Policies

Last updated
Save as PDF

Policy Concepts

This section describes Ops Center Protector's policy management features.

For further information, refer to:

Policy Tasks
Policies UI Reference

About policies

A Policy consists of Classifications that specify what data is to be protected and Operations that specify how that data is to be protected.

Physical classifications specify the data by directly naming the path, logical device/volume or disk type to be protected, whereas Application classifications specify the data indirectly by naming the application instance such as databases or virtual machines to be protected, Ops Center Protector then discovers the volumes that the application's data resides on. The following table shows which classifications can be used in conjunction with a particular type of source node.

Classifications vs. Source Node Types
Source Node Type	Policy Classifications
Source Node Type	^{Oracle Database}	^{Oracle RMAN}	^{Disk Type}	^Block	^Path
OS Host			Yes		Yes
Oracle	Yes	Yes
VMware		Yes
Hitachi Block Device				Yes
Hitachi Logical Block Device
Hitachi Block Host				Yes
Generation 1 Repository	A Generation 1 Repository can act as a source node in a cascaded data flow, where one generation 1 repository is backed up to another generation 1 repository. The policy classification is effectively the same as the one applied to the original data source in the cascade.
Generation 2 storage nodes (HCP, Amazon S3 and Repository)	Can act as a source node in a cascaded data flow, where one generation 2 node is backed up to another generation 2 node. The policy classification is effectively the same as the one applied to the original data source in the cascade

The Operations in a policy define the methods to be used to create backups of the primary data. Operations can be implemented using Protector software methods (e.g. Backup), or by orchestrating the hardware storage devices (e.g. Hitachi Block) to implement operations in hardware (e.g. Thin Image and Universal Replicator). The following table shows which operations can be used in conjunction with a particular type of source or destination node.

For example: from the table below we can see that an OS Host node can act as the Source (S) for a H/W based Replicate operation, and that a Block Device node can act as the Destination (D).

Node Types vs. Operation Types. (Key: S=Source node for the operation, D=Destination node for the operation)
Node Type	Policy Operations
	Backup	Access	Replicate		Mount	Snapshot
	S/W	S/W	S/W⁽¹⁾	H/W	S/W⁽²⁾	H/W⁽³⁾	H/W
OS Host	S			S		S	D
Oracle		S		S		S	D
VMware	S			S		S
Hitachi Block Device				S or D		S
Hitachi Logical Block Device				S or D		S
Hitachi Block Host				S		S
Repository	S or D
HCP	S or D
Amazon S3	S or D
⁽¹⁾	^{(2) Software Replication is not currently supported.} ^{(3) Software Snapshot is not currently supported.} ^{(4) Snapshots are local operations, so the source is always the same as the destination on a data flow.}

Operations defined in a Policy work in conjunction with Movers placed on a Data Flow. When a policy is assigned to a source node, all the operations in that policy are assigned to that node. The policy is then routed by a mover and the contained operations assigned to one or more destination nodes. The following table shows which operations can be used in conjunction with a particular type of mover:

Operation Types vs. Mover Types
Policy Operation	Implementation	Batch Mover	Continuous Mover
Backup	Software	Scheduled or on-demand incremental backups are created on a repository HCP or Amazon S3 node, based on RPO.	N/A
Replicate	Software	Not supported.	N/A.
Replicate	Hardware	Hitachi Block: Scheduled or on-demand replicas of the P-VOL are created on an S-VOL using Refreshed Thin Image, ShadowImage, TrueCopy or Universal Replicator.	Hitachi Block: Live changes to the P-VOL are replicated to an S-VOL using ShadowImage, Universal Replicator or Global-Active Device.
Snapshot	Software	Windows: Not currently supported.	N/A
	Software	Linux/AIX: Not currently supported.	N/A
	Hardware	Hitachi Block: Scheduled or on-demand local snapshots are created using Thin Image. The batch mover is implied but not shown on the data flow since the operation is local to the storage device.	N/A
Mount	Hardware	Automatically mounts a Hitachi Block LDEV based on a schedule. The mounted LDEV can then be used for repurposing or proxy backup.	N/A

About policy classifications

A Classification specifies what data is to be protected either by directly identifying files or volumes, or indirectly by specifying application level objects such as databases or datastores.

Protector resolves a classification down to a unit of data appropriate to the underlying storage device type.

For a host based backup, the classification is resolved down to disk data blocks where the data being protected resides and it is changed disk data blocks that are recorded in the repository.
For block storage based backup, the classification is resolved down to LDEVs and it is entire LDEVs that are replicated or snapshotted.

A classification is resolved when a data flow that implements a policy is first activated, when it is re-activated while currently active and possibly when re-triggered. It is important to understand the behaviour when classification resolution results in changes to the set of underlying data units being backed up.

For a classification that is applied to a host based backup operation, when resolution alters the files included in the backup then:

Any files that remain in the backup are unaffected and continue to be backed up as before.
Any files that are newly included are added to the backup.
Any files that are no longer included remain in the backup, but changes to them are no longer recorded in the repository.

For a classification that is applied to a block storage device backup operation (snapshot or replication), when resolution alters the LDEVs included in the backup set then:

Any LDEVs that remain in the backup set are unaffected and continue to be backed up as before.
Any LDEVs that are newly included are added to the backup set, pairings are created with the respective S-VOLs.
Any LDEVs that are no longer included are removed from the backup set, their pairings are torn down and the respective S-VOLs are deleted.
NoteThis behaviour differs from the case when deactivating a data flow, where the entire backup set is torn down but the S-VOLs are left in place as static copies.
NoteFor Global-Active Device, when a Thin Image snapshot, Refreshed Thin Image, ShadowImage or Universal Replicator replication is taken from the GAD S-VOL, the GAD S-VOL cannot be deleted.

About VMware policy classifications

When items are added to the inclusion or exclusion lists displayed in the VMware Classification Wizard, the VMware Resource Selection Wizard is launched. This wizard enables virtual machines and templates to be selected based on the VMware inventories in which they appear in vSphere, or by pattern matching of VMware container object name, virtual machine name or template name. The list of VMs and templates included in the classification is evaluated at different times depending on how they are specified:

Evaluation is done only once (i.e. when the data flow implementing the policy is compiled), if VMs and templates are:
- Explicitly selected from a list or inventory tree.
- Specified using their full name (i.e. without using wildcards, e.g. Sales_SQLServer).
Evaluation is done every time the operation is triggered, if VMs and templates are:
- Implicitly selected using a container object (folder, host, cluster, datastore, resource pool, datacenter, or vApp).
- Selected using a tag defined in vSphere.
- Specified using a name pattern (i.e. using wildcards, e.g. Sales_Client*).
TipWith this method of classification, VMs will be automatically added to the backup (without reactivating the data flow) when they are added to a container, assigned the appropriate tag or given a name that matches the defined pattern. For continuous replications it will be necessary to trigger the relevant operation to cause re-evaluation.

Every VMware object selected in the classification is resolved to a list of VMs and templates. For example, when selecting a datastore, all the VMs and templates that are in that datastore are selected. If any included VMs and templates reference VMDKs located in another datastore, these will be selected too. This ensures that VMs and templates that are backed up can be fully restored.

Backup behaviour differs depending on the type of operation the VMware classification is combined with in a policy.

For host based Backup operations, the VMware files that record each selected VM's state (system configuration, virtual hard disk configuration and virtual hard disk data) are backed up as dictated by the policy's operation(s). If a VM contains RDM storage then:

Physical compatibility mode RDM disks are not backed up because they are not included in a VMware snapshot.
Virtual compatibility mode RDM disks are backed up.

For block based Snapshot and Replicate operations, the datastores that contain the selected VMs are identified. Those datastores that reside on Hitachi Block storage are then resolved down to their underlying LDEVs and are snapshotted/replicated as dictated by the policy's operation(s).

If the VM contains physical or virtual compatibility mode RDM storage, the backup operation will continue without backing up the RDM storage and the following warning will be logged:
VM: <VM_NAME>. Contains a RawDiskMapping (RDM). This RDM storage won't be backed up.
If the VM contains Passthrough storage, the backup operation will continue without backing up the passthrough storage and the following warning will be logged:
VM: <VM_NAME>. Contains <TYPE> Passthrough storage. This Passthrough storage won't be backed up.
If the VM has a dependency on a non-VMFS datastore (i.e. one that is not located on a block storage device), then:
- If no VMDKs for the VM are present in the non-VMFS datastore, the backup operation will continue and the following warning will be logged:
  VM contains non-VMFS datastore '<DATASTORE_NAME>', which won't be backed up.
- If VMDKs for the VM are present in the non-VMFS datastore, the backup operation will be aborted and the following error will be logged:
  The following non-VMFS datastores contain VM disks which won't be backed up: <LIST OF NON-VMFS DATASTORE NAMES WITH VMDKS>.

TipAny RDM storage that cannot be protected by a VMware classification can be backed up using a separate Physical classification if appropriate.

About Hyper-V policy classifications

The Hyper-V policy classification defines which virtual machines will be protected to which level of consistency as part of a policy.

When items are added to the inclusion or exclusion lists displayed in the Hyper-V Classification Wizard, the Hyper-V Resource Selection Wizard is launched. This wizard enables virtual machines to be selected based via browsing, or by pattern matching of virtual machine name, configuration path or host running the VM.

