Installation and Deployment Guidepublic.dhe.ibm.com/software/data/cognos/... · IBM OpenPages GRC...

IBM OpenPages GRC PlatformVersion 7.2.0

Installation and Deployment Guide

IBM

Note

Before using this information and the product it supports, read the information in “Notices” on page 387.

Product Information

This document applies to IBM OpenPages GRC Platform Version 7.2.0 and may also apply to subsequentreleases.

Licensed Materials - Property of IBM Corporation.© Copyright IBM Corporation, 2003, 2018.

US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP ScheduleContract with IBM Corp.

iv IBM OpenPages GRC Platform Version 7.2.0 : Installation and Deployment Guide

Contents

Note..................................................................................................................... iii............................................................................................................................ ivIntroduction....................................................................................................... xiii

Installation locations.................................................................................................................................xiii

Chapter 1. What's new?......................................................................................... 1New features in version 7.2.0.4...................................................................................................................1New features in version 7.2.0.3...................................................................................................................1New features in version 7.2.0.2...................................................................................................................1New features in version 7.2.0.1...................................................................................................................2New features in version 7.2.0......................................................................................................................2Changed features in version 7.2.0...............................................................................................................3New features in version 7.1.0.1...................................................................................................................3New features in version 7.1.0......................................................................................................................3Changed features in version 7.1.0...............................................................................................................3New features in version 7.0.0......................................................................................................................4

Use IBM Installation Manager to install the OpenPages GRC Platform Administrative Console.........4Topology-driven deployments in the IBM OpenPages GRC Platform Administrative Console............5New deployment wizards in the OpenPages GRC Platform Administrative Console........................... 5Embedded guidance for the Next Steps panel in the OpenPages GRC Platform Administrative

Console.............................................................................................................................................. 5Validation of software prerequisites...................................................................................................... 5

Changed features in version 7.0.0...............................................................................................................5Supported software environments........................................................................................................ 5Silent installations require a topology file and a deployment folder.................................................... 5Interactive Object Manager loading and status monitoring..................................................................5IBM Cognos BI Software Development Kit installation no longer required..........................................5

Chapter 2. OpenPages GRC Platform overview.......................................................7OpenPages GRC Platform components.......................................................................................................7

Database server......................................................................................................................................8Application server...................................................................................................................................8Reporting server..................................................................................................................................... 8Search server.......................................................................................................................................... 9

Server topology and installation configurations......................................................................................... 9Clustered OpenPages GRC Platform environments............................................................................ 11

Chapter 3. Installation of prerequisite software....................................................13Software prerequisites.............................................................................................................................. 13

Prerequisite software for all servers....................................................................................................13Prerequisite software for the database server.................................................................................... 13Prerequisite software for application servers..................................................................................... 14Prerequisite software for reporting servers.........................................................................................15Prerequisite software for OpenPages GRC Platform client computers.............................................. 16Prerequisite software for the search server........................................................................................ 17

VMWare configuration requirements on Windows computers.................................................................18

Chapter 4. Preparing your system for installation..................................................19Installation on different operating systems..............................................................................................20Super Administrator...................................................................................................................................20

v

Users and groups for installations on Windows........................................................................................20Users and user groups for installation on AIX and Linux..........................................................................21Enabling Data Execution Prevention for essential Windows programs and services.............................. 22Installing IBM Installation Manager..........................................................................................................22WebSphere Application Server installations.............................................................................................23

Installing WebSphere Application Server Network Deployment........................................................23Creating the WebSphere Application Server profiles for IBM Runtime Environment for Java.......... 24

Installing the OPAdminConsoleRemote component................................................................................ 25Creating the OpenPages GRC Platform directories for AIX or Linux........................................................ 26Setting the file descriptor limit for OpenPages GRC Platform users on AIX ........................................... 26Setting the file descriptor limit for OpenPages GRC Platform users on Linux ........................................ 27Optional: Changing the Temp directory for Windows installations.......................................................... 28Optional: Changing the TEMP directory for AIX installations....................................................................28Port assignments ...................................................................................................................................... 29Configuring the hosts file for OpenPages GRC Platform.........................................................................31

Chapter 5. IBM DB2 database server and client setup for OpenPages GRCPlatform.......................................................................................................... 33IBM DB2 database server installations.....................................................................................................33

The DB2 Text Search component ........................................................................................................34Operating system user accounts for IBM DB2 databases........................................................................34

Users and groups for application servers on Linux or AIX that use DB2 databases.......................... 35Creating workflow schemas.................................................................................................................36

Preparing the DB2 database instance for OpenPages GRC Platform.......................................................37DB2 database client installations..............................................................................................................39

Creating and configuring a DB2 client instance in AIX and Linux environments............................... 39Creating the OpenPages GRC Platform database manually..................................................................... 40Creating the OpenPages GRC Platform database manually from the OpenPages application server

computer...............................................................................................................................................42Manually creating database objects in the OpenPages GRC Platform repository................................... 44Testing the connection between the DB2 client and server ....................................................................52Upgrade IBM DB2...................................................................................................................................... 53

Upgrading IBM DB2 (Windows)........................................................................................................... 54Upgrading IBM DB2 (Linux or AIX)...................................................................................................... 56Dropping the DB2 Text Search index and disabling DB2 Text Search................................................ 60Copying database driver files...............................................................................................................61Copy Java routine class files to the DB2 server.................................................................................. 61

Chapter 6. Oracle database server and client setup for OpenPages GRC Platforminstallations.................................................................................................... 63Oracle database server installations.........................................................................................................63Creating users and groups on the Oracle database server for Linux operating systems........................ 63Oracle package dependencies.................................................................................................................. 64Adding an Oracle listener for the OpenPages GRC Platform database....................................................66Creating an Oracle database instance for the OpenPages GRC Platform repository.............................. 67Add a local net service name for the OpenPages GRC Platform database.............................................. 68Setting the Oracle environment variables for the database server..........................................................68Scripts to manually create the OpenPages GRC Platform database schema in Oracle before

installation............................................................................................................................................ 69Changing the database object names for Oracle Automatic Storage Management................................ 70Starting and stopping the database server in a Windows environment...................................................73Testing the connections to the database server and the OpenPages GRC Platform repository............. 73Oracle database client installations..........................................................................................................74

Creating users and groups for application servers on UNIX that use Oracle databases................... 74Setting the ORACLE_HOME environment variable on the OpenPages GRC Platform application

servers............................................................................................................................................. 76Testing the connection to the OpenPages GRC Platform repository from the database client......... 77

vi

Custom OpenPages database schema installations........................................................................... 77

Chapter 7. IBM Cognos Business Intelligence installations....................................79Installing IBM Cognos Business Intelligence .......................................................................................... 80Creating users and groups for reporting servers on UNIX that use Oracle databases ........................... 82Web server configuration options for IBM Cognos BI.............................................................................. 83

Configuring the IBM Cognos gateway on Microsoft Internet Information Services...........................84Configuring Apache Web Server or IBM HTTP Server.........................................................................85

Configuring a connection to the content store for Oracle database.........................................................86Configuring a connection to the content store for DB2 database............................................................ 88Saving your settings and starting the IBM Cognos services.....................................................................89Prerequisite tasks for CommandCenter installations...............................................................................90

Setting database environment variables for reporting servers on Windows operating systems ......90Setting database environment variables for the reporting server on AIX and Linux operating

systems............................................................................................................................................91Testing the connection to the OpenPages GRC Platform repository from the database client......... 92Enabling the connection to a DB2 database from the OpenPages GRC Platform

CommandCenter computer............................................................................................................ 93Creating the installation directory for CommandCenter on AIX and Linux operating systems......... 94

Chapter 8. Installing the OpenPages GRC Platform Administrative Console........... 95

Chapter 9. Upgrading OpenPages GRC Platform....................................................97Upgrade process for OpenPages GRC Platform........................................................................................97Preparing to upgrade................................................................................................................................. 98

Backing up directories and files...........................................................................................................99Backing up the existing OpenPages GRC Platform environment......................................................100Dropping the DB2 reporting schema................................................................................................. 102Exporting OpenPages GRC Platform data......................................................................................... 102Exporting the Cognos content store.................................................................................................. 103Create the reporting schema for the DB2 server.............................................................................. 103Update the database schema............................................................................................................104Verifying that services are running.................................................................................................... 109

Upgrading Cognos Business Intelligence............................................................................................... 109Preparing the OpenPages GRC Platform application servers for upgrade.............................................111

Updating WebSphere Application Server profiles to IBM Runtime Environment for Java.............. 111Configuring the default profile to accept the signer certificates...................................................... 113Saving custom settings in configuration files after the upgrade.......................................................114Disabling single sign-on..................................................................................................................... 114Disabling system admin mode...........................................................................................................115Modifying the ObjectManager properties file to disable object force update strings...................... 115

Upgrading an OpenPages GRC Platform deployment............................................................................ 115Upgrade installation recovery options.................................................................................................... 119

Rolling back manually to a previous installation...............................................................................119Post upgrade tasks.................................................................................................................................. 123

Updating the list of valid domains and host names.......................................................................... 124Starting services after the upgrade................................................................................................... 124Upgrade verification tests..................................................................................................................124Updating the reporting framework.................................................................................................... 125Testing IBM Cognos Business Intelligence after the upgrade..........................................................126Upgrading deployed images and custom query subjects on the reporting server...........................126Load the OpenPages ORM data......................................................................................................... 126Configuring the Process Analysis Visualization report to launch......................................................130Custom settings in configuration files .............................................................................................. 130Removing standard triggers from the trigger configuration file........................................................131OpenPages solutions post installation tasks.....................................................................................132

vii

Chapter 10. Migrating OpenPages GRC Platform................................................. 135Migrate from OpenPages GRC Platform version 5..................................................................................135

Exporting data from your current environment.................................................................................136Creating the Oracle database schema and importing the database................................................ 136Updating the Oracle database schema............................................................................................. 140Migrating an OpenPages GRC Platform deployment........................................................................ 142Creating default profiles and updating workflow jobs...................................................................... 146

Migrate from OpenPages GRC Platform version 6..................................................................................147Import the OpenPages GRC Platform database and upgrade database schema............................ 148

Migrate from OpenPages GRC Platform version 7..................................................................................154Import the OpenPages GRC Platform database and upgrade database schema............................ 156

Post migration tasks................................................................................................................................ 162Loading OpenPages GRC Platform ORM reports...............................................................................163Configuring the Process Analysis Visualization report to launch......................................................164

Chapter 11. Installing a new OpenPages GRC Platform deployment.................... 165Granting control on SYSTOOLS schema objects to the DB2 database instance owner on the

Windows operating system................................................................................................................ 169Testing the connections to the database server and the OpenPages GRC Platform repository........... 170Installing the OpenPages GRC Platform solutions................................................................................. 170

Preparing the system for installation.................................................................................................170Installing the OpenPages GRC Platform solutions data................................................................... 171Testing the OpenPages GRC Platform solutions installation............................................................ 171Updating the reporting schema and reporting framework............................................................... 171Configuring the temporary folder for reports and notifications........................................................172

Chapter 12. Post installation tasks..................................................................... 173Backing up and restoring the Administrative Console workspace.........................................................173OpenPages GRC Platform CommandCenter post installation tasks...................................................... 173

Copying the IBM Global Security Kit files to the DB2 server installations on Windows operatingsystems......................................................................................................................................... 173

Starting the OpenPages GRC Platform Framework Model Generator service on Windows............ 174Creating the reporting schema and framework................................................................................ 174OpenPages GRC Platform CommandCenter portal security.............................................................175Creating an open session command block for the OpenPages GRC Platform data source............. 175

Configuring OpenPages GRC Platform to work on a single computer with an Oracle database...........176Configuring OpenPages GRC Platform to work on a single computer with a DB2 database.................177Verification checklist............................................................................................................................... 177Administrative server tuning................................................................................................................... 179

Enable simultaneous access to OpenPages GRC Platform and Fujitsu Interstage BPM................. 179Preventing concurrency conflicts for installations that use Oracle databases................................ 180Optional: Increasing the paging file size on Windows computers....................................................181Optional: Increasing the paging file size on AIX computers.............................................................181

Database server tuning ...........................................................................................................................181Tuning the performance of the database instance........................................................................... 181Memory tuning guidelines for Oracle databases...............................................................................182Changing the IBM DB2 varchar limit for IBM Cognos reports.......................................................... 182

Enabling LDAP..........................................................................................................................................183Disabling LDAP.........................................................................................................................................185Search server post installation tasks...................................................................................................... 185

Copying database driver files to the search server........................................................................... 185Start or stop the global search server using scripts in version 7.2.0.1 or later ...............................186Setting login information for the search server.................................................................................187Setting up SSL for the global search service..................................................................................... 188Search server tuning.......................................................................................................................... 191Global search and the reporting schema.......................................................................................... 192

viii

Chapter 13. Reinstalling the search server on a different computer..................... 195

Chapter 14. Installing QRadar integration.......................................................... 197Setting up the QRadar SSL certificate..................................................................................................... 197Importing the assembly line................................................................................................................... 198Configuring the connector.properties file............................................................................................... 199Configuring the Connector.Passwords properties file............................................................................ 199

Chapter 15. Starting and stopping servers.......................................................... 201Starting application servers.................................................................................................................... 201

Microsoft Windows services.............................................................................................................. 201Microsoft Windows commands..........................................................................................................202AIX and Linux scripts......................................................................................................................... 203Determining application readiness....................................................................................................203Loading the approval app configuration............................................................................................ 204

Automatically starting application servers in Windows......................................................................... 204Starting all application services in Windows using a script....................................................................204Starting application services individually using Windows services....................................................... 205Starting all application servers in AIX and Linux using a script............................................................. 205Starting application servers in AIX and Linux individually using scripts................................................206Starting and stopping the global search services...................................................................................206Stopping application servers...................................................................................................................208Stopping application servers in a Windows environment...................................................................... 208

Automatically stopping application servers in Windows.................................................................. 208Stopping all application services in Windows using a script.............................................................209Stopping application services individually using Windows services................................................ 209

Stopping all application servers in AIX and Linux using a script............................................................210Stopping application servers in AIX and Linux individually using scripts.............................................. 210Starting and stopping the database server in a Windows environment................................................ 211Starting and stopping the database server in an AIX and Linux environment.......................................212Starting and stopping the Cognos services.............................................................................................213

Using the IBM Cognos configuration tool to start and stop the IBM Cognos service...................... 213Using the Windows operating system to start and stop the IBM Cognos service............................213Using the AIX or Linux operating system to start and stop IBM Cognos service............................. 214Starting and stopping the OpenPages GRC Platform Framework Model Generator service on

Windows........................................................................................................................................214Starting and stopping the OpenPages GRC Platform Framework Model Generator service on

AIX or Linux................................................................................................................................... 214

Chapter 16. Configure clustered environments................................................... 217Clustered OpenPages GRC Platform Configurations ............................................................................. 217

Increasing the Oracle connection limit............................................................................................. 217Configuring OpenPages GRC Platform applications to use a domain account on Windows

operating systems.........................................................................................................................218Configuring file share permissions on AIX or Linux operating systems........................................... 219Sharing a network OpenPages GRC Platform storage directory on Windows operating systems...219Sharing a network OpenPages GRC Platform storage directory on AIX or Linux operating

systems......................................................................................................................................... 221Configuring IBM HTTP Server for load balancing .................................................................................. 224

Adding a load-balancing port to virtual hosts................................................................................... 226Configuring the HTTP Server for SAMLV2.0 single sign-on ..............................................................226Configuring property files for load balancing on Windows, AIX, and Linux operating systems.......227Configuring property files for each OpenPages GRC Platform instance...........................................228Customizing the load balancer for large data sets............................................................................229

Load balancing the OpenPages GRC Platform reporting server.............................................................229Adding OpenPages GRC Platform servers to the Cognos Application Firewall safe list.................. 230

ix

Communication between OpenPages GRC Platform CommandCenter servers.............................. 230Configuring the primary reporting server.......................................................................................... 230Configuring secondary servers.......................................................................................................... 231Configuring an Apache load balancer or proxy server...................................................................... 232Using a reverse proxy server for load balancing............................................................................... 232Changing the CommandCenter host settings ...................................................................................233

Chapter 17. Single sign-on integration for OpenPages GRC Platform applicationserver and the reporting server...................................................................... 235Configuring header-based single sign-on............................................................................................... 235Configuring SAML V2.0 single sign-on.................................................................................................... 236Configuring the single signon logout destination................................................................................... 239Enabling single sign-on........................................................................................................................... 240Disabling single sign-on for OpenPages GRC Platform.......................................................................... 240Configuring single signon for a reporting server.....................................................................................240

Chapter 18. Fix packs........................................................................................ 243Fix Pack 7.2.0.2....................................................................................................................................... 243

Installation process overview for Fix Pack 7.2.0.2........................................................................... 243Preinstallation tasks for Fix Pack 7.2.0.2.......................................................................................... 244Installation tasks for Fix Pack 7.2.0.2............................................................................................... 247Postinstallation tasks for Fix Pack 7.2.0.2........................................................................................ 253Additional tasks for Fix Pack 7.2.0.2................................................................................................. 256

Fix Pack 7.2.0.3....................................................................................................................................... 260Installation process overview for Fix Pack 7.2.0.3........................................................................... 260Preinstallation tasks for Fix Pack 7.2.0.3.......................................................................................... 261Installation tasks for Fix Pack 7.2.0.3............................................................................................... 264Postinstallation tasks for Fix Pack 7.2.0.3........................................................................................ 270Additional tasks for Fix Pack 7.2.0.3................................................................................................. 275

Fix Pack 7.2.0.4....................................................................................................................................... 278Installation process overview for Fix Pack 7.2.0.4........................................................................... 279Preinstallation tasks for Fix Pack 7.2.0.4.......................................................................................... 280Installation tasks for Fix Pack 7.2.0.4............................................................................................... 283Postinstallation tasks for Fix Pack 7.2.0.4........................................................................................ 290Additional tasks for Fix Pack 7.2.0.4................................................................................................. 295

Fix Pack 7.2.0.5 and later fix packs........................................................................................................ 299Installation process overview for Fix Pack 7.2.0.5 or later.............................................................. 299Preinstallation tasks for Fix Pack 7.2.0.5 or later............................................................................. 300Installation tasks for Fix Pack 7.2.0.5 or later.................................................................................. 304Postinstallation tasks for Fix Pack 7.2.0.5 or later............................................................................310Additional tasks for Fix Pack 7.2.0.5 or later.................................................................................... 318

Chapter 19. Uninstalling OpenPages GRC Platform............................................. 323Uninstalling the search server.................................................................................................................323Uninstalling OpenPages GRC Platform on Microsoft Windows operating systems............................... 323Uninstalling OpenPages GRC Platform on Linux or AIX computers.......................................................325

Chapter 20. Approval app.................................................................................. 329Deployment process overview for the approval app.............................................................................. 329Predeployment tasks for the approval app.............................................................................................330Preparing for the deployment of the approval app.................................................................................330Supported data types and field types in the approval app.....................................................................330Ensuring that you have the fields and field groups required for the approval app profile ................... 331

Excluding object types from the approval app profile ......................................................................332Excluding the Loss Event object type from the approval app profile ...............................................334Notes for users who do not have the 7.2 solutions schema.............................................................337

Loading the approval app profile ............................................................................................................338

x

Completing the approval app deployment..............................................................................................340Configuring the JSON file for the approval app ......................................................................................340

Approval app certification questions.................................................................................................344Customizing the JSON file for the approval app ...............................................................................346

Conditional steps for the approval app................................................................................................... 347

Chapter 21. Loss Event Entry..............................................................................349Installation process overview for Loss Event Entry................................................................................349Preinstallation tasks for Loss Event Entry...............................................................................................350Installation tasks for Loss Event Entry....................................................................................................350

Preparing for the installation of Loss Event Entry............................................................................. 350Installing Loss Event Entry.................................................................................................................350Log files for Loss Event Entry............................................................................................................. 351

Postinstallation tasks for Loss Event Entry.............................................................................................352Modifying the web.xml files for Loss Event Entry..............................................................................352Setting passwords for Loss Event Entry users.................................................................................. 353Configuration of Loss Event Entry......................................................................................................353Conditional steps for Loss Event Entry..............................................................................................353

Additional tasks for Loss Event Entry......................................................................................................353Silent installation for Loss Event Entry..............................................................................................353Manual data loading for Loss Event Entry......................................................................................... 354

Appendix A. Silent installations......................................................................... 359Creating a topology file for a silent installation...................................................................................... 359Creating a deployment directory.............................................................................................................360Running a silent installation.................................................................................................................... 360

Appendix B. Troubleshooting problems.............................................................. 361Troubleshooting resources......................................................................................................................361

Support Portal.................................................................................................................................... 362Service requests ................................................................................................................................362OpenPages GRC Platform Customer Center..................................................................................... 362Fix Central.......................................................................................................................................... 362Knowledge bases............................................................................................................................... 362Log files...............................................................................................................................................363

Order of starting and stopping services ................................................................................................. 365Reusing property settings for similar deployments................................................................................365Manually creating the reporting tablespace and user for Oracle databases......................................... 365Known problems and solutions for global search.................................................................................. 366

Forcing a reset of global search.........................................................................................................367Installation issues and solutions.............................................................................................................368

Update to IBM Installation Manager 1.8 is blocked when the data location is the same as theinstallation location.......................................................................................................................368

OpenPages GRC Platform migration utility fails................................................................................369REST API security check does not complete.................................................................................... 369Issues with enabling global security................................................................................................. 370Install the 32-bit Oracle 12.1.0.2 client and 64-bit Oracle 12.1.0.2 database server on the

same computer............................................................................................................................. 370Issues with importing data to Oracle 12.1.0.2 using Oracle data pump......................................... 370Memory issue when installing OpenPages GRC Platform Administrative Console on Linux........... 371Unable to install OpenPages GRC Platform Administrative Console using WinZip..........................371SQL0569N Authorization ID "user_name" does not uniquely identify a user, a group or a role in

the system error............................................................................................................................371OpenPages GRC Platform and software that is installed in a directory that contains spaces.........371Garbled characters are displayed on the OpenPages GRC Platform home page when you log in

for the first time............................................................................................................................ 372Manually loading the configuration data after a new installation.....................................................372

xi

Manually loading the configuration data after an upgrade............................................................... 373Dropping the DB2 database for the OpenPages GRC Platform repository.......................................375Updating the services for multiple DB2 instances............................................................................ 375OP-03620: The Reporting Schema has not been instantiated error................................................376Errors extracting installation files......................................................................................................377Error updating password encryption module during the installation...............................................377Incorrect Java locations causes validation errors............................................................................ 377Uninstalling OpenPages GRC Platform with an Oracle database before you reinstall ....................377Issues when importing databases.....................................................................................................379Cognos content store import fails .....................................................................................................379Admin user name not set to OpenPagesAdministrator.................................................................... 379High CPU use with Windows 2012 R2 servers..................................................................................380Updating the Oracle client path on the reporting server ..................................................................380Issues when you use IBM Installation Manager on Linux................................................................ 380Error on the approval app home page: The requested operation could not be completed.............380IBM WebSphere profile errors or SOAP port conflicts after you change an application server

host name......................................................................................................................................380Troubleshooting IBM OpenPages GRC Platform solutions.................................................................... 382

ObjectManager loader failed message during the installation......................................................... 382Importing the solutions deployment package.................................................................................. 382Reporting Framework generation fails with CAMCryptoBC error..................................................... 383

Notices..............................................................................................................387Index................................................................................................................ 391

xii

Introduction

IBM® OpenPages® GRC Platform is an integrated governance, risk, and compliance platform that enablescompanies to manage risk and regulatory challenges across the enterprise.

Audience

The IBM OpenPages GRC Platform Installation and Deployment Guide provides instructions for installingand deploying the OpenPages GRC Platform application.

Finding information

To find product documentation on the web, including all translated documentation, access IBMKnowledge Center (http://www.ibm.com/support/knowledgecenter).

Accessibility features

Accessibility features help users who have a physical disability, such as restricted mobility or limitedvision, to use information technology products. OpenPages GRC Platform documentation has accessibilityfeatures. PDF documents are supplemental and include no added accessibility features.

Installation locationsThe installation directory is the location of product artifacts after a package, product, or component isinstalled. The following table lists the conventions that are used to refer to the installation location ofinstalled components and products:

Important: Directory locations that contain spaces are not supported. IBM OpenPages GRC Platform orany software that is used by it must not be installed into a directory with spaces. For example, do notinstall database server, database client, or application server software into the Program Filesdirectory.

Table 1: Variable notations for installation directories

Directory Description

OP_Home The installation directory where OpenPages GRC Platform is installed.

For example:

• on Microsoft Windows operating systems: c:\OpenPages• on AIX® and Linux operating systems: /opt/OpenPages

Workflow_Home The installation location of the Fujitsu Interstage Business ProcessManagement (BPM) server.

For example:

• on Windows, C:\Fujitsu\InterstageBPM• on AIX and Linux, /opt/Fujitsu/InterstageBPM

http://www.ibm.com/support/knowledgecenter


Table 1: Variable notations for installation directories (continued)

Directory Description

ORACLE_Home The installation location of the Oracle database server.

For example:

• on Windows, C:\app\Administrator\product\12.1\client_1• on AIX and Linux, /home/oracle/app/oracle/product/12.1/client_1

DB2_Home The installation location of the DB2® software.

For example:

• on Windows, C:/IBM/SQLLIB• on AIX and Linux, /home/db2inst1/sqllib

WAS_HOME The installation location of the WebSphere® Application Server.

For example:

• on Windows, C:\IBM\WebSphere\AppServer• on AIX and Linux, /opt/IBM/WebSphere/AppServer

Cognos_Home The installation location of Cognos® Business Intelligence (BI).

For example:

• on Windows, C:\IBM\cognos\c10_64• on AIX and Linux, /usr/IBM/cognos/c10_64

JAVA_Home The installation location of your Java™ Runtime Environment (JRE) oryour Java Development Kit (JDK).

JDK example:

• on Windows, C:\IBM\WebSphere\AppServer\java_1.7.1_64• on AIX and Linux, /opt/IBM/WebSphere/AppServer/java_1.7.1_64

JRE example:

• on Windows, C:\IBM\WebSphere\AppServer\java\jre• on AIX and Linux, /opt/java/jre

CommandCenter_Home

CC_Home

The installation location of the OpenPages GRC PlatformCommandCenter.

For example:

• on Windows, C:\OpenPages\CommandCenter• on AIX and Linux, /opt/OpenPages/CommandCenter

xiv IBM OpenPages GRC Platform Version 7.2.0 : Installation and Deployment Guide

Chapter 1. What's new?New and changed features affect the installation and configuration of IBM OpenPages GRC Platform. Usethis information to help you plan your upgrade and deployment strategies and the training requirementsfor your users.

For information about all new features for this release, see the IBM OpenPages GRC Platform NewFeatures Guide.

For an up-to-date list of environments that are supported by OpenPages GRC Platform, see the IBMSoftware Product Compatibility Reports (http://www.ibm.com/support/docview.wss?uid=swg27039467).

New features in version 7.2.0.4The new features in IBM OpenPages GRC Platform, version 7.2.0.4, are described in the followingsections.

Collect and view logs

The new LogCollector tool provides a command-line interface that you can use to collect log files anddiagnostic data from the IBM OpenPages GRC Platform environment.

With the LogCollector tool, you can collect log and diagnostic files from the IBM OpenPages GRC Platformenvironment and from the IBM OpenPages database.

For more information, see “Collect log files and diagnostic data” on page 363.


Changes to DB2 conformance

Version 7.2.0.3 introduces support for IBM DB2 version 11.1. IBM DB2 10.5.0.5 special_33521 is alsosupported.

For more information, see supported software environments (http://www.ibm.com/support/docview.wss?uid=swg27039467).

For information about upgrading to IBM DB2 version 11.1, see “Upgrade IBM DB2” on page 53.


OpenPages Loss Event Entry

You can use the new optional, chargeable component, IBM OpenPages Loss Event Entry, to enable usersacross an organization to quickly create loss events. It is easy to use and task focused for users with noexperience with OpenPages.

For more information, see Chapter 21, “Loss Event Entry,” on page 349.

http://www.ibm.com/support/docview.wss?uid=swg27039467




Approval app

The approval app is an optional feature that leverages the power of IBM OpenPages GRC Platform andprovides an easy-to-use interface for quickly taking action on a review, approval, or attestation requestwith confidence and full knowledge of the context surrounding the request. The approval app works withobjects that are set up for the configurable lifecycle.

