IBM Storage Protect With Wasabi

How do I use IBM Storage Protect with Wasabi?

IBM Storage Protect (previously Spectrum Protect) can be used with Wasabi by leveraging the configuration procedure described In this article.

The data restoration process is handled by your specific backup software application. As there are many potential variables that will affect your unique environment, Wasabi strongly recommends that you seek the guidance of your backup software's technical support team in the event that you encounter difficulty or have application-specific inquiries.

This article details the procedure to backup directly to Wasabi. Tiering from local storage to Wasabi is out of this article’s scope.

Prerequisites

Active Wasabi storage account with console access.
Wasabi access and secret keys.
A Wasabi bucket, either Object Lock (highly recommended) or non-Object-Lock. See Creating a Bucket for details.
- For Object Lock buckets, ensure the Default Object Retention is enabled, Compliance Mode is selected, and the number of days match the CLOUDDATALOCKDURation that will be configured below on IBM Storage Protect. See Setting Object Lock for a Bucket for more details.
IBM Storage Protect software installed. This solution was tested with version 8.1.26 running on Ubuntu 20.04.
IBM Backup Archive client installed, with login credentials available. The BA client was installed on the IBM Storage Protect server during testing.
An existing node defined on IBM Storage Protect (or register a new node to be used with Wasabi).

Configuring IBM Storage Protect

Login to the IBM Backup Archive command-line client, dsmadmc, as shown in this example. The user “ibmadmin” is used in the example and was previously defined; it will likely differ in your environment.
$ sudo dsmadmc
IBM Storage Protect
Command Line Administrative Interface - Version 8, Release 1, Level 26.0
(c) Copyright IBM Corp. 1990, 2025. All Rights Reserved.
Enter your user id: ibmadmin
Enter your password:
Session established with server IBM-SP-4: Linux/x86_64
Server Version 8, Release 1, Level 26.000
Server date/time: 06/10/2025 15:45:28 Last access: 06/10/2025 15:43:42
Protect: IBM-SP-4>
Define a connection to your Wasabi bucket:
Protect: IBM-SP-4>define connection <connection_name> cloudtype=s3 cloudurl=<Wasabi_URL> bucketname=<your_bucket> identity=<your_Wasabi_access_key> password=<your_Wasabi_secret_key>
In the following example, the Wasabi us-east-1 URL was used. Please refer to Service URLs for Wasabi's Storage Regions for the correct URL for the region your bucket is located in.