The list of VMs included in the classification is evaluated at different times depending on how they are specified:

Evaluation is only performed once, when browsing and selecting the virtual machine directly.

Evaluation is done every time the operation is triggered if VMs are:

Implicitly selected using a virtual machine location (path) or virtual machine host (hypervisor)
Specified using a name pattern (i.e. using wildcards, e.g. Sales*)

TipWith this method of classification, VMs will be automatically added to the backup (without reactivating the data flow) when they are added to a selected path or host or given a name that matches the defined pattern. For continuous replications it will be necessary to trigger the relevant operation to cause re-evaluation

Every Hyper-V object selected in the classification is resolved to a list of VMs. For example, when selecting a virtual machine location, all VMs with configurations in that location are selected. If any included VMs utilize additional paths, these will be added too. This ensures that backed up virtual machines can be fully restored.

TipUse the preview selection functionality of the Hyper-V Classification Wizard to preview which VMs will be included for a given Hyper-V Node based on the provided inclusion and exclusion lists.

Virtual machine consistency

The consistency of virtual machine backups differs based on the consistency level chosen in the policy. Before the block-based backup is performed Protector will create a checkpoint for every virtual machine.

Application consistent checkpoints will use Hyper-V integration services to quiesce the data inside the VM. In case of Windows VMs, Protector will utilize VSS within the virtual machine to save application and filesystem data to disk. For Linux, the Hyper-V integration will request a quiesce, however usually this will only cause the filesystem buffers to be saved to disk. If an application consistent VM checkpoint cannot be created, Protector will create a crash consistent checkpoint instead.

Crash consistent checkpoints will create a checkpoint of the virtual disks as they are.

About Microsoft SQL Server Policy Classifications

The Microsoft SQL Server policy classification defines which databases will be protected and with what impact to the differential base.

Adding the classification starts the Microsoft SQL Server Classification Wizard. Once the source Microsoft SQL node has been selected, databases can be added using the Microsoft SQL Server Database Selection Wizard.

The Backup mode selection defines if the snapshot or clone will be recognized as a full backup by the SQL Server or if it should just be a copy which does not affect the differential base. In both cases, Protector will protect the complete database as well as the current log files and will represent the database at the point in time of the snapshot or clone creation.

It is not possible to backup only the transaction logs. Use the “BACKUP LOG” SQL command or a 3rd party tool to protect your transaction logs. Protector’s file system backups can help to store the files safely in the datacenter or cloud.

TipKeep in mind Microsoft SQL Server requires that at least a single full backup before transaction log backups can be performed.

About path macros

Path macros are used to define paths when constructing a policy.

There are occasions where it is desirable to define paths logically when constructing a policy, knowing that only the source machines that will receive the policy can actually determine where those paths should really be on the local system. For example, all the fixed drives or the Exchange directory, as these can differ from machine to machine.

Ops Center Protector facilitates this requirement by allowing the use of macros when defining paths. These macros are placed in a path name using the syntax $[MACRO_NAME], and are resolved during initial data flow activation and on-going rules updates on each source machine. They are resolved by looking up the macro name in a macros.cfg file stored on each source machine in C:\Program Files\Hitachi\Protector\db\config\.

Entries within macros.cfg are given in the form:

keyword=path

For example:

files=c:\files

To use this macro, $[files] would be entered in either the Include or Exclude list for a Path classification. Note that macros can be combined with normal text, so that $[files]\subdirectory would be a valid entry. If the macro is defined with a trailing slash, ensure it is not combined with another slash when combining it with plain text.

Caution Macro substitution is case sensitive. Ensure the case of macros in each macros.cfg file matches the case of macros when used to define a policy.

Multiple paths can be assigned to a single macro by delimiting each path with a semi-colon (;), as so:

keyword=path_1;path_2;path_3

About application quiescing

Ordinarily, when a backup is performed, the state of the backup consists of the exact state of the file system at the point in time at which it was triggered. This can be problematic when the backup is eventually restored, since some applications that were running at the time cannot, for example, have flushed all their in-memory file buffers, and their data files on disk could therefore be in an inconsistent state.

To resolve this, it is possible to request certain applications to quiesce into a safe state prior to a backup being triggered, and then to restore their previous active state after the backup is triggered. This ensures their state during the backup is consistent and that they can run as expected if the backup is restored. The quiesce option applies to classifications containing:

File system data - where those policies are implemented on Windows source nodes.
Applications - where the application type is supported by Protector.
VMware VMs - where those virtual machines are running Windows, are online and running VMware tools.

If an application cannot be quiesced then a snapshot of its files is said to be in a crash-consistent state, as if the application had crashed while running. Crash consistent backups can, depending on the application, be used to restore state to some point prior to the backup.

Ops Center Protector includes built-in classifications that enable specific application types to quiesce into a consistent state prior to a Ops Center Protector Backup being triggered. This is done by selecting the Quiesce configured applications before backup check box in the backup operation's attributes. When a backup is triggered in a data flow that makes use of this policy, the resulting backup will contain a quiesced version of the application’s files.

If other applications, not directly supported by Protector, need to put themselves into a certain state prior to a backup operation, pre and post scripts can be run during the backup cycle. This is done by selecting the Pre script and Post script check boxes in the backup operation's attributes, and then supplying the names of appropriate script files. This script file must be present on the source node that implements the policy and must be placed in the Protector scripts directory (C:\Program Files\Hitachi\Protector\scripts is the Windows default).

About synchronization groups

The purpose of synchronization groups is to ensure that, if required, multiple hardware snapshots or batch hardware replications of source data can be created on multiple nodes using the same schedule and yet remain consistent with each other and with the source data.

To this end any two operations in the same policy using the same schedule name will be placed in the same synchronization group. When a hardware snapshot/replication data flow is created, any nodes implementing operations using that synchronization group will be scheduled all as one.

Note

The RPO of all hardware snapshot operations in the same synchronization group must be identical. The rules compiler checks the RPO settings and if inconsistent generates error 10356: Policy policy contains multiple hardware snapshot operations with different RPO settings but all use schedule schedule

In a simple case of a cascaded batch data flow (i.e. Node A --> Node B --> Node C), where Nodes B and C both implement a hardware replication operation within the policy, then if both those operations share the same schedule name, they will both be part of the same synchronization group and be scheduled as one. This ensures that the replica of Node B that is created on Node C is created only when the replica of Node A created on Node B has been completed and so the replicas on Nodes B and C remain identical.

When mixing live and batch data flows or implementing different synchronization groups (schedules) at different points of the data flow, then the basic rule for these is that any operation is traced back towards the source, and if an operation sharing the same synchronization group is implemented on an immediately preceding node, then they will be scheduled together by the first preceding node that does not use that synchronization group. Note that live replications are considered to be in all synchronization groups since they should always match the source.

Where synchronization groups are not in use, replicate operations are scheduled on the sending node and snapshot operations are scheduled on the destination node.

About the automated Mount operation

The automated Mount policy operation provides a mechanism for mounting a Hitachi Block based snapshot or replication to a host machine so that the mounted volume can be used for repurposing or proxy backup to another medium (e.g. a Protector repository). The mount operation can be scheduled to occur at the desired phase relative to other operations in the policy. The computing load of repurposing or backup processing is offloaded to the host where the volume is mounted. The sequencing of the mount operation is dependent on the type of mount selected when the policy is assigned on the data flow:

Repurpose - the volume remains mounted but is periodically unmounted, re-evaluated, then remounted. See About the repurposing mount sequence.
Proxy Backup - the volume remains unmounted but is periodically mounted, the backup process run, then the volume is unmounted. See About the proxy backup mount sequence.

About the repurposing mount sequence

NoteRepurposing is not valid for continuous replications.

In this scenario the replication destination remains mounted on the mount host and is available to the repurposing application. The replication is, depending on the schedule, periodically unmounted, re-evaluated then remounted. The actual sequence is as follows:

The Before Unmount script (specified in the Mount Operation Wizard) is invoked on the mount host. The script would typically stop any applications from accessing the repurposed volumes while they are being re-evaluated.
The replicated volumes are unmounted from mount host.
The replication is resumed, re-evaluated and then paused again.
The updated volumes are remounted to the mount host.
The After Mount script is invoked on the mount host. The script would typically restart any applications accessing the repurposed volumes.

When repurposed volumes are subsequently unmounted by the user, the replication operation is automatically resumed.

About the proxy backup mount sequence

Proxy backup is valid for live and batch backup. In this scenario the replication destination is mounted, work performed on it and then unmounted. The actual sequence is as follows:

The replication is re-evaluated.
If the replication is live then it is paused.
The updated replicated volumes are mounted on the mount host.
The After Mount script (specified in the Mount Operation Wizard) is invoked on the mount host. This script would typically cause the proxy backup to run, calling out to a third party backup product or invoke a Protector backup using a trigger schedule.
The Before Unmount script is invoked on the mount host. This script may be omitted.
The replicated volumes are unmounted from mount host.
If the replication is live then it is resumed.

Policies UI Reference

This section describes the Policies UI, accessed via the Navigation Sidebar.

For further information, refer to:

Policy Concepts
Policy Tasks

Policies Inventory

This inventory lists all defined Policies. Each policy consists of a set of data classifications defining what to backup and a set of operations defining how to backup that data.