For more information, see Chapter 20, “Approval app,” on page 329.

New features in version 7.2.0New features affect the installation and configuration of IBM OpenPages GRC Platform.

Software versions

Support for the Oracle 12.1.0.2 database server and database client is now supported in addition to theexisting supported versions.

Microsoft Internet Explorer version 11 is now provided in addition to the existing supported versions.

Google Chrome is now a supported web browser.

OpenPages GRC Platform requires new versions of some software. If you are upgrading or migrating, youmust update your environment to use these versions:

• IBM Runtime Environment for Java 1.7.3• IBM WebSphere Application Server Network Deployment 8.5.5.5• IBM Cognos Business Intelligence (BI) version 10.2.2.1

IBM WebSphere Liberty Profile 8.5.5.6 is now installed with OpenPages CommandCenter instead ofApache Tomcat. Tomcat is no longer supported.

Two versions of Dojo are now installed when you deploy OpenPages. Dojo 1.8.4 is required forvisualization reports and Dojo 1.10.4 is used in the OpenPages application.

Search server

Global search is an optional component that you can install so users can search easily for objects acrossthe entire application. The search server that you install for global search is deployed as part of theOpenPages GRC Platform application from the Administrative Console.

For more information, see “Search server” on page 9.

IBM QRadar integration

IBM QRadar® integration is an optional project that you can install to import offenses from QRadar toOpenPages GRC Platform as incidents.

For more information, see Chapter 14, “Installing QRadar integration,” on page 197.

SAML V2.0 single sign-on

You can now configure IBM OpenPages GRC Platform to use SAML V2.0 for single sign-on without theneed for custom code and without involvement from IBM Services.

For more information, see “Configuring SAML V2.0 single sign-on” on page 236.

2 IBM OpenPages GRC Platform Version 7.2.0 : Installation and Deployment Guide

Changed features in version 7.2.0The following topics describe features that have changed since the last release of IBM OpenPages GRCPlatform.

New objects added to profiles

After you upgrade or migrate, new object types are added to the master profiles.

• The Questionnaire subcomponent includes new object types - Questionnaire Template, QuestionnaireAssessment, Section Template, SubSection Template, Question Template.

• A new subcomponent, Assessment Program, is added. It includes a new object type - Program.• The Regulatory Library subcomponent includes a new object type - Regulation Initiative.

For more information, see the IBM OpenPages GRC Platform Solutions Guide.

Changes to solutions trigger files

After you upgrade or migrate, the following files are updated:

• Standard solutions classes are removed from the openpages-ext.jar file.• A new file is deployed, openpages-solutions.jar, that contains the standard solutions classes.

When you add custom triggers, do not include the class files the openpages-solutions.jar file. If youalready added custom trigger class files to openpages-solutions.jar for the previous release, youcan back up the class file before you upgrade, and restore it manually.

For more information, see “Removing standard triggers from the trigger configuration file” on page 131.

New features in version 7.1.0.1The following topics describe the new features for this release.

Support for Oracle 12.1.0.2 database server

Support for the Oracle 12.1.0.2 database server is now provided in addition to the existing supportedversions.

New features in version 7.1.0The following topics describe the new features for this release.

Use IBM Installation Manager to install OpenPages GRC Platform solutions

You now use IBM Installation Manager to install, update, and uninstall IBM OpenPages GRC Platformsolutions.

Changed features in version 7.1.0The following topics describe features that have changed since the last release.

IBM JRE for OpenPages GRC Platform is included with the Administrative Console

When you install the IBM OpenPages GRC Platform Administrative Console, IBM Runtime Environment forJava for OpenPages GRC Platform is now installed as well. It is no longer necessary to install Java as aseparate component.

What's new? 3

REST API security or IBM WebSphere Application Server global security must be enabled

IBM WebSphere Application Server global security is now enabled by default on the application serverswhen you first install IBM OpenPages GRC Platform.

If you enabled REST API security or WebSphere Application Server global security before upgrading ormigrating OpenPages GRC Platform, no further action is required.

If you did not enable REST API security or IBM WebSphere Application Server global security beforeupgrading or migrating, you must enable REST API security manually.

Migrating OpenPages GRC Platform

The process for migrating from a previous version of IBM OpenPages GRC Platform has changed. For moreinformation, see Chapter 10, “Migrating OpenPages GRC Platform,” on page 135.

Increased support for concurrent users

IBM OpenPages GRC Platform now supports up to 1000 concurrent users on a single node.

Default folder for adding new child objects

If you upgrade or migrate from IBM OpenPages GRC Platform 7.0, when you create a new object, thesystem uses the default folder setting to determine in which folder to create child objects.

In previous releases, when the parent_entity folder was set as the default folder, child objects wereadded to the next level parent folder.

In this release, when the parent_entity is set as the default folder, new child objects are added to theparent_entity folder.

Check the value of this setting after upgrading or migrating to ensure that it is correctly set for yourrequirements.

For more information, see the IBM OpenPages GRC Platform Administrator's Guide.

New features in version 7.0.0The following topics describe the new features for this release.

Use IBM Installation Manager to install the OpenPages GRC Platform AdministrativeConsole

Use IBM Installation Manager to install, update, and uninstall the IBM OpenPages GRC PlatformAdministrative Console. Use the Administrative Console to install, configure, and deploy OpenPagescomponents to WebSphere Application Server.

You can run the Administrative Console application interface on computers that are running MicrosoftWindows operating systems. To use the Administrative Console on Linux or AIX operating systems, youmust use it in silent mode.


Topology-driven deployments in the IBM OpenPages GRC Platform AdministrativeConsole

The IBM OpenPages GRC Platform Administrative Console provides a topological view of yourdeployments. You can manage the topology by adding components, such as more application servers toan existing OpenPages GRC Platform deployment.

New deployment wizards in the OpenPages GRC Platform Administrative ConsoleThe IBM OpenPages GRC Platform Administrative Console has changed and now provides newdeployment wizards for managing your OpenPages deployments.

Wizards allow you to create new deployments and upgrade or migrate existing deployments. You can alsoextend existing OpenPages GRC Platform deployments, such as by adding servers to the deployment.

Embedded guidance for the Next Steps panel in the OpenPages GRC PlatformAdministrative Console

The Next Steps panel displays the status of your IBM OpenPages GRC Platform deployment, and alsoprovides help for completing the next steps in the deployment.

Validation of software prerequisitesThe IBM OpenPages GRC Platform Administrative Console provides validation of your softwareprerequisites, such as installed versions of your database server, database client, WebSphere ApplicationServer, and IBM Cognos Business Intelligence software.

If the software does not meet the minimum requirements, you must update the software before you canproceed with the installation.

Changed features in version 7.0.0The following topics describe features that have changed since the last release.

Supported software environmentsEnsure that you review the software environments that are supported by IBM OpenPages GRC Platformversion 7.0. New versions and end of support for various environments can affect your upgrade strategy.

You can review the supported environments by using the IBM Software Product Compatibility Reports(http://www.ibm.com/support/docview.wss?uid=swg27039467).

Silent installations require a topology file and a deployment folderBefore you run a silent installation, you must create a topology file, defining your installation, and identifya deployment folder.

You can create the topology file and the deployment folder from the IBM OpenPages GRC PlatformAdministrative Console.

Interactive Object Manager loading and status monitoringUse the Config > OM Load tab in the IBM OpenPages GRC Platform Administrative Console to view thestatus, load, and reload Object Manager schema data to your OpenPages database.

IBM Cognos BI Software Development Kit installation no longer requiredThe IBM OpenPages GRC Platform reporting server no longer requires the IBM Cognos BusinessIntelligence (BI) Software Development Kit.

What's new? 5



Chapter 2. OpenPages GRC Platform overviewYou use IBM OpenPages GRC Platform to manage risk and regulatory challenges across the enterprise.OpenPages GRC Platform provides core services and components that span risk and compliance domains.These components include operational risk, policy and compliance, financial controls management, ITgovernance, internal audit, regulatory compliance management, and model risk governance.

The following diagram shows the architectural components for OpenPages GRC Platform applications.The platform contains the database and key services such as the security framework and reportingframework, the workflow engine, and document management. The solutions are configurations that workwith the platform.

Figure 1: OpenPages GRC Platform components

OpenPages GRC Platform componentsIBM OpenPages GRC Platform consists of the following components:

• A database server for hosting the OpenPages GRC Platform repository.• One or more application servers for hosting the OpenPages GRC Platform application and the

OpenPages GRC Platform workflow server.• One or more reporting servers for hosting IBM Cognos Business Intelligence and OpenPages GRC

Platform CommandCenter.• Up to one search server (optional) for hosting the OpenPages GRC Platform global search component.

After installation, users can access OpenPages GRC Platform from a separate client computer.

Database serverA database server is required to host the IBM OpenPages GRC Platform repository. The repository is acentral source for metadata management, versioned application data, and access control.

To install the IBM OpenPages GRC Platform application, you must create an OpenPages databaseschema, a set of database users, and a tablespace.

You can automatically create and configure these components during the OpenPages installation.Alternatively, you can create them manually before you install the OpenPages application servers.

You can use an IBM DB2 database or an Oracle database for the OpenPages repository.

Application serverAn application server is required to host the IBM OpenPages GRC Platform application and theOpenPages GRC Platform workflow server.

You must install the IBM WebSphere Application Server software before you install OpenPages GRCPlatform.

OpenPages GRC Platform application

The IBM OpenPages GRC Platform application runs the application solutions, and includes the definitionand administration of business metadata, UI views, user profiles, and user authorization.

OpenPages GRC Platform workflow server

IBM OpenPages GRC Platform workflow server provides automated workflow capabilities to ensureconsistent execution of business processes.

OpenPages workflow technology automates GRC processes, enabling companies to focus their resourceson the gray areas of business where critical human decision making is required. Automation can helpoptimize the flow of risk and compliance activities.

Fujitsu Interstage Business Process Management (BPM) software is used for the workflow server. It isautomatically installed as part of the OpenPages GRC Platform installation.

Reporting serverA reporting server is required to host IBM Cognos Business Intelligence (BI) and OpenPages GRCPlatform CommandCenter.

Cognos Business Intelligence

Cognos BI provides executive dashboards and reports that are designed to accelerate the review andapproval of governance, risk, and compliance management (GRCM) information throughout theenterprise. Business users can browse through complex information easily by clicking dashboardelements to drill down through detailed reports.

Cognos BI includes a content store. This is a relational database that contains data, such as reportspecifications, published models, and the packages that contain them. The content store also containsconnection information for data sources.

If you install more than one reporting server with OpenPages GRC Platform, you only need one IBMCognos content store database for all servers. The main sever is known as the active reporting server, andall secondary servers are known as standby reporting servers.

For more information on active and standby servers, see the IBM Cognos Business Intelligence Installationand Configuration Guide.

OpenPages GRC Platform CommandCenter

OpenPages GRC Platform CommandCenter integrates the OpenPages application with Cognos BI so youcan create reports.


It installs the OpenPages Reporting Framework Generator and the OpenPages security provider, createsthe OpenPages data sources, and imports the standard OpenPages report packages.

Search serverOpenPages GRC Platform supports a single search server in the enterprise configuration.

The search server is required to host the OpenPages GRC Platform global search component. Globalsearch is an optional component that you can install so users can search easily for objects across theentire application.

For best performance, install the search server on a separate computer.

Server topology and installation configurationsBefore you install IBM OpenPages GRC Platform, plan the server topology. The number of computers youuse depends on the expected user loads.

A mix of client and server operating systems are supported. For example, you can install OpenPages GRCPlatform applications on a Windows operating system and install the OpenPages repository on Linux orAIX operating systems. You can also install the OpenPages applications on Linux or AIX and install theOpenPages repository on Windows.

Use the following guidelines to help you determine your topology.

Light loads

For light user loads, install the application server and reporting server on one computer. You then installthe OpenPages GRC Platform application and Cognos Business Intelligence on the same computer. Installthe database server on a separate computer.

If you are installing a search server, install it on a separate computer.

This topology is typical in a testing or staging environment. Do not use this setup in a productionenvironment.

The following diagram shows a test environment that uses two computers for the OpenPages GRCPlatform installation. It also uses a third computer for the search server.

OpenPages GRC Platform overview 9

Figure 2: Topology for test environments or light user loads

Moderate loads

For moderate user loads, use three separate computers: one for the database server, a second one for theapplication server, and a third one for the reporting server. Install the OpenPages GRC Platformapplication on the same computer as the application server. Install the database server on the secondcomputer. Install Cognos Business Intelligence on the same computer as the reporting server.

If you are installing a search server, install it on a fourth computer.

The following diagram shows an installation where the application server, reporting server and databaseserver are each on separate computers. In this example, there is no search server installed.

Figure 3: Topology for moderate user load


Multiple computers

If you anticipate heavier user loads, you can set up a clustered OpenPages GRC Platform environment. Byadding vertical or horizontal cluster members to the environment, you can increase scalability. Scalingrequires that you use a load balancer to distribute the incoming client requests.

The following diagram shows an example of using a web server as a load balancer. The web serverdistributes incoming requests to horizontal cluster members.

Figure 4: Topology for heavy user load

Clustered OpenPages GRC Platform environmentsA clustered environment consists of multiple IBM OpenPages GRC Platform application servers andworkflow servers (known as cluster members) running simultaneously to provide increased scalability.

You can set up a vertical cluster with multiple cluster members running on a single computer. You can alsoset up a horizontal cluster with multiple cluster members running on different computers.

When you set up a clustered environment, load balancing is required to distribute incoming clientrequests across the members. This configuration allows the IBM OpenPages GRC Platform application toscale as the number of concurrent users increases.

You can also scale the reporting server horizontally by installing additional reporting servers. You mustconfigure additional Cognos dispatchers to ensure that the incoming requests are distributed acrossmultiple servers.

OpenPages GRC Platform overview 11


Chapter 3. Installation of prerequisite softwareEnsure that you have installed the prerequisite software before you install IBM OpenPages GRC Platform.

Related conceptsServer topology and installation configurations

Software prerequisitesTo ensure that your product works properly, apply all minimum required operating system patches, anduse only the supported versions of third-party software. Review the prerequisite software before installingIBM OpenPages GRC Platform.

You can review the supported prerequisite software by using the IBM Software Product CompatibilityReports (www.ibm.com/support/docview.wss?uid=swg27039467).

Prerequisite software for all serversBefore you install IBM OpenPages GRC Platform, ensure that the prerequisite software is installed oneach server in your environment.

The following table lists the third-party software that must be installed on each computer you are usingfor the database server, all application servers, reporting servers, and the search server.

Table 2: Software prerequisites for all Windows computers

Requirement Specification

Operating System Microsoft Windows

Web browser Microsoft Internet Explorer

File compression utility For example, WinZip or 7-Zip

PDF reader Adobe Acrobat

Table 3: Software prerequisites for all AIX or Linux computers


Operating System AIX or Linux

File compression utility For example, GNU compression utility (gtar)

Prerequisite software for the database serverYou must install the required software on the database server, including any fix packs, patches, or otherservice updates.

For more information, see supported software environments (http://www.ibm.com/support/docview.wss?uid=swg27039467).




Table 4: Supported database server software

Database server software Version

IBM DB2 10.5.0.5 special_33521, which is available withthe OpenPages GRC Platform installation media.

The generally available DB2 10.5.0.5 does notwork with OpenPages GRC Platform.

If you are installing the database server on aMicrosoft Windows operating system, ensure thatthe C:\ drive contains a minimum of 8GB free diskspace for temporary files that are created duringthe installation.

If you installing the database server on a Linuxoperating system, ensure that the temp foldercontains sufficient free disk space for log files thatare created during the installation.

If you are using OpenPages GRC Platform version7.2.0.3 or later, you can use IBM DB2 version 11.1.For more information, see “Upgrade IBM DB2” onpage 53.

Oracle 11.2.0.4, 12.1.0.2

If you use Oracle 12.1.0.2, encryption of longstring fields is not supported.

Related conceptsOracle database server installationsIBM OpenPages GRC Platform requires a database server. Use the installation instructions from thevendor to install the Oracle database server on the OpenPages database server. After you install Oracledatabase, some configuration is required.IBM DB2 database server installations

Prerequisite software for application serversEnsure that you install the prerequisite software on all application servers.

The following table lists the software requirements for application servers.

Table 5: Software prerequisites for application server computers


IBM Runtime Environment for Java 1.7.3 For IBM WebSphere Application Server NetworkDeployment, use the 1.7.1_64 that is availablewith the application server.


Table 5: Software prerequisites for application server computers (continued)


Application server WebSphere Application Server NetworkDeployment 8.5.5.5 and all fix packs, and IBMWebSphere SDK Java Technology Edition 7.1.3.0.

The OpenPages GRC Platform installation requiresthat the application server software is installed to apath with no spaces.

The installation also requires a dedicatedWindows-based server and WebSphere ApplicationServer environment. Sharing the OpenPagesapplication server with other applications and IBMWebSphere Application Server environments is notsupported.

Workflow server When you install OpenPages GRC Platform on AIX,you must install the 32-bit IBM RuntimeEnvironment for Java. The 32-bit version isrequired for the Fujitsu Interstage BPM softwareinstallation. OpenPages does not use the JRE afterworkflow server is installed.

Database client software IBM DB2 or Oracle database client software.

For DB2, ensure that you use the same version ofthe database client software that you installed forthe database server software. Apply all requiredpatches, interim fixes, or services to both thedatabase server and the database client software.

For Oracle, you can install version 11.2.0.4 or12.1.0.2. Both versions are compatible with thedatabase server software.

If you are using the same computer for theapplication server and reporting server, and youwant to install Oracle 12.1.0.2, you must install the32-bit version.

OPAdminConsoleRemote If you are deploying the application server on aseparate computer from the OpenPages GRCPlatform installation program (the Administrativeconsole), ensure that OPAdminConsoleRemote isinstalled and running on the target computer.

Prerequisite software for reporting serversThe following table provides the software requirements for reporting servers.

Installation of prerequisite software 15

Table 6: Software prerequisites for reporting server computers


IBM Runtime Environment for Java 1.7.3 JDK 1.7.1_64

IBM JRE is available on the IBM OpenPages GRCPlatform installation media.

Database client software IBM DB2 or Oracle database client software.

For DB2, ensure that you use the same version ofthe database client software that you installed forthe database server software. Apply all requiredpatches, interim fixes, or services to both thedatabase server and the database client software.

For Oracle, you can install version 11.2.0.4 or12.1.0.2. Both versions are compatible with thedatabase server software.

The 32-bit Oracle database client is required bythe reporting server. If you are using the samecomputer for the application server and reportingserver, you must install the 32-bit version.

Reporting server IBM Cognos Business Intelligence (BI) version10.2.2.1.

If you are using IBM DB2version 11.1, then IBMCognos Business Intelligence version 10.2.2 FixPack 6 or later is required.

For information about the software prerequisitesfor Cognos BI, see the IBM Cognos BusinessIntelligence Installation and Configuration Guide.

Web server One of the following web servers:

• Apache Web Server• IBM HTTP Server 8.5.5• Microsoft IIS (Windows only)

OPAdminConsoleRemote If you are deploying the reporting server toseparate computer from the OpenPages GRCPlatform installation program (the administrativeconsole), ensure that OPAdminConsoleRemote isinstalled and running on the target computer.

Prerequisite software for OpenPages GRC Platform client computersEnsure that prerequisite software is installed on all computers that access IBM OpenPages GRC Platform.

The following table lists the software requirements for client computers.


Table 7: Software prerequisites for client computers


Web browser Microsoft Internet Explorer version 9, 10 or 11running in Native view.

Microsoft Internet Explorer version 10 or 11running in Compatibility mode.

Google Chrome.

PDF reader For example, Adobe Reader.

Optional: Microsoft Excel Required for some reporting functions.

Optional: Microsoft .NET Framework Required on client computers where IBM CognosOffice products are installed.

Prerequisite software for the search serverThe following table provides the software requirements for the search server.

Table 8: Software prerequisites for search server computer


IBM Runtime Environment for Java 1.7.3 JDK 1.7.1_64

IBM JRE is available on the IBM OpenPages GRCPlatform installation media.

Attention: If the IBM Runtime Environmentfor Java (IBM JRE) is not available on theserver on which you are installing thesearch server, you must first copy the IBMJRE from WebSphere and set up thesystem environment variables for Java.

For more information, see “Get a copy of the IBMRuntime Environment for Java” on page 17.

OPAdminConsoleRemote

Get a copy of the IBM Runtime Environment for Java

1. From a server where you have IBM WebSphere installed, copy the entire Java content to a local driveon the search server.

• For the Windows operating system: copy the Java content from <WAS_Home>\AppServer\java_1.7.1_64\ to C:\IBM\java_1.7.1_64\ .

• For the UNIX operating system: copy the Java content from <WAS_Home>/AppServer/java_1.7.1_64/ to /opt/IBM/java_1.7.1_64/.

2. Set the system environment for Java.

• For the Windows operating system (the step to get to Environment Variables can vary with Windowsversion).

Installation of prerequisite software 17

a. Click the Start button, right-click the Computer option, click Properties, and click Advancedsystem settings.

b. Click Environment Variables.c. Under System variables, click New.d. For Variable name, type JAVA_HOME.e. For Variable value, type C:\IBM\java_1.7.1_64.f. Click OK.

g. Under System variables, select the existing variable Path and then click Edit.h. For Variable value, insert %JAVA_HOME%\bin; at the start of the filepath.i. Click OK.

• For the UNIX operating system:

a. Based on which shell is in use, edit the startup shell and add the line: setJAVA_HOME=/opt/IBM/java_1.7.1_64/.

b. Locate the line that holds your path and insert $JAVA_HOME/bin at the start of the line.

Attention: You must use a supported IBM Runtime Environment for Java with the search server,such as the IBM JRE that comes with IBM WebSphere.

VMWare configuration requirements on Windows computersThe VMWare performance on a virtualized system is comparable to hardware. You can use the hardwareguidelines for the database server, application server, reporting server, or search server for sizing VMrequirements.

Cloning of IBM OpenPages GRC Platform application server VMs is not supported.


Chapter 4. Preparing your system for installationBefore you install IBM OpenPages GRC Platform, some pre-installation tasks must be completed.

Procedure

1. Ensure that the computer that you use to deploy OpenPages GRC Platform can connect to eachcomputer on which you are installing the database server, application servers, reporting servers, andsearch server.For more information, see “Configuring the hosts file for OpenPages GRC Platform” on page 31.

2. Install the database server software.

For more information about installing DB2 database server, see “IBM DB2 database serverinstallations” on page 33.

For more information about installing Oracle database server, see “Oracle database serverinstallations” on page 63

3. Check that the required database users and user groups exist and that they each have theappropriate permissions for installing applications.

For more information about DB2 users and groups, see “Operating system user accounts for IBM DB2databases” on page 34.

4. Check that database passwords have not expired.5. Install IBM Installation Manager on each computer where you install the OpenPages Administrative

Console or the IBM WebSphere Application Server software.

For more information about installing IBM Installation Manager, see “Installing IBM InstallationManager” on page 22.

6. Install IBM WebSphere Application Server, and all fix packs, on each application server.

For more information, see “WebSphere Application Server installations” on page 23.7. Ensure that WebSphere Application Server computer clocks are synchronized for the database server

and each application server, reporting server, and the search server.8. Create the WebSphere Application Server profile for IBM Runtime Environment for Java for

OpenPages GRC Platform.

For more information, see “Creating the WebSphere Application Server profiles for IBM RuntimeEnvironment for Java” on page 24.

9. If you are deploying OpenPages remotely, install and run the OPAdminConsoleRemote component oneach target computer that you using as an application server, reporting server, and the search server.

For more information, see “Installing the OPAdminConsoleRemote component” on page 25.10. For Windows installations, enable Data Execution Prevention (DEP), and ensure that you have access

to the Microsoft Registry Editor (regedit.exe).11. Ensure that all required ports are available for application use.12. If the database server is installed on a separate computer to the application servers, install the

database client software on each application server computer.

For more information, see the following topics:

• “DB2 database client installations” on page 39• “Oracle database client installations” on page 74

13. If the database server is installed on a separate computer to the reporting servers, install thedatabase client software on each reporting server computer.

14. Set the environment variables on each OpenPages application server, reporting server, and searchserver.

If you are installing a search server, ensure that the JAVA_HOME environment variable is added tothe start of the PATH variable on the computer on which you are installing the search server.

15. Install IBM Cognos Business Intelligence on the reporting server.

For more information, see Chapter 7, “IBM Cognos Business Intelligence installations,” on page 79.16. Install the OpenPages Administrative Console on the computer from which you plan to install

OpenPages components.

For more information, see Chapter 8, “Installing the OpenPages GRC Platform AdministrativeConsole,” on page 95.

Installation on different operating systemsYou use the IBM OpenPages GRC Platform Administrative Console to install OpenPages GRC Platform.

It is possible to run the Administrative Console on one operating system, and install the OpenPages GRCPlatform application to a different operating system.

For example, you can run the Administrative Console from a computer that is running the MicrosoftWindows operating system, and install OpenPages GRC Platform to computers that are running on a UNIXoperating system.

All computers on which you install OpenPages GRC Platform must be running the same operating system.

Supported shells for UNIX installations

You can run the Administrative Console on the Bourne shell (/bin/sh), Bourne Again Shell, (/bin/bash), C-Shell (/bin/sh), or Korn Shell (/bin/ksh).

Super AdministratorIBM OpenPages GRC Platform uses the concept of a Super Administrator account. A Super Administratoris set up as part of the installation process with complete access to all objects, folders, role templates,and groups in the OpenPages system.

In a new installation, the Super Administrator is the only user in the system. You can change the login username and password before, during, or after installation.

Do not use the following user names, which are reserved by OpenPages:

• OPSystem• OpenPages• OpenPagesApplicationUsers• OPAdministrators

If you change the login information using the IBM OpenPages GRC Platform application, you must alsomanually update the CommandCenter Framework Generator property file. For more information, see theIBM OpenPages GRC Platform Administrator's Guide.

Users and groups for installations on WindowsTo install and configure IBM OpenPages GRC Platform on a Windows operating system, you must set upan OpenPages installation user that is a member of the power user or administrator group.

Important: The password for this user cannot contain special characters due to conflicts with OpenPagesscripts.


Users and user groups for installation on AIX and LinuxTo install WebSphere Application Server and IBM OpenPages GRC Platform on a UNIX operating system,you must create the required users and groups.

Tip: For simplicity, you can use the root user to install WebSphere Application Server, then change theowner of the WebSphere directory to the same account as the OpenPages installation user.

If you prefer, you can create two separate users:

• One user to install WebSphere Application Server.• One user to install the OpenPages application.

Both users must belong to the same primary group. If you create separate users, after the installation,you must change the permission of the installation directories and files. To ensure that the groupmembers have write permission, modify the permissions to 775.

Example: Create an AIX or Linux operating system group named opgroup. This group contains the userthat starts the WebSphere Application Server and the user that owns the IBM OpenPages applicationserver files. Install WebSphere Application Server and the OpenPages application. Ensure that theinstallation files and directories are writable for the owner and that the owners are members of the samegroup (chmod 775 command).

Before you beginIf you are using an IBM DB2 database, create group and user IDs for a DB2 database installation (http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.server.doc/doc/t0006742.html).

Procedure

1. Log on to the application server as root and open a shell.2. To create a group, such as opgroup, enter the following command:

• On AIX operating systems:

mkgroup -A opgroup• On Linux operating systems:

groupadd opgroup3. Do one of the following steps:

• If you created an opgroup group, add the opuser and wasuser users to the primary group(opgroup group).

useradd -G opgroup opuser

useradd -G opgroup wasuser• If the same user account installs both WebSphere Application Server and the OpenPages

application server, create a user, such as opuser.

useradd -m opuser4. Change the password for the OpenPages installation user by using the following command:

passwd opuser5. To install WebSphere Application Server, create a user, such as wasuser.

useradd -m wasuser6. Change the password for the OpenPages application user by using the following command:

passwd wasuser

Preparing your system for installation 21

http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.server.doc/doc/t0006742.html

7. On AIX and Linux operating systems, grant read, write, and execute permissions to the home directoryof the OpenPages installation user.

chmod 755 /home/opuser

To install the Fujitsu IBPM software successfully, you must grant read, write, and execute permissionsto the home directory of the user who is installing the OpenPages application.