As an example:
Protect: IBM-SP-4>define connection WasabiWithObjectLock6 cloudtype=s3 cloudurl=https://s3.us-east-1.wasabisys.com bucketname=mt-ibm-sp-2025-06-23 identity=****************90TG password=************************************K7ICf
ANR3315I DEFINE CONNECTION: Connection WASABIWITHOBJECTLOCK6 defined.
Define a Wasabi storage pool. For Object Lock (Immutable) buckets:
Protect: IBM-SP-4>define stgpool <pool_name> stgtype=cloud connection=<connection_name> pooltype=primary encrypt=no ENABLECLOUDDATALock=yes CLOUDDATALOCKDURation=<immutability_period_in_days>
Here is an example storage pool configuration:
Protect: IBM-SP-4>define stgpool WasabiObjectLockPool6 stgtype=cloud connection=WasabiWithObjectLock6 pooltype=primary encrypt=no ENABLECLOUDDATALock=yes CLOUDDATALOCKDURation=30
ANR2249I Storage pool WASABIOBJECTLOCKPOOL6 is defined.
Please note that data will be encrypted during transit and while at rest within Wasabi. You may also encrypt the data with customer-provided and managed keys before the data is sent to Wasabi by specifying “encrypt=yes”. The encryption configuration is beyond the scope of this document.
For non-Object Lock (non-immutable) buckets:
Protect: IBM-SP-4>define stgpool <pool_name> stgtype=cloud connection=<connection_name> pooltype=primary encrypt=no
Here is an example storage pool configuration. This assumes the WasabiWithoutObjectLock6 connection was defined previously.
Protect: IBM-SP-4>define stgpool WasabiWithoutObjectLockPool6 stgtype=cloud connection=WasabiWithoutObjectLock6 pooltype=primary encrypt=no
ANR2249I Storage pool WASABIWITHOUTOBJECTLOCKPOOL6 is defined.
Define a storage pool directory that will be used for temporary storage while backups are being sent to Wasabi. This directory must already exist on the server.
IBM-SP-4>define stgpooldirectory <pool_name> <directory_name>
As an example:
Protect: IBM-SP-4>define stgpooldirectory WasabiObjectLockPool6 /tsminst1/wasabi_object_lock_tmp_backups_6
ANR3254I Storage pool directory /tsminst1/wasabi_object_lock_tmp_backups_6 was defined
in storage pool WASABIOBJECTLOCKPOOL6.
Define a domain.
Protect: IBM-SP-4>define domain <domain>
For example in our testing:
Protect: IBM-SP-4>define domain test_dom6
ANR1500I Policy domain TEST_DOM6 defined.
Define a policy set.
Protect: IBM-SP-4>define policyset <domain> <policy_name>
In our testing:
Protect: IBM-SP-4>define policyset test_dom6 test_pol6
ANR1510I Policy set TEST_POL6 defined in policy domain TEST_DOM6.
Define a management class.
Protect: IBM-SP-4>define mgmtclass <domain> <policy_name> <management_class_name>
From our testing:
Protect: IBM-SP-4>define mgmtclass test_dom6 test_pol6 test_class6
ANR1520I Management class TEST_CLASS6 defined in policy domain TEST_DOM6, set TEST_POL6.
Assign the default management class.
Protect: IBM-SP-4>assign defmgmtclass <domain> <policy_name> <management_class_name>
In our example:
Protect: BM-SP-4>assign defmgmtclass test_dom6 test_pol6 test_class6
ANR1538I Default management class set to TEST_CLASS6 for policy domain TEST_DOM6, set TEST_POL6.
Define or update the STANDARD backup copy group to backup to Wasabi:
Protect: IBM-SP-4>define copygroup <domain> <policy_name> <management_clase_name> type=backup destination=<storage_pool_name> verexist=<max_number_of_backup_versions> verdeleted=<number_of_backup_versions_to_keep_if_object_deleted>
From our testing:
Protect: IBM-SP-4>define copygroup test_dom6 test_pol6 test_class6 type=backup destination=WasabiObjectLockPool6 verexist=8 verdeleted=8
ANR1530I Backup copy group STANDARD defined in policy domain TEST_DOM6, set TEST_POL6, management class TEST_CLASS6.
Activate the policy set.
Protect: IBM-SP-4>activate policyset <domain> <policy_name>
As an example from our testing:
Protect: IBM-SP-4>activate policyset test_dom6 test_pol6
ANR1554W DEFAULT Management class TEST_CLASS6 in policy set TEST_DOM6 TEST_POL6 does not have an ARCHIVE copygroup: files will not be archived by default if this set is activated.
Do you wish to proceed? (Yes (Y)/No (N)) y
ANR1554W DEFAULT Management class TEST_CLASS6 in policy set TEST_DOM6 TEST_POL6 does not
have an ARCHIVE copygroup: files will not be archived by default if this set is activated.
ANR1514I Policy set TEST_POL6 activated in policy domain TEST_DOM6.
Update your existing (or newly defined) node.
Protect: IBM-SP-4>update node <existing_node> domain=<domain>
For example:
Protect: IBM-SP-4>update node banode domain=test_dom6
ANR2729W This command will register the node to new domain TEST_DOM6.
Changing the domain will cause the node to be disassociated from the schedule of original domain.
Do you wish to proceed? (Yes (Y)/No (N)) y
ANR2063I Node BANODE updated.

Performing a Test Backup

Using the IBM Storage Protect Backup Archive client, perform a test backup to your Wasabi bucket.
Here is an example from our testing:
$ sudo dsmc selective /home/tsminst1/test2.txt
IBM Storage Protect
Command Line Backup-Archive Client Interface
Client Version 8, Release 1, Level 26.0
Client date/time: 06/10/2025 15:58:24
(c) Copyright IBM Corp. 1990, 2025. All Rights Reserved.
Node Name: BANODE
Session established with server IBM-SP-4: Linux/x86_64
Server Version 8, Release 1, Level 26.000
Server date/time: 06/10/2025 15:58:25 Last access: 06/10/2025 15:23:56
Selective Backup function invoked.
Normal File--> 28 /home/tsminst1/test2.txt [Sent]
Selective Backup processing of '/home/tsminst1/test2.txt' finished without failure.