Control	Description
Edit	Edits an existing policy in the inventory. The Policy Wizard is launched to enable the policy's attributes to be changed.
Tag	Modifies the tags of an existing object from the either the inventory screen or the details screen of the object.
View Permissions	View an existing policy's access permissions. The Access Control Permissions Inventory is launched to enable the policy's access permissions to be read/view only.
Delete	Enabled only when one or more Policies are selected. Deletes the selected item from the inventory. The associated Classifications and Operations are also deleted.
Add	Creates a new Policy. The Policy Wizard is launched to guide you through the process.
Policy	Any number of user defined Policies can be created. These are displayed in the inventory. The Policy Details is displayed to enable the policy to be viewed and edited.
Filter on Policy Name	Filters the displayed results based on the policy name.
Filter on Data Classification	Filters the displayed results based on classification type.
Filter on Operations	Filters the displayed results based on operation type

Policy Wizard

This wizard is launched when a new Policy is added to the Policies Inventory.

A Policy consists of the following parts:

One or more Data Classification items that define what type of data is to be backed up.
- Path and Disk Type classifications can also have additional Age, File Type and OS Type Filters applied to them.
One or more Operation items that define what action is to be performed on that data.

Note

If the policy is in use in the current data flow definition, any modifications made to the policy only take effect following recompilation and reactivation of the affected data flows. If data operation items have been added or deleted, it may be necessary to first modify the data flow definition to take account of these changes before it is recompiled and reactivated.
If a policy using the Replicate, CDP or Backup data operations has any part of its data classification changed, then all destination nodes for that policy need to be re-synchronized to include the change in scope of the policy.

Policy Wizard - Specify name and description

Control	Description
Name	Enter a name for the policy.
Description	Optional. Enter a short description of the policy.
Tags	Add the tags to be associated with the object being created.

Policy Wizard - Allocate policy to Resource Group

Control	Description
Resource Groups	It allows the user to view the access permissions for those items granted to specific users and groups. NoteA single policy can be assigned to multiple resource groups.

Policy Wizard - Classifications Inventory

Control	Description
Edit	Edits an existing classification in the inventory. The relevant Classification wizard is launched to enable the classification's attributes to be changed.
Delete	Deletes the selected item from the inventory.
Add	Creates a new Classification. The Classification Selection page (shown above) of this wizard is reopened to enable other classifications to be added to the policy.
Classification(s)	Any number of Classifications can be created. These are displayed in the inventory. The appropriate classification wizard is displayed to enable the classification to be viewed and edited.
Edit Filters	Launches the Classification Filters Wizard to enable you to add Filters to the classification.

Policy Wizard - Select Classification (Application)

Each Application Classification Type defines a specific set of criteria for selecting data related to a specific application. For example, the Oracle type can be used to select data related to a specific Oracle database.

Control	Description
Microsoft SQL Server Database	Adds a Microsoft SQL Server Database classification to the policy. The Microsoft SQL Server Classification Wizard will be launched to guide you through the process.
Ops Center Application	Adds an Ops Center Application classification to the policy. The Ops Center Classification Wizard will be launched to guide you through the process.
Oracle Database	Adds an Oracle Database classification to the policy. The Oracle Database Classification Wizard will be launched to guide you through the process.
Oracle RMAN Database	Adds an Oracle RMAN Database classification to the policy. The Oracle RMAN Classification Wizard will be launched to guide you through the process.

Policy Wizard - Select Classification (Physical)

Each Physical Classification type defines a specific set of criteria for selecting data on a node’s file system. For example, the Path type can be used to select data by its folder location.

Control	Description
Disk Type	Adds a Storage Type classification to the policy. The Disk Type Classification Wizard will be launched to guide you through the process.
Hitachi Block	Adds an Hitachi Block classification to the policy. The Hitachi Block Classification Wizard will be launched to guide you through the process.
Path	Adds a Path classification to the policy. The Path Classification Wizard will be launched to guide you through the process.

Policy Wizard - Select Classification (Hypervisor)

Each Hypervisor Classification Type defines a specific set of criteria for selecting data related to a specific hypervisor. For example, the VMware type can be used to select virtual machines on an ESXi Server.

Control	Description
Hyper-V	Addsa Hyper-V classification to the policy. The Hyper-V Classification Wizard will be launched to guide you through the process.
VMware	Adds a VMware classification to the policy. The VMware Classification Wizard will be launched to guide you through the process.

Each Operation Type represents an action that can be performed on data that matches the classification. For example, Snapshot can be used to create a point in time copy of the data specified by a Hitachi Block Classification.

Control	Description
Backup	Adds a backup operation to the policy. The Backup Operation Wizard will be launched to guide you through the process. Note This operation cannot be applied to hardware storage devices.
Mount	Adds a mount operation to the policy. The Mount Operation Wizard will be launched to guide you through the process.
Replicate	Adds a replication operation to the policy. The Replicate Operation Wizard will be launched to guide you through the process.
Snapshot	Adds a snapshot operation to the policy. The Snapshot Operation Wizard will be launched to guide you through the process.
Tier	Adds a tier operation to the policy. The Tier Operation Wizard will be launched to guide you through the process.

Policy Wizard - Add one or more Operations

Control	Description
Edit	Edits an existing operation in the inventory. The relevant Operation wizard is launched to enable the operation's attributes to be changed.
Delete	Enabled only when one or more Operations is selected. Deletes the selected item from the inventory.
Add	Creates a new Operation. The Operation Selection page of this wizard is reopened to enable other operations to be added to the policy.
Operation(s)	Launches the appropriate operations wizard to enable the operation to be viewed and edited.

Microsoft SQL Server Classification Wizard

This wizard is launched when a new MS SQL Server classification is added to a Policy.

This wizard is launched when a new Microsoft SQL Server Database classification is added to the policy.

The Microsoft SQL Server Database classification conveniently specifies which should be included in a backup. Refer to About Microsoft SQL Server Policy Classifications for details on how this classification works.

Microsoft SQL Server Wizard - Specify Microsoft SQL Server classification attributes

Control	Description
Node	Select the Microsoft SQL Server node you want to protect with this classification.
Instance	Select the SQL Server instance, hosting the databases you want to protect. This control is not available when an SQL Server Availability Group Node is selected.
User	List the user which will be used to protect the instance. Editing the credentials will open the Microsoft SQL Server Instance Credentials Dialog SQL Server Instance Credentials Dialog.
Included Items	Lists the databases which will be included in the backup.
Add	Opens the Microsoft SQL Server Database Selection Wizard, which allows databases to be added to the Included Items list above.
Backup Mode	Select which backup type is desired for the selected databases: Full backup Create a point in time copy of the complete database. Copy Only Create a point in time copy of the complete database. Does not affect sequencing of differential backups or transaction logs.
Replica Backup Preference (Availability Group only)	Selected Replica Select a specific replica (instance) as a source for the backup, irrespective if it is currently acting as a primary or a secondary replica. This option ensures that backups are always created on the same storage. Primary The primary replica at the time of the backup will be used to protect the databases of the availability group. Ensure that all possible storage arrays are configured on the data flow, as the location of the primary replica may change over time. SQL Server preference The SQL Server's Availability Group preference will be honored and used as the source for the backup. Ensure that all possible storage arrays are configured on the data flow if the SQL Server backup preference allows for more than one replica to become the preferred backup source.

Microsoft SQL Server Database Selection Wizard

This wizard is displayed when the user chooses to include database in a Microsoft SQL Server classification.

Control	Description
Search	Enter a part of a database name and confirm to filter the list of known databases
Database List	Select one or more databases Note Do not select databases which are temporarily mounted by Protector. Including mounted databases in backups may cause problem during backup or when you try to unmount the database.

Microsoft SQL Server Instance Credentials Dialog

This dialog allows the user to specify which credentials should be used when protecting an instance

Control	Description
Authentication Mode	Lists the required account type.
Username	Specify the user which should be used to protect the databases of this instance. Use the format <NETBIOS DOMAIN NAME>\<username>. Refer to Microsoft SQL Server User Privileges for more details.
Password	Password for the user specified above

Microsoft SQL Server User Privileges

To create, mount or revert block-based Microsoft SQL Server backups Protector requires credentials with the necessary permissions.

The user account must meet the following requirements:

Windows account
Member of the sysadmin role for the SQL Server instance

Ops Center Classification Wizard

This wizard is launched when a new Ops Center Application classification is added to a Policy. The Ops Center classification is used to define which applications are to be protected.

NoteOps Center Classification Wizard allows to backup only the master node at present

Ops Center Wizard - Specify Ops Center Applications attributes

Control	Description
Included Items	Lists the Ops Center resources that will be included in the backup policy.
Add	Opens the Ops Center Application Selection Wizard to enable Ops Center resources to be added to the include list above. NoteOnly Ops Center Protector Master node can be backed up currently.
Excluded Items	Lists the Ops Center resources that will be excluded from the backup policy.
Remove	Each row has a remove button at the end of the row, the selected Ops Center resource is removed from the include/exclude list.
Add	Opens the Ops Center Application Selection Wizard to enable VMware resources to be added to the exclude list above.

Ops Center Application Selection Wizard

This wizard is displayed when the user includes or excludes Ops Center resources in a policy.

Ops Center Applications Selection for Inclusion/Exclusion Wizard

Control	Description
Available Applications	Select the Ops Center application you want to protect with this classification.

Oracle Database Classification Wizard

This wizard is launched when a new Oracle Database classification is added to a Policy.

The Oracle Database classification is used to define which databases are to be protected.