For local installations on Linux operating systems, the OpenPages installation user is the user who runsthe OpenPages Administrative Console.

For remote installations on AIX and Linux operating systems, the OpenPages installation user is theuser who connects to the remote server.

What to do nextAfter you install WebSphere Application Server and OpenPages application server, ensure that installationdirectories and files have write permission for the group.

Enabling Data Execution Prevention for essential Windows programs andservices

By default, Windows Server uses settings that are designed to prevent an application from runningunauthorized programs. These settings can interfere with the IBM OpenPages GRC Platform installation.Configure Data Execution Prevention (DEP) before starting the installation to prevent any issues.

Procedure

1. Log on to the server.2. Open Windows Explorer.3. Right-click Computer > Properties.4. In the System Properties window, click Advanced System Settings.5. On the Advanced tab, under the Performance heading, click Settings.6. In the Performance Options window, click the Data Execution Prevention tab, and then select Turn

on DEP for essential Windows programs and services only.7. Click OK and then restart your system to enable the change.8. Repeat these steps for each server in the installation.

What to do next

When the installation of all software is complete, you can disable the setting.

Installing IBM Installation ManagerInstall IBM Installation Manager on each computer where you plan to install the following items: IBMWebSphere Application Server, the OpenPages Administrative console or the OPAdminConsoleRemotecomponent.

Ensure you install the 64-bit version of IBM Installation Manager.

For more information about IBM Installation Manager, see the Installation Manager documentation(http://www.ibm.com/support/knowledgecenter/SSDV2W/im_family_welcome.html).

Procedure

1. Download IBM Installation Manager from Passport Advantage®.2. Complete the following steps.


http://www.ibm.com/support/knowledgecenter/SSDV2W/im_family_welcome.html

a) On Microsoft Windows, double-click install.exe.b) On AIX or Linux, in a terminal window, enter ./install.

3. Follow the steps to install IBM Installation Manager.

WebSphere Application Server installationsThe IBM WebSphere Application Server for IBM OpenPages GRC Platform must be installed and runningon each computer where you plan to install the OpenPages application.

Installation restrictions

Review the following restrictions before you install WebSphere Application Server.

Supported WebSphere Application Server software environmentsEnsure that you are using a supported version of WebSphere Application Server. The OpenPages GRCPlatform installation program verifies the version. For more information about supported softwareenvironments, see Review the IBM OpenPages GRC Platform supported software environments andother system requirements (http://www.ibm.com/support/docview.wss?uid=swg27039467).

Note: IBM product fixes and updates are available from IBM Fix Central (www.ibm.com/support/fixcentral/).

Installation path cannot contain spaces

The installation path for WebSphere Application Server cannot contain spaces. The default location ispath\WebSphere\AppServer. For Windows installations, if WebSphere Application Server isinstalled in a directory with spaces, you can enter the short file name convention. For example, forC:\Program Files\IBM\WebSphere\AppServer, enter C:\PROGRA~1\IBM\WebSphere\AppServer.

Installing WebSphere Application Server Network DeploymentUse IBM Installation Manager to install WebSphere Application Server and all fix packs.

For horizontal cluster configurations, install WebSphere Application Server on the administrative serverand all non-administrative servers. You must install the same version of the WebSphere ApplicationServer software on each server.

For more information, see the IBM WebSphere Application Server IBM Knowledge Center http://www-01.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.installation.nd.doc/ae/tins_install.html?cp=SSAW57_8.5.5%2F1-5-0-5 (www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.installation.nd.doc/ae/tins_installation_dist_gui.html?cp=SSAW57_8.5.5%2F1-5-0-5-0-1).

Restriction: Do not install into a directory that contains spaces or non-ASCII characters.

Procedure

1. Start IBM Installation Manager.2. Click File > Preferences, and then click Repositories.3. Click Add repository.4. Enter the path to the WebSphere Application Server installation files, and click OK.

If you provided an HTTPS or restricted FTP repository location, then you are prompted to enter a userID and password. The new or changed repository location is listed. If the repository is not accessible, ared x is displayed in the Accessible column.

5. In IBM Installation Manager, click Install.6. Select the WebSphere Application Server installation package, then click Next. Follow the steps in IBM

Installation Manager to complete the installation.




http://www.ibm.com/support/fixcentral/

http://www-01.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.installation.nd.doc/ae/tins_install.html?cp=SSAW57_8.5.5%2F1-5-0-5



7. When the installation process is complete, select whether to create a profile and then click Finish. ForOpenPages administrative and non-administrative servers, select None.

Creating the WebSphere Application Server profiles for IBM Runtime Environment forJava

Before you can start a new installation, you must create an IBM WebSphere Application Server profile forIBM Runtime Environment for Java on each IBM OpenPages GRC Platform application server.

If WebSphere Application Server global security is enabled, you are prompted to enter the WebSphereAdministrator user name and password when you run commands that access the application server.

Before you begin

Ensure that the OpenPages installation user has read, write, and execute permissions to the WebSphereApplication Server installation directory.

Procedure

1. Log on to the IBM OpenPages GRC Platform administrative server computer as an OpenPagesinstallation user.

2. Add the JAVA_HOME environment variable.

• On a Microsoft Windows operating system:

a. Right-click My Computer > Properties.b. Click Advanced system settings > Environment Variables.c. Add the JAVA_HOME variable to the New System Variable box, then click OK.

For example: JAVA_HOME=C:\IBM\WebSphere\AppServer\java_1.7.1_64d. Select the PATH variable in the System Variables pane, and click Edit.e. In the Edit System Variable box, add %JAVA_HOME%\bin at the start of the PATH variable.f. Click OK twice to exit.

• On a UNIX operating system,

a. Add the JAVA_HOME variable to the profile.

On Linux, the profile is /home/user/.bash_profile

Where user is the OpenPages installation user that you use to log in to the operating system.

On AIX, the profile is /home/user/.profile

For example: export JAVA_HOME=/opt/IBM/WebSphere/AppServer/java_1.7.1_64b. Append the location of JAVA_HOME/bin to the PATH environment variable.

For example: export PATH=$JAVA_HOME/bin:$PATHc. Refresh the profile.

For example, on Linux, open a shell and run the following command:

. /home/opuser/.bash_profile

On AIX, open a shell and run the following command:

. /home/opuser/.profile

3. Open a command prompt window.4. Go to the WAS_HOME\bin directory and run the following command to create the profile:

managesdk.bat -setNewProfileDefault -sdkName 1.7.1_64 (Windows)


./managesdk.sh -setNewProfileDefault -sdkName 1.7.1_64 (UNIX)5. Verify that the profile exists by running the following command:

managesdk.bat -getNewProfileDefault (on Windows)

./managesdk.sh -getNewProfileDefault (on UNIX)6. Run the following command to allow the profile to use IBM Runtime Environment for Java:

managesdk.bat -enableprofileall -sdkname 1.7.1_64 (on Windows)

./managesdk.sh -enableprofileall -sdkname 1.7.1_64 (on UNIX)

Installing the OPAdminConsoleRemote componentYou must install OPAdminConsoleRemote on each remote computer you use as an IBM OpenPages GRCPlatform application server, reporting server, and search server.

You do not need to install OPAdminConsoleRemote on the database server computer.

You must install and run OPAdminConsoleRemote before you install IBM OpenPages GRC Platform fromthe Administrative Console.

OPAdminConsoleRemote runs on all currently supported operating systems.

Tip: For simplicity, you can use the root user to install OPAdminConsoleRemote, then change the owner ofthe installation directory to the same account as the OpenPages installation user.

Before you begin

Ensure that the JAVA_HOME environment variable is set for the OpenPages installation user account.

On Microsoft Windows operating systems, ensure that %JAVA_HOME%\bin is added to the PATH variable.

On UNIX operating systems, ensure that $JAVA_HOME/bin is added to the PATH variable,

Procedure

1. Start IBM Installation Manager.2. Click File > Preferences > Repositories.3. Click Add Repository.4. Enter the path to the OPAdminConsoleRemote installation files, and click OK.

For example, enter the path to OpenPages_Install_Files\OP_version_Non_Embedded\OP_version_Admin_and_Config_Remote\disk1\diskTag.inf.

5. In IBM Installation Manager, click Install.6. Select the OpenPages Administration Console (Remote) version package, and click Next.7. Follow the steps in IBM Installation Manager to complete the installation.8. Click Finish and close IBM Installation Manager.

The OPAdminConsoleRemote files are copied to your computer.9. Grant read, write, and execute permissions on the OPAdminConsoleRemote installation directory to

the OpenPages installation user.

For example, on UNIX run the following command:

chown -R opuser /opt/IBM/OPAdminConsoleRemote

10. Log in as an OpenPages installation user, then go to the location where IBM Installation Managerinstalled the OPAdminConsoleRemote files.For example, on Windows, go to the C:\Program Files (x86)\IBM\OPAdminConsoleRemotedirectory.

11. Run the OPAdminConsoleRemote from a command line.


• On Windows, double-click OPAdminConsoleRemote.cmd.• On Linux or UNIX, run OPAdminConsoleRemote.sh.

12. Verify that OPAdminConsoleRemote is running in a web browser.

The URL is http://server_name:9091/?action=sysProps.

A list of Java system properties appears.

OPAdminConsoleRemote uses port 9091 by default. To change it, edit the port number in the scriptfile.

13. When the OpenPages installation is complete, you can exit OPAdminConsoleRemote.

Creating the OpenPages GRC Platform directories for AIX or LinuxYou must create the installation directories for OpenPages GRC Platform and change the ownership ofthese directories to the OpenPages installation user. This task must performed if you are installingOpenPages GRC Platform on a UNIX operating system.

Procedure

1. Log on to the application server computer as the root user.2. If the installation directory for OpenPages and Fujitsu Interstage BPM do not exist, create them by

typing the following command.

Restriction: Ensure that the directory to which you install OpenPages and the Fujitsu Interstage BPMsoftware contains only ASCII characters in the path name.

mkdir -p <directory>

mkdir -p /OpenPages

mkdir -p /Fujitsu3. Change the ownership of the directories to the OpenPages installation user.

Tip: For simplicity, you can use the root user to install WebSphere Application Server, then change theowner of the WebSphere directory to the same account as the OpenPages installation user.

chown -R opuser /OpenPages

chown -R opuser /Fujitsu

Setting the file descriptor limit for OpenPages GRC Platform users on AIXYou must set the soft and hard limits for the file descriptor and update system files to allocate sufficientresources to the IBM OpenPages GRC Platform users. You must complete this task on all AIX operatingsystem servers in your environment.

Procedure

1. Log on to the operating system as root user.2. Open the /etc/security/limits file.3. Add the following lines to the end of the file:

opuser:fsize = -1 nofiles =-1


4. To set the maximum number of processes for non-root users, open a shell and type the followingcommand:

chdev -l sys0 -a maxuproc='16384'

5. Restart the operating system.

Setting the file descriptor limit for OpenPages GRC Platform users on LinuxYou must set the soft and hard limits for the file descriptor and update system files to allocate sufficientresources to the IBM OpenPages GRC Platform users. You must complete this task on all Linux operatingsystem servers in your environment.

Procedure

1. Log on to the application server as the root user.2. Verify that the /etc/pam.d/system-auth file contains the correct settings by typing the following

commands:

• cat /etc/pam.d/system-auth | grep session | grep pam_unix.so

The system response: session required pam_unix.so• cat /etc/pam.d/system-auth | grep session | grep pam_limits.so

The system response: session required pam_limits.so

Both commands must return a session line.3. To determine the current value of the fs.file-max property that is set in the /etc/sysctl.conf file,

type the following command:

cat /etc/sysctl.conf | grep fs.file-max

• If the fs.file-max setting does not exist, add it to the /etc/sysctl.conf file by typing thefollowing commands:

echo "# Added to increase system open files" >> /etc/sysctl.confecho "fs.file-max=500000" >> /etc/sysctl.conf

• If the fs.file-max setting exists, but it is set to less than 500000, change the fs.file-max setting to500000.

4. Change the file descriptor limits in the /etc/security/limits.conf file by adding the followingtext to the end of the file before the #End of file text.

* soft nofile 100000

* hard nofile 200000

* soft stack 10240

5. To determine the startup limits for the number of processors, type the following command:

ls /etc/security/limits.d/90-nproc.conf

• If this 90-nproc.conf file exists, then modify the number of processes to 4096.• If the file does not exist, add the following lines to the end of the /etc/security/limits.conf

file:

* soft nproc 4096* hard nproc 5120

The soft limit provides a specific limit that can be exceeded, for a short period, up to the systemhard limit.

6. Restart the system and then verify the settings that you changed by typing the following command:


ulimit -a

Optional: Changing the Temp directory for Windows installationsBy default, the TEMP and TMP environment variables are set to a hidden user folder location. The folderlocation is typically %USERPROFILE%\AppData\Local\Temp. You can change the location of the TEMPand TMP directory by changing the environment variables in the system properties.

Procedure

1. Ensure that the /tmp directory is set to at least 8 GB on the database server and application server.2. Log on to application server as the OpenPages administrator.3. Right-click My Computer > Properties.4. Click Advanced System Settings > Environment Variables.5. Select the TEMP variable and click Edit.TEMP and TMP might be defined as system variables or user variables, depending on how your systemis set up.

6. In the Variable value box, type the new temporary folder location and click OK.7. Repeat the steps to change the folder location for the TMP variable.

Optional: Changing the TEMP directory for AIX installationsBy default, the /tmp directory is configured as the TEMP directory. For AIX installations, you can changethe TEMP directory by adding variables to the .profile of the user who is installing the product.

Procedure

1. On the IBM OpenPages GRC Platform application servers, ensure that the /tmp directory on thedatabase server is set to a minimum size of 4 GB.

2. Log on to the application server as the IBM OpenPages installation user.

The user has non-root privileges.3. Use the following commands to change the TEMP directory:

export IATEMPDIR=temp_directory

export TEMP=temp_directory

export TMP=temp_directory

export TMPDIR=temp_directory

export TEMPDIR=temp_directory

For example, use the following commands:

export IATEMPDIR=/opt/temp

export TEMP=/opt/temp

export TMP=/opt/temp

export TMPDIR=/opt/temp

export TEMPDIR=/opt/temp


Port assignmentsBoth dedicated ports and ports that are dynamically assigned for each installation are used for the IBMOpenPages GRC Platform installation. These default ports can be changed after installation.

You can change some port settings during the installation. You can also change the default port settingsafter installation. For information about changing the ports after installation, see the IBM OpenPages GRCPlatform Administrator's Guide.

Default ports

The following table lists the default ports.

Table 9: Default fixed port assignments

Description Ports

Oracle database server console application port 1158

OpenPages database instance 1521

OpenPages admin server 9060

OpenPages admin server (SSL) 9043

Workflow admin server 9061

Workflow admin server (SSL) 9044

OpenPages application server 10108

OpenPages application server (SSL) 10111

Workflow application server 20108 (Windows)

20208 (AIX)

Workflow application server (SSL) 20111

Cognos Business Intelligence gateway (as configured for your web server) 80

Framework Generator port 8080

Cognos Business Intelligence dispatcher URI 9300

OPAdminConsoleRemote 9091

On Windows computers, additional OpenPages installations increment the port numbers by two.

On Windows computers, additional workflow installations also increment the port numbers by two.

Files containing port numbers

The following tables list property files on the OpenPages admin server that contain port numbers.


These files contain the HTTP and HTTPS ports for all OpenPages application instances that are associatedwith the current admin server. You can also refer to the server_name-OpenPagesServer#-server.properties files.

Table 10: Files that contain default port numbers

Port File name Parameter Name

OpenPages admin server port OP_Home/temp/wasconfig/ OpenPagesCell.dmgr. config.props

WC_adminhost

OpenPages admin server SSL port OP_Home/temp/wasconfig/ OpenPagesCell.dmgr. config.props

WC_adminhost_secure

OpenPages application port OP_Home/temp/wasconfig /OpenPagesCell. server_name-OPNode#Server# .config.props

WC_defaulthost

OpenPages application SSL port OP_Home/temp/wasconfig /OpenPagesCell. server_name-OPNode#Server# .config.props

WC_defaulthost_secure

Workflow admin server port OP_Home/temp/wasconfig/ IBPMCell.dmgr. config.props

WC_adminhost

Workflow admin server SSL port OP_Home/temp/wasconfig/ IBPMCell.dmgr. config.props

WC_adminhost_secure

Workflow application port OP_Home/temp/wasconfig/ IBPMCell.dmgr. config.props

WC_defaulthost

Workflow application SSL port OP_Home/temp/wasconfig/ IBPMCell.dmgr. config.props

WC_defaulthost_secure

Oracle database instance port Oracle_Home/NETWORK/ADMIN/ tnsnames.ora

N/A

Framework Generator port OP_Home/aurora/conf/ aurora.properties

cognos.framework

OpenPages CommandCenter port OP_Home/aurora/conf/ aurora.properties

cognos.server

Cognos Dispatcher URI OP_Home/aurora/conf/ aurora.properties

cognos.computation.server


Dynamically assigned ports

Port numbers for IBM OpenPages GRC Platform servers that are not listed, such as OpenPages non-adminservers, are assigned dynamically during the installation.

OpenPages application and workflow non-admin server port numbers start at the following values andincrement by 1 for each additional server in the installation:

• OpenPages application non-admin servers: 9080.• OpenPages workflow non-admin servers: 49951.

After installation, you can view all port assignments in OpenPages property files. There are multipleOpenPages property files, each with a .props extension (OP_Home/temp/wasconfig/*.props).

The OpenPages application server and workflow server port information are in the following files:

• OpenPagesCell.dmgr.config.props• OpenPagesCell.server_name-OPNode#;Server#;.config.props• IBPMCell.dmgr.config.props• IBPMCell.server_name-IBPMNode#Server.config.props

On a cluster system, the OpenPagesCell.server_name-OPNode1Server1.config.props file andIBPMCell.server_name-IBPMNode1Server.config.props file contain port information for thatnon-admin server only. If there is a second non-admin server within the same computer (vertical cluster),the port information is displayed in the OpenPagesCell.server_name-OPNode1Server2.config.props and IBPMCell.server_name-IBPMNode2Server.config.props files.

In a horizontal cluster, the numbering for the non-admin servers in the .props file restarts at 1 for eachcluster member computer.

Configuring the hosts file for OpenPages GRC PlatformYou must ensure that the computer that you use to deploy IBM OpenPages GRC Platform can connect toeach computer on which you install the database server, application servers, reporting servers, andsearch server.

Procedure

1. Log on to the admin server as the admin user.2. Edit the hosts file:

• For UNIX, go to the /etc directory and open the hosts file in a text editor.• For Windows, open the C:\Windows\System32\drivers\etc\hosts file.

3. Add the IP address and name of each OpenPages managed server, each reporting server, searchserver, and database server.

4. Save and close the hosts file.5. Repeat the steps for each managed server, each reporting server, search server, and database server.



Chapter 5. IBM DB2 database server and client setupfor OpenPages GRC Platform

Before you install OpenPages GRC Platform, you must complete these tasks if you are installing IBM DB2:

• Install the DB2 database server and DB2 client software.

For more information, see “IBM DB2 database server installations” on page 33 and “DB2 databaseclient installations” on page 39.

• Create a DB2 database instance for the OpenPages repository on the database server.• Prepare the database for the OpenPages installation.

For more information, see “Preparing the DB2 database instance for OpenPages GRC Platform” on page37.

Restriction: If you are installing DB2 on the database server and on the reporting server, you must usetwo separate databases - one for the IBM Cognos BI content store, and a second one for the IBMOpenPages GRC Platform repository.

IBM DB2 database server installationsYou can use an IBM DB2 database for the IBM OpenPages GRC Platform repository.

Check the specific requirements for your system before you install DB2 products.

For more information about IBM OpenPages GRC Platform supported software, see “Softwareprerequisites” on page 13.

For more information about DB2 system requirements, see the DB2 for Linux, UNIX, and Windows systemrequirements web page.

To use a DB2 database for the OpenPages repository, complete following tasks:

__ • Install the DB2 database server using a custom installation to include the DB2 Text Searchcomponent.

The database server that hosts the OpenPages repository must have the required server softwareinstalled. DB2 must be installed before you install any required fix packs.

For more information about database server versions, see “Prerequisite software for the databaseserver” on page 13.

For more information about the DB2 Text Search component, see “The DB2 Text Search component ”on page 34.

Restriction: The OpenPages installation does not support installation of DB2 software in directoriesthat contain spaces. To use DB2 software that is installed in a directory with spaces, you can enterthe short file name convention in the OpenPages Administrative Console. For example, forC:\Program Files\IBM\DB2\SQLLIB, use C:\PROGRA~1\IBM\DB2\SQLLIB.

__ • Set up the required users and groups.__ • Prepare the IBM DB2 database instance for OpenPages.

Related conceptsPrerequisite software for the database serverYou must install the required software on the database server, including any fix packs, patches, or otherservice updates.Operating system user accounts for IBM DB2 databases

http://www.ibm.com/software/data/db2/linux-unix-windows/sysreqs.html

http://www.ibm.com/software/data/db2/linux-unix-windows/sysreqs.html

The DB2 Text Search componentThe DB2 Text Search component is required by the OpenPages installation. When you install the IBM DB2database server, select the custom installation type and the DB2 Text Search component.

For more information, see the Installing and configuring DB2 Text Search in the DB2 Information Center.

If the DB2 database server is already installed on the database server computer, use the DB2 setupprogram to add the DB2 Text Search function to your existing DB2 installation.

To determine whether the DB2 Text Search component is installed, run the db2ts command to start orstop the component. If the command fails, the component is not installed. For more information aboutrunning the command, see the DB2 search commands in the DB2 Information Center.

Operating system user accounts for IBM DB2 databasesOperating system user accounts affect the procedures that are used to create the IBM OpenPages GRCPlatform repository and IBM Cognos Business Intelligence content store.

Restriction: If you are installing DB2 on the database server and on the reporting server, you must usetwo separate databases - one for the IBM Cognos BI content store, and a second one for the IBMOpenPages GRC Platform repository.

DB2 instance ownerThis user controls all DB2 processes and owns all file systems and devices that are used by thedatabases within the database instance.For Windows operating systems, the default user is db2admin.For Linux and AIX operating systems, the default user is db2inst1.

The user account for the DB2 instance owner is created as a prerequisite step to installing DB2software and instance.

DB2 administration server (DAS) userThe user ID for the DB2 administration server user.For Windows operating systems, the default user is db2admin.For Linux and AIX operating systems, the default user is dasusr1.

Important: To simplify user administration, when you install the DB2 database, ensure that youassign the DB2 instance owner as the DAS user.

OpenPages installation userThis user installs OpenPages GRC Platform. The user account can create the OpenPages databaseautomatically by using the OpenPages Administrative Console or manually by running scripts.

Restriction: On Windows, if the OpenPages installation user is not the same as the DB2 instanceowner, the OpenPages installation user must run the dba-grant.sql script. The script explicitlygrants control on SYSTOOLS schema objects to the DB2 database instance owner.

For information on manually running the script, see “Creating the OpenPages GRC Platform databasemanually” on page 40.For information on running the script if you use the Administrative Console to create the OpenPagesdatabase, see the post installation tasks.

Database schema owners

The following distinct database user accounts must exist before you install OpenPages GRC Platform andCognos Business Intelligence:

• OpenPages database user account.• Workflow database user account• Cognos content store user account


http://pic.dhe.ibm.com/infocenter/db2luw/v10r1/index.jsp?topic=%2Fcom.ibm.db2.luw.admin.ts.doc%2Fdoc%2Ft0054804.html

http://pic.dhe.ibm.com/infocenter/db2luw/v10r1/index.jsp?topic=%2Fcom.ibm.db2.luw.admin.cmd.doc%2Fdoc%2Fr0052046.html

Important: You cannot use the same user name for both the OpenPages database user account and theworkflow database user accounts.

On Linux and AIX operating systems, the user names for the OpenPages database user account andworkflow database user accounts must not be the same as the group name. For example,opuser:opuser is not allowed.

DB2 guidelines for creating users

Important: The user accounts must match the schema names on which they operate.

Follow the DB2 guidelines for creating user names (http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.1.0/com.ibm.db2.luw.admin.dbobj.doc/doc/c0007248.html).

• On UNIX and Linux, user names can contain 1-8 characters.• On Windows, user names can contain 1-20 characters.• Group and instances names can contain 1-8 characters.• Names cannot begin with a number or underscore (_) characters.

For more information about passwords for your IBM DB2 user accounts, see the IBM DB2 documentation(http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.swg.im.dbclient.install.doc/doc/c0060749.html)

Users and groups for application servers on Linux or AIX that use DB2 databasesTo install the DB2 database client, WebSphere Application Server, and the IBM OpenPages GRC Platformapplication, you must create two users and one group. You can create a separate user and group to installWebSphere Application Server.

To install the DB2 database client, create and configure the required users and groups as specified in thefollowing table.

Table 11: Required users and groups for application servers

User Assign to Groups Permissions Reason

db2user The group isassigned during theinstallation of theDB2 client.

Read, write, executepermission to the DB2 clientinstallation directory.

Required by DB2 database clientinstallation program.

wasuser IBM WebSphereApplication Serverinstallation.

Read, write, executepermission to theWebSphere ApplicationServer installation directory.

You can create a non-root user toinstall the WebSphere ApplicationServer software. You can create aseparate user or use opuser.

If the wasuser and opuser areseparate users, they must belong tothe same primary group.

IBM DB2 database server and client setup for OpenPages GRC Platform 35

http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.1.0/com.ibm.db2.luw.admin.dbobj.doc/doc/c0007248.html

http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.swg.im.dbclient.install.doc/doc/c0060749.html

Table 11: Required users and groups for application servers (continued)


opuser Read, write, executepermission to the followingdirectories:

• DB2 database clientinstallation directory.

• IBM WebSphereApplication Serverinstallation directory.

• Java JDK or JREinstallation directory.

• Cognos BI installationdirectory.

The user account that installsOpenPages GRC Platform.

Creating workflow schemasWith the exception of the users who installed the IBM DB2 database instance, any user can create theOpenPages and workflow schemas.

For example, the user who runs the IBM OpenPages GRC Platform Administrative Console can create theschemas. The user who creates the OpenPages repository in DB2 must have privileges to create adatabase, a tablespace, tables, and indexes.

Procedure

1. Identify the DB2 administrators group.

The group is created when you install the DB2 instance.

For Windows installations, the default administrators group name is DB2ADMNS.

For Linux or AIX installations, the default group name is db2iadm1.2. Start the DB2 Command Line Processor (CLP).

• On Windows, start the DB2 CLP from the Start menu by clicking All Programs > IBM DB2 >DB2COPY1, or typing db2cmd from the command line,

• On Linux and AIX, open the command line of the DB2 instance.3. Type the following commands:

db2 update dbm cfg using SYSADM_GROUP <DB2_admin_group>db2 update dbm cfg using SYSCTRL_GROUP <DB2_admin_group>db2stopdb2start

4. Add the user who is not the DB2 instance owner to the <DB2_admin_group>.

• For DB2 installations on Windows computers, add the user to the DB2ADMNS group.• For DB2 installations on AIX or Linux computers, add the user to the db2iadm1 group.

5. Log on to the DB2 client computer or DB2 server computer as the user you added to the<DB2_admin_group>.

Related tasksManually creating database objects in the OpenPages GRC Platform repository


Preparing the DB2 database instance for OpenPages GRC PlatformYou must prepare the IBM DB2 database instance that is used for the IBM OpenPages GRC Platformrepository.

To prepare the database instance, you must:

__ • Run the enable-ora-compatibility script to enable the Oracle compatibility mode.

Important: Oracle compatibility mode must be enabled for the IBM DB2 database instance that isused for the OpenPages and workflow schemas. Oracle compatibility mode must not be enabled onthe IBM DB2 database instance that is used for the IBM Cognos Business Intelligence content store.

__ • Run the opx-dbm-cfg script to update the database manager configuration for the OpenPagesdatabase instance.

__ • Copy the Java routine class files to the IBM DB2 server installation location from the OpenPagesinstallation files.

__ • Enable and configure DB2 text search.


Before you begin


Tip: To verify the current version and service level of the installed IBM DB2 product, use the db2levelcommand.

Procedure

1. Log on to the IBM DB2 database server as the DB2 instance owner.2. Go to the location where you extracted the installation files from the OP_version DVD or from your

network share location.