Total number of objects inspected: 1
Total number of objects backed up: 1
Total number of objects updated: 0
Total number of objects rebound: 0
Total number of objects deleted: 0
Total number of objects expired: 0
Total number of objects failed: 0
Total number of objects encrypted: 0
Total number of objects grew: 0
Total number of retries: 0
Total number of bytes inspected: 28 B
Total number of bytes transferred: 61 B
Data transfer time: 0.00 sec
Network data transfer rate: 0.00 KB/sec
Aggregate data transfer rate: 0.05 KB/sec
Objects compressed by: 0%
Total data reduction ratio: 0.00%
Elapsed processing time: 00:00:01
Verify data is being written to your bucket. It may take some time for the server to process the backup and send it to Wasabi.
a. Login to the Wasabi console.
b. Click on Buckets, then click on the name of your bucket used by IBM Storage Protect.

c. Click on the name of one of the folders.

d. If Object Lock is being used, enable “Show Versions”.

e. Click on an object name. Ensure that under Object Lock the Mode is set to Compliance and the Retain Until date matches the CLOUDDATALOCKDURation value set above. This is how long the immutability period will last, not how long the object will be retained in your bucket.

Performing a Test Restore

Using the IBM Storage Protect Backup Archive client, perform a test restore to your Wasabi bucket.
Here is an example from our testing:
Remove the test file first.
$ sudo rm -f /home/tsminst1/test2.txt
Perform a test restore:
$ sudo dsmc restore /home/tsminst1/test2.txt
IBM Storage Protect
Command Line Backup-Archive Client Interface
Client Version 8, Release 1, Level 26.0
Client date/time: 06/10/2025 17:45:36
(c) Copyright IBM Corp. 1990, 2025. All Rights Reserved.
Node Name: BANODE
Session established with server IBM-SP-4: Linux/x86_64
Server Version 8, Release 1, Level 26.000
Server date/time: 06/10/2025 17:45:36 Last access: 06/10/2025 17:04:07
Restore function invoked.
Restoring 28 /home/tsminst1/test2.txt [Done]
Restore processing finished.

Total number of objects restored: 1
Total number of objects failed: 0
Total number of bytes transferred: 61 B
Data transfer time: 0.00 sec
Network data transfer rate: 29,785.15 KB/sec
Aggregate data transfer rate: 0.01 KB/sec
Elapsed processing time: 00:00:03

Setting a Backup Schedule

Login to the IBM Backup Archive command-line client, dsmadmc.
Define a backup schedule. Note that we have tested with “action=backup” to backup the objects specified. You may instead use “action=incremental” to backup only new objects and objects that have changed.
Protect: IBM-SP-4>define schedule <domain> <schedule_name> description=<description> objects=<objects_to_backup> startdate=<start_date> starttime=<start_time> period=<period> perunits=<units> action=<backup | incremental> duration=<length_of_startup_duration> durunits=<duration_units>
From our testing:
Protect: IBM-SP-4>define schedule test_dom6 daily_backup_6 description="Daily Backup 6" objects="/home/tsminst1/test6.txt" startdate=TODAY starttime=NOW period=1 perunits=days action=backup duration=11 durunits=minutes
ANR2500I Schedule DAILY_BACKUP_6 defined in policy domain TEST_DOM6.
See Define Schedule for further details.
Associate the schedule with your node:
Protect: IBM-SP-4>define association <domain> <schedule> <node>
For example:
Protect: IBM-SP-4>define association test_dom6 daily_backup_6 banode
ANR2510I Node BANODE associated with schedule DAILY_BACKUP_6 in policy domain TEST_DOM6.
Quit the Backup Archive Client to return to a bash prompt.
Enable the schedule to run:
$ nohup dsmc schedule 2> /dev/null &