NoteWhen used in combination with a storage hardware backup operation, Protector will discover the underlying hardware paths at runtime. For Hitachi Block storage hardware based backups, all the paths must exist on the same block hardware device.

Oracle Database Wizard - Specify Oracle Database classification attributes

Control	Description
Databases	Lists the currently selected databases. Only the databases listed are backed up. For block based policies - Databases are discovered only once, when the policy is defined. For host based policies - This classification is not currently supported.
Select Database	Click to open the Select Database dialog shown below.
Backup Mode	Select one of the following: Online – Available only if Oracle Database is running in `ARCHIVELOG` mode. Oracle is briefly quiesced while an application consistent snapshot is made. Offline – Available always. Oracle is taken offline while an application consistent snapshot is made. Crash Consistent – Available only in Version 12c and if Oracle Database is running in `ARCHIVELOG` mode. Oracle remains running while a crash consistent snapshot is taken. Note If the Backup Mode is set to Online, ensure that Quiesce configured applications before backup is selected in the Snapshot/Replicate Operation Attributes Wizard. If the Backup Mode is set to Crash Consistent, ensure that the Use consistency group option is selected in the Snapshot/Replicate Operation Properties Dialog on the data flow.

Oracle Database Wizard - Select Oracle Databases Dialog

Control	Description
Oracle Node	Select a node representing the Oracle server hosting the database(s) to be selected for backup.
Filter database by name	Filters the databases list below to show only those entries that contain the filter string.
Databases	Select the database(s) to be backed up from the list.
Refresh	Click this button to refresh the cached details and clear the name filter.

Oracle RMAN Classification Wizard

This wizard is launched when a new Oracle RMAN classification is added to a Policy.

The Oracle RMAN classification allows to conveniently specify, which databases can or cannot access Oracle RMAN data using the access operation.

Oracle RMAN Wizard - Specify Oracle Databases (Allowed / Denied Access)

Control	Description
Allow Databases	Lists the databases that will be allowed access for Oracle RMAN access operations.
Add Databases	Opens the Oracle RMAN Database Selection Wizard to enable databases to be added to the Allow Databases list above.
Deny Databases	Lists the databases that will not be allowed access for Oracle RMAN access operations.
Add Databases	Opens the Oracle RMAN Database Selection Wizard to enable databases to be added to the "Deny Databases" list above.
Preview Database Selection	Click this button to preview the which databases are allowed access for an existing Oracle Database node.

Control	Description
Oracle Node	Select a node representing the Oracle setup, which should be previewed.
Database List	List all databases on this node which would be allowed access with the defined classification.

Oracle RMAN Database Selection Wizard

This wizard is launched when a user adds entries to the list of allowed or denied databases in an Oracle RMAN classification.

Oracle Database Selection – Select method

Control	Description
Browse for databases	Select this option to browse an existing Oracle node for databases. See Oracle Database Selection – Browse by below.
Specify databases by name or wildcard	Select this option specify a database by name pattern match. See Oracle Database Selection – Specify name or wildcard below.

Control	Description
Oracle Node	Select an Oracle database application node to browse for databases.
Database List	Lists the databases which exist on the selected node. You can select one or more databases.
Refresh	Refreshes the list of databases for the selected node. This operation may take a few minutes.

Oracle Database Selection – Specify name or wildcard

Control	Description
Pattern	Enter a case insensitive pattern that will be used to match the database by name. The '' character can be used to match any sequence of characters. E.g.: IH_ would match any database type whose name begins with IH_. NoteProtector evaluates the pattern every time Oracle RMAN tries to access the data. If new databases are added later, they will still be allowed or denied access, depending if they match the pattern or not.

Control

Description

Pattern

Enter a case insensitive pattern that will be used to match the database by name. The '*' character can be used to match any sequence of characters. E.g.: IH_* would match any database type whose name begins with IH_.

NoteProtector evaluates the pattern every time Oracle RMAN tries to access the data. If new databases are added later, they will still be allowed or denied access, depending if they match the pattern or not.

Hyper-V Classification Wizard

This wizard is launched when a new Hyper-V classification is added to policy.

The Hyper-V classification is used as a means to conveniently specify the Hyper-V resources which should be included in a backup. Refer to About Hyper-V policy classifications for details about how this classification works with host and block based operations.

Hyper-V Wizard - Specify Hyper-V classification attributes

Control	Description
Included Items	Lists the Hyper-V resources that will be included in the backup.
Add	Opens the Hyper-V Resource Selection Wizard to enable Hyper-V Resources to be added to the include/exclude items list above.
Excluded Items	Lists the Hyper-V VMs that will be excluded from the backup policy.
Remove	Each row has a remove button at the end of the row. When clicked the selected Hyper-V resource is removed from the include/exclude list.
Preview Selection	Opens the Hyper-V Classification Preview Wizard Hyper-V Classification Preview Wizard, that will preview which VMs will be included if the classification is applied to a selected Hyper-V node.
Virtual Machine Consistency	Select which level of consistency is desired for the virtual machines: Application consistent checkpoints will use Hyper-V integration services to quiesce the data inside the VM. Crash consistent checkpoints will just use the data currently available on the virtual disks.

Hyper-V Classification Preview Wizard

This wizard is displayed when the user previews a Hyper-V policy classification.

Control	Description
Hyper-V Node	Select the Hyper-V app node you want to preview the classification for.
Virtual Machine List	Lists all virtual machines that would be considered for backup, based on the classification.

Hyper-V Resource Selection Wizard

This wizard is displayed when the user includes or excludes Hyper-V resources in a policy.

CautionProtector tracks Hyper-V VMs via their unique ID. If the id of an explicitly selected VM is changed (e.g. by deleting and restoring the VM) it will not be included in the backup and an error will be logged.

Control	Description
Virtual Machines	Displays flat list of the virtual machines configured on a Hyper-V node. One more VMs can be selected.. See Hyper-V Resource Selection Wizard – Browse Virtual Machines below.
Virtual Machine Locations	Displays a hierarchical view of a Hyper-V node’s file system. See Hyper-V Resource Selection Wizard – Browse by Virtual Machine Locations below. NoteProtector will select all virtual machines, that have a configuration file under the select path. The list of VMs per path is re-evaluated at the beginning of each backup.
Virtual Machine Host	Displays a hierarchical view of Hyper-V nodes and VMs. It is possible to select one or more nodes of a cluster as well as individual VMs. See Hyper-V Resource Selection Wizard – Browse by Virtual Machine Hosts below. NoteIf a host is selected Protector will select all virtual machines available on that host. The list of available virtual machines per host is re-evaluated at the beginning of each backup.
Pattern	Select if you want to specify a resource by type and name pattern match. See Hyper-V Resource Selection Wizard – Pattern search below.

Hyper-V Resource Selection Wizard – Browse Virtual Machines

This page of the wizard is displayed when the browse by virtual machines option is selected in the initial wizard page above.

Hyper-V Policy Wizard - Classification – Browse Virtual Machines

Control	Description
Hyper-V Node	Select the Hyper-V app node you want to select VMs from.
Search	Enter a part of a virtual machine name and confirm to filter the list of virtual machines.
Virtual Machine List	Select one or more machines.

Hyper-V Resource Selection Wizard – Browse by Virtual Machine Locations

This page of the wizard is displayed when the browse by virtual machine paths option is selected in the initial wizard page above.

Hyper-VM - Browse by Virtual Machine Locations

Control	Description
Hyper-V Node	Select the Hyper-V app node you want to select paths from.
Location	Select one or more paths. Protector will search for virtual machines under the defined path at the beginning of each backup. Note A virtual machine will only be selected for a backup if the virtual machine configuration is located under the specified path. If any included VMs utilize additional paths, these will be added as to the backup as well. This ensures that backed up virtual machines can be fully restored. For clustered Hyper-V nodes it is only possible to select paths which are located on cluster shared volumes, as only these paths are available on all nodes

Hyper-V Resource Selection Wizard – Browse by Virtual Machine Hosts

This page of the wizard is displayed when the browse by virtual machine host option is selected in the initial wizard page above.

Hyper-V VM Selection - Browse by Virtual Machine Hosts

Control	Description
Hyper-V Node	Select the Hyper-V app node you want to select hosts or VMs from.
Hosts	Select either individual virtual machines or complete hosts. In case a host is selected, Protector will determine the list of VMs available on the host at the beginning of the backup.

Hyper-V Resource Selection Wizard – Pattern search

This page of the wizard is displayed when the pattern search option is selected in the initial wizard page above.

Control	Description
Resource Type	Select a Hyper-V resource type, that will be matched by the provided name pattern. Available options: Virtual Machine Virtual Machine Location (Path) Virtual Machine Host
Pattern	Enter a case insensitive pattern that will be used to match the resource type by name. The '?’ character matches any single character, while the '' character can be used to match any sequence of characters. E.g.: `IH_` would match any resource of the given type whose name begins `IH_`**. NoteResources are re-evaluated against the name pattern every time the policy is executed. New resources having a name that matches this pattern, added after the policy is activated, will be automatically included in the backup.

Control

Description

Resource Type

Select a Hyper-V resource type, that will be matched by the provided name pattern. Available options:

Virtual Machine
Virtual Machine Location (Path)
Virtual Machine Host

Pattern

Enter a case insensitive pattern that will be used to match the resource type by name. The '?’ character matches any single character, while the '*' character can be used to match any sequence of characters. E.g.: IH_* would match any resource of the given type whose name begins IH_.