• On Microsoft Windows operating systems, go to the following directory:

\WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration\Database\DB2\INSTALL_SCRIPTS

• On AIX operating systems, go to the following directory:

/AIX64-OP_version/OpenPages/AIX64/OP_version_Non_Embedded_DB2_AIX64/OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS

• On Linux operating systems, go to the following directory:

\Linux64-OPversion/OpenPages/Linux64/OP_version_Non_Embedded_LINUX64/OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS

3. On Linux and AIX, ensure that the DB2 instance owner has execute permission on the scripts in theINSTALL_SCRIPTS directory.

• If the DB2 instance owner owns the directory, type the following command:

chmod -R 755 /path/INSTALL_SCRIPTS• If the DB2 instance owner belongs to the same group as the user who owns the directory, type the

following command:

chmod -R 775 /path/INSTALL_SCRIPTS• If the DB2 instance owner is part of other groups, type the following command:

chmod -R 777 /path/INSTALL_SCRIPTS


4. Edit the sql-wrapper.sql file to ensure that the variables are set correctly for your environment andsave the changes.

Restriction: Do not change the following properties:

• define super_admin_username='OpenPagesAdministrator'• define super_admin_password='OpenPagesAdministrator'

To change these settings, from the INSTALL_SCRIPTS directory, open the op-app-global-env.sql file in a text editor.

If the DB2 instance owner does not have write permission on the sql-wrapper.sql file, switch usersor change the permission on the file by using the chmod command.

• On Windows operating systems, if required, modify the following properties to suit yourenvironment:

define opx_base_currency_iso_code='USD'define opx_dflt_stor_srv_root='c:\OpenPages\openpages-storagedefine opx_op_admin_name='OpenPagesAdministrator'define opx_op_admin_pwd='OpenPagesAdministrator'

• On AIX or Linux operating systems, if required, modify the following properties to suit yourenvironment.

define opx_base_currency_iso_code='USD'define opx_dflt_stor_srv_root='opt/openpages-storage/define opx_op_admin_name='OpenPagesAdministrator'define opx_op_admin_pwd='OpenPagesAdministrator'

5. Enable Oracle compatibility mode.

• On Windows, open a command window and type db2cmd to start the DB2 command line processor(CLP). Then, type enable-ora-compatibility.bat.

• On AIX or Linux, type ./enable-ora-compatibility.sh.

Note: If you have multiple instances of the DB2 server, ensure that you choose the DB2COPY of theOpenPages database instance.

Restriction: DB2 compatibility features are enabled at the database level and cannot be disabled.Keep the selected compatibility level for the life of the OpenPages database.

To confirm that Oracle compatibility mode is set, type db2set -all. One of the DB2 profile variablesthat are listed is DB2_COMPATIBILITY_VECTOR=ORA.

6. Update the database manager configuration for the OpenPages database instance.

• On Windows, open a command window and type db2cmd to start the DB2 command line processor(CLP). Then, type opx-dbm-cfg.bat.

• On AIX or Linux, type ./opx-dbm-cfg.sh.7. Copy the Java routine class files for OpenPages to the DB2 server.

a) Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.b) Copy the following files to the DB2_HOME\FUNCTION directory:

• opconvert.class• regexp.class

For example, on Windows, the DB2_HOME\FUNCTION directory is install_path\ibm\SQLLIB\FUNCTION.

On AIX or Linux, the default location is /home/db2_instance_owner/sqllib/FUNCTION.8. Enable and configure text search.9. Copy the encryption function for OpenPages to the DB2 server.

a) Go to the/OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS /bin/<PLATFORM> directory.


http://pic.dhe.ibm.com/infocenter/db2luw/v10r1/index.jsp?topic=%2Fcom.ibm.db2.luw.admin.ts.doc%2Fdoc%2Fc0051296.html

b) Copy the files to the following directories:

• DB2_HOME\FUNCTION• DB2_HOME\FUNCTION\unfenced

What to do next

You can create the database schema for OpenPages by selecting Install Now for the Schema option inthe OpenPages Administrative Console, or you can manually create the schema by using scripts.

DB2 database client installationsYou must install a DB2 database client so that the IBM OpenPages GRC Platform application servers canconnect to the DB2 database server. If the application server is on a different computer than the databaseserver, you must install and create a DB2 client instance on the application server and reporting servercomputers.

Use the following checklist to guide you through the required setup:

__ • Install the DB2 client software.

Use the DB2 Setup wizard to install the IBM Data Server Client.

For information, see the DB2 Setup wizard documentation (http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.server.doc/doc/t0059589.html?lang=en).

__ • Create a DB2 database client instance on the client computer (AIX and Linux only).__ • Configure the DB2 client and server connection.__ • Test the connection between the database server and the client.

For information about the installation methods for IBM data server clients in AIX and Linux environments,see the IBM data server clients (Linux and UNIX) documentation (http://www.ibm.com/support/knowledgecenter/SSEPGG_10.1.0/com.ibm.swg.im.dbclient.install.doc/doc/t0007317.html).

Creating and configuring a DB2 client instance in AIX and Linux environmentsIf the IBM OpenPages GRC Platform application server is on a different Linux or AIX computer than thedatabase server, you must create a DB2 client instance on the application server and reporting servercomputers.

In Windows environments, the client instance is created by default when the client software is installed.

For more information, see the db2icrt - Create instance command topic in the DB2 Information Center.

Procedure

1. Log on to the application server computer as a root user.2. Go to the DB2DIR/instance/ directory.

DB2DIR is installation location of the DB2 client software.

• On AIX operating systems, the default DB2 installation directory is /opt/IBM/db2/version/instance.

• On Linux operating systems, the default installation directory is /opt/ibm/db2/version/instance.

3. To create an instance for a client, type the following command:

db2icrt -s client <instname>

The -s option is used when you create an instance other than the default instance that is associatedwith the installed product from which you run the db2icrt command.

instname is the login name of the instance owner.


http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.server.doc/doc/t0059589.html?lang=en

http://www.ibm.com/support/knowledgecenter/SSEPGG_10.1.0/com.ibm.swg.im.dbclient.install.doc/doc/t0007317.html

http://pic.dhe.ibm.com/infocenter/db2luw/v10r1/index.jsp?topic=%2Fcom.ibm.db2.luw.admin.cmd.doc%2Fdoc%2Fr0002057.html

Example: db2icrt -s client db2inst2

The default location for the DB2 instance is in the /home/db2inst2/sqllib directory.4. Log on to the reporting server computer as a root user, and repeat steps 2 and 3.

Creating the OpenPages GRC Platform database manuallyIBM OpenPages GRC Platform requires an OpenPages database. You can create the database from theOpenPages Administrative Console or you can do so manually by using the scripts provided.

To create the database from the OpenPages Administrative Console, select the Install now option in theDatabase Creation Information section of the OpenPages Administrative Console.

Procedure

1. Log on to the DB2 database server computer as the DB2 database instance owner.2. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.3. Edit the sql-wrapper.sql file to ensure that the variables are set correctly for your environment and

save the changes.

Restriction: Do not change the following properties:


To change these settings, from the INSTALL_SCRIPTS directory, open the op-app-global-env.sql file in a text editor.

If the DB2 instance owner does not have write permission on the sql-wrapper.sql file, switch usersor change the permission on the file by using the chmod command.

• On Windows operating systems, if required, modify the following properties to suit yourenvironment:

define opx_base_currency_iso_code='USD'define opx_dflt_stor_srv_root='c:\OpenPages\openpages-storagedefine opx_op_admin_name='OpenPagesAdministrator'define opx_op_admin_pwd='OpenPagesAdministrator'

• On AIX or Linux operating systems, if required, modify the following properties to suit yourenvironment.

define opx_base_currency_iso_code='USD'define opx_dflt_stor_srv_root='opt/openpages-storage/define opx_op_admin_name='OpenPagesAdministrator'define opx_op_admin_pwd='OpenPagesAdministrator'

4. From the INSTALL_SCRIPTS directory, open the op-app-global-env.sql script in a text editor,and if required, modify the following values for the Super Administrator.

define super_admin_username='OpenPagesAdministrator' define super_admin_password='OpenPagesAdministrator'

5. On Windows, start the DB2 command line processor (CLP) from the Start menu, by clicking AllPrograms > IBM DB2 > IBM DB2 DB2COPY1 > DB2 Command Window - Administrator

6. To create the database for OpenPages, run the create-opx-db-srv script from the command line.

Use the following table to replace the variables in the command-line options with values that aresuitable for your environment.


Table 12: Options for the create-opx-db-srv script

Variable Description

database-name The name of the OpenPages database

path The location of the database on the server

catalog_path The location of the database alias on the localserver

On Windows operating systems, the catalog_pathis the drive letter (C: or E:). On Linux or AIXoperating systems, catalog_path is the absolutepath (/db2data

• On Windows, type the following command:

create-opx-db-srv.bat <database-name> <path> <catalog_path>

Example: A database named OPX is created. The database and database alias are on the D: drive.

create-opx-db-srv.bat OPX D: D:

• On AIX or Linux, type the following command:

./create-opx-db-srv.sh <database-name> <path> <catalog_path>

Tip: Ensure that you grant execute permission on the create-opx-db-srv.sh script file beforeyou run it.

Example: A database named OPX is created. The database and database alias are in the /db2datadirectory.

./create-opx-db-srv.sh OPX /db2data /db2data

7. If the database server is on a Windows operating system and the OpenPages installation user is notthe DB2 database instance owner, run the following script:

clpplus -nw <username>/<password>@<hostname>:<portnumber>/<database-name> @sql-wrapper dba-grant.sql dba-grant.log <instance.owner.username>

• username variable is the user name of the OpenPages installation user (the user that is logged in tothe system).

• password variable is the password of the OpenPages installation user.• instance.owner.username variable is the DB2 database instance owner (the user who creates the

database instance).

If the OpenPages installation user is the same as the DB2 database instance owner, no action isrequired.

The script explicitly grants control on the SYSTOOLS schema objects to the DB2 database instanceowner.

8. If the database server is on a Windows computer, the OpenPages installation user is not the DB2database instance owner, and the DB2 database instance owner is not the DB2 administration server(DAS) user, then run the following script:

clpplus -nw <username>/<password>@<hostname>:<portnumber>/<database-name> @sql-wrapper dba-grant.sql dba-grant.log <das_user_name>



• password is the password of the OpenPages installation user.• das_user_name is the DB2 Administration server (DAS) user account.

The script explicitly grants control on the SYSTOOLS schema objects to DAS user.9. For the best performance, set the PCKCACHESZ DB2 parameter to automatic. For more information,

see pckcachesz - Package cache size configuration parameter.

What to do next

Run the scripts from the database server or from the OpenPages application server to create the databaseobjects.

Creating the OpenPages GRC Platform database manually from theOpenPages application server computer

If your IBM OpenPages GRC Platform application server is not on the same computer as your OpenPagesdatabase server, you can also manually create the OpenPages database remotely.

Before you begin

Ensure that you set up the DB2 database instance on the server computer:

__ • Enable the Oracle compatibility mode.__ • Update the database manager configuration for the OpenPages database instance.__ • Copy the Java routine class files to the DB2 server from the OpenPages installation files.__ • Enable and configure DB2 text search.

Procedure

1. Log on to the OpenPages GRC Platform application server computer as the DB2 administrator.2. If you are using Windows, start the DB2 command line processor.

From the command prompt, type db2cmd, or from the Start menu, click All Programs > DB2COPY1 >Command Window - Administrator.

3. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.4. To catalog the node, run the following script:

• On Windows operating systems, type db2-catalog-node.bat <node_name> <hostname><port>.

• On AIX or Linux operating systems, type ./db2-catalog-node.sh <node_name> <hostname><port>.

Table 13: Command-line variables for the script to catalog a node

Variable name Description

node_name The node name of the database partition server.

The node name represents a local nickname thatyou can set for the computer that contains thedatabase you want to catalog.

hostname The host name or the IP address of the nodewhere the target database is installed.


http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.config.doc/doc/r0000266.html?cp=SSEPGG_10.5.0%2F2-4-4-9-123

Table 13: Command-line variables for the script to catalog a node (continued)


port The port that the database server uses.

The default port is 50000.

Example: On Windows operating systems:

db2-catalog-node.bat OPNode OPAdmin 50000

Example: On AIX or Linux operating systems:

db2-catalog-node.sh OPNode OPAdmin 50000

5. To create the database for OpenPages, run the create-opx-db-clt script.

Replace the variables with your system values:

• database-name is the name of the OpenPages database.• path is the location on which to create the database on the server.• catalog_path is the location of the database alias on the local computer.• node_name is the cataloged node name.• instance.owner.usrname is the user name of the DB2 account that owns the instance on the remote

computer.• instance.owner.password is the password for the account that owns the database instance.

• On Windows operating systems, type the following command:

create-opx-db-clt.bat <database-name> <path> <catalog_path> <node_name> <instance.owner.username> <instance.owner.password>

Example: Create a remote database on AIX or Linux operating systems from a Windows-basedcomputer. The DB2 database instance owner on the remote computer is db2inst1.

create-opx-db-clt.bat OPdb7 /usr /usr OPNode db2inst1 Db2_1234

• On AIX or Linux operating systems, type the following command:

create-opx-db-srv.sh <database_name> <path> <catalog_path>

Example: Create a remote database on a Linux operating system from an AIX-based computer. TheDB2 database instance owner on the remote computer is db2inst1

create-opx-db-clt.sh OPdb7 /usr /usr OPNode db2inst1 Db2_1234

6. If the database server is on a Windows operating system and the OpenPages installation user is notthe DB2 database instance owner, run the following script:



• password variable is the password of the OpenPages installation user.


• instance.owner.username variable is the DB2 database instance owner (the user who creates thedatabase instance).


The script explicitly grants control on the SYSTOOLS schema objects to the DB2 database instanceowner.

7. If the database server is on a Windows computer, the OpenPages installation user is not the DB2database instance owner, and the DB2 database instance owner is not the DB2 administration server(DAS) user, then run the following script:

clpplus -nw <username>/<password>@<hostname>:<portnumber>/<database-name> @sql-wrapper dba-grant.sql dba-grant.log <das_user_name>


• password is the password of the OpenPages installation user.• das_user_name is the DB2 Administration server (DAS) user account.

The script explicitly grants control on the SYSTOOLS schema objects to DAS user.8. For the best performance, set the PCKCACHESZ DB2 parameter to automatic. For more information,

see pckcachesz - Package cache size configuration parameter.

Results

If you have problems when you run the scripts to create the database objects, you can remove thedatabase objects and start again. The following table lists the scripts to help you drop the database and touncatalog the node.

If you are using Windows, run these scripts by using the DB2 command line processor.

Table 14: Scripts to drop the database and to uncatalog the node

Description Script

Drop thedatabase drop-opx-db-clt.(bat|sh) <database-name>

<node-name> <instance.owner.username> <instance.owner.password>

Uncatalogthe node db2-uncatalog-node.(bat|sh)

<node-name>

Related tasksManually creating database objects in the OpenPages GRC Platform repository

Manually creating database objects in the OpenPages GRC Platformrepository

You can run scripts to manually create the required database objects in DB2 for the IBM OpenPages GRCPlatform repository.

Procedure

1. Log on to the DB2 database server computer as an installation user for OpenPages GRC Platform.2. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.

• On Windows operating systems, go to the following directory:


http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.config.doc/doc/r0000266.html?cp=SSEPGG_10.5.0%2F2-4-4-9-123




• For Linux operating systems, go to the following directory:


3. On Windows operating systems, start the DB2 command line processor (CLP).4. For Windows operating systems, use the following table to run the required scripts in order.

Table 15: Scripts to create the OpenPages database in DB2 on Windows-based computers

Script description Windows-based computers

Create thebufferpool andtablespaces

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name> @sql-wrapper create-opx-tablespaces.sql create-opx-tablespaces.log


• instance.owner.usrname is the user name of the DB2 account that owns theinstance.

• instance.owner.password is the password for the account that owns thedatabase instance.

• hostname is the database server computer name. database-name is thename of the OpenPages database.

• port-number is the port that the database instance uses.• database name is the name of the OpenPages database.• -nw specifies that the CLPPlus session is started in the current command-

line window.

Example: The instance owner is db2admin. The database instance is on aserver named OP and uses the default DB2 port, 50000.

clpplus -nw DB2ADMIN/Db2_1234@OP:50000/OPdb621 @sql-wrapper create-opx-tablespaces.sql create-opx-tablespaces.log

Grant authorizationsand create schema

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name> @sql-wrapper create-opx-schema-owner.sql create-opx-schema-owner.log <openpages.db.username>

openpages.db.username is the user name that belongs to the user account thatowns the OpenPages database schema.

Example: The openpages user owns the database schema for OpenPages.

clpplus -nw DB2ADMIN/Db2_1234@OP:50000/OPdb621 @sql-wrapper create-opx-schema-owner.sql create-opx-schema-owner.log openpages


Table 15: Scripts to create the OpenPages database in DB2 on Windows-based computers (continued)


Install Java routinesfor OpenPages

manageOPJavaRoutines.bat <database-name> <openpages.db.password> <openpages.db.password> install opdb2udf.jar

Example: The openpages user account logs in to the OPdb621 to install Javaroutines.

manageOPJavaRoutines.bat OPdb621 openpages openpages123 install opdb2udf.jar

Create tables,sequences, andindexes

clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name >@sql-wrapper AuroraDBCreate.sql AuroraDBCreate.log

Example: The openpages user account logs in to the OPdb621 to createdatabase objects.

clpplus -nw openpages/openpages123@OP:50000/OPdb621 @sql-wrapper AuroraDBCreate.sql AuroraDBCreate.log

Create views clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper AuroraDbViews.sql AuroraDbViews.log

Example: The openpages user account logs in to the OPdb621 to createdatabase views.

clpplus -nw openpages/openpages123@OP:50000/OPdb621 @sql-wrapper AuroraDbViews.sql AuroraDbViews.log

Load PL/SQL(ProceduralLanguage/Structured QueryLanguage)

AuroraProcCreate.bat <database-name> <openpages.db.username> <openpages.db.password>

Example: The openpages user account runs the script to load PL and SQLfiles.

AuroraProcCreate.bat OPdb621 openpages openpages123

The load might take some time to complete.

Revalidate PL/SQL clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper revalidate.sql revalidate.log <openpages.db.username>

Example: Revalidate OPdb621 packages

clpplus -nw openpages/openpages123@OP:50000/OPdb621 @sql-wrapper revalidate.sql revalidate.log openpages




Rebind all packages db2rbind <database-name> -l oprbind.log all -u <openpages.db.username> -p <openpages.db.password> -r any

Example: Rebind OPdb621 packages

db2rbind OPdb621 -l oprbind.log all -u openpages -p openpages123 -r any

Load bootstrap data clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper AuroraDbLoad.sql AuroraDbLoad.log

clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper load_OP_APP_DATA.sql load_OP_APP_DATA.log

Example: The openpages user account runs the script to load data into theOPdb621 database.

clpplus -nw openpages/openpages123@OP:50000/OPdb621 @sql-wrapper AuroraDbLoad.sql AuroraDbLoad.log

Note: The scripts take some time to complete.

clpplus -nw openpages/openpages123@OP:50000/OPdb621 @sql-wrapper load_OP_APP_DATA.sql load_OP_APP_DATA.log

Create the workflowschema andtablespaces

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name >@sql-wrapper ibpm-create-ts-schema-owner.sql ibpm-create-ts-schema-owner.log <opworkflow.db.username>

opworkflow.db.username is the owner of the workflow schema in theOpenPages database.

Example: The opworkflow user owns the workflow database schema.Ensure that the user belongs to the DB2ADMINS group on the operatingsystem.

clpplus -nw db2admin/Db2_1234@OP:50000/OPdb621 @sql-wrapper ibpm-create-ts-schema-owner.sql ibpm-create-ts-schema-owner.log opworkflow

Create workflowtables

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper ibpm-create-tables.sql ibpm-create-tables.log

Example: The opworkflow user connects to the OpenPages database tocreate tables.

clpplus -nw opworkflow/opworkflow123@OP:50000/OPdb621 @sql-wrapper ibpm-create-tables.sql ibpm-create-tables.log




Create workflowviews

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper ibpm-create-views.sql ibpm-create-views.log

Example: The opworkflow user connects to the OpenPages database tocreate views.

clpplus -nw opworkflow/opworkflow123@OP:50000/OPdb621 @sql-wrapper ibpm-create-views.sql ibpm-create-views.log

Load workflowprocedures

ibpm-proc-create.bat <database-name> <opworkflow.db.username> <opworkflow.db.password>

Example: The opworkflow user runs the script to load workflow proceduresinto the OPdb621 OpenPages database

ibpm-proc-create.bat OPdb621 opworkflow opworkflow123 -ni

Load workflowbootstrap data

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper ibpm-data-load.sql ibpm-data-load.log

Example: The opworkflow connects to the OPdb621 OpenPages database toload the workflow bootstrap data.

clpplus -nw opworkflow/opworkflow123@OP:50000/OPdb621 @sql-wrapper ibpm-data-load.sql ibpm-data-load.log

Create synonyms fordatabase objects inworkflow schemainto OpenPagesschema

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name > @sql-wrapper dba_integrate_iflow.sql dba_integrate_iflow.log <openpages.db.username> <opworkflow.db.username>

Example: The db2admin user connects to the OPdb621 database to createsynonyms.

clpplus -nw db2admin/Db2_1234@OP:50000/OPdb621 @sql-wrapper dba_integrate_iflow.sql dba_integrate_iflow.log openpages opworkflow

5. For Linux or AIX installations, use the following table to run the required scripts in order.


Table 16: Scripts to create the OpenPages database in DB2 on AIX or Linux operating systems

Script description Linux or AIX-based computers

Create thebufferpool andtablespaces

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname> <port-number>/<database-name> @sql-wrapper create-opx-tablespaces.sql create-opx-tablespaces.log


• instance.owner.usrname is the user name of the DB2 account that owns theinstance.

• instance.owner.password is the password for the account that owns thedatabase instance.

• hostname is the database server computer name. database-name is thename of the OpenPages database.

• port-number is the port that the database instance uses.• database name is the name of the OpenPages database.• -nw runs the script without being prompted.

Example: The instance owner is db2inst1. The database instance is on aserver named OP and uses the default DB2 port, 50000.

clpplus -nw db2inst1/Db2_1234@OP:50000/OPdb621 @sql-wrapper create-opx-tablespaces.sql create-opx-tablespaces.log

Grant authorizationsand create schema

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name> @sql-wrapper create-opx-schema-owner.sql create-opx-schema-owner.log <openpages.db.username>

openpages.db.username is the user name that belongs to the user account thatowns the OpenPages database schema.

Example: The opuser user owns the database schema for OpenPages.Ensure that the user name is fewer than 8 characters.

clpplus -nw db2inst1/Db2_1234@OP:50000/OPdb621 @sql-wrapper create-opx-schema-owner.sql create-opx-schema-owner.log opuser

Install Java routinesfor OpenPages

manageOPJavaRoutines.sh <database-name> <openpages.db.password> <openpages.db.password> install opdb2udf.jar

Example: The openpages user account logs in to the OPdb621 to install Javaroutines.

manageOPJavaRoutines.sh OPdb621 openpages openpages123 install opdb2udf.jar


Table 16: Scripts to create the OpenPages database in DB2 on AIX or Linux operating systems(continued)


Create tables,sequences, andindexes

clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name >@sql-wrapper AuroraDBCreate.sql AuroraDBCreate.log

Example: The opuser user account logs in to the OPdb621 to createdatabase objects.

clpplus -nw opuser/opuser123@OP:50000/OPdb621 @sql-wrapper AuroraDBCreate.sql AuroraDBCreate.log

Create views clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper AuroraDbViews.sql AuroraDbViews.log

Example: The opuser user account logs in to the OPdb621 to createdatabase views.

clpplus -nw opuser/opuser123@OP:50000/OPdb621 @sql-wrapper AuroraDbViews.sql AuroraDbViews.log

Load PL/SQL(ProceduralLanguage/Structured QueryLanguage)

./AuroraProcCreate.sh <database-name> <openpages.db.username> <openpages.db.password>

Example: The opuser user account runs the script to load PL and SQL files.

./AuroraProcCreate.sh OPdb621 opuser opuser123

Revalidate PL/SQL clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper revalidate.sql revalidate.log<openpages.db.username>

Example: Revalidate OPdb621 packages

clpplus -nw opuser/opuser123@OP:50000/OPdb621 @sql-wrapper revalidate.sql revalidate.log opuser

Rebind all packages db2rbind <database-name> -l oprbind.log all -u <openpages.db.username> -p <openpages.db.password> -r any

Example: Rebind OPdb621 packages

db2rbind OPdb621 -l oprbind.log all -u opuser -p opuser123 -r any




Load bootstrap data clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper AuroraDbLoad.sql AuroraDbLoad.log

clpplus -nw <openpages.db.username>/<openpages.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper load_OP_APP_DATA.sql load_OP_APP_DATA.log

Example: The opuser user account runs the script to load data into theOPdb621 database.

clpplus -nw opuser/opuser123@OP:50000/OPdb621 @sql-wrapper AuroraDbLoad.sql AuroraDbLoad.log

Note: The scripts take some time to complete.

clpplus -nw opuser/opuser123@OP:50000/OPdb621 @sql-wrapper load_OP_APP_DATA.sql load_OP_APP_DATA.log

Create the workflowschema andtablespaces

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name >@sql-wrapper ibpm-create-ts-schema-owner.sql ibpm-create-ts-schema-owner.log <opworkflow.db.username>

opworkflow.db.username is the owner of the workflow schema in theOpenPages database.

Example: The opwork user owns the workflow database schema. Ensure thatthe user name is 8 or fewer characters

clpplus -nw db2inst1/Db2_1234@OP:50000/OPdb621 @sql-wrapper ibpm-create-ts-schema-owner.sql ibpm-create-ts-schema-owner.log opwork

Create workflowtables

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name> @sql-wrapper ibpm-create-tables.sql ibpm-create-tables.log

Example: The opwork user connects to the OpenPages database to createtables.

clpplus -nw opwork/opwork123@OP:50000/OPdb621 @sql-wrapper ibpm-create-tables.sql ibpm-create-tables.log

Create workflowviews

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper ibpm-create-views.sql ibpm-create-views.log

Example: The opwork user connects to the OpenPages database to createviews.

clpplus -nw opwork/opwork123@OP:50000/OPdb621 @sql-wrapper ibpm-create-views.sql ibpm-create-views.log




Load workflowprocedures

ibpm-proc-create.sh <database-name> <opworkflow.db.username> <opworkflow.db.password>

Example: The opwork user runs the script to load workflow procedures intothe OPdb621 OpenPages database

./ibpm-proc-create.sh OPdb621 opwork opwork123

Load workflowbootstrap data

clpplus -nw <opworkflow.db.username>/<opworkflow.db.password>@<hostname>:<port-number>/<database-name > @sql-wrapper ibpm-data-load.sql ibpm-data-load.log

Example: The opworkflow connects to the OPdb621 OpenPages database toload the workflow bootstrap data.

clpplus -nw opwork/opwork123@OP:50000/OPdb621 @sql-wrapper ibpm-data-load.sql ibpm-data-load.log

Create synonyms fordatabase objects inworkflow schemainto OpenPagesschema

clpplus -nw <instance.owner.usrname>/<instance.owner.password>@<hostname>:<port-number>/<database-name > @sql-wrapper dba_integrate_iflow.sql dba_integrate_iflow.log <openpages.db.username> <opworkflow.db.username>

Example: The db2admin user connects to the OPdb621 database to createsynonyms.

clpplus -nw db2inst1/Db2_1234@OP:50000/OPdb621 @sql-wrapper dba_integrate_iflow.sql dba_integrate_iflow.log opuser opwork

Related tasksCreating workflow schemas

Testing the connection between the DB2 client and serverIf the IBM OpenPages GRC Platform application server is not on the same computer as the databaseserver, test the connection. Ensure that you can connect to the DB2 server from the OpenPagesapplication server computer.

Before you begin

You must have System Administrative (SYSADM) or System Controller (SYSCTRL) authority. Otherwise,ensure that the catalog_noauth option is set to ON. You cannot use root authority when you catalog anode.

