter 7. Configuring i2 Analyze Configuring the environment Configure the environment and the i2 Analyze application for your test and production systems. Complete any configuration changes from the example deployment to the test or production systems. The i2 Analyze deployment toolkit automates many of the tasks that are typically involved in installing and configuring web applications. To perform these tasks, the toolkit requires information about the environment into which you are deploying i2 Analyze and settings for the Analysis Repository. About this task The following sections describe how to modify the configuration of a deployment. Change any settings that differ between the example deployment, and your test or production environment. Optional: Setting the IBM HTTP Server properties The script in the deployment toolkit that deploys i2 Analyze requires information about your IBM HTTP server. The values that describe your IBM HTTP server must be present in the http-server.properties file in the configuration/ environment directory. About this task You can change any property values in http-server.properties from the default values. The values are configured by using the instructions in Generating the default values on page 21 and can then be edited as required. Procedure 1. Using a text editor, open the http-server.properties file. You can find this file in the following location: toolkit/configuration/environment. 2. Using the descriptions in the file, ensure that the property values for the HTTP Server in your environment are correct. 3. Save and close the file. Optional: Setting the i2 Analyze environment properties The script in the deployment toolkit that deploys i2 Analyze requires information about your application server, your database, and some other system components. The values that describe your environment must be present in the environment.properties file in the configuration/environment/i2analyze directory. About this task You can change any property values in environment.properties from the default values. The settings are configured according to the instructions in Generating the default values on page 21 and can then be edited as required. Copyright IBM Corp. 2012,

32 Procedure 1. Using a text editor, open the environment.properties file. You can find this file in the following location: toolkit/configuration/environment/i2analyze. 2. Using the descriptions in the file, ensure that the property values for the application server, the data directory, and the web help, match the values that you would like to use. Note: The deployment script uses these properties for setting up the environment and creating the i2 Analyze application. As such, the values of these properties can overwrite values that are stored in other files. 3. Save and close the file. Specifying the deployment structure In the deployment toolkit, the topology.xml file contains information about the physical architecture of i2 Analyze. The topology.xml file contains the information that the setup script requires to identify the prerequisites that are being used, where the system stores information, and the fragments to combine to create the application. About this task When you deploy i2 Analyze, you must identify the host name of your server, and the location to store search index information. The values for the host name and search index location can be configured according to the instructions in Generating the default values on page 21 or manually by using the following information. Note: The topology.xml file can be extended to include extra data sources and custom applications. More information on the topology can be found in Appendix A. The topology. Procedure 1. Optional: To change the database management system, copy the version of topology.xml that is specific to the database management system you are using from the examples directory into toolkit/configuration/environment. The topology files are in the following location: toolkit/configuration/examples/ topology/database management system type/topology.xml. 2. Using an XML editor, open toolkit/configuration/environment/topology.xml. 3. Populate the host-name attributes of the following elements: Element database application Attribute values Specify the host name of the server that is being used to store the WriteStore database. By default, the value is the name of the local host. Note: The instance name should also be updated to match your deployment. Specify the host name of the server for i2 Analyze. By default, the value is the name of the local host. 28 Linux Deployment Guide

33 For example:... <databases> <database dialect="db2" xa="true" instance-name="db2inst1" database-name="writesto" database-type="writestore" id="write1" host-name="host" port-number="50000" max-pool-size="5" /> </databases> <applications> <application name="i2analyze" host-name="host" http-server-host="true"> Optional: In the <lucene-index> element, set the full paths to the locations where i2 Analyze stores the main search index and the alternative terms. By default, the values are:... <lucene-indexes> <lucene-index id="ar" main-index-location="opt/ibm/i2analyze/data/ar/main_index" alternatives-location="opt/ibm/i2analyze/data/ar/alternatives" /> </lucene-indexes>... Note: Ensure that all file paths use forward slashes (/). 5. Save your changes and close topology.xml. Results Your topology file is now ready to deploy i2 Analyze with an English locale that uses the default alternative term index. What to do next Configuring the applications Depending on your requirements, you can continue with your deployment with the specified structure. Alternatively you can customize your topology in one of the following ways: v To change the locale of your index, see Specifying the index language on page 61 v To change the default terms in the index, see Creating a custom alternative term index on page 59 In a test or production deployment, before you deploy i2 Analyze, you must specify the security mechanism. A schema and charting scheme can be specified before the deployment, or created afterwards by using Analysis Repository Schema Designer. Chapter 7. Configuring i2 Analyze 29

34 About this task The deployment toolkit stores information for and about the instance of i2 Analyze that you are deploying in the toolkit/configuration/fragments directory. This location contains further directories that hold application configuration information, and a common directory that stores files that are used across the system. Specifying a security schema The security mechanism that IBM supplies with the deployment toolkit can associate application server users with their ability to view and edit items in i2 Analyze. To define the details of this association, you must create and deploy a security schema. About this task An i2 Analyze security schema defines the security dimensions that exist in a deployment, and the security permissions that can be assigned to users. When you deploy i2 Analyze with the supplied security mechanism, the group names in your security schema must match the names of user groups in the user repository. Note: The IBM i2 Analyze Security White Paper contains more information about the security model, the security schema, and the permission changes that are possible on a deployed platform. Procedure 1. Navigate to the directory that contains the security schema for the deployment: toolkit/configuration/fragments/common/web-inf/classes. 2. Make a copy of the example-dynamic-security-schema.xml file in the same location, and name it security-schema.xml. 3. Using an XML editor, open security-schema.xml. 4. Edit the example security schema so that it matches your security model, and so that the names of the groups it contains match the names of WebSphere Application Server Liberty profile user groups. Note: The Level attribute of the <Permission> element must be in uppercase. The following are the allowed values: v v v READ_CLOAKED READ_ONLY UPDATE 5. Each time that you make any changes to the AccessSecurityDimensions and GrantSecurityDimensions in the security schema, you must increment the Version attribute value before you redeploy i2 Analyze. After you redeploy i2 Analyze, when you start the server the following message is displayed: # Security Schema amended (core) Note: Changes to the SecurityPermissions do not need the Version number to be incremented. 6. Save and close the file. 30 Linux Deployment Guide