NoteResources are re-evaluated against the name pattern every time the policy is executed. New resources having a name that matches this pattern, added after the policy is activated, will be automatically included in the backup.

VMware Classification Wizard

This wizard is launched when a new VMware classification is added to policy.

The VMware classification is used as a means of conveniently specifying the VMware resources on a vCenter or ESX/ESXi host. Refer to About VMware policy classifications for details about how this classification works with host and block based operations.

VMware Wizard - Specify VMware classification attributes

NoteIf you attempt to edit a legacy VMware policy classification created prior to Protector 6.5, a message will be displayed asking you to reset the Include Items and Exclude Items lists.

Control	Description
Included Items	Lists the VMware resources that will be included in the backup policy. NoteProtector will not take a snapshot of a VM if that VM already has a Protector snapshot mounted to it.
Add	Opens the VMware Resource Selection Wizard to enable VMware resources to be added to the include list above.
Excluded Items	Lists the VMware resources that will be excluded from the backup policy.
Remove	Each row has a remove button at the end of the row, the selected VMware resource is removed from the include/exclude list.
Add	Opens the VMware Resource Selection Wizard to enable VMware resources to be added to the exclude list above.
VMware Node	Select the VMware node the policy is being created for.

VMware Resource Selection Wizard

This wizard is displayed when the user includes or excludes VMware resources in a policy.

Caution Protector tracks VMware resources via their MoRef (Managed Object Reference). If a resource's MoRef is changed then it will not be included in the backup and a warning will be logged. Tracking resources via their MoRef means that they will be included in the backup even if vMotion moves them.

VMware Resource Selection for Inclusion/Exclusion Wizard - Select method

Control	Description
Browse for resources	Select this option to browse for VMware resources in similar ways to those provided in vSphere Client. See VMware Resource Selection for Inclusion/Exclusion Wizard - Browse By below.
Specify resource by name or wildcard	Select this option to specify a resource by type and name pattern match. See VMware Resource Selection for Inclusion/Exclusion Wizard - Specify name or wildcard below.

VMware Resource Selection for Inclusion/Exclusion Wizard - Browse by

This page of the wizard is displayed when the Browse for resources selection method is specified in the initial wizard page above.

Control	Description
Virtual Machines, Templates and Folders	Displays a hierarchical view ordered by datacenters, folders, and virtual machines and templates.
Virtual Machines and Templates	Displays a flat list of virtual machines and templates ordered alphabetically.
Hosts and Clusters	Displays a hierarchical view ordered by datacenters, hosts and virtual machines.
Hosts	Displays a flat list of hosts ordered alphabetically.
Storage	Displays a hierarchical view ordered by datacenters and datastores.
Datastores	Displays a flat list of datastores ordered alphabetically.
Resource Pools	Displays a flat list of resource pools ordered alphabetically.
Datacenters	Displays a flat list of datacenters ordered alphabetically.
vApps	Displays a flat list of vApps ordered alphabetically.
Tags	Displays a flat list of tags ordered alphabetically. NoteTo browse by tags, the VMware proxy node must have PowerCLI installed. Refer to VMware Product Interoperability Matrices for vCenter Server/PowerCLI version compatibility.

VMware Resource Selection for Inclusion/Exclusion Wizard - Virtual Machines, Templates and Folders Hierarchy

In a hierarchical view it is possible to select or deselect entire trees, sub-trees and individual nodes. For example, the screen-shot above shows the entire Sustaining datacenter selected, but with the Alison folder and the IH_Client5 virtual machine deselected from a backup policy.

VMware Resource Selection for Inclusion/Exclusion Wizard - Virtual Machines and Templates List

In a flat list view it is possible to select or deselect multiple items of the same type.

VMware Resource Selection for Inclusion/Exclusion Wizard - Hosts and Clusters Hierarchy

VMware Resource Selection for Inclusion/Exclusion Wizard - Hosts List

VMware Resource Selection for Inclusion/Exclusion Wizard - Storage Hierarchy

VMware Resource Selection for Inclusion/Exclusion Wizard - Datastores List

VMware Resource Selection for Inclusion/Exclusion Wizard - vApps List

VMware Resource Selection for Inclusion/Exclusion Wizard - Tags List

VMware Resource Selection for Inclusion/Exclusion Wizard - Specify name or wildcard

This page of the wizard is displayed when the Specify resource by name or wildcard selection method is specified in the initial wizard page above.

Control	Description
Resource Type	Select a VMware resource type that will be matched by the provided name pattern.
Pattern	Enter a case insensitive pattern that will be used to match the resource type by name. The '' character can be used to match any sequence of characters. E.g.: `IH_` would match any resource of the given type who's name begins `IH_`. NoteResources are re-evaluated against the name pattern every time the policy is executed. New resources having a name that matches this pattern, added after the policy is activated, will be automatically included in the backup.

Disk Type Classification Wizard

This wizard is launched when a new Disk Type classification is added to a Policy.

The Disk Type classification is used to limit backups to files that are located on fixed devices and/or to files that are located on removable disks. To specify file types use the Classification Filters Wizard in conjunction with this Classification.

Control	Description
Fixed Disks	Backs up all fixed disks, as this is the only disk type option it is permanently selected. All drives connected to SCSI, ATAPI, ATA, SAS, Fiber, RAID, and so on are considered fixed.
Fast incremental based on file modification date	This is only applicable for backups to Generation 2 storage nodes. If this is checked then Ops Center Protector decides what files need resynchronizing based on whether the modification date has changed. This reduces the time taken to resynchronize, but can be disabled if it is known that software is installed that will modify files without updating their size or modification date. NoteIf only file metadata changes between batch backups (e.g. file ownership or file permissions), then the changes are not captured. These changes are only captured when the file data changes.
Fine change detection	This is only applicable for backups to Generation 2 storage nodes. Reduces the amount of data transferred and stored during a resynchronization. An entire file is transferred if it has changed and is less than one block in size. (This option should be used sparingly as there is a processing overhead.)

Hitachi Block Classification Wizard

This wizard is launched when a new Hitachi Block classification is added to a Policy.

The Hitachi Block classification is used to define which LDEVS are to be protected.

Hitachi Block Classification Wizard - Specify Hitachi Block Storage classification attributes

Control	Description
Use Hitachi Block Host selections	Select this option if the policy is used in conjunction with a Hitachi Block Host Node (see Hitachi Block Host Node Wizard). In this case the LDEVs were specified when the node was created.
Specify additional selections	Select this option to specify the LDEVs when used in conjunction with a: Hitachi Block Node (see Hitachi Block Device Node Wizard) or a Hitachi Logical Block Node (see Hitachi Logical Block Device Node Wizard) You can also select this option if the policy is used in conjunction with a Hitachi Block Host Node (see Hitachi Block Host Node Wizard). In this case the LDEVs specified here will be in addition to those specified when the node was created.
Included Logical Devices	Enter a list of LDEVs or Host Groups to be included in this Block Host (one logical device or host group specification per line) in the format described below.
Excluded Logical Devices	Enter a list of LDEVs or Host Groups to be excluded from this Block Host (one logical device or host group specification per line) in the format described below. TipThis enables the inclusion of an entire Host Group but exclusion of individual LDEVs within that Host Group.

LDEVs are entered in the following format:

serial_number/identifier

Where:

serial_number is the serial number of the Block storage device
identifier is one of:
- ldev_id a single LDEV ID in hex or decimal
- ldev_id-ldev_id a range of LDEV IDs
- host_group_id a host group identifier using the format:
  - CLc-s-h where:
    - CL is a literal string
    - c is the physical channel number in the range 1…n
    - s is the physical slot number in the range A…Z
    - h is the logical host group ID in the range 0…255

For example:

210613/0x00a0 for an LDEV specified in hexadecimal

210613/220-230 for a range of LDEVs specified in decimal

210613/CL2-A-12 for a host group

Note

Spaces and colons must not be present in the classification entries. If a space or colon is encountered on a line, the remaining text on that line from the space or colon will be disregarded. This allows existing entries (that contain the LDEV name after a space or colon) to be present in the list.
When using pseudo multi-tenancy, if an LDEV or host group is manually specified that is not accessible then it will be excluded from the backup. An attachment is included in the log message that specifies what was included and excluded in the backup.
If a selection of provisioned ports are specified, the port with the least amount of LUNs assigned to it will be used. The exception is when a TI Snapshot already exists and an update is made to the provisioned ports, in this case the port used will be taken from the existing TI snapshot set.
When a replication already exists and a change is made to provisioned ports then the affected data flow must be reactivated. The existing replication will remain using the existing port after it has been resynchronized. New replications will use the updated settings.

Path Classification Wizard

This wizard is launched when a new Path classification is added to a Policy.

The Path classification allows you to define the path or paths for directories that contain files to be backed up. All files in each directory will be backed up. To specify file types use the Classification Filters Wizard in conjunction with this Classification.