Procedure

1. Log on to the OpenPages application server as a DB2 user.2. Start the DB2 command line processor.

On Windows computers, from the command prompt, type db2cmd, or from the Start menu, click AllPrograms > DB2COPY1 > Command Window - Administrator.

3. Test the connection from the client to the database.


a) Start the DB2 command line processor.

On Windows computers, from the command prompt, run the db2cmd command.

On UNIX computers, from the command prompt, run the db2 command.b) To verify that the node was created, issue the following command to list the contents of the node

directory:

db2 list node directory show detail

A list of the nodes that you created is displayed.

Node Directory

Number of entries in the directory = 1

Node 1 entry:

Node name = OPNode_Name Comment = Directory entry type = LDAP Protocol = TCPIP Hostname = database_server_name Service name = 50000

c) To verify that the node was created, issue the following command to list the contents of the nodedirectory:

db2 list database directory

A list of the databases is displayed.d) To connect to the remote database from the client, type the following command

db2 => connect to database_alias user userid

Example: connect to opdb user opuser

If the connection is successful, a message similar to the following message is displayed:

Database Connection Information

Database server = DB2 version

SQL authorization ID = opuser

Local database alias = opdb

Upgrade IBM DB2If you are using IBM OpenPages GRC Platform version 7.2.0.3 or later, you can upgrade IBM DB2 toversion 11.1.

For more information, see supported software environments (http://www.ibm.com/support/docview.wss?uid=swg27039467#72).

Complete these tasks to upgrade IBM DB2:

• Upgrade IBM DB2 server software.• Upgrade IBM DB2 client software. For more information, see Upgrade DB2 Clients (http://

www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/c0023396.htm).l

• Copy the database driver files to the application servers, reporting servers, and to the search server (ifyou are using global search).

• If you are using a new instance for the OpenPages database, copy the Java routine class files to the DB2server.

• Upgrade IBM Cognos Business Intelligence to version 10.2.2 Fix Pack 6 or later.


http://www.ibm.com/support/docview.wss?uid=swg27039467#72

http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/c0023396.html

After you upgrade IBM Cognos Business Intelligence, complete the steps in the following technote toresolve a known issue Cannot open Cognos reports on home page report tabs on Google Chrome afterapplying Cognos fix pack 10.2.2.2 (http://www.ibm.com/support/docview.wss?uid=swg21993634).

In previous versions of OpenPages GRC Platform, it was necessary to drop the reporting schema duringproduct upgrades or after you changed the OpenPages schema (creating or modifying objects, fieldgroups, or fields). Version 7.2.0.3 or later on DB2 V11.1 now supports performing these operationswithout dropping the reporting schema.

Upgrading IBM DB2 (Windows)You can upgrade IBM DB2 to version 11.1 if you are using IBM OpenPages GRC Platform version 7.2.0.3or later.

This task provides the basic steps for upgrading IBM DB2. For more information about this process, seethe IBM DB2 Knowledge Center.

Procedure

1. Stop all OpenPages application servers.For more information, see “Stopping application servers” on page 208.

2. Stop the global search services.For more information, see “Starting and stopping the global search services” on page 206.

3. Stop all IBM Cognos services.For more information, see “Starting and stopping the Cognos services” on page 213.

4. Complete the DB2 pre-upgrade tasks for both the OpenPages database and the Cognos database. Formore information, see Pre-upgrade tasks for DB2 servers.

If you get warnings about the discontinued SYSFUN.ASCII1 function, you can ignore them.5. Drop the DB2 Text Search index and disable DB2 Text Search (DTS).

For more information, see “Dropping the DB2 Text Search index and disabling DB2 Text Search” onpage 60.

6. Back up the OpenPages database and the Cognos database.7. Run the IBM DB2 installation program.

The installation program installs DB2 and upgrades existing database instances. For moreinformation, see Upgrading a DB2 server (Windows).a) Click Install a Product.b) For the Product, choose Workgroup, Enterprise and Advanced Editions. Click Work with

Existing.c) Select the installation that you want to upgrade.d) Select the Custom option.e) Accept the default values for the response file settings.f) Expand Server Support and select DB2 Text Search for installation.g) Accept the default settings on each page of the wizard until you are prompted for the db2admin

credentials.h) Enter the domain and password for the db2admin user.i) Accept the default settings on the remaining pages of the wizard. Click Finish.

When the installation process completes, check the log files.8. Upgrade your OpenPages database.

For more information, see Upgrading databases.


http://www-01.ibm.com/support/docview.wss?uid=swg21993634


http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.server.doc/doc/c0060076.html

http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/t0050541.html



For example, start the DB2 command line processor (CLP) and run the following commands:

set db2instance=db2inst1db2start db2 upgrade database opx user opuser using passw0rd

9. Upgrade your Cognos database.For more information, see Upgrading databases.

For example, start the DB2 command line processor (CLP) and run the following commands:

set db2instance=db2inst2 db2start db2 upgrade database cognosdb user db2admin using passw0rd

10. Revalidate objects, rebind packages, and redeploy the Java routines for OpenPages in the OpenPagesdatabase.

For more information, see “Manually creating database objects in the OpenPages GRC Platformrepository” on page 44.

a) Start the DB2 command line processor (CLP).b) Run the following command:

set db2instance=db2inst1

c) Go to the\OP_<version>_Non_Embedded\OP_<version>_Configuration\Database\DB2\INSTALL_SCRIPTS directory.

For example:

cd C:\OP\OpenPages\DB2\INSTALL_SCRIPTS

d) Revalidate the database objects.

For example:

clpplus -nw opuser/passw0rd@localhost:50000/opx @sql-wrapper revalidate.sql revalidate.log opuser

e) Rebind the packages.

For example:

db2rbind opx -l opbind.log all -u db2admin -p passw0rd -r any

f) Redeploy the Java routines for OpenPages.

For example:

manageOPJavaRoutines.bat opx opuser passw0rd remove opdb2udf.jar

manageOPJavaRoutines.bat opx opuser passw0rd install opdb2udf.jar

11. Revalidate objects and rebind packages in the Cognos database.a) Start the DB2 command line processor (CLP).b) Run the following command:

set db2instance=db2inst2

c) Revalidate the database objects.



For example:

db2 connect to cognosdb user db2admin using passw0rddb2 "call sysproc.admin_revalidate_db_objects()"

d) Rebind packages in the Cognos database.

For example:

db2rbind cognosdb -l cogbind.log -u db2admin -p passw0rd

12. Apply the IBM DB2 license.a) Decompress the quick start activation file for IBM DB2.

b) Start the DB2 command line processor (CLP).c) Go to the directory where the license file, db2ese_u.lic, is stored.d) Run the following command:

db2licm –a db2ese_u.lic

13. Start all IBM OpenPages GRC Platform services.14. Configure and enable DB2 Text Search (DTS), create the index, and schedule a job to synchronize the

index.For more information, see "Utilities for filtering on long string field content in a DB2 database" in theIBM OpenPages GRC Platform Administrator's Guide.

What to do next

• Upgrade IBM DB2 client software. For more information, see Upgrade DB2 Clients (http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/c0023396.htm)l

• Copy the database driver files to the application servers, reporting servers, and to the search server. Formore information, see “Copying database driver files” on page 61.

Upgrading IBM DB2 (Linux or AIX)You can upgrade IBM DB2 to version 11.1 if you are using IBM OpenPages GRC Platform version 7.2.0.3or later.

This task provides the basic steps for upgrading IBM DB2. For more information about this process, seethe IBM DB2 Knowledge Center.

Procedure

1. Stop all OpenPages application servers.For more information, see “Stopping all application servers in AIX and Linux using a script” on page210.

2. Stop the global search services.For more information, see “Starting and stopping the global search services” on page 206.

3. Stop all IBM Cognos services.For more information, see “Starting and stopping the Cognos services” on page 213.

4. Mount the IBM DB2 installation media or extract the downloaded installation package onto your filesystem.a) Log in as the instance owner.b) Create a new directory. Do not create it under /sqllib.c) Extract the installation package to the directory that you created.

5. Check that your system meets the installation prerequisites.



http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.server.doc/doc/c0060076.html

For more information, see db2prereqcheck - Check installation prerequisites.a) Go to the IBM DB2 V11.1 installation directory.

cd server_ese_u

b) As the root or sudo user, check the installation requirements.

./db2prereqcheck –i -v 11.1.0.0

If successful, you see the message DBT3533I The db2prereqcheck utility hasconfirmed that all installation prerequisites were met.

c) Review the log file.6. Complete the DB2 pre-upgrade tasks for both the OpenPages database and the Cognos database. For

more information, see Pre-upgrade tasks for DB2 servers.

If you get warnings about the discontinued SYSFUN.ASCII1 function, you can ignore them.7. Drop the DB2 Text Search index and disable DB2 Text Search (DTS).

For more information, see “Dropping the DB2 Text Search index and disabling DB2 Text Search” onpage 60.

8. Back up the OpenPages database and the Cognos database.9. Run the IBM DB2 installation program to upgrade IBM DB2

For more information, see Upgrading DB2 server (Linux and UNIX).a) Log on to the database server as the root user and run the db2setup command.

cd <Installation Home>/servers_ese_u./db2setup

b) Click Install a Product and New Install.c) For the Product, choose Workgroup, Enterprise and Advanced Editions.d) Select the Custom option.e) Clear the Create an instance check box.f) Expand Server Support and select DB2 Text Search for installation.g) Accept the default settings on the remaining pages of the wizard.h) When the installation process completes, review the log files.i) Click Finish.

10. Upgrade your OpenPages database instance.Perform this step as the root userFor more information, see Upgrading Version 10.5 or DB2 Version 10.1 instances.a) Stop all IBM DB2 version 10.5 services.b) Edit the /etc/services file and remove any existing entry for the DB2 text service.c) Upgrade the OpenPages database instance.

For example:

cd /opt/ibm/db2/V11.1/instance./db2iupgrade -u db2fenc1 -j "TEXT_SEARCH,db2j_db2inst1,55000" db2inst1

d) View the log file, for example /tmp/db2iupgrade.log.20620. Verify that the upgrade wassuccessful. Look for the message DBI1070I Program db2iupgrade completedsuccessfully.

11. Upgrade your Cognos database instance.Perform this step as the root userFor more information, see Upgrading Version 10.5 or DB2 Version 10.1 instances.


http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.admin.cmd.doc/doc/r0059710.html



http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/t0007196.html?pos=2


Note: Perform this step after the OpenPages database instance upgrade completes successfully.

a) Upgrade the Cognos database instance.

For example:

cd /opt/ibm/db2/V11.1/instance./db2iupgrade -u db2fenc1 db2inst2

b) View the log file, for example /tmp/db2iupgrade.log.18463. Verify that the upgrade wassuccessful. Look for the message DBI1070I Program db2iupgrade completedsuccessfully.

12. Check the installation level for both instances.For more information, see db2level - Show DB2 service level command.

For each instance, run the db2level command as the instance owner.

For each instance, look for a return value of DB2 v11.1.0.0.13. If you are using DB2 Administration Server (DAS), upgrade the service.

For more information, see Upgrading the DB2 Administration Server (DAS).

For example:

cd /opt/ibm/db2/V11.1/instance./dasmigr

The value DBI1070I Program dasmigr completed successfully indicates success.14. Upgrade your OpenPages database.

Perform this step as a user with SYSADM authority.For more information, see Upgrading databases.

For example:

db2start db2 upgrade database opx user opuser using passw0rd

15. Upgrade your Cognos database instance.Perform this step as a user with SYSADM authority.For more information, see Upgrading databases.

For example:

db2start db2 upgrade database cognosdb user db2inst2 using passw0rd

16. Configure and enable DB2 Text Search (DTS), create the index, and schedule a job to synchronize theindex.For more information, see "Utilities for filtering on long string field content in a DB2 database" in theIBM OpenPages GRC Platform Administrator's Guide.

17. Revalidate objects, rebind packages, and redeploy the Java routines for OpenPages in the OpenPagesdatabase.Perform these steps as the instance owner for the OpenPages database.

For more information, see “Manually creating database objects in the OpenPages GRC Platformrepository” on page 44.

a) Go to the /OP_version_Non_Embedded/OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.

For example:

cd /home/opuser/OP/OpenPages/DB2/INSTALL_SCRIPTS






b) Revalidate the database objects.

For example:

clpplus -nw opuser/passw0rd@localhost:50000/opx @sql-wrapper revalidate.sql revalidate.log opuser

c) Rebind the packages.

For example:

db2rbind opx -l opbind.log all -u db2admin -p passw0rd -r any

d) Redeploy the Java routines for OpenPages.

For example:

./manageOPJavaRoutines.sh opx openpage passw0rd remove /home/db2inst1/sqllib/function/jar/OPENPAGE ./manageOPJavaRoutines.sh OPX openpage passw0rd install /home/opuser/OP/OpenPages/DB2/INSTALL_SCRIPTS/opdb2udf.jarls -lrt /home/db2inst1/sqllib/function/jar/OPENPAGE

18. Revalidate objects and rebind packages in the Cognos database.Perform these steps as the instance owner for the Cognos database.a) Revalidate the database objects.

For example:

db2 connect to cognosdb user db2admin using passw0rddb2 "call sysproc.admin_revalidate_db_objects()"

b) Rebind packages in the Cognos database.

For example:

db2rbind cognosdb -l cogbind.log -u db2inst2 -p passw0rd

19. Optional: Back up the databases.

• For the OpenPages database, run the following commands as the instance owner for theOpenPages database:

mkdir db2v11bucd db2v11budb2 backup database opx to .

• For the Cognos database, run the following commands as the instance owner for the Cognosdatabase:

mkdir db2v11bucd db2v11budb2 backup database cognosdb to .

20. Apply the IBM DB2 license.For more information, see db2licm - License management tool command.a) Decompress the quick start activation file for IBM DB2.

b) Run the db2licm command.

For example:

db2licm -a /home/db2inst1/v11install/server_ese_u/db2/license/db2ese_u.lic

c) Verify the license by running the db2licm -l command.21. Start all IBM OpenPages GRC Platform services.



22. Verify that DTS is running.

db2connect to <openpages_database_name> user <openpages_database_user> using <database_user_password>db2 "select count(*) from <openpages_database_user>.propertyvals_clob where contains(CLOB_VALUE, 'RPS') = 1"

What to do next

• Upgrade IBM DB2 client software. For more information, see Upgrade DB2 Clients (http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.qb.upgrade.doc/doc/c0023396.htm)l

• Copy the database driver files to the application servers, reporting servers, and to the search server. Formore information, see “Copying database driver files” on page 61.

Dropping the DB2 Text Search index and disabling DB2 Text SearchDrop the DB2 Text Search index and disable DB2 Text Search (DTS) before you upgrade an IBM DB2database.

Procedure

1. Log on to a system as the OpenPages installation user, for example opuser.

You can use any system with access to CLPPlus that can connect to the OpenPages GRC Platformdatabase server.

2. If you are using version 7.2.0.3, copy the CustomIndexing_Step5_IndexDrop.sql file from theOP_7.2.0.3_Patch_Scripts\DB2\PATCH_SCRIPTS directory to the <OP_Home>/OpenPages/aurora/bin/full-text-index directory

3. Drop the DB2 Text Search index.a) Go to the <OP_HOME>/aurora/bin/full-text-index directory.b) Open a command line and run the following command:

clpplus -nw @sql-wrapper CustomIndexing_Step5_IndexDrop.sql <LOG_FILE_NAME> <DB2_SERVER_NAME> <DB2_PORT_NUMBER> <DATABASE_NAME> <OP_DB_USER> <OP_DB_PASSWORD> <FORCE_DROP_INDEX>

For example

clpplus -nw @sql-wrapper CustomIndexing_Step5_IndexDrop.sql CustomIndexing_Step5_IndexDrop.log localhost 50000 OPX OPENPAGE passw0rd Y

Note: For more information about the script, see "Drop a long string index" in the IBM OpenPagesGRC Platform Administrator's Guide.

4. Run the following command to determine if DB2 Text Search is enabled.

select * from all_tables where table_schema = 'SYSIBMTS';

If the command returns any data, DB2 Text Search is enabled. Continue with the next step to disableDB2 Text Search.

5. Log on to the OpenPages database as the instance owner.

db2 connect to opx user opuser using passw0rd

6. Run the following command to disable DB2 Text Search.For more information, see SYSTS_DISABLE procedure - Disable current database for text search.

db2 "call sysproc.systs_disable('','en_US',?)"



http://www.ibm.com/support/knowledgecenter/SSEPGG_11.1.0/com.ibm.db2.luw.sql.rtn.doc/doc/r0051993.html

Alternatively, use these commands.

db2 GRANT SYSTS_ADM TO db2inst1 db2 grant SYSTS_MGR to db2inst1db2 connect reset db2ts start for textexport DB2DBDFT=OPXdb2ts DISABLE DATABASE FOR TEXT

Copying database driver filesAfter you upgrade IBM DB2, copy the JDBC driver files to the application servers, reporting servers, and tothe search server.

Procedure

1. Go to the following directory on the database server:

<DB2_Home>\sqllib\java\ (on Windows)

<DB2_Home>/sqllib/java/ (on UNIX)2. Locate the following files:

• db2jcc4.jar• db2jcc_license_cu.jar• db2jcc.jar

3. Copy the db2jcc4.jar and db2jcc_license_cu.jar files to the following directories on eachapplication server:

Windows:

• <OP_Home>\aurora\lib\• <OP_Home>\aurora\ws-ext-lib\

UNIX:

• <OP_Home>/aurora/lib/• <OP_Home>/aurora/ws-ext-lib/

4. If you are using global search, copy the db2jcc4.jar and db2jcc_license_cu.jar files to thefollowing directory on the search server:

<OP_Home>\OpenPages\OPSearch\opsearchtools\lib\ (on Windows)

<OP_Home>/OpenPages/OPSearch/opsearchtools/lib/ (on UNIX)5. Copy the db2jcc.jar and db2jcc_license_cu.jar files to the following directory on each

reporting server:

<Cognos_Home>\webapps\p2pd\WEB-INF\lib\ (on Windows)

<Cognos_Home>/webapps/p2pd/WEB-INF/lib/ (on UNIX)6. Restart the services.

Copy Java routine class files to the DB2 serverIf you are using a new instance for the OpenPages database, copy the Java routine class files for IBMOpenPages GRC Platform to the IBM DB2 server before you create the reporting schema.

Perform this task after you have upgraded your database server to IBM DB2 version 11.1.

1. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.2. Copy the following files to the DB2_HOME/FUNCTION directory:



For example, on Microsoft Windows operating systems, the DB2_HOME\FUNCTION directory isinstall_path\ibm\SQLLIB\FUNCTION.

On AIX or Linux operating systems, the default location is /home/db2_instance_owner/sqllib/FUNCTION.


Chapter 6. Oracle database server and client setupfor OpenPages GRC Platform installations

Install and configure database server software to use with IBM OpenPages GRC Platform.

Install the database client software (Oracle Admin client) on all computers where the OpenPagesapplication and Cognos Business Intelligence reporting servers are installed.

Oracle database server installationsIBM OpenPages GRC Platform requires a database server. Use the installation instructions from thevendor to install the Oracle database server on the OpenPages database server. After you install Oracledatabase, some configuration is required.

Before starting the installation, you must add the SYS.DBMS.CRYPTO package to the PUBLIC group. Formore information, see “Oracle package dependencies” on page 64.

Restriction: Do not install Oracle database server or Oracle client software into a directory that containsspaces.

Important: The password for database users (such as SYSTEM, SYS, DBSNMP, SYSMAN) cannot containspecial characters due to database requirements and conflicts with OpenPages scripts.

After installing the Oracle database server, you must install an Oracle client software on all applicationserver computers.

Creating users and groups on the Oracle database server for Linux operatingsystems

For Linux installations, create and configure the oinstall, dba, and opuser groups and the oracleuser on the server that hosts the Oracle database.

The users and groups must be created and configured by a user with SYSADMIN privileges and access toroot.

For more information, see the Oracle documentation.

If you are installing a cluster environment, you must create these users on the cluster administratorserver and on each cluster member.

About this task

Use the following table to help you create the required users and user groups for the database server.

Table 17: Required users and groups for Oracle database servers


oracle oinstall; dba

oinstall is theprimary group forthis user.

Read, write, executepermission to the OracleAdmin client installationdirectory.

Required by Oracle databaseinstallation program.

Important: The password for thisuser cannot contain specialcharacters due to conflicts with IBMOpenPages GRC Platform scripts.

Procedure

1. Log on to the database server as root.2. To create a group that is called oinstall, open a Linux shell and type the following command:

groupadd oinstallgroupadd dba

This group is the primary group for the oracle user. This group is the inventory group.

Note: The Oracle database requires these names.3. Create a user that is called oracle, assign the initial login group (oinstall), and add the user to thedba group.a) Go to the /usr/sbin/ directoryb) Type the following command:

/usr/sbin/useradd -m -g oinstall -G dba oracle4. Change the password for the oracle user by using the following command:

passwd oracle5. At the New Password prompt, enter a new password.

Related tasksSetting the file descriptor limit for OpenPages GRC Platform users on Linux

Oracle package dependenciesTo function correctly, the IBM OpenPages GRC Platform Oracle packages must have access to somestandard Oracle objects.

In a standard Oracle deployment, database users can access most of the objects listed in the followingtables. Some customer environments might restrict the default Oracle access model and remove publicaccess from some of these objects. To use the OpenPages GRC Platform application, users require accessto all objects in the tables. You must verify the correct access to these objects during the installation. In atypical deployment, you might need to grant explicit access only to the DBMS_CRYPTO package.

The following tables list the standard Oracle objects to which the OpenPages application requires access.The tables show the base object, the object name, and the public synonym for the Oracle databaseobjects.

Table 18: Base objects for the package object type

Base Object Object Name Public Synonym

SYS.DBMS_CRYPTO DBMS_CRYPTO PUBLIC.DBMS_CRYPTO

SYS.DBMS_RANDOM DBMS_RANDOM PUBLIC.DBMS_RANDOM

SYS.DBMS_SQL DBMS_SQL PUBLIC.DBMS_SQL

SYS.DBMS_JOB DBMS_JOB PUBLIC.DBMS_JOB

SYS.DBMS_OUTPUT DBMS_OUTPUT PUBLIC.DBMS_OUTPUT

SYS.DBMS_SESSION DBMS_SESSION PUBLIC.DBMS_SESSION

SYS.DBMS_UTILITY DBMS_UTILITY PUBLIC.DBMS_UTILITY


Table 18: Base objects for the package object type (continued)


SYS.DBMS_SNAPSHOT DBMS_MVIEW PUBLIC.DBMS_MVIEW

SYS.DBMS_STATS DBMS_STATS PUBLIC.DBMS_STATS

SYS.STANDARD N/A N/A

SYS.DBMS_STANDARD N/A PUBLIC.ODCICONST

SYS.ODCICONST ODCICONST N/A

SYS.PLITBLM N/A PUBLIC.DUAL

Table 19: Base objects for the view object type


SYS.ALL.PROCEDURES ALL_PROCEDURES PUBLIC.ALL_PROCEDURES

SYS.ALL_TAB_PRIVS ALL_TAB_PRIVS PUBLIC.ALL_TAB_PRIVS

SYS.NLS_SESSION_

PARAMETERS

NLS_SESSION_PARAMETERS

PUBLIC.NLS_SESSION_PARAMETERS

SYS.PRODUCT_COMPONENT_

VERSION

PRODUCT_COMPONENT_VERSION

PUBLIC.PRODUCT_COMPONENT_VERSION

SYS.USER_CONS_COLUMNS

USER_CONS_COLUMNS PUBLIC.USER_CONS_COLUMNS

SYS.USER_CONSTRAINTS

USER_CONSTRAINTS PUBLIC.USER_CONSTRAINTS

SYS.USER_DB_LINKS USER_DB_LINKS PUBLIC.USER_DB_LINKS

SYS.USER_IND_COLUMNS

USER_IND_COLUMNS PUBLIC.USER_IND_COLUMNS

SYS.USER_INDEXES USER_INDEXES PUBLIC.USER_INDEXES

SYS.USER_OBJECTS USER_OBJECTS PUBLIC.USER_OBJECTS

SYS.USER_SEGMENTS USER_SEGMENTS PUBLIC.USER_SEGMENTS

SYS.USER_SEQUENCES USER_SEQUENCES PUBLIC.USER_SEQUENCES

SYS.USER_SOURCE USER_SOURCE PUBLIC.USER_SOURCE

Oracle database server and client setup for OpenPages GRC Platform installations 65

Table 19: Base objects for the view object type (continued)


SYS.USER_TAB_COLS USER_TAB_COLS PUBLIC.USER_TAB_COLS

SYS.USER_TAB_COLUMNS

USER_TAB_COLUMNS PUBLIC.USER_TAB_COLUMNS

SYS.USER_TABLES USER_TABLES PUBLIC.USER_TABLES

SYS.USER_TABLESPACES

USER_TABLESPACES PUBLIC.USER_TABLESPACES

SYS.USER_TRIGGERS USER_TRIGGERS PUBLIC.USER_TRIGGERS

Users also require access to all synonyms. If any public synonyms are removed from a default Oracledeployment, you must create a private synonym to the object in the OpenPages GRC Platform applicationuser schema.

Follow these steps to grant explicit permission to an object:

1. Log on to a computer with SQL*Plus and access to the database server.2. From the command line, log on to SQL*Plus:

sqlplus sys/<password>@<tns_alias> as sysdba

3. At the SQL prompt, type the following command for the objects listed in Table 18 on page 64:

grant execute on <object_name> to public;

Type the following command for the objects listed in Table 19 on page 65:

grant select on <object_name> to public;

Each package object requires the EXECUTE permission. All other objects require the SELECT permission.

Adding an Oracle listener for the OpenPages GRC Platform databaseYou must manually add an Oracle database listener for the IBM OpenPages GRC Platform database.

Procedure

1. Log on to your database server as a user with administrative privileges.2. Start the Net Configuration Assistant.

a) Open a Command Prompt window as a user with Administrative privileges.b) Go to the Oracle_Home\bin directory.c) To start the Net Configuration Assistant, type the following command: netca.

3. Accept the default options on all pages, except for the pages described here. For full information, seethe Oracle documentation.a) On the Listener Configuration, Listener Name page, ensure the listener name that you specify is

unique in the current Oracle Homeb) On the TCP/IP Protocol page, choose a port.

If you have installed only one Oracle database instance on your computer, select the Use standardport number of 1521 option.


If you have other instances of Oracle installed, choose another port number. This port numbercannot be used by any other services that are running on your computer.

Creating an Oracle database instance for the OpenPages GRC Platformrepository

You must create an Oracle database instance for OpenPages GRC Platform to use.

Procedure

1. Log on to your database server as a user with administrative privileges.2. Start the Database Configuration Assistant.

a) Open a command prompt window as a user with administrative privileges.b) Go to the Oracle_Home\bin directory.c) To start the Database Configuration Assistant, type the following command: dbca.

3. Accept the default options on all pages, except for the pages described here. For full information, seethe Oracle documentation.

4. On the Initialization Parameters page, change the following settings.a) On the Memory tab, click Custom and then set the following options:

• Memory Management to Automatic Shared Memory Management.• SGA Size field to 1024.• PGA Size field to 768.

b) On the Sizing tab, set the following options:

• Block Size to 8192.• Processes to 250.

c) On the Character Sets tab, select Use Unicode (AL32UTF8) and set the National Character Setoption to AL16UTF16 - Unicode UTF-16 Universal character set.

You must create your database with the AL32UTF8 character set.5. Click All Initialization Parameters > Show Advanced Parameters and use the custom settings.

Table 20: Initialization parameter values for Oracle database instance

Parameter Name Value Default

nls_length_semantics CHAR

CHAR is required for globalization.

BYTE

open_cursors 300

optimizer_index_caching 100 0

optimizer_index_cost_adj 1 100

optimizer_mode FIRST_ROWS ALL_ROWS

optimizer_secure_view_merging false


Add a local net service name for the OpenPages GRC Platform databaseThe database client uses a net service name to connect to the IBM OpenPages GRC Platform repository.

You must add a net service name, with the appropriate host, port, and service name details, for eachserver in the OpenPages GRC Platform deployment.

For more information on creating a net service name, see the Oracle documentation.

Setting the Oracle environment variables for the database serverAfter you install the Oracle database server, you must set the Oracle environment variables on theOpenPages database server computer.

The following table lists the environment variables required for AIX and Linux operating systems. If youare using Microsoft Windows, you need to set only the ORACLE_HOME environment variable.

Table 21: Oracle environment variables and descriptions

Environment variables Description

ORACLE_SID Specifies the database service name.

Restriction: The SID is case-sensitive in AIX and Linux environments.

ORACLE_HOME Specifies the installation location or top-level directory structure for thedatabase installation.

NLS_LANG Specifies the database character set that is configured during the databaseinstallation. The default value is AMERICAN_AMERICA.AL32UTF8

Note: To display non-English characters for Japanese locales, set thevariable to the following value:NLS_LANG=JAPANESE_JAPAN.JA16SJISTILDE

TNS_ADMIN Specifies the location of the tnsnames.ora file. The default location is theOracle_Home\network\admin directory.

On Windows:

1. Log on to the database server as a user with administrative privileges.2. Right-click My Computer > Properties.3. Click Advanced system settings > Environment Variables.4. In the System Variables panel, click New.5. Add the ORACLE_HOME variable to the System variables panel, then click OK.

For example: ORACLE_HOME=C:\app\Administrator\product\11.2.0\dbhome_16. Select the PATH variable in the System Variables panel, and click Edit.7. In the Edit System Variable box, add the path to ORACLE_HOME at the start of the PATH variable.

%ORACLE_HOME%\bin

By default, the PATH variable already includes the path %ORACLE_HOME%\bin after you install theOracle database server software.

8. Click OK twice to exit.

On UNIX:


1. Log on to the database server as the user who installed the Oracle database server.2. Open the user profile, and set the ORACLE_SID, NLS_LANG, ORACLE_HOME, and TNS_ADMIN

variables.

Important: Use the syntax and delimiters that are appropriate for the shell that you are using.

For example:

export ORACLE_SID=OPexport NLS_LANG=AMERICAN_AMERICA.AL32UTF8export ORACLE_HOME=/home/oracle/app/oracle/product/12.1.0/dbhome_1export TNS_ADMIN=$ORACLE_HOME/network/admin

3. Append the location of ORACLE_HOME/bin to the PATH environment variable.

For example:

export PATH=$ORACLE_HOME/bin:$PATH

4. Refresh the profile.


. /home/oracle/.bash_profile


. /home/oracle/.profile

Scripts to manually create the OpenPages GRC Platform database schema inOracle before installation

To create the IBM OpenPages GRC Platform schema before installation, you can use either the IBMOpenPages GRC Platform Administrative Console or the SQL wrapper scripts that are included in themedia kit.

OpenPages GRC Platform requires that you create an OpenPages database schema, a set of databaseusers, and a tablespace. During the OpenPages installation, you can choose to automatically create theschema using the IBM OpenPages GRC Platform Administrative Console. Optionally, you can manuallycreate the OpenPages database schema before you install OpenPages application servers.

Scripts used to create the database schema

To create the OpenPages application tablespace and users, run a SQL wrapper script. The SQL wrapperscript calls other scripts.

sql-wrapper.sqlThe script runs other required SQL scripts in the correct order. Use this script to manually install thedatabase.

database-install.sqlThe wrapper script contains default definition values that you can modify. Change settings in thescript file and not the command-line interface. Default values include the OpenPages administratoruser account, base currency denomination, and the location of the OpenPages storage folder.The base currency must match the base currency that is set in any previous installations. You cannotchange the base currency after installation.

op-app-global-env.sqlThe script is called by the wrapper script and defines the Super Administrator user account. You mustverify the user account values in this script.


Changing the database object names for Oracle Automatic StorageManagement

The IBM OpenPages GRC Platform database includes coded names and locations of tablespaces, datadirectories, and data files. To prevent a conflict with internal systems, practices, or IT policies, you mustmodify some scripted values.

For example, the installation program creates the aurora.dbf data file that stores all OpenPages GRCPlatform data. Use Oracle Automatic Storage Management to change the name of this data file.

To change the name of the data file in the OpenPages database, a database administrator must updatethe following scripts before you run the sql-wrapper.sql script.create-opx-tablespaces.sql

Creates tablespaces for OpenPages database application tablesibpm-ts-and-schema-owner.sql

Creates tablespaces for IBPM application tables.

Restriction: OpenPages GRC does not support installation into an Oracle database that utilizes encryption(such as, Oracle Transparent Data Encryption).

Procedure

1. Log on to a system as a user with administrator privileges.

Tip: You can use any system that has access to SQL*Plus and that can connect to the database server.2. Go to the OP_version_Configuration\Database\Oracle directory and copy the /OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory.

3. Open the create-opx-tablespaces.sql script in a text editor.a) As appropriate for your environment, modify the SQL script under -- permanent storage,protected by logging, -- dedicated temporary tablespace and --temporarystorage, no logging protection:

CREATE TABLESPACE iflowdb DATAFILE '&dbf_location/&tablespace_name.dbf' SIZE 25M REUSE AUTOEXTEND ON NEXT 25M MAXSIZE UNLIMITED ONLINE EXTENT MANAGEMENT LOCAL UNIFORM SIZE 256K';

b) Save and close the file.4. Open the ibpm-ts-and-schema-owner.sql script in a text editor.

a) Use the following syntax to modify the SQL script under ReCreate the tablespace andRECREATE THE USER:

CREATE TABLESPACE iflowdb DATAFILE '&dbf_location/&tablespace_name.dbf' SIZE 25M REUSE AUTOEXTEND ON NEXT 25M MAXSIZE UNLIMITED ONLINE EXTENT MANAGEMENT LOCAL UNIFORM SIZE 256K';

b) Save and close the file.For example, the following SQL syntax creates a tablespace with a data file called OPdatafile in theOracle data home location. The tablespace is managed locally.

CREATE TABLESPACE iflowdb DATAFILE '&&10/OPdatafile.dbf' SIZE 25M REUSE AUTOEXTEND ON NEXT 25M MAXSIZE UNLIMITED ONLINE EXTENT MANAGEMENT LOCAL UNIFORM SIZE 256K';

Where &&10 uses the datafile_storage_location parameter that you entered in the database-install.sql command for the data file location. OPdatafile.dbf is the name of the data file.


The following SQL syntax creates a temporary tablespace with a data file in disk_group_1. Thetablespace is managed locally.

CREATE TEMPORARY TABLESPACE OPDATA_TEMP TEMPFILE '+disk_group_1' SIZE 2G EXTENT MANAGEMENT LOCAL;

5. To verify the default definition values, open the sql-wrapper.sql wrapper script in a text editor andmodify the values as required for the following definitions.

• define opx_base_currency_iso_code='USD'• define opx_dflt_stor_srv_root='C:\openpages-storage'

For example, by default, the base currency is set to USD. If you use Euros as your base currency,change the default ISO currency code from USD to EUR.

define opx_base_currency_iso_code='EUR'

6. From the INSTALL_SCRIPTS directory, open the custom environment script op-app-global-env.sql in a text editor.a) Modify the following default values for the Super Administrator.


Do not use the following user names, which are reserved by OpenPages:


b) Save and close the file.7. Use the following syntax to run the database-install.sql wrapper script that creates the

database components:

sqlplus /nolog @database-install.sql database-install.sql log_file oracle_tns_alias dba_user dba_password workflow_user workflow_password op_user op_password datafile_storage_location

The following table provides a list of parameters that are passed to the SQL wrapper script.

Table 22: Examples of SQL wrapper script parameters and descriptions

Parameter Name Description Example

log_file The log file name that thescript creates and writesinformation to.

logfile.txt

oracle_tns_alias The database alias for theOpenPages databaseinstance, as set during theOracle database installation.If necessary, you can retrievethis alias from thetnsnames.ora file.

OP


Table 22: Examples of SQL wrapper script parameters and descriptions (continued)


dba_user The Oracle system username.

If you do not have access tothe system user account,then use a database useraccount with administrativeprivileges.

system

dba_password The password for the Oraclesystem account.

openpages

workflow_user The workflow database username.

OpenPages uses this accountto create and access theworkflow database, and tomanage workflow-relatedtransactions.

opworkflow

workflow_password The password for theworkflow database useraccount.

opworkflow

op_user The user name that is usedby OpenPages to create andaccess the OpenPagesdatabase instance

openpages

op_password The password for theOpenPages database useraccount.

openpages

datafile_storage_location The location of the Oracledata directory on thedatabase server. The locationof this directory is set duringthe Oracle installationprocess.

• C:\oracle\ora112\oradata\OP

• C:\openpages_data\repository\database112_se_x64\oradata\OP

The following sample code shows the SQL*Plus command line with example values from the tablefrom the preceding step as the variables.

sqlplus /nolog @sql-wrapper.sql database-install logfile.txt OPsystem openpages opworkflow opworkflow openpages openpagesC:\oracle\ora112\oradata\OPC:\openpages_data\repository\ database112_se_x64\oradata\OP

After the SQL script finishes, the OpenPages database schema is created. A log file is created in thedirectory where you ran the SQL script. The name of the log file matches the value of the log_fileparameter you entered.


Results

If you have problems when you run the database-install.sql script, you can use theOP_version_Configuration\Database\Oracle\init-db-cleanup.sql script. The init-db-cleanup.sql removes the database components that were added. Then, you can run the database-install.sql script in a clean database environment.

Example

sqlplus /nolog @sql-wrapper.sql init-db-cleanup.sql log_fileoracle_tns_alias dba_user dba_password workflow_user op_user

Starting and stopping the database server in a Windows environmentUse Windows services to start or stop the Oracle database instance.

Procedure

1. Log on to the database server as a user with administrative privileges.2. Click Start > All Programs > Administrative Tools > Services.3. Start the Oracle database listener service, which connects the user to the Oracle database instance

4. To start the Oracle database instance, right-click the service name (OracleServiceSID) and selectStart.

Testing the connections to the database server and the OpenPages GRCPlatform repository

Test whether the SQL*Net connect string can connect to the database listener by using the TNSPINGutility in the ORACLE HOME/bin directory. The TNSPING utility tests whether the listener is available. Itdoes not test whether the databases behind the listener are working.

To test that the IBM OpenPages GRC Platform repository is created, use SQL*Plus to log on to theOpenPages Oracle database schema.

Procedure

1. To test whether you can log on to Oracle Enterprise Manager Database Control, the web-basedinterface that is used to administer an Oracle database, type the following command:

https://oracle_server_name:port/em

If you are using Oracle 11.2.0.4, the default port number is 1158.

If you are using Oracle 12.1.0.2, the default port number is 5500.2. To test whether a SQL*Net connect string can connect to the listener, type the following command:

tnsping database_instance_name

The utility requests acknowledgement that the service name is valid and that the listener is configuredto handle requests for that service name.

If the configuration is correct, a message is displayed that shows the return time.

If the configuration is not correct, the utility returns an error message. Ensure that you use the correctservice name and that the listener is started on the server computer.

3. To test that the OpenPages repository is created, type the following command:

sqlplus username/password@service_name

For example, sqlplus system/openpages@op


The system connects you to an Oracle database instance.4. To exit SQL*Plus, type exit.

Oracle database client installationsYou install the Oracle database client on each IBM OpenPages GRC Platform application server so that itcan connect to the Oracle database server remotely and administer the OpenPages repository.

If the Oracle database server is installed on the same computer as the application server, the OracleAdmin client is not required.

The 32-bit Oracle database client is required by the reporting server. If you are using the same computerfor the application server and reporting server, you must install the 32-bit version.

Review the following tasks before you install the Oracle Admin client software:

• “Creating users and groups for application servers on UNIX that use Oracle databases” on page 74.• “Setting the ORACLE_HOME environment variable on the OpenPages GRC Platform application servers”

on page 76.• “Testing the connection to the OpenPages GRC Platform repository from the database client” on page

77.• “Custom OpenPages database schema installations” on page 77.

For information on installing the Oracle Admin client software, see the Oracle documentation.

Creating users and groups for application servers on UNIX that use Oracle databasesTo install the Oracle Admin client, WebSphere Application Server, and the IBM OpenPages GRC Platformapplication, you must create two users and one group on AIX® and Linux operating systems. You cancreate a separate user and group to install IBM WebSphere Application Server.

About this task

To install the Oracle Admin client, create and configure the oinstall group and the oracle user on theserver that hosts the OpenPages application.

Table 23: Required users and groups for application servers


oracle oinstall

The primary groupfor the oracle user.


Required by Oracle Admin clientinstallation program.

For information on creating standardOracle users and user groups, seethe Oracle documentation.

wasuser IBM WebSphereApplication Serverinstallation

Read, write, executepermission to theWebSphere ApplicationServer installation directory.

You can create a non-root user toinstall the WebSphere ApplicationServer software. You can create aseparate user and group or use theopuser user.


Table 23: Required users and groups for application servers (continued)


opuser oinstall Read, write, executepermission to the followingdirectories:

• OP_Home/tmp directory.• Oracle Admin client

installation directory andOracle_Home directory.

• IBM WebSphereApplication Serverinstallation directory.

• Java JDK or JREinstallation directory.

• Cognos BI installationdirectory.

User must includeOracle_Home/bin in thepath to run SQL*Pluscommands.

Required by the OpenPagesinstallation.

Procedure

1. Log on to the application server as the root user and open a shell.2. To create a group called oinstall, enter the following command:

mkgroup oinstall (on AIX)

groupadd oinstall (on Linux)

Restriction: The Oracle Admin Client installer requires that this group is named oinstall.3. To create a user oracle and assign the user to the oinstall group, go to the /usr/sbin/

directory and enter the following command:

/usr/sbin/useradd -m -g oinstall oracle

Restriction: The Oracle Admin Client installer requires that this user is named oracle.4. Use the following command to change the password for the oracle user:

passwd oracle5. Enter a new password at the New Password prompt.6. To install the OpenPages application, opuser must exist.

If this user does not already exist, create the user:

useradd -m -g oinstall name

If the user already exists, assign it to the oinstall group:

a. Obtain the groups to which opuser belongs by using the id opuser command.b. Add the oinstall group to its supplementary groups:

usermod -G group1,group2,...,oinstall opuser

For example:

a. Run the command id opuser


The output from the command window shows that opuser has been assigned to the groupsopgroup and staff:

uid=210(opuser) gid=206(opgroup) groups=1(staff)

b. Run the command usermod -G staff,oinstall opuserc. Run the command id opuser to verify whether opuser has been assigned to the oinstall

group successfully.

The output from the command window shows that opuser has been assigned to the groupsstaff and oinstall:

7. If you created a new opuser in the previous step, change the password by using the followingcommand:

passwd name

Restriction: The password cannot contain spaces or special characters. Otherwise, the OPBackupscript will fail.

8. At the New Password prompt, enter a new password.9. Grant read, write, and execute permissions to the Oracle home directory to allow opuser to run the

following command using SQL*Plus:

chmod -R 775 /home/oracle

10. Grant read, write and execute permissions for opuser to the WebSphere Application Serverinstallation directory, the Java™ JDK or IBM JRE installation directory, and the Cognos® BI installationdirectory.

Setting the ORACLE_HOME environment variable on the OpenPages GRC Platformapplication servers

Set up the ORACLE_HOME environment variable to point to the directory where the Oracle database clientsoftware is installed. Set the variable on the admin server and each non-admin server.

Procedure

1. Log on to the application server.

On Microsoft Windows, log on as a user with administrative privileges and full access to the localserver drives.

For UNIX, log in as a non-root user, such as the opuser user that you created for the IBMOpenPages GRC Platform installation.

2. Set the ORACLE_HOME environment variable to point to the Oracle Admin Client installation directory.

On Windows:

a. Right-click My Computer > Properties.b. Click Advanced system settings > Environment Variables.c. Click New in the System Variables panel.d. Add the ORACLE_HOME variable to the New System Variable box, then click OK.

For example: ORACLE_HOME=C:\app\Administrator\product\12.1.0\client_1e. Select the PATH variable in the System Variables panel, and click Edit.f. In the Edit System Variable box, add the path to ORACLE_HOME at the start of the PATH variable.

%ORACLE_HOME%\bin

By default, the PATH variable already includes the path ORACLE_HOME\bin after you install theOracle client software.

g. Click OK twice to exit.


On UNIX, add the ORACLE_HOME variable to the profile.

• On Linux, the profile is /home/user/.bash_profile• On AIX, the profile is /home/user/.profile

Where user is the person who logs in to the operating system and creates the OpenPages installation.

For example:

export ORACLE_HOME=/home/oracle/app/oracle/product/11.2.0/client_1

3. Append the location of ORACLE_HOME/bin to the PATH environment variable.

For example:

export PATH=$ORACLE_HOME/bin:$PATH

4. Refresh the profile.


. /home/opuser/.bash_profile


. /home/opuser/.profile

Testing the connection to the OpenPages GRC Platform repository from the databaseclient

Test whether the SQL*Net connect string can connect to the IBM OpenPages GRC Platform repository onthe Oracle database server from the Oracle database client.

Procedure

1. Copy the file ORACLE_HOME\network\admin\tnsnames.ora from the Oracle database serveroperating system to the ORACLE_HOME\network\admin\ Oracle database client directory.

Ensure that the OpenPages installation user has read, write and execute permissions to thetnsnames.ora file in the Oracle database client operating system.

2. Log on to the Oracle database client as an OpenPages installation user.3. Edit the file ORACLE_HOME\network\admin\tnsnames.ora, and update the Host value to the

hostname or IP address of the Oracle database server.4. To test the connection to the OpenPages repository on the database server, type the following

command:




Custom OpenPages database schema installationsInstead of loading the default IBM OpenPages GRC Platform database schema, you can load your owncustom configuration data. You can install the OpenPages application before you load your custom data.However, you must load your data before you run the OpenPages application.



Chapter 7. IBM Cognos Business Intelligenceinstallations

OpenPages CommandCenter must be installed on the same computer as IBM Cognos BusinessIntelligence. This server is referred to as the reporting server.


Reporting server distribution options

For light user loads, with fewer than 50 concurrent users, IBM Cognos BI and OpenPagesCommandCenter can be installed on the same computer as the OpenPages application.

For heavier user loads, install IBM Cognos BI and OpenPages CommandCenter on a different computer tothe OpenPages application servers. OpenPages GRC Platform operates at peak performance when thedatabase server, application server, and the reporting server are installed on separate computers.

Requirements for installing IBM Cognos BI in a Linux environment

IBM Cognos Business Intelligence requires specific Linux packages. For more information, see the IBMCognos Business Intelligence documentation.

The IBM Cognos BI installation program and requires the following 32-bit and 64-bit libraries.

32-bit libraries

• gtk2-2.18.9-6.el6.i686.rpm• glib2-2.22.5-6.el6.i686.rpm• libXtst-1.0.99.2-3.el6.i686.rpm• compat-libstdc++-33-3.2.3-69.el6.i686.rpm• pam-1.1.1-10.el6.i686.rpm• openmotif22-2.2.3-19.el6.i686.rpm• libXp-1.0.0-15.1.el6.i686.rpm• ibXmu-1.0.5-1.el6.i686.rpm

64-bit libraries

• gtk2-2.18.9-6.el6.x86_64.rpm• glib2-2.22.5-6.el6.x86_64.rpm• libXtst-1.0.99.2-3.el6.x86_64.rpm• compat-libstdc++-33-3.2.3-69.el6.x86_64.rpm• openmotif22-2.2.3-19.el6.x86_64.rpm• pam-1.1.1-10.el6.x86_64.rpm• libXp-1.0.0-15.1.el6.x86_64.rpm• libXmu-1.0.5-1.el6.x86_64.rpm• compat-glibc-headers-2.3.4-2.26.x86_64.rpm• compat-glibc-2.3.4-2.26.x86_64.rpm

Database server requirements for OpenPages GRC Platform and IBM Cognos BI

If you are using an IBM DB2 database server, you must use two separate databases - one for the IBMCognos Business Intelligence content store, and a second one for the IBM OpenPages GRC Platformrepository.

If you are using an Oracle database server, for best performance, use separate databases for the contentstore and IBM OpenPages GRC Platform repository.

Installing IBM Cognos Business IntelligenceBefore you install IBM OpenPages GRC Platform components, ensure that IBM Cognos BusinessIntelligence is installed and running on your reporting server computer.

For more information, see the IBM Cognos Business Intelligence Installation and Configuration Guide inIBM Knowledge Center (http://www.ibm.com/support/knowledgecenter).

Important: For 64-bit installations, the report server component in IBM Cognos BI is provided with 32-bitand 64-bit versions. You select the version to use from IBM Cognos Configuration. For OpenPages GRCPlatform applications, you must use the default 32-bit report server.

Before you begin

If the OpenPages database is installed on a separate computer to the IBM Cognos BI server, ensure that a32-bit database client is installed on the Cognos BI server.

Restriction: Do not install the database client software into a directory with spaces.

On Linux operating systems, ensure that the dependent 32-bit and 64-bit libraries are installed.

If you are using an Oracle database on the same computer as IBM Cognos BI, you must update yourenvironment variables so that the IBM Cognos service uses the 32-bit Oracle libraries, and the Oracleserver uses the 64-bit libraries.

To create the user variables for the IBM Cognos service:

• Create a user variable named ORACLE_HOME and set its value to the 32-bit Oracle Admin client home.

For example, on Microsoft Windows operating systems, set the ORACLE_HOME user variable to C:app\Administrator\product\11.2.0\client_1.

• Create a user variable named PATH, or append to an existing one, and include the 32-bit Oracle Adminclient home.

For example, on Windows, set the PATH user variable to %ORACLE_HOME%\bin;%PATH%.• Add ORACLE_HOME/lib to the system libraries variable.

Table 24: Oracle Admin client path environment variables for Cognos installations

Operatingsystem Environment variable Example

Linux LD_LIBRARY_PATH LD_LIBRARY_PATH=$ORACLE_HOME/lib:$LD_LIBRARY_PATH

AIX LIBPATH LIBPATH=$ORACLE_HOME/lib:$LIBPATH

Important: The 64-bit IBM DB2 database installations includes libraries for both 32-bit and 64-bitsystems. Use the following table to add the path to the DB2 32-bit server libraries.



Table 25: IBM DB2 database path environment variables for Cognos installations

Operatingsystem Environment variable Example

Linux LD_LIBRARY_PATH LD_LIBRARY_PATH=$DB2DIR/lib32:$LD_LIBRARY_PATH

AIX LIBPATH LIBPATH=$DB2DIR/lib32:$LIBPATH

Procedure

1. Ensure that a web server is installed.

For more information, see “Prerequisite software for reporting servers” on page 15.2. On the reporting server, install IBM Cognos BI server.

a) Install IBM Cognos BI Server.

Important: In the installation wizard, accept the default components that are selected. Do notselect Cognos Content Database.

Restriction: Install IBM Cognos BI into a directory that contains only ASCII characters in the pathname. Do not install IBM Cognos BI into a directory that contains spaces.

After the installation is complete, ensure that the IBM Cognos Configuration check box is clear.Before you configure Cognos BI Server, you must do other tasks to set up your environment.

For information about installing IBM Cognos BI Server on Windows operating systems, seeInstalling server components on Windows operating systems in the IBM Cognos Knowledge Center.

For information about installing IBM Cognos BI Server on AIX or Linux operating systems, seeInstalling server components on UNIX or Linux operating systems in the IBM Cognos KnowledgeCenter.

b) Install Framework Manager.

Framework Manager is not required in production environments. Framework Manager is themodeling tool for creating and managing business-related metadata.

Restriction: If you need Framework Manager in your development environment, you must installthe 64-bit IBM Cognos BI server and the 32-bit Framework Manager to different directories. Thedefault installation locations for 32 and 64-bit IBM Cognos components are different. For moreinformation about installing Framework Manager, see Installing Framework Manager in the IBMCognos Knowledge Center.

3. Copy the JDBC database driver to the Cognos_Home\webapps\p2pd\WEB-INF\lib directory.

• If the content store is an Oracle database, copy the following file from the Oracle installation.

– If you are using Oracle 11.2.0.4, copy the ojdbc6.jar file.– If you are using Oracle 12.1.0.2, copy the ojdbc7.jar file.

• If the content store is a DB2 database, copy the db2jcc.jar and db2jcc_license_cu.jar filesfrom the IBM DB2 installation.

4. Append the Cognos_HOME/bin64 directory to the library path environment variable.

• On Linux operating systems, update the LD_LIBRARY_PATH environment variable.

Example: export LD_LIBRARY_PATH=/opt/ibm/cognos/c10_64/bin64:$LD_LIBRARY_PATH

• On AIX operating systems, update the LIBPATH environment variable.

Example: LIBPATH=/opt/ibm/cognos/c10_64/bin64:$LIBPATH5. Append the Cognos_HOME/bin64 directory to the PATH environment variable.

Example: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/ibm/cognos/c10_64/bin64

IBM Cognos Business Intelligence installations 81

http://pic.dhe.ibm.com/infocenter/cbi/v10r2m1/index.jsp?topic=%2Fcom.ibm.swg.ba.cognos.inst_cr_winux.10.2.1.doc%2Ft_instsrvrwin.html&path%3D0_13_6_1_1

http://pic.dhe.ibm.com/infocenter/cbi/v10r2m1/index.jsp?topic=%2Fcom.ibm.swg.ba.cognos.inst_cr_winux.10.2.1.doc%2Ft_instsrvrunix.html

http://pic.dhe.ibm.com/infocenter/cbi/v10r2m1/index.jsp?topic=%2Fcom.ibm.swg.ba.cognos.qrc_inst.10.2.1.doc%2Ft_qrc_inst_fm.html

6. If you are using an Oracle database on the same computer as IBM Cognos BI, update the IBM Cognosservice settings to the user account for which you created the user variables for the 32-bit Oraclelibraries.

a) Open the Microsoft Windows Services panel.b) Right-click the IBM Cognos service, select Properties, and click the Log On tab.c) Select This Account, and select the user account for which you created the user variables for the

32-bit Oracle libraries.

Related tasksManually creating the reporting tablespace and user for Oracle databases

Creating users and groups for reporting servers on UNIX that use Oracledatabases

To install the Oracle Admin client and IBM Cognos Business Intelligence create two users and one group.

About this task

To install the Oracle Admin client, create and configure the oinstall group and the oracle user on theserver that hosts the IBM OpenPages GRC Platform application.

Use the following table to help you create the users and groups.

Table 26: Required users for reporting servers


oracle oinstall

The primary groupfor the oracle user.


Required by Oracle Admin clientinstallation program.

For information on creating standardOracle users and user groups, seethe Oracle documentation.

opuser oinstall Read, write, executepermission to the followingdirectories:

• OP_Home/tmp directory.• Oracle Admin client

installation directory.• Java JDK or JRE

installation directory.• Cognos BI installation

directory.

User must includeOracle_Home/bin in thepath to run SQL*Pluscommands.

Required by the OpenPagesinstallation.

Procedure

1. Log on to the reporting server as the root user and open a shell.2. To create a group called oinstall, enter the following command.


mkgroup oinstall (on AIX)

groupadd oinstall (on Linux)

This group is the primary group for the oracle user.3. To create a user called oracle and assign the user to the oinstall group, go to the /usr/sbin/

directory and enter the following command.

/usr/sbin/useradd -m -g oinstall oracle

This user is used to install Oracle Admin client.

Note: The Oracle Admin Client installer requires that this user is named oracle.4. Use the following command to change the password for the oracle user.

passwd oracle.5. Enter a new password at the New Password prompt.

Restriction: The password for this user cannot contain special characters due to conflicts withOpenPages scripts

6. To install the OpenPages application, opuser must exist. If this user does not already exist, createthe user.

useradd -m -g bin -G oinstall opuser7. Assign opuser to the oinstall group, if it is not already.

a) Use the id opuser command to obtain the groups that opuser belongs to.b) Add the oinstall group to its supplementary groups, for example:

usermod -G group1,group2,...,oinstall,bin,security,cron,audit,staffopuser (On AIX)

usermod -G group1,group2,...,oinstall,bin opuser (On Linux)c) Optionally, add opuser to the cron group (on AIX) .

8. If you created an opuser, change the password by using the following command:

passwd name

Enter a new password at the New Password prompt.

Restriction: The password for this user cannot contain spaces or special characters.9. Grant read, write, and execute permissions to the Oracle home directory to allow opuser to run the

following command using SQL*Plus:

chmod -R 775 /home/oracle10. Grant read, write, and execute permissions to the Java JDK or JRE installation directory, and Cognos

BI installation directory to opuser.

Web server configuration options for IBM Cognos BIYou must configure your web server before users can connect to the IBM Cognos Business Intelligenceportal.