Caution

Protector will not backup the files or directories referred to by a symbolic link. The symbolic link itself will be backed up, so upon restore the link will still work assuming the referenced files or directories exist in their original location. Essentially, Protector performs a shallow backup in respect of symbolic links.
The following filesystem types are excluded from backups:
- Windows: bad, cdrom, no root, ramdisk, unknown
- Linux: autofs, binfmt_misc, configfs, debugfs, devpts, devtmpfs, fuse, group, hugetlbfs, mqueue, nfsd, proc, pstore, rootfs, rpc_pipefs, securityfs, selinuxfs, sysfs, tmpfs, vmblock
- AIX: ahafs, autofs, cdrom, procfs

NoteWhen used in the context of storage hardware backups, Protector will discover the underlying hardware paths at runtime. For storage hardware based backups, all the paths must exist on the same block hardware device.

Physical Path Wizard - Specify Path classification attributes

Control	Description
Included Paths	Enter the paths to be included in the backup policy. The targeted directory paths are entered with one path specified per line. To specify file types add a Filter using the Classification Filters Wizard. Refer also to Path selection rules.
Excluded Paths	Enter the paths to be excluded from the backup policy. The targeted directory paths are entered with one path specified per line. Files themselves cannot be specified – only directories. If Included Paths to be backed up contains one or more sub-paths that are not required, then enter the paths of these sub-directories here. NoteIf Excluded Paths contains paths that are not sub-paths of Included Paths, Protector will backup the entire file system. Refer also to Path selection rules.
Select Paths	Opens the Select Classification Paths Dialog to enable you to select existing paths to be included or excluded. You can search for a path on a specific node and then apply that path broadly to all nodes or apply it to one node only.
Fast incremental based on file modification date	Only applicable to Generation 2 host based storage. If this is checked then Ops Center Protector decides what files need resynchronizing based on whether the modification date has changed. This reduces the time taken to resynchronize, but can be disabled if it is known that software is installed that will modify files without updating their size or modification date. Note: If only file metadata changes between batch backups (e.g. file ownership or file permissions), then the changes are not captured. These changes are only captured when the file data changes.
Fine change detection for repositories	Only applicable to Generation 2 repository backups. Reduces the amount of data transferred and stored during a resynchronization. An entire file is transferred if it has changed and is less than one block in size. (This option should be used sparingly as there is a processing overhead.)

TipIt is possible to use wildcard characters (*) within each path entry. Only one wildcard character is permissible within each path element. That is: C:\*\hello is valid, whereas C:\*document*\hello is not valid.

It is possible to use variables within a Path classification. See About path macros for details.

Select Classification Paths Dialog

This dialog is displayed when selecting paths (e.g. in the Path Classification Wizard).

Control	Description
Node	Enter the name of a node or select one from the dropdown menu.
Directory Tree	Expand the directory tree for the node and select the required directory.
Restrict path(s) to selected node	If selected then the path will only be applied to the node selected above; the path will be qualified with the node name (i.e. {node_name}path_name) in the Path Classification Wizard path list. If deselected then the path will be applied to all nodes where the policy is assigned.

Path selection rules

A Physical - Path policy classification is a set of Included Paths, Exclude Paths and Filters. Paths must be specified following the rules listed below:

General path rules:

Only directories can be specified by a path; files cannot.
A path specification is only considered to refer to the leaf node of the path. For example:
/path_element_1/path_element_2
only refers to the path_element_2 leaf node.
/home/ is the same as /home. The trailing delimiter is ignored.
An included path must be defined to be a valid classification.
An excluded path will never implicitly include other paths.
An excluded path will be ignored if it is not a sub directory of an included path.
- For example, if /home is set as both an included path and an excluded path, it will be included. This is because the excluded path it is not a sub-path of the included path.
Only local files are backed up. Filesystem walking will not continue beyond a remote mount point.

Windows specific path rules:

A windows path must start with <drive letter>:\ (<drive letter> can be an actual drive letter or a * or ?).
Delimiters can be / or \ and can be mixed within a path specification.

Posix specific path rules:

A Posix path must start with /
Delimiters can only be /

Wild card rules:

The following characters that have special meaning in a path specification:
- * matches zero or more characters.
- ? matches only a single character.
If a path element contains a * it only matches directories at that level.
Any number of * and ? wildcards can be used in a path.

File filters:

A file filter will only match files not directories.
The same wildcard rules apply; directories will not be matched.

Path examples:

Example	Interpretation
/home/**	Selects all directories immediately beneath /home. The second * has no effect.
/home/*d	Selects all directories immediately beneath /home ending in d. The directory /home is not selected.
/home/?	Selects all directories immediately beneath /home that have a name that is exactly 1 character long. The directory /home is not selected.
/home/*	Selects all directories immediately beneath /home. The directory /home is not selected.
?:\	Selects all Windows drives, as will *:\
/h/m*	Selects all directories that contain an m, that are beneath all directories at the root level starting with h.
/hm	Selects all directories at the root level that start with h and also have m in the name. Note that a directory named /hm would be selected since * matches zero or more characters.
/h*me	Selects all directories at the root level that starts with h followed by any number of characters and ending with me.
/h?me	Selects all directories at the root level that starts with h followed by any single character and ending with me.

Backup Operation Wizard

This wizard is launched when a new Backup operation is added to a Policy.

The Backup operation makes complete or incremental copies of the source node's data (specified by the associated data classification). These backups are performed at times dictated by the Run Options.

Note This operation cannot be applied to hardware storage devices.

NoteOperating System Specific Behaviour:

OS	Note
AIX	AIX host-based backups do not capture ACLs.

Backup Wizard - Specify Backup operation attributes

Control	Description
Name	The name of the operation. The default name is 'Backup'. This is used to identify the operation when the policy is used in a Data Flow diagram and when operations are to be triggered sequentially.
Tags	Add the tags to be associated with the object being created.
Run Options	Select one of the following: Run on RPO - the operation is triggered whenever the RPO is reached. Run on RPO and Schedule - the operation will trigger based on the RPO and the selected Schedule Name. Run on completion of operation - the operation will be triggered on completion of the operation entered in the Select Operation field. This is used when a policy contains more than one operation and it is necessary that the operations occur in a sequential order.
Select a Schedule Name	Enabled only when the Run Option is set to Scheduled. Enter an existing schedule name or select one from the dropdown menu.
Manage Schedules	Opens the Schedules Inventory in a new tab to enable you to add, edit, review or delete schedules. The times, dates and/or windows within which backups are written to a repository can be controlled by a named schedule that is then selected in the Schedule Name control. Once you have finished working in the Schedules tab, close it and return to the Backup Wizard.
Select Operation	Enabled only when the Run Option is set to Run on completion of operation. Enter an existing operation name or select one from the dropdown menu. This is used when a policy contains more than one operation and it is necessary that the operations occur in a sequential order.
Recovery Point Objective	This can be set to a specified period and is used in conjunction with the Run Options. If Run on RPO or Run on RPO and Schedule is selected, then a backup is created whenever the Recovery Point Objective time is reached, following the initial backup performed when the policy is activated.
Retention	The backup is retained for the specified period before being retired.
Quiesce configured applications before backup	This is used to ensure backup consistency. If this option is selected and any Application classifiers are included in the policy, then these applications will be temporarily quiesced into a consistent state prior to the snapshot occurring. See About application quiescing.
Pre Script	Specify a script that will be run before the backup is performed. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard. Note The Pre script and Post script fields have no effect with VMware ESX backups. If scripts need to be run either before or after a backup operation then those scripts need to be held locally on each virtual machine that must run them. See the following VMware articles for further information: https://pubs.vmware.com/vsphere-50 http://kb.vmware.com/selfservice In order to run a Python script as Pre and Post scripts is it necessary to precede the script name with the path and the name of the python binary as follows: `<script bin path>/<full script bin name> <script>` So for Windows this would look like this: `C:\Users\Administrator\AppData\Local\Programs\Python\Python38-32\python.exe E:\myScript.py` For Linux: `/usr/bin/python3 /opt/hitachi/Protector/scripts/myScript.py`
Post Script	Specify a script that will be run after the backup is performed. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard.

Mount Operation Wizard

This wizard is launched when a new Mount operation is added to a Policy.

The Mount operation is used to automatically mount and unmount the destination of a Hitachi Block and File storage replication so that it can be used in Repurposing and Proxy Backup scenarios.

NoteThe selected mount host must have a pre-existing LUN mounted from the corresponding storage device (this is required for the auto discover feature to work). If not then the automated mount operation will fail and the error message "Cannot mount to machine that does not have path to storage" will be logged.

Note

Only Replications can be auto-mounted using the Mount operation; Snapshots cannot.
The storage paths used for Proxy Backup and Repurposing are not deleted immediately after use, therefore it is possible that they may be shown as offline in the OS's Disk Management UI.
If a mount operation needs to mount multiple disks and one of the mount operations fail, the replication destination is shown as mounted rather than partially mounted. The logs will indicate the mount was only partially successful.

Mount Wizard - Specify Mount operation attributes

Control	Description
Name	The name of the operation. The default name is 'Mount'. This is used to identify the operation when the policy is used in a Data Flow diagram and when operations are to be triggered sequentially.
Run Options	Select one of the following options: Run on Schedule - specify a trigger schedule name in the Select a Schedule field to specify when the mount operation should occur.
Select a Schedule	The mount operation can have its own trigger schedule that can be used when applied to a continuous replication. The operation can also be part of a synchronization group so that it can participate in a batch replication sequence. Enter an existing schedule name or select one from the dropdown menu.
Manage Schedules	Opens the Schedules Inventory to enable you to add, edit, review or delete schedules.
After Mount	Specify a script that will be run on the mount host after the volume is mounted, allowing the script writer to invoke an action after the volumes have been mounted on the mount host, e.g.: schedule a host based backup. By default Protector will look for the script on the mount host in the C:\Program Files\Hitachi\Protector\Scripts folder.
Before Unmount	Specify a script that will be run on the mount host before the volume is unmounted, allowing the script writer to put the application into a safe state before the volumes are unmounted from the mount host. By default Protector will look for the script on the mount host in the C:\Program Files\Hitachi\Protector\Scripts folder.