For more information, see the following topics in the IBM Cognos Business Intelligence Knowledge Centerhttp://www.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.2.doc/c_configureawebserver_single.html%23ConfigureaWebServer_single?cp=SSEP7J_10.2.2%2F0-12-5-14:

• Use compiled gateways for production systems

For production systems, you can improve performance by changing the gateway from the default CGIgateway.

• Use CGI gateways


http://www.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.inst_cr_winux.10.2.2.doc/c_configureawebserver_single.html%23ConfigureaWebServer_single?cp=SSEP7J_10.2.2%2F0-12-5-14



You can use the CGI gateway on IBM HTTP Server, Apache Web Server, or Microsoft InternetInformation Services (IIS) Server. IBM Cognos BI is configured to use the CGI gateway by default.

• Configuring WebDAV to view and browse images

To view and browse images in the Report Studio, configure Web Distributed Authoring and Versioning(WebDAV) on your web server. Report authors can browse for images to include in reports in a way thatis similar to browsing a file system.

Configuring the IBM Cognos gateway on Microsoft Internet Information ServicesYou must configure the IBM Cognos Business Intelligence gateway on your web server.

About this task

Microsoft Internet Information Services has security features that, by default, prohibit files with webservice extensions (cgi) from executing. As a result, Cognos files that have these web service extensionsare unable to run. To modify IIS security features so that Cognos files with Web Service extensions canexecute properly, you must enable IIS to allow CGI.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. In the Microsoft Windows Control Panel, click Programs > Programs and Features.

If you are using Microsoft Windows 8 or 2012 Server, Programs and Features is available directlyfrom the Control Panel.

3. Click Turn Windows features on or off.

• If you are using Microsoft Windows 2012 Server, use the following steps.

a. In the Add Roles and Features Wizard, click Role-based or feature-based installation, andclick Next.

b. Select your server, and click Next.c. Click Web Server (IIS) > Web Server > Common HTTP Features > WebDAV Publishing.d. Click Next > Next, and then click Install.

• If you are using Microsoft Windows 7 or 8, use the following steps.

a. Click Internet Information Services > World Wide Web Services > Common HTTP Features> WebDAV Publishing.

b. Click OK.4. In the Internet Information Services (IIS) Manager console, under Connections, select your server

name.

• If you are using Microsoft Windows 2012 Server, in Server Manager, select IIS, and then right-click your server name, and click Internet Information Services (IIS) Manager.

• If you are using Microsoft Windows 8, from the Control Panel, click Administrative Tools toaccess the Internet Information Services (IIS) Manager console.

• If you are using Microsoft Windows 7, from the Control Panel, click System and Security >Administrative Tools to access the Internet Information Services (IIS) Manager console.

5. Double-click ISAPI and CGI Restrictions.6. Under Actions, click Add.7. Enter the path to the cognos.cgi file. The file is in the c10_location\cgi-bin directory.

You must enter the full path, including the file name. If the path includes spaces, ensure you usequotation marks around the path.

For example, enter C:\Program Files\ibm\cognos\c10\cgi-bin\cognos.cgi.8. Enter a Description, such as CognosCGI.


9. Select Allow extension path to execute, and click OK.10. Under Connections, expand Sites, and under your website, add the virtual directories as shown in

the table:

Table 27: IBM Cognos BI virtual directories

Alias Location

ibmcognos c10_location/webcontent

ibmcognos/cgi-bin c10_location/cgi-bin

Important: ibmcognos is the default value that is used in the Gateway URI values in IBM CognosConfiguration. If you do not use ibmcognos for the Alias values, ensure that you change theGateway URI value to match the value you use.

11. Select the cgi-bin virtual directory that you created.12. Double-click Handler Mappings.13. Under Actions, click Add Module Mapping.

a) In Request Path, type cognos.cgi.b) In Module, select CgiModule.c) Leave Executable (optional) blank.d) In Name, enter a name for the entry, such as CognosCGI.e) Click OK.

Configuring Apache Web Server or IBM HTTP ServerYou must configure the IBM Cognos Business Intelligence gateway on your web server.

Procedure

1. Log on to the web server as a user with administrative privileges.2. From the command prompt, go to the Webserver_installation\conf\ directory.3. Make a backup copy of the httpd.conf file and rename the file to: httpd.conf.original.4. Open the httpd.conf file in a text editor.5. Configure the virtual directories by adding the following lines to the end of the httpd.conf file.

On Microsoft Windows:

ScriptAlias /ibmcognos/cgi-bin "<Cognos_HOME>\cgi-bin"<Directory "<Cognos_HOME>\cgi-bin">Options FollowSymLinksAllowOverride FileInfoOrder Allow,DenyAllow from All</Directory>

Alias /ibmcognos "<Cognos_HOME>\webcontent"<Directory "<Cognos_HOME>\webcontent">Options FollowSymLinksAllowOverride FileInfoOrder Allow,DenyAllow from All</Directory>

On UNIX:

ScriptAlias /ibmcognos/cgi-bin "<Cognos_HOME>/cgi-bin"<Directory "<Cognos_HOME>/cgi-bin">Options FollowSymLinksAllowOverride FileInfoOrder Allow,Deny


Allow from All</Directory>

Alias /ibmcognos "<Cognos_HOME>/webcontent"<Directory "<Cognos_HOME>/webcontent">Options FollowSymLinksAllowOverride FileInfoOrder Allow,DenyAllow from All</Directory>

Note: Ensure that you define the /ibmcognos/cgi-bin alias before the /ibmcognos alias.6. Save and close the file.7. Restart the web server.

Configuring a connection to the content store for Oracle databaseAfter you install IBM Cognos Business Intelligence, configure a connection to the content store database.

Before you beginEnsure that you copied the JDBC database driver from the Oracle_Home/jdbc/lib directory of thedatabase to be used for the connection:

• If you are using Oracle 11.2.0.4, copy the ojdbc6.jar file.• If you are using Oracle 12.1.0.2, copy the ojdbc7.jar file.

Copy the file to the c10_location\webapps\p2pd\Web-Inf\lib directory.

Procedure

1. Log on to the reporting server computer where IBM Cognos Business Intelligence is installed.2. Go to the OP_version_Non_Embedded\OP_version_Configuration\Database\ORACLE\COGNOS directory.

3. Log on to the Oracle database as SYS using the following command:

sqlplus sys/password@SID as sysdba

For example:

sqlplus sys/mypassword@OP as sysdba

4. At the SQL*Plus prompt, run the following command to create the user and password for the contentstore database:

@cognosdbcreate.sql cognos_user cognos_password oracle_data_home tablespace_name log_file

Table 28: Parameter descriptions for cognosdbcreate.sql script for Oracle databases

Script parameters Description

cognos_user Specifies the new user name for the content store database

cognos_password Specifies the password for the cognos_user

oracle_data_home Specifies the location of the Oracle data home directory for thecontent store database instance.

On Windows operating systems: ORACLE_BASE\oradata\SID


Table 28: Parameter descriptions for cognosdbcreate.sql script for Oracle databases (continued)


tablespace_name Specifies the name of the exported tablespace.

log_file Specifies the file name and location of the log file to create.

For example:

@cognosdbcreate.sql cognos mypassword /home/oracle/app/oracle/oradata/SID cognos_ts cognosdbcreate.log

5. Exit SQL*Plus.6. Start Cognos Configuration.

• On Windows computers, from the Start menu, click All Programs > IBM Cognos 10 > IBM CognosConfiguration.

• On Linux or AIX, go to the c10_location/bin64 directory, type ./cogconfig.sh, and pressEnter.

7. In Cognos Configuration, configure the database connection to the content store.a) In the Explorer pane, under Data Access > Content Manager, right-click Content Store > Delete.b) Right-click Content Manager > New Resource > Database.c) In the New Database window, for the Name field, enter a descriptive name for the connection.

Note: The name is not required to match the database identifier.d) For the Type, select Oracle Database (Advanced) for Oracle RAC databases, or Oracle Database if

you are not using an Oracle RAC database.e) Click OK.f) In the Explorer panel, select the new connection, and in the Properties panel, use the following

tables to enter the property settings.

Table 29: Content store property settings for Oracle database

Property name Property value

Database server and port number The name of the database server and thelistener port that is used for the databaseinstance.

User ID and Password Click the value field and then click the pencilicon.

In the Value - User ID and password field,enter the appropriate values for the user andpassword for the content store database youcreated in step 4.

If you used the IBM OpenPages GRC PlatformInstaller for Cognos, the default user is cognos.

Service name Enter the SID for the database instance.


Table 30: Content store property settings for Oracle database (Advanced) (Oracle RAC database)

Property name Property value

Database server and port number The name of the database server and the listener portthat is used for the database instance.

User ID and Password Click the value field and then click the pencil icon.

In the Value - User ID and password field, enter theappropriate values for the content store database youcreated in step 4.

If you used the OpenPages GRC Platform Installer forCognos, the default user is cognos.

Database specifier Enter a database specifier string in the followingformat with no carriage returns:

(description=(address=(host=<server_name>)(protocol=tcp)(port=<port>)(connect_data(service_name=<service_name>)))

8. To test that the database connection to the content store database is successful, in the Explorer pane,right-click the content store database connection and click Test.

Configuring a connection to the content store for DB2 databaseAfter you install IBM Cognos Business Intelligence, configure a connection to the content store database.

Important: The content store database must be in a separate database instance than the IBM OpenPagesGRC Platform database. Oracle compatibility mode must not be enabled for a DB2 database instance thatis used for the content store.

Before you begin

Ensure that you copied the following files from the DB2_installation\sqllib\java directory to theCognos_HOME\webapps\p2pd\WEB-INF\lib directory:

• db2jcc.jar• db2jcc_license_cu.jar

Procedure

1. Log on to the reporting server as a user with administrator privileges.

Note: For Windows installations, the user must belong to the DB2ADMINS group. For Linux or AIXinstallations, the user must belong to the db2iadm group.

2. Start Cognos Configuration.



3. In Cognos Configuration, configure the database connection to the content store.a) In the Explorer pane, under Data Access > Content Manager,, click Content Store.b) In the Database server and port number field, enter the name of the computer and the port

number on which DB2 is running.


localhost:50000 is the default setting. 50000 is the default port number that is used by DB2.Replace localhost with the DB2 server name. If you are using a different port number, replace thedefault port with the port that you are using.

c) Click the Value field next to the User ID and password property, click the edit icon, and type theappropriate values for the Cognos user that you created for the content store database, and clickOK.

d) In the Properties window, for the Database name property, type the name for your content storedatabase.

Restriction: Do not use a name longer than eight characters and use only letters, numbers,underscores, and hyphens in the name.

4. Right-click Content Store, and click Generate DDL.5. In the message box, click Details to record the location of the DDL file that is generated.

The createDb.sql file is created in the Cognos_HOME\configuration\schemas\content\db2directory.

6. To save your settings in Cognos Configuration, click File > Save.7. To run the script that creates the database, log in to the database server as a user who has

permissions to create a database.a) For Windows installations, at the command prompt, type db2cmd.b) From the command line, type db2 -tvf createDb.sql.c) On Windows computers, close the CLP.

8. In Cognos Configuration, in the Explorer pane, right-click the content store database connection andclick Test.

Saving your settings and starting the IBM Cognos servicesYou must save your configuration settings and start the IBM Cognos services.

Procedure

1. Start Cognos Configuration.



2. Ensure that the name under IBM Cognos services is IBM Cognos, the default value.

Important: On Microsoft Windows operating systems, IBM OpenPages GRC Platform requires IBMCognos as the service name.

3. Under Local Configuration, click Environment.4. Ensure that you use the default port number for the values such as Dispatcher URIs for gateway,

External dispatcher URI, Internal dispatcher URI, Dispatcher URIs for external applications, andContent Manager URIs. The default port number is 9300.

Important: Changing the default port number also changes the IBM Cognos service name.5. In IBM Cognos Configuration, click File > Save to save your configuration settings.

You must save the configuration settings, even if you have not changed any of the values.6. Click Actions > Start.

It might take a few minutes for the IBM Cognos service to start.

If you receive a warning during the Testing the mail server connection process, click OK andContinue to continue starting the services. A mail server connection is not required.


Warning: If you chose to upgrade your content store database by creating a backup andrestoring it, you are prompted to upgrade your reports. Do not select the option to upgrade yourreporting content. Upgrade your reports later by using the New Report Upgrade wizard in IBMCognos Administration.

Prerequisite tasks for CommandCenter installationsSome prerequisite tasks are required before you install IBM OpenPages GRC Platform CommandCenteron the reporting server.

Setting database environment variables for reporting servers on Windows operatingsystems

You must set some system environment variables on the reporting server.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Set the following environment variables in the user profile.

Table 31: Environment variable settings on the reporting server on Windows operating systems

Environment variable Setting

JAVA_HOME Specifies the installation location of your Java RuntimeEnvironment (JRE).

COGNOS_HOME Specifies the location of the IBM Cognos Business Intelligencebin64 directory. C:\IBM\cognos\c10_64

3. Append the JAVA_HOME to the PATH environment variable.

Example: Add %JAVA_HOME%/bin to the PATH environment variable.4. If you are using an Oracle database for the IBM OpenPages GRC Platform repository, set the following

environment variables.

Table 32: Oracle environment variable settings on the reporting server on Windows operating systems


ORACLE_HOME The default location is a subdirectory of ORACLE_BASE, suchas ORACLE_BASE=C:\app\product\Oracle_version\client_1

If you installed the OpenPages application and IBM CognosBusiness Intelligence on the same server, enter the location ofthe 32-bit Oracle Admin Client.

Example: ORACLE_HOME=C:\app\product\Oracle_version\client_32bit

TNS_ADMIN Specifies the location of the tnsnames.ora file

The default location is the Oracle_Home\network\admindirectory


Table 32: Oracle environment variable settings on the reporting server on Windows operating systems(continued)


NLS_LANG Specifies the database character set configured during thedatabase installation. The default value isAMERICAN_AMERICA.AL32UTF8

To display non-English characters for Japanese locales, setthe NLS_LANG property:NLS_LANG=JAPANESE_JAPAN.JA16SJISTILDE

5. Append the ORACLE_HOME to the PATH environment variable.

Example: Add %ORACLE_HOME%/bin to the PATH environment variable.

Setting database environment variables for the reporting server on AIX and Linuxoperating systems

If you use an Oracle database for the IBM OpenPages GRC Platform repository, you must set some systemenvironment variables on the reporting server.

Procedure

1. Log on to the reporting server as an OpenPages installation user with administrative privileges.2. To determine the version of Java that is in the PATH variable, enter the following command:

java -version

If you get the following error, Java is not in the PATH variable.Command not found

3. Set the following environment variables.

Table 33: Environment variable settings on the reporting server on Linux or AIX operating systems

Environment variable Example settings

JAVA_HOME Specifies the installation location of your Java RuntimeEnvironment (JRE).

/opt/local/jdkversion

COGNOS_HOME Specifies the installation location of IBM Cognos BusinessIntelligence.

/opt/IBM/cognos/c10_64

4. Append the JAVA_HOME to the PATH variable.

Example: PATH=$JAVA_HOME/bin:$PATH5. If you use an Oracle database for the OpenPages repository, set the following environment variables.


Table 34: Oracle database environment variable settings on the reporting server on Linux or AIXoperating systems

Environment variable Example settings

ORACLE_HOME The default location is /home/oracle/app/oracle/product/Oracle_version/client_1

If you installed the OpenPages application and Cognos on thesame server, enter the location of the 32-bit Oracle AdminClient.

TNS_ADMIN Specifies the location of the tnsnames.ora file

The default location is the $ORACLE_Home\network\admindirectory

NLS_LANG Specifies the database character set configured during thedatabase installation. By default, set toAMERICAN_AMERICA.AL32UTF8

Important: To display non-English characters for Japaneselocales, set NLS_LANG=JAPANESE_JAPAN.JA16SJISTILDE

6. Append the ORACLE_HOME to the PATH variable.

Example: PATH=$ORACLE_HOME/bin:$PATH7. Refresh the profile.

Testing the connection to the OpenPages GRC Platform repository from the databaseclient

Test whether the SQL*Net connect string can connect to the IBM OpenPages GRC Platform repository onthe Oracle database server from the Oracle database client.

Procedure

1. Copy the file ORACLE_HOME\network\admin\tnsnames.ora from the Oracle database serveroperating system to the ORACLE_HOME\network\admin\ Oracle database client directory.

Ensure that the OpenPages installation user has read, write and execute permissions to thetnsnames.ora file in the Oracle database client operating system.

2. Log on to the Oracle database client as an OpenPages installation user.3. Edit the file ORACLE_HOME\network\admin\tnsnames.ora, and update the Host value to the

hostname or IP address of the Oracle database server.4. To test the connection to the OpenPages repository on the database server, type the following

command:





Enabling the connection to a DB2 database from the OpenPages GRC PlatformCommandCenter computer

Cataloging a TCP/IP node adds an entry to the Data Server Client node directory that describes theremote node. This entry specifies the chosen alias, the host name or IP address, and the service name (orthe port number) that the client uses to access the remote host.

Before a client application can access a remote database, the database must be cataloged on the client.When you create a database, the database is automatically cataloged on the server with a database alias.The database alias is the same as the database name, unless a different database alias is specified.

Important: If the application server and database server are on the same computer, you can ensure thatthe Cognos installation user has access to the IBM OpenPages GRC Platform data source by catalogingthe OpenPages repository node and database.

Before you begin

Ensure that DB2 client software is installed on the OpenPages reporting server.

Procedure

1. Log on to the reporting server with a valid DB2 user ID.2. Start the DB2 command line processor.

• On Windows operating systems, issue the db2cmd command from a command prompt.• On Linux or UNIX operating systems, issue the db2 command from a command prompt.

3. Catalog the node by entering the following commands in the command line processor:

db2 catalog tcpip node <node_name> <remote hostname|ip_address> <server service_name|port_number>

db2 terminate

Example:

db2 catalog tcpip node OPNODE remote mycomputer.domain.com server 50000

db2 terminate

4. Catalog the database by entering the following commands in the command line processor:

db2 catalog database <database_name> as <database_alias> at node <node_name> [ authentication <auth_value> ]

Example:

db2 catalog database OPX at node OPNODE authentication server

db2 terminate

5. To list the node directory, type the following command:

db2 list node directory show detail6. To list the database directory, type the following command:

db2 list database directory


Creating the installation directory for CommandCenter on AIX and Linux operatingsystems

Create the installation directory for the IBM OpenPages GRC Platform CommandCenter installation andchange the ownership of the directory to the installation user.

Procedure

1. Log on to the reporting server as a root user.2. Open a shell.3. If the Cognos installation directory does not exist, create it by typing the following command:

Restriction: Install OpenPages CommandCenter into a directory that contains only ASCII characters inthe path name.

mkdir -p <CC_HOME>4. To change ownership of the directory, type the following command:

chown -R <user>:<group> <CC_HOME>

Important: Different users install OpenPages CommandCenter and Cognos BI. However, both usersmust belong to the same primary group. Ensure that the installation directories and files have thecorrect permissions. To ensure that the group members have WRITE permission to the files, changethe directory and file permissions to 775.


Chapter 8. Installing the OpenPages GRC PlatformAdministrative Console

You use the IBM OpenPages GRC Platform Administrative Console to install OpenPages components.

Install the Administrative Console from IBM Installation Manager. For more information about IBMInstallation Manager, see “Installing IBM Installation Manager” on page 22.

Install the Administrative Console on a computer from which you want to run an installation, upgrade, ormigration. You do not have to install the Administrative Console on a computer that you use in yourdeployment.


Procedure

1. Start IBM Installation Manager.2. Click File > Preferences > Repositories.3. Click Add Repository.4. Enter the path to the OpenPages GRC Platform Administrative Console installation files, and click OK.

For example, enter the path to OpenPages_Install_Files\OP_version_Non_Embedded\OP_version_Admin_and_Config_Console\repository.config.

5. Click OK to return to the main IBM Installation Manager panel.6. Click Install.7. Select OPAdminConsole > Version 7.2.0, then click Next.8. Follow the steps in IBM Installation Manager to complete the installation.9. Click Finish and close IBM Installation Manager.

What to do nextAfter you install the OpenPages GRC Platform Administrative Console, you can use the console to install,upgrade, or migrate OpenPages. The Administrative Console is installed to C:\Program Files(x86)\IBM\opadminconsole or /opt/IBM/opadminconsole by default.


Chapter 9. Upgrading OpenPages GRC PlatformUpgrade your existing version of IBM OpenPages GRC Platform to take advantage of new features,enhancements, and performance improvements.

The decision to perform an upgrade or migration depends on the version of OpenPages GRC Platform thatyou currently have installed, and the version of WebSphere Application Server that you are using.

For more information about the supported software versions for OpenPages GRC Platform, see “Softwareprerequisites” on page 13.

Starting from OpenPages version 5.x

If you have OpenPages version 5.x, you can migrate directly to OpenPages version 7.2.

For more information, see “Migrate from OpenPages GRC Platform version 5” on page 135.

Starting from OpenPages version 6.x or later installed on WebLogic or WebSphere Application Serverversion 8.0 or 8.5

If you are currently using OpenPages GRC Platform installed on WebLogic or WebSphere ApplicationServer version 8.0 or 8.5, you can migrate directly to OpenPages version 7.2.


For information about migrating from Oracle WebLogic Application Server to IBM WebSphereApplication Server, see the additional documentation (http://www.ibm.com/support/docview.wss?uid=swg27045210).

Moving from OpenPages version 7.0 installed on Windows on WebLogic

If you are currently using OpenPages GRC Platform installed on Windows and you want to move toLinux or AIX and use WebSphere Application Server, use a migration to move your environment.



Starting from OpenPages version 7.0 or later installed on WebSphere Application Server version8.5.5 or 8.5.5.2

If you have OpenPages GRC Platform version 7.0.0.x or 7.1.0.x, you can upgrade the supportedversion of the OpenPages application that is deployed on WebSphere Application Server.

For more information, see Chapter 9, “Upgrading OpenPages GRC Platform,” on page 97.

Upgrade process for OpenPages GRC PlatformYou can upgrade from IBM OpenPages GRC Platform version 7.0.0.x or 7.1.0.x to version 7.2, if it isinstalled on IBM WebSphere Application Server version 8.5.5 or 8.5.5.2.

Upgrading OpenPages GRC Platform requires the following steps.

1. Prepare the system for upgrade.

• Back up the OpenPages database and application files and directories.

For more information, see “Backing up directories and files” on page 99.• Back up any configuration files, reports, and the IBM Cognos Business Intelligence content store

database.



For more information, see “Backing up the existing OpenPages GRC Platform environment” on page100.

• If you are using an IBM DB2 reporting server, drop the reporting schema.

For more information, see “Dropping the DB2 reporting schema” on page 102.• Export data by using the OpenPages migration tool.

For more information, see “Exporting OpenPages GRC Platform data” on page 102.• Export the IBM Cognos content store by using the OpenPages CommandCenter migration tool.

For more information, see “Exporting the Cognos content store” on page 103.2. Upgrade the software that is required for OpenPages GRC Platform.

• Upgrade your database server and database client software to the supported version.

For more information about upgrading IBM DB2 on Microsoft Windows operating systems, see theUpgrading a DB2 server (Windows) topic in the IBM DB2 documentation (http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.upgrade.doc/doc/t0007199.html).

For more information about upgrading IBM DB2 on Linux or AIX, see the Upgrading a DB2 server(Linux and UNIX) topic in the IBM DB2 documentation (http://www.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.qb.upgrade.doc/doc/t0007200.html).

• Upgrade IBM Cognos Business Intelligence to the supported version.

For more information, see “Upgrading Cognos Business Intelligence” on page 109.• Upgrade IBM WebSphere Application Server to the supported version.

For more information, see “Installing WebSphere Application Server Network Deployment” on page23.

• For more information on supported software versions, see “Software prerequisites” on page 13.3. Prepare the application servers for upgrade.

For more information, see “Preparing the OpenPages GRC Platform application servers for upgrade” onpage 111.

4. Upgrade the OpenPages application and databases.

• Restore your OpenPages database to the new version of the database server.• Update the reporting schema and OpenPages database schema.

For more information, see “Create the reporting schema for the DB2 server” on page 103, and“Update the database schema” on page 104.

• Upgrade your OpenPages deployment.

For more information, see “Upgrading an OpenPages GRC Platform deployment” on page 115.5. Complete the post upgrade tasks and update any custom settings in the configuration files.

For more information, see “Post upgrade tasks” on page 123, and “Custom settings in configurationfiles ” on page 130.

6. Review the new and changed features for this release to check if there is anything that affects yourinstallation after upgrading.

For more information, see Chapter 1, “What's new?,” on page 1

Preparing to upgradeBefore you upgrade, prepare your IBM OpenPages GRC Platform environment.

Ensure that the following conditions are met on all of your servers:





__ • If you are using Oracle, ensure that there is network access to the server that hosts the Oracledatabase by using the TNSPING or SQL*Plus.

__ • Ensure that the required users and groups exist and that they each have the appropriate permissionsfor installing applications.

__ • On Microsoft Windows operating systems, enable Data Execution Prevention (DEP) in Windows Serverfor essential Windows programs and services only.

__ • Ensure that you have access to the Microsoft Registry Editor (regedit.exe).__ • If you use multiple network interfaces, ensure that all of the IP addresses and host names are listed

in the Windows hosts file.__ • Review the IBM OpenPages GRC Platform supported software environments and other system

requirements (http://www.ibm.com/support/docview.wss?uid=swg27039467).

Backing up directories and filesYou can back up the IBM OpenPages GRC Platform repository, and application files and directories beforeyou upgrade or migrate.

Before you begin

If the following services are running, stop them:

• OpenPages application and workflow services (IBM WebSphere Application Server DeploymentManagers (dmgrs), nodes, and servers)

• OpenPages Framework Model Generator service• IBM Cognos services

Procedure

1. Create a backup directory in a location that is different from the installation location.

C:\OpenPagesBackup.2. Log on to the application server as a user with administrative privileges and full access to the local

server drives.3. Go to the <WebSphere Installation>\Java\jre\lib\ext directory and copy the following jar

files to the backup location:

• modelobjects_jvm.jar• bcprov-jdk14-145.jar (if it exists)

You must restore these jar files after the Java SDK is updated.4. Go to the OP_HOME installation directory and copy the following directories and files to the backup

location:

• applications• aurora• bin• openpagesregistry.xml• profiles

5. To back up the Interstage BPM directory, copy the Workflow_Home installation directory to thebackup location.

The default installation location is C:\Fujitsu\InterstageBPM.6. Log on to the reporting server as a user with administrative privileges and full access to the local server

drives.7. To back up OpenPages CommandCenter directories and files, on the reporting server, copy the

following directories and files from the CC_Home to the backup location:

Upgrading OpenPages GRC Platform 99



• apache-tomcat• tools\bin• openpagesregistry.xml

8. To back up the IBM Cognos Business Intelligence directories and files, see the IBM Cognosdocumentation (http://www-01.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.cbi.doc/welcome.html).

Related conceptsStarting and stopping serversYou can start and stop the IBM OpenPages GRC Platform application servers, the database server, and theCognos server.

Backing up the existing OpenPages GRC Platform environmentRun the OPBackup and OPCCBackup utilities to back up the existing IBM OpenPages GRC Platformenvironment.

The OPBackup and OPCCBackup utilities back up the OpenPages database and application and theOpenPages CommandCenter content store and files.

Important: For complete information, including prerequisites, about backing up your environment, seethe IBM OpenPages GRC Platform Administrator's Guide.

Procedure

1. Run the OPBackup utility.

• If you want to stop the IBM OpenPages services before you back up the application andenvironment files and export the OpenPages application database, run the OPBackup commandfrom OP_Home\aurora\bin directory.

OPBackup path-to-backup-location

Note: The services are restarted when the backup activities are complete.• If you want the OpenPages application to continue to run during the backup process, use the

nosrvrst option to run the OPBackup command from the OP_Home\aurora\bin directory.

OPBackup path-to-backup-location nosrvrst

The path-to-backup-location variable is the full path of the directory where the backup files arelocated. If the file path is not specified, the OPBackup command uses the backup location that isspecified by the BACKUP_LOCATION parameter in the OP_Home\aurora\bin\op-backup-restore.env file.