Replicate Operation Wizard

This wizard is launched when a new Replicate operation is added to a Policy.

The Replicate operation maintains a complete copy of the source data (specified by the associated data classification) on the destination.

Replicate Wizard - Replication Operation Attributes

Control	Description
Name	The name of the operation. The default name is 'Replicate'. This is used to identify the operation when the policy is used in a Data Flow diagram and when operations are to be triggered sequentially.
Refresh Options	Replication can be performed in real time using a continuous mover or in batch mode using a batch mover. In the case of a continuous mover these options will cause the application to re-evaluate the LDEVs being used in the replication. Run when manually triggered - the operation is manually triggered. Run on Schedule - the operation will trigger based on the schedule specified in the Select a Schedule field. Run on completion of operation - the operation will be triggered on completion of the operation entered in the Select Operation field.
Select a Schedule	Enabled only when the Run Option is set to Scheduled. Enter an existing schedule name or select one from the dropdown menu.
Manage Schedules	Opens the Schedules Inventory in a new tab to enable you to add, edit, review or delete schedules. The times, dates and/or windows within which backups are written to a repository can be controlled by a named schedule that is then selected in the Schedule Name control. Once you have finished working in the Schedules tab, close it and return to the Replicate Wizard.
Run on completion of operation	Enabled only when the Run Option is set to Run on completion of operation. Enter an existing operation name or select one from the dropdown menu. This is used when a policy contains more than one operation and it is necessary that the operations occur in a sequential order.
Quiesce configured applications before backup	Only valid when performing a batch replication operation. This is used to ensure backup consistency. If this option is selected and any Application classifiers are included in the policy, then these applications will be temporarily quiesced into a consistent state prior to the snapshot occurring. See About application quiescing. Caution Oracle - Policies containing these application classifications must have the quiesce application option checked, otherwise backups may not be restorable. VMware - Policies containing this hypervisor classification require that VMware Tools is installed on the VM to perform quiesced backups, otherwise backups will fail.
Pre Script	Specify a script that will be run before the replication is started. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard.
Post Script	Specify a script that will be run after the replication is completed. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard.

Snapshot Operation Wizard

This wizard is launched when a new Snapshot operation is added to a Policy.

The Snapshot operation is used to trigger snapshots of entire volumes. Multiple copies may be retained, enabling reversion to a specific point in time.

Caution

Snapshot operations always apply to the whole selected volume. Any associated data classifications are ignored.
Snapshots will be automatically retired after the given retention period.

Control	Description
Name	The name of the operation. The default name is 'Snapshot'. This is used to identify the operation when the policy is used in a Data Flow diagram and when operations are to be triggered sequentially.
Mode	This can currently only be set to: Hardware - for snapshots of Hitachi Block.
Hardware Type	Only enabled if Mode is set to Hardware. This can be set to: Hitachi Block - for VSP and HUS VM block storage
Run Options	Select one of the following: Run on RPO - the operation is triggered whenever the RPO is reached. Run on RPO and Schedule - the operation will trigger based on the RPO and the schedule name entered in the Select a Schedule field. Run on completion of operation - the operation will be triggered on completion of the operation entered in the Select Operation field.
Select a Schedule	Enabled only when the Run Option is set to Scheduled. Enter an existing schedule name or select one from the dropdown menu.
Manage Schedules	Opens the Schedules Inventory in a new tab to enable you to add, edit, review or delete schedules. The times, dates and/or windows within which snapshots are created can be controlled by a named schedule that is then selected in the Schedule Name control. Once you have finished working in the Schedules tab, close it and return to the Snapshot Wizard.
Select Operation	Enabled only when the Run Option is set to Run on completion of operation. Enter an existing operation name or select one from the dropdown menu. This is used when a policy contains more than one operation and it is necessary that the operations occur in a sequential order.
Recovery Point Objective	This can be set to a specified period and is used in conjunction with the Run Options. If no schedules are defined (i.e. Run on RPO is selected), then a snapshot is created whenever the Recovery Point Objective time is reached.
Retention	The backup is retained for the specified period before being retired.
Quiesce configured applications before backup	This is used to ensure backup consistency. If this option is selected and any Application classifiers are included in the policy, these applications will be temporarily quiesced into a consistent state prior to the snapshot occurring. See About application quiescing. Caution Oracle - Policies containing these application classifications must have the quiesce application option checked, otherwise backups may not be restorable. VMware - Policies containing this hypervisor classification require that VMware Tools is installed on the VM to perform quiesced backups, otherwise backups will fail.
Pre Script	Specify a script that will be run before the snaphot is taken. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard.
Post Script	Specify a script that will be run after the shapshot is taken. This is used to ensure consistent state for applications other than those with a predefined Application Classification Wizard.

Tier Operation Wizard

This wizard is launched when a new Tier operation is added to a Policy.

The Tier operation is used to trigger tiering of entire data from a repository store to a cloud storage platform.

Control	Description
Name	The name of the operation. The default name is 'Tier'. This is used to identify the operation when the policy is used in a Data Flow diagram and when operations are to be triggered sequentially.

Classification Filters Wizard

This wizard is launched when Filters for a Path or Disk Type Classification are created or edited.

Classification Filters are applied to Path and Disk Type Classifications when used in conjunction with host based operations (Backup) to provide finer control over what is backed up.

Classification Filter Wizard - Add one or more Classification Filters

Control	Description
Edit	Edits an existing filter in the inventory. The appropriate Filter wizard is launched to enable the filter's attributes to be changed.
Delete	Deletes the selected item from the inventory.
Add	Creates a new Classification Filter. The following wizard page is displayed allowing a Filter to be specified.
Existing Filter	Click on the filter name to Launch the appropriate Filter wizard to enable the filter to be viewed and edited.

Filter Selection Wizard - Select Classification Filter

Control	Description
Files	Filters based on user defined file type.
OS Type	Filters based on OS Type.

Filter Selection Wizard - Specify Files filter attributes

Control	Description
Include Files	The specified file types will be included in the classification. All files, regardless of path, whose name matches the given name will be included. Specify one file name and extension per line. To specify paths, create a path classifier using the Path Classification Wizard and attach this filter to it.
Include File Type Categories	Launches the Select File type categories dialog.
Exclude Files	The specified file types will be excluded from the classification. Specify one file name and extension per line.
Exclude File Type Categories	Launches the Select File type categories dialog.

Filter Selection Wizard - Specify Operating System filter attributes

Control	Description
OS Type	Restricts the associated data classification to those machines running one or more of the selected operating system types.

Select File type categories dialog

This dialog is lauched when Include or Exclude file type catagories is selected during classification filter creation or editing.

It facilitates selection of groups of items such as ‘All Images’ or ‘All System’ files with a single selection. Once the selection has been made the list can still be edited in the Classification Filters Wizard

Control	Description
File Type Categories	Select one or more categories to add those to the include or exclude list of the Classification Filters Wizard.

Access Operation Wizard

This wizard is launched when a new Access operation is added to a Policy.

The access operation allows a node full or read-only access to Oracle RMAN data on a Gen2 repository or other UBI datastore.

NoteIt is not possible to apply this operation to hardware storage devices or Gen1 repositories

Control	Description
Name	The name of the operation. The default name is 'Access'. This is used to identify the operation when the policy is used in a Data Flow diagram and when displaying the triggers on the command line.
Read / Write	When selected, Nodes using this operation have full access to the data. It is possible to create, read, change and delete data.
Read only	When selected, Nodes using this operation will only be able to read data created previously or by other nodes. Creation of new data, modifications and deletes will be blocked.

Oracle RMAN Classification Wizard

This wizard is launched when a new Oracle RMAN classification is added to a Policy.

The Oracle RMAN classification allows to conveniently specify, which databases can or cannot access Oracle RMAN data using the access operation.

Control	Description
Allow Databases	Lists the databases that will be allowed access for Oracle RMAN access operations.
Add Databases	Opens the Oracle RMAN Database Selection Wizard to enable databases to be added to the Allow Databases list above.
Deny Databases	Lists the databases that will not be allowed access for Oracle RMAN access operations.
Add Databases	Opens the Oracle RMAN Database Selection Wizard to enable databases to be added to the "Deny Databases" list above.
Preview Database Selection	Click this button to preview the which databases are allowed access for an existing Oracle Database node.

Control	Description
Oracle Node	Select a node representing the Oracle setup, which should be previewed.
Database List	List all databases on this node which would be allowed access with the defined classification.

Oracle RMAN Database Selection Wizard

This wizard is launched when a user adds entries to the list of allowed or denied databases in an Oracle RMAN classification.

Control	Description
Browse for databases	Select this option to browse an existing Oracle node for databases. See Oracle Database Selection – Browse by below.
Specify databases by name or wildcard	Select this option specify a database by name pattern match. See Oracle Database Selection – Specify name or wildcard below.

Control	Description
Oracle Node	Select an Oracle database application node to browse for databases.
Database List	Lists the databases which exist on the selected node. You can select one or more databases.
Refresh	Refreshes the list of databases for the selected node. This operation may take a few minutes.

Control

Description

Pattern

Policy Details

This page displays the details of a Policy and enables you to launch the wizard to edit them.

Control	Description
Edit	Launches the Policy Wizard at the Classifications page to enable the policy to be edited.
Tag	Modifies the tags of an existing object from the either the inventory screen or the details screen of the object.
Permissions	Displays the Access Control Permissions Inventory to enable you to view and edit the policy's permissions.
Classification(s)	Lists the classifications for this policy. Click on a classification name to open the Policy Classification Details to enable you to view the classification.
Operation(s)	Lists the operations for this policy. Click on an operation name to open the Policy Operation Details to enable you to view the operation.

Policy Classification Details

The Classification Details page is displayed when the user clicks on a classification in a policy.

Policy Operation Details

The Operation Details page is displayed when the user clicks on an operation in a policy.

Policy Tasks

This section describes policy configuration tasks that users will perform with Ops Center Protector.

Refer to Data Protection Workflows for detailed descriptions of specific Repository and Hitachi Block data protection scenarios.

For further information, refer to:

Policy Concepts
Policies UI Reference

How to create a policy

Before you begin

Ensure that the nodes acting as sources and destinations for your backup data have been added to Protector, see How to add a node.

To create a policy:

Procedure

Click the Policies link on the Navigation Sidebar to open the Policies Inventory.
Click the Create new item tile to open the Policy Wizard.
Enter a Name and Description for the policy, then click Next.
From the Classifications inventory page of the Policy Wizard you can either:
- Add filters to an existing classification. Refer to How to add a filter to a classification.
- Click the Create new item tile to add another classification to the policy. Refer to How to add a classification to a policy.
- Edit an existing classification in the policy. Refer to How to edit a classification in a policy.
- Delete an existing classification from the policy. Refer to How to delete a classification from a policy.
At least one classification must be added to a new policy. When you have finished adding classifications and filters, click Next.
The Operation Selection page of the Policy Wizard is displayed.
Select the required operation for the policy. At least one operation must be added to a new policy. Refer to How to add an operation to a policy before proceeding further.
From the Operations inventory page of the Policy Wizard you can either:
- Click the Create new item tile to add another operation to the policy. Refer to How to add an operation to a policy.
- Edit an existing operation in the policy. Refer to How to edit an operation in a policy.
- Delete an existing operation from the policy. Refer to How to delete an operation from a policy.
When you have finished adding operations, click Finish.

How to edit a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of editing the policy is understood.

To edit a policy:

Procedure

Click the Policies link on the Navigation Sidebar to open the Policies Inventory.
Select the required policy tile.
The Policy Details opens.
Click Edit above the inventory to open the Policy Wizard.
Editing the policy is similar to creating one. Refer to How to create a policy.
If required, you can now recompile and reactivate all data flows where the edited policy is used. Refer to How to activate a data flow.

How to delete a policy

Before you begin

NoteIt is not possible to delete a policy which has been applied to a node within a data flow (active or not). All data flows where the policy is used must therefore be reviewed and edited so that the policy to be deleted is unassigned from all nodes.

To delete a policy:

Procedure

Click the Policies link on the Navigation Sidebar to open the Policies Inventory.
Select the policy to be deleted by clicking in the top left corner of the corresponding tile.
Click Delete above the inventory.
Recompile and reactivate the rules for all data flows where the deleted policy was used.

How to add a classification to a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of adding the classification is understood.

To add a classification to a policy:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard either by creating a new policy (How to create a policy) or editing an existing one (How to edit a policy).
Click the Create new item tile to add a classification to the policy.
The Classification Selection page of the wizard is displayed.
Select the classification category you require on the left of the wizard.
The available classification types are displayed on the right of the wizard.
Select the required classification from the list on the right of the wizard, then click Next.
One of the following classification wizards is displayed:
- Application classifications:
  - Oracle Database Classification Wizard
  - Oracle RMAN Classification Wizard
- Hypervisor classifications:
  - VMware Classification Wizard
- Physical classifications:
Enter the parameters required for the selected classification, then click Apply.

How to edit a classification in a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of editing the classification is understood.

To edit a classification:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard by editing an existing policy.
Select the classification to be edited by clicking on the <classification name> of the corresponding tile.
The classification wizard is displayed.
Make the required changes to the classification, then click Apply.

How to delete a classification from a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of deleting the classification is understood.

To delete a classification:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard by editing an existing policy.
Select the classification to be deleted by clicking in the top left corner of the corresponding tile.
Click Delete above the inventory.

How to add a filter to a classification

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of adding the filter is understood.

To add a filter to a classification:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard either by creating a new policy (How to create a policy) or editing an existing one (How to edit a policy).
Click the Edit Filters link on the required classification tile.
The Classification Filters Wizard is displayed.
Click the Create new item tile.
The Classification Filter Selection page of the wizard is displayed.
Select the required filter from the list displayed by the wizard, then click Next.
Enter the parameters required for the selected filter, then click Apply.

How to edit a filter on a classification

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of editing the filter is understood.

To edit a filter on a classification:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard by editing an existing policy.
Select the filter to be edited by clicking on Edit Filters of the corresponding classification tile.
The Classification Filters Wizard is displayed.
Select the filter to be edited by clicking on the <filter name> of the corresponding tile.
Make the required changes to the filter, then click Apply.

How to delete a filter from a classification

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of deleting the filter is understood.

To delete a filter from a classification:

Procedure

Navigate to the Classifications inventory page of the Policy Wizard by editing an existing policy.
Select the filter to be deleted by clicking on Edit Filters of the corresponding classification tile.
The Classification Filters Wizard is displayed.
Select the filter to be deleted by clicking in the top left corner of the corresponding tile.
Click Delete above the inventory.

How to add an operation to a policy

It is recommended that all data flows where the policy is used are reviewed so that the effect of adding the operation is understood. Adding an operation may cause a compiler warning if the operation is not applied to all data flows using the policy.

To add an operation to a policy:

Procedure

Navigate to the Operations inventory page of the Policy Wizard either by creating a new policy (How to create a policy) or editing an existing one (How to edit a policy).
Click the Create new item tile to add an operation to the policy.
The Operation Selection page of the wizard is displayed.
Select the required operation from the list displayed by the wizard, then click Next.
One of the following operation wizards is displayed
Enter the parameters required for the selected operation. For some operations it is possible to select Run on Schedule under Run Options to specify when the operation will be run. To create a schedule click Manage Schedules then refer to How to create a schedule.
Once the operation's parameters have been entered, click Apply.

How to edit an operation in a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of editing an operation is understood.

To edit an operation:

Procedure

Navigate to the Operations inventory page of the Policy Wizard by editing an existing policy.
Select the operation to be edited by clicking on the <operation name> of the corresponding tile.
The operation wizard is displayed.
Make the required changes to the operation, then click Apply.

How to delete an operation from a policy

Before you begin

It is recommended that all data flows where the policy is used are reviewed so that the effect of deleting the operation is understood.

To delete an operation:

Procedure

Navigate to the Operations inventory page of the Policy Wizard by editing an existing policy.
Select the operation to be deleted by clicking in the top left corner of the corresponding tile.
Click Delete above the inventory.

Quick Links

Policy Concepts

About policies

About policy classifications

About VMware policy classifications

About Hyper-V policy classifications

Virtual machine consistency

About Microsoft SQL Server Policy Classifications

About path macros

About application quiescing

About synchronization groups

About the automated Mount operation

About the repurposing mount sequence

About the proxy backup mount sequence

Policies UI Reference

Policies Inventory

Policy Wizard

Microsoft SQL Server Classification Wizard

Microsoft SQL Server Database Selection Wizard

Microsoft SQL Server Instance Credentials Dialog

Microsoft SQL Server User Privileges

Ops Center Classification Wizard

Ops Center Application Selection Wizard

Oracle Database Classification Wizard

Oracle RMAN Classification Wizard

Oracle RMAN Database Selection Wizard

Hyper-V Classification Wizard

Hyper-V Classification Preview Wizard

Hyper-V Resource Selection Wizard

Hyper-V Resource Selection Wizard – Browse Virtual Machines

Hyper-V Resource Selection Wizard – Browse by Virtual Machine Locations

Hyper-V Resource Selection Wizard – Browse by Virtual Machine Hosts

Hyper-V Resource Selection Wizard – Pattern search

VMware Classification Wizard

VMware Resource Selection Wizard

Disk Type Classification Wizard

Hitachi Block Classification Wizard

Path Classification Wizard

Select Classification Paths Dialog

Path selection rules

Backup Operation Wizard

Mount Operation Wizard

Replicate Operation Wizard

Snapshot Operation Wizard

Tier Operation Wizard

Classification Filters Wizard

Select File type categories dialog

Access Operation Wizard

Oracle RMAN Classification Wizard

Oracle RMAN Database Selection Wizard

Policy Details

Policy Classification Details

Policy Operation Details

Policy Tasks

How to create a policy

How to edit a policy

How to delete a policy

How to add a classification to a policy

How to edit a classification in a policy

How to delete a classification from a policy

How to add a filter to a classification

How to edit a filter on a classification

How to delete a filter from a classification

How to add an operation to a policy

How to edit an operation in a policy

How to delete an operation from a policy