2. Run the OPCCBackup utility.a) Go to the CC_Home\tools\bin directory.b) Run the following command: OPCCBackup path-to-backup-location

The path-to-backup-location variable is the full path of the directory where the backup files arelocated. If the file path is not specified, the OPCCBackup command uses the backup location that isspecified by the BACKUP_LOCATION parameter in the CC_Home\tools\bin\op-cc-backup-restore.env file.

For an Oracle deployment, if the backup process is not successful, configure the Oracle data pumpstorage directory, then run OPCCBackup again.

a) Go to the WAS_HOME\java_1.7.1_64\lib\ folder and copy the tools.jar file to theCognos_HOME\bin64\jre\7.0\lib folder.

b) Log on to a computer that has the SQL*Plus utility and a connection to the OpenPagesCommandCenter database instance.


http://www-01.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.cbi.doc/welcome.html

http://www-01.ibm.com/support/knowledgecenter/SSEP7J_10.2.2/com.ibm.swg.ba.cognos.cbi.doc/welcome.html

c) Go to the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS\ upgrade version directory.

For example, the OP710X_TO_OP7200 directory.d) From the command line, run the update-datapump-directory.sql script.

sqlplus /nolog @sql-wrapper update-datapump-directory log_file_nametns_name_alias SYSTEM password create directory_location user_name

The following table describes the variables in the script.

Table 35: Descriptions for variables in the update-datapump-directory.sql file


log_file_name The user-defined name of the log file that thescript creates to store information.

tns_name_alias The database Oracle TNS entry that is used bythe OpenPages CommandCenter databaseinstance on the reporting server computer.

password The password for the Oracle SYSTEM useraccount.

directory_location The full directory path to the location on thedatabase server where the backup files arestored.

user_name The user name of the Cognos account for theOpenPages CommandCenter database schema(content store).

Example:

sqlplus /nolog @sql-wrapper update-datapump-directory C:\temp\update-datapump.log OP SYSTEM sys2Password create d:\cc_backup cognos

Customized files required for upgrade or migrationThe following files and directories are not included by default when you run the OPBackup utility. You canadd them to the op_backup.manifest file to ensure they are backed up.

• OP_HOME\aurora\lib\openpages-ext.jar• OP_HOME\application\OP_Workflow\classes• OP_HOME\application\OP_Workflow\resources• OP_HOME\application\OP_Workflow\calendar• OP_HOME\OpenpagesDomain\config\jdbc• OP_HOME\OpenpagesDomain\config\jms• OP_HOME\OpenpagesDomain\config\config.xml• OP_HOME\jsp-reports\op-jsp-reports-op-file-content.zip• OP_HOME\jsp-reports\op-jsp-reports-op-config.xml• OP_HOME\aurora\util\UpgradeCommandProcessor\UpgradeCommandProcessor.cmd


• OP_HOME\aurora\util\Reporting_Schema_Exporter\• OP_HOME\aurora\util\NotificationManager\• OP_HOME\aurora\util\JobLaunchManager\• OP_HOME\aurora\util\entity_move_rename\• OP_HOME\aurora\util\DataEntryImporter\• OP_HOME\aurora\util\apache-ant\• OP_HOME\aurora\conf\• OP_HOME\aurora\logs\• OP_HOME\aurora\bin\• OP_HOME\applications\services-sosa-files.zip

Note: Ensure that the services-sosa-files.zip file includes these folders: \sosa\dojo_1.10.4\dojo\, \sosa\dojo_1.10.4\dojox\, and \sosa\dojo_1.10.4\dijit\

• OP_HOME\applications\solutions-sosa-files.zip

Note: Ensure solutions-sosa-files.zip file includes these folders: \sosa\dojo_1.10.4\dojo\, \sosa\dojo_1.10.4\dojox\, and \sosa\dojo_1.10.4\dijit\

• OP_HOME\applications\services-publishweb-files.zip• OP_HOME\applications\solutions-publishweb-files.zip• OP_HOME\applications\solutions-opx-files.zip

For information on adding files to a manifest file, see "Backing up custom OpenPages GRC Platform files"in the IBM OpenPages GRC Platform Administrator's Guide.

Dropping the DB2 reporting schemaIf you are using IBM DB2 for your reporting server, drop the reporting schema before you upgrade ormigrate the IBM OpenPages GRC Platform application or before you install the OpenPages GRC Platformsolutions.

Procedure

1. In a web browser, open the OpenPages GRC Platform application:

http://openpages_server:port/openpages2. Click Enabled for the System Admin Mode.3. From the menu bar, click Administration and select Reporting Schema.4. Click Drop.5. Click Disabled for the System Admin Mode.

Exporting OpenPages GRC Platform dataTo export the OpenPages application files and directories, use the IBM OpenPages GRC Platformmigration utility.

Procedure

1. Log on to the current application server as an administrative user.2. Go to the OP_version_Configuration\OpenPages_Migration directory from the OP_version

DVD or on your network share location.3. Copy the files from this directory to the OP_HOME\aurora directory.4. Update the PATH environment variable by adding the following line:

OpenPages_Migration\apache-ant-1.8.1\bin

5. Open a Windows command prompt, or a UNIX shell, and run the following command:


OP_HOME\aurora\OPMigration.cmd (on Windows)

OP_HOME/aurora/OPMigration.sh (on UNIX)6. At each prompt, specify the required information or press Enter to accept the default value.

Results

The migration utility creates a compressed file on the server on which you ran the tool. The name of thecompressed file is op_backup_YYYY_MM_DD_HH_MM_SS.zip

What to do next

Copy the compressed file to the server on which OpenPages GRC Platform Administrative Console isinstalled, and note the location to which you are copying it.

Because the files are in binary format, always transmit the files in binary format by using a protocol suchas FTP. Transmitting export files in character mode can cause errors that affect the import and upgrade ormigration process.

After you specify the migration zip file in the Administrative Console, it merges the data to the newapplication server to re-create your OpenPages environment.

Exporting the Cognos content storeTo export the IBM Cognos content store, use the IBM OpenPages GRC Platform CommandCentermigration utility.

Procedure

1. Log on to the current reporting server as a user with administrative privileges.2. Go to the OP_version_Configuration\CommandCenter_Migration directory from theOP_version DVD or on your network share location and copy the files to a local directory.

3. Open a Microsoft Windows command prompt by using the Run as Administrator option, or a UNIXshell with administrative privileges.

4. Go to the directory where you copied the migration utility files and run the following command:

OPCCMigration.cmd (on Windows)

OPMCCigration.sh (on UNIX)5. At each prompt, specify the required information or press Enter to accept the default value.

Results

The migration utility creates a compressed file on the server on which you ran the tool. The name of thecompressed file is openpagescc_migration_backup_YYYY_MM_DD_HH_MM_SS.zip.

The compressed files contain the data that is required to re-create your OpenPages environment on thenew servers.

What to do next

Copy the compressed file to the target reporting server, and note the location to which you are copying it.

Because the files are in binary format, always transmit the files in binary format by using a protocol suchas FTP. Transmitting export files in character mode can cause errors that affect the import and upgradeprocess.

Create the reporting schema for the DB2 serverTo create the reporting schema, you must copy the Java routine class files for IBM OpenPages GRCPlatform to the DB2 server after you upgrade the server.

1. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.


2. Copy the following files to the DB2_HOME\FUNCTION directory:


For example, on Microsoft Windows operating systems, the DB2_HOME\FUNCTION directory isinstall_path\ibm\SQLLIB\FUNCTION.

On AIX or Linux operating systems, the default location is /home/db2_instance_owner/sqllib/FUNCTION.

Update the database schemaYou must manually update the OpenPages database schema before you can upgrade IBM OpenPagesGRC Platform.

Updating an Oracle database schemaYou must manually update the database schema from version 7.0.0.x or 7.1.0.x to version 7.2.

Before you begin

Ensure that the passwords for the Oracle database system, IBM OpenPages GRC Platform, and workflowuser accounts have not expired.


About this task

The following table describes the parameters that are used in this task.

Table 36: Description of parameters


op_user The user name that is used byOpenPages to create and accessthe OpenPages database instance

openpages

op_password The password for the OpenPagesdatabase user account.

openpages


OpenPages uses this account tocreate and access the workflowdatabase, and to manageworkflow-related transactions.

opworkflow

workflow_password The password for the workflowdatabase user account.

opworkflow

log_file The name of the log file that thescript creates and writesinformation to.

logfile.txt


Table 36: Description of parameters (continued)


oracle_tns_alias The database alias for theOpenPages database instance, asset during the Oracle databaseinstallation.

If necessary, you can retrieve thisalias from the tnsnames.orafile.

OP

dba_user The Oracle system user name.

If you do not have access to thesystem user account, then use adatabase user account withadministrative privileges.

system


openpages

Procedure

1. Stop all OpenPages services.2. Extract the installation files from the OP_version DVD or from your network share location.3. Go to the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS directory, and copy each of the following directories tothe database server:

• OP700X_TO_OP7100

This directory is required if you are upgrading from version 7.0.0.x only.• OP710X_TO_OP7200

4. Log on to the database server computer.5. Open a Windows command prompt using the Run as Administrator option.6. Log on as SYS using sqlplus and go to the directory where you copied the upgrade scripts.7. Execute this script:

@[email protected] x x [email protected] x x workflow_user

8. Update the sql-wrapper.sql file in each upgrade version directory with the values for yourOpenPages Administrator username and password:

define op_admin_user = op_admin_userdefine op_admin_password = op_admin_password

9. If you are upgrading from version 7.0.0.x, update the database schema to version 7.1.a) Go to the OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS\OP700X_TO_OP7100 directory.

b) Run the following script:

sqlplus /nolog @sql-wrapper.sql database-upgrade.sqllog_file oracle_tns_alias dba_user dba_password workflow_user workflow_password op_user op_password


Example:

sqlplus /nolog @sql-wrapper.sql database-upgrade.sql db_upgrade.log OP system oppassword opworkflow opworkflow openpages openpages

10. Update the database schema from version 7.1.0.x to version 7.2.a) Go to the OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS\OP710X_TO_OP7200 directory.

b) Repeat step 9b to run the script.

Results

After the SQL script finishes, the OpenPages database schema is upgraded. The log file that you specifiedas a parameter is created in the directory where you ran the SQL script.

If you have problems when you run the database-upgrade.sql script, use the\OP_version_Configuration\Database\ORACLE\init-db-cleanup.sql script, which removesthe database components that were added. Then, run the database-upgrade.sql script in a cleandatabase environment.

Example

sqlplus /nolog @sql-wrapper.sql init-db-cleanup.sql log_fileoracle_tns_alias dba_user dba_password workflow_user op_user

Note: The init-db-cleanup.sql script drops the database. You must restore the database frombackup before you continue with the database upgrade. After the database environment is restored frombackup, you can run the database-upgrade.sql wrapper script again.

Related tasksUpgrading an OpenPages GRC Platform deployment

Copying the encryption function for OpenPages GRC Platform to the IBM DB2 serverYou must manually copy the encryption function for IBM OpenPages GRC Platform to the IBM DB2 server.

Procedure

1. Go to the/OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS /bin/<PLATFORM>directory.

2. Copy the files to the following directories:


Extending IBM DB2 database row sizes for upgraded databasesAfter you restore your IBM OpenPages GRC Platform database to the supported version of IBM DB2, youmust manually enable the EXTENDED_ROW_SZ database configuration parameter

Procedure

1. Start the IBM DB2 command line processor.

On Microsoft Windows operating systems, from the command prompt, type db2cmd, or from the Startmenu, click All Programs > DB2COPY1 > Command Window - Administrator.

On AIX or Linux operating systems, from the command prompt, type db2cmd.2. Connect to the OpenPages database.


For example, type

db2 connect to OPX user userid

3. Enter the following commands:

db2 update db cfg using EXTENDED_ROW_SZ ENABLEdb2 update db cfg for OPX using APPLHEAPSZ 25600 APPL_MEMORY 320000

Updating the IBM DB2 database schemaYou must manually update the database schema from version 7.0.0.x or 7.1.0.x to version 7.2.

Before you begin

After you have upgraded your database to the supported version, complete the following tasks beforeupdating the database schema:

• “Extending IBM DB2 database row sizes for upgraded databases” on page 106

About this taskThe following table describes the command parameters that are used in this task.

Table 37: Description of DB2 parameters


log_file The log file name that the scriptcreates and writes information to.

logfile.txt

DB2_server_name The name of the DB2 server.

DB2_port_number The port number of the DB2database.

50000

DB2_database_name The name of the DB2 database. OPX

DB2_admin_name The user name of the DB2administrator.

db2admin

DB2_admin_password The password for the DB2administrator.

openpages


This account is used byOpenPages GRC Platform tocreate and access the workflowdatabase, and to manageworkflow-related transactions.

opworkflow


opworkflow

op_user The user name that is used tocreate and access the OpenPagesGRC Platform database instance

openpages


Table 37: Description of DB2 parameters (continued)


op_password The password for the OpenPagesGRC Platform database useraccount.

openpages

Procedure

1. Stop all IBM OpenPages GRC Platform services.2. Log on to a computer that has Command line processor plus (CLPPlus) and access to the database

server.3. Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\ directory, and copy

each of the following directories to the database server:

• OP700X_TO_OP7100

This directory is required if you are upgrading from version 7.0.0.x only.• OP710X_TO_OP7200

4. Update the sql-wrapper.sql file in each upgrade version directory with the values for yourOpenPages Administrator username and password:


5. If you are upgrading from version 7.0.0.x, update the database schema to version 7.1.a) Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\OP700X_TO_OP7100 directory.

b) Run the following scripts.

clpplus -nw @sql-wrapper database-upgrade-preproc log_file DB2_server_name DB2_port_number DB2_database_name DB2_admin_name DB2_admin_password workflow_user workflow_password op_user op_password

On a Microsoft Windows operating system, start the DB2 command line processor and run thefollowing command.

AuroraProcCreate.bat DB2_database_name op_user op_password

On a UNIX operating system:

AuroraProcCreate.sh DB2_database_name op_user op_password

Run the following commands:

clpplus -nw op_user/op_password@DB2_server_name: DB2_port_number/DB2_database_name @sql-wrapper revalidate.sql revalidate.log op_user

db2rbind DB2_database_name -l oprbind.log all -u op_user -p op_password -r any

clpplus -nw @sql-wrapper database-upgrade-postproc log_file DB2_server_name DB2_port_number DB2_database_name DB2_admin_name DB2_admin_password workflow_user workflow_password op_user op_password


6. Update the database schema from version 7.1.0.x to version 7.2.a) Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\OP710X_TO_OP7200 directory.

b) Repeat step 5b to run the scripts.7. Install the Java routines for OpenPages.

a) Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\OP710X_TO_OP7200 directory.

b) Run the following script.


manageOPJavaRoutines.bat database-name openpages.db.username openpages.db.password install opdb2udf.jar


manageOPJavaRoutines.sh database-name openpages.db.username openpages.db.password install opdb2udf.jar

Results

After the CLPPlus script finishes, the OpenPages database schema is upgraded. The log file that youspecified as a parameter is created in the directory where you ran the CLPPlus script.

If you have problems when you create the OpenPages database on DB2, you can remove the databaseand then recreate it.

Verifying that services are runningAll servers must be running during the upgrade of the IBM OpenPages GRC Platform. The upgradevalidates user input by testing connections.

Procedure

1. If any administrative or non-admin servers are stopped, start them.2. Verify that all administrative and non-admin servers are running, including database and reporting

servers.

Upgrading Cognos Business IntelligenceYou must upgrade IBM Cognos Business Intelligence (BI) before you upgrade or migrate your IBMOpenPages GRC Platform environment.

This task provides the basic steps for upgrading Cognos BI. For more information about this process, seethe IBM Cognos Business Intelligence Installation and Configuration Guide.

If you install the upgraded version of Cognos BI on the same server as a previous version, in theOpenPages Administrative Console, you must select the location of your current OpenPagesCommandCenter location. The upgrade process creates a backup of your OpenPages CommandCenter,and then deploys the new version. Deploying the OpenPages CommandCenter to the same location as theprevious version ensures that the services are upgraded properly.

If you install Cognos BI to a different computer, you can deploy OpenPages CommandCenter to a newlocation on that computer.


Before you begin

Ensure that the supported version of a web server is installed.

If you are installing on UNIX, IBM Runtime Environment for Java for OpenPages GRC Platform is notautomatically installed. You must install it before you upgrade IBM Cognos Business Intelligence.

Procedure

1. Back up your Cognos BI content store database.2. Install the supported version of Cognos BI.

• If you want to install the supported version of Cognos BI to the same location as a previous version,you must first uninstall the previous version.

• If you want to keep the previous version, you must install the supported version of Cognos BI toanother computer or to another location on the same computer.

If you install to another location on the same computer, you must ensure that you use different portnumbers and different virtual directory settings so that the two versions do not conflict.

– Dispatcher URIs for gateway– External dispatcher URI– Internal dispatcher URI– Dispatcher URI for external applications– Content Manager URIs– Local log server port number– Shutdown port number

For more information about these options, see the upgrade chapter in the IBM Cognos BusinessIntelligence Installation and Configuration Guide.

3. Configure Cognos BI.

When you configure Cognos BI, you must define a content store. You can use a new content storedatabase or you can use a backup of the content store from the previous version in your configuration.

4. If you create a new content store database, use the following steps to move your OpenPages contentto the new version of Cognos BI.a) Open IBM Cognos Connection for the previous version of Cognos BI.b) In IBM Cognos Administration, on the Configuration tab, click Content Administration, and click

New Export.c) Enter a name for the archive and select the content that you want to include, and follow the steps in

the wizard to create the deployment file.d) Copy the deployment file from the BI_previous_version_install_location/deployment

directory to the BI_new_version_install_location/deployment directorye) Open Cognos Connection for the supported version of Cognos BI.f) In Cognos Administration, on the Configuration tab, click Content Administration, and click New

Import.g) Select the deployment file that you copied, and follow the steps in the wizard to import the content.

5. If you configure Cognos BI to use a backup of the content store database for the previous version, youare prompted to upgrade your reports when you start your Cognos BI services.

Upgrading your reports can take a long time. It is better to upgrade them after the newly installedversion of Cognos BI is running. You can upgrade your reports later by using IBM CognosAdministration.


ResultsYou can now install the CommandCenter component for OpenPages GRC Platform to the location wherethe newly installed version of Cognos BI is running.

What to do nextIf you installed Cognos BI to a different location from the previous version, you must also update the webserver to use the new location. For more information, see “Web server configuration options for IBMCognos BI” on page 83.Related conceptsUpgrade installation recovery options

Preparing the OpenPages GRC Platform application servers for upgradeAfter you back up directories and files on all servers, some additional setup is required to prepare the IBMOpenPages GRC Platform application servers for upgrade.

Updating WebSphere Application Server profiles to IBM Runtime Environment for Java

Before you can upgrade IBM OpenPages GRC Platform, you must update the IBM WebSphere ApplicationServer profile to IBM Runtime Environment for Java 1.7.3 for IBM OpenPages GRC Platform on eachapplication server.

If WebSphere Application Server global security is enabled, you are prompted to enter the WebSphereAdministrator user name and password when you run commands that access the application server.

Procedure

1. Update the profile for the OpenPages GRC Platform Deployment Manager.a) Log on to the OpenPages administrative server computer as an administrator.b) Open a command prompt window as an administrator.c) Go to the WAS_HOME\bin directory and run the following command:

On Microsoft Windows operating systems:

managesdk.bat -enableProfile -profileName OpenPagesDmgr -sdkName 1.7.1_64

On UNIX operating systems:

./managesdk.sh -enableProfile -profileName OpenPagesDmgr -sdkName 1.7.1_64

d) Start the OpenPages Deployment Manager.

• On Microsoft Windows operating systems, go to the OP_Home\profiles\OpenPagesDmgr\bin directory and run startManager.bat.

• On UNIX operating systems, go to the OP_Home/profiles/OpenPagesDmgr/bin directoryand run ./startManager.sh.

2. Update the profile for the OpenPages application server.a) Start the OpenPages application server.

• On Microsoft Windows operating systems, go to the OP_Home\profiles\servername-OPNode1\bin directory and run startNode.bat.

• On UNIX operating systems, go to the OP_Home/profiles/servername-OPNode1/bindirectory and run ./startNode.sh.

b) Go to the WAS_HOME\bin directory and run the following command:



managesdk.bat -enableProfile -profileName servername-OPNode1 -sdkName 1.7.1_64


./managesdk.sh -enableProfile -profileName servername-OPNode1 -sdkName 1.7.1_64

3. Repeat step 2 for all OpenPages application servers in your environment.4. Update the profile for the IBPM Deployment Manager for the workflow server.

a) Go to the WAS_HOME\bin directory and run the following command:


managesdk.bat -enableProfile -profileName IBPMDmgr -sdkName 1.7.1_64


./managesdk.sh -enableProfile -profileName IBPMDmgr -sdkName 1.7.1_64

b) Start the IBPM Deployment Manager for the workflow server.

• On Microsoft Windows operating systems, go to the IBPM_HOME\profiles\IBPMDmgr\bindirectory and run startManager.bat.

• On UNIX operating systems, go to the IBPM_HOME/profiles/IBPMDmgr/bin directory andrun ./startManager.sh.

5. Update the profile for the IBPM application server.a) Start the IBPM node.

• On Microsoft Windows operating systems, go to the IBPM_HOME\profiles\servername-IBPMNode1\bin directory and run startNode.bat.

• On UNIX operating systems, go to the IBPM_HOME/profiles/servername-IBPMNode1/bindirectory and run ./startNode.sh.

b) Go to the WAS_HOME\bin directory and run the following command:


managesdk.bat -enableProfile -profileName servername-IBPMNode1 -sdkName 1.7.1_64


./managesdk.sh -enableProfile -profileName servername-IBPMNode1 -sdkName 1.7.1_64

6. Repeat step 5 for all IBPM application servers in your environment.7. To verify all profiles are updated, go to the WAS_HOME\bin directory and run the following command:


managesdk.bat -listEnabledProfileAll


./managesdk.sh -listEnabledProfileAll


You should see a confirmation similar to the following:

CWSDK1004I: Profile OpenPagesDmgr :CWSDK1006I: PROFILE_COMMAND_SDK = 1.7.1_64 CWSDK1008I: Node OpenPagesDmgrNode SDK name: 1.7.1_64CWSDK1009I: Server dmgr SDK name: 1.7.1_64

CWSDK1004I: Profile servername-OPNode1 :CWSDK1006I: PROFILE_COMMAND_SDK = 1.7.1_64 CWSDK1008I: Node servername-OPNode1 SDK name: 1.7.1_64CWSDK1009I: Server servername-OPNode1Server1 SDK name: 1.7.1_64CWSDK1009I: Server nodeagent SDK name: 1.7.1_64

CWSDK1004I: Profile IBPMDmgr :CWSDK1006I: PROFILE_COMMAND_SDK = 1.7.1_64 CWSDK1008I: Node IBPMDmgrNode SDK name: 1.7.1_64CWSDK1009I: Server dmgr SDK name: 1.7.1_64

CWSDK1004I: Profile servername-IBPMNode1 :CWSDK1006I: PROFILE_COMMAND_SDK = 1.7.1_64 CWSDK1008I: Node servername-IBPMNode1 SDK name: 1.7.1_64CWSDK1009I: Server servername-IBPMNode1Server SDK name: 1.7.1_64CWSDK1009I: Server nodeagent SDK name: 1.7.1_64CWSDK1001I: Successfully performed the requested managesdk task.

8. Update and verify that the new profile default is correctly set to the updated Java 1.7. You mustcomplete this step on the OpenPages administrative server.


managesdk.bat -setNewProfileDefault -sdkname 1.7.1_64managesdk.bat -getNewProfileDefault


./managesdk.sh -setNewProfileDefault -sdkname 1.7.1_64

./managesdk.sh -getNewProfileDefault

You should see a confirmation similar to the following:

CWSDK1007I: New profile creation SDK name: 1.7.1_64CWSDK1001I: Successfully performed the requested managesdk task.

9. Repeat the managesdk.bat/sh -setNewProfileDefault and managesdk.bat/sh -getNewProfileDefault commands for all OpenPages application servers for each WebSphereinstance in your environment to confirm that the profile has been correctly updated to use the latestJava.

10. After you have updated the Java SDK, copy the following jar files from the backup location to the newJava SDK folder if they are not already there:

• modelobjects_jvm.jar• bcprov-jdk14-145.jar (if it exists)

Configuring the default profile to accept the signer certificatesIf WebSphere Application Server global security is enabled, you must configure the default profile toautomatically accept the signer certificates from IBM OpenPages GRC Platform and workflow deploymentmanagers.

Procedure

1. Log on to the OpenPages GRC Platform administrative server computer as an administrator.2. Open a command prompt window as an administrator.3. Go to the WAS_HOME\bin directory and run the following command to list the WebSphere Application

Server profiles.

manageProfiles.bat -listProfiles


A list of the profiles is displayed. The first profile name is the Default_Profile_Name.

Note: For example, on an admin server where you deployed two servers, the following message isdisplayed:

[OpenPagesDmgr, op-OPNode1, IBPMDmgr, op-IBPMNode1, op-IBPMNode2]

OpenPagesDmgr is the Default_Profile_Name.4. To get the location of the Default_Profile_Name, run the following command:

manageProfiles.bat -getPath -profileName <Default_Profile_Name>

The DEFAULT_PROFILE_PATH is displayed.5. Go to the DEFAULT_PROFILE_PATH\bin directory and run the following two commands:

retrieveSigners.bat -autoAcceptBootstrapSigner -host <HOST_NAME> -port <OP_SOAP_PORT> -username <WAS_ADMIN_USERNAME> -password <WAS_ADMIN_PASSWORD>

Example: To automatically accept the signer certificate from the OpenPages deployment manager:

retrieveSigners.bat -autoAcceptBootstrapSigner -host MY_HOST -port 8879 -username admin -password mypassword

retrieveSigners.bat -autoAcceptBootstrapSigner -host <HOST_NAME> -port <WORKFLOW_SOAP_PORT> -username <WAS_ADMIN_USERNAME> -password <WAS_ADMIN_PASSWORD>

Example: To automatically accept the signer certificate from the workflow deployment manager:

retrieveSigners.bat -autoAcceptBootstrapSigner -host MY_HOST -port 8880 -username admin -password mypassword

6. To apply the changes, restart all the services.

Saving custom settings in configuration files after the upgradeIf you manually edited any configuration files, you must reapply the changes. Keep a record of anycustomizations to ensure that they can be reapplied after you upgrade. Also, back up these files so thatthe original version can be restored if necessary.

Procedure

1. Before you upgrade, open the configuration file that has the settings that you changed manually.2. Note the settings that you changed.3. Back up the configuration file.4. Install the upgrade.5. Ensure that the upgrade works.6. In the upgrade installation location, open the configuration file.7. If necessary, update the configuration file with the changes you made in the previous product version.

Disabling single sign-onBefore you upgrade, temporarily disable single signon. You can test the upgraded environment withoutlogging on to the single sign-on system.

About this taskFor more information, see “Disabling single sign-on for OpenPages GRC Platform” on page 240.


Disabling system admin modeBefore you upgrade, temporarily disable the system admin mode.

To view System Admin Mode in the IBM OpenPages GRC Platform application, you must have SystemAdministration Mode permission.

Procedure

1. Log on to the OpenPages GRC Platform application user interface as a user with the SystemAdministration Mode permission.

2. From the menu, click Administration > System Admin Mode > Disable.3. Log on to the OpenPages application user interface as a user with the System AdministrationMode permission.

4. From the menu, click Administration > System Admin Mode > Disable.5. Click OK.

Modifying the ObjectManager properties file to disable object force update stringsThe ObjectManager.properties file contains a number of settings that control or limit the scope ofexported configuration and related data from the IBM OpenPages GRC Platform ObjectManager tool.

Procedure

1. Log on to the application server as an administrative user.2. Go to the OP_HOME/bin directory.3. Make a backup copy of the ObjectManager.properties file.4. Open the ObjectManager.properties file in a text editor.5. Verify that the following two properties are set to false to ensure that custom strings are not

overwritten:

• configuration.manager.force.update.object.strings=false• configuration.manager.force.update.application.strings=false

6. Save and close the file.

Upgrading an OpenPages GRC Platform deploymentYou can use the Administrative Console to upgrade an IBM OpenPages GRC Platform deployment fromversion 7.0.0.x or 7.1.0.x to version 7.2, if it is installed on WebSphere Application Server version 8.5.5 or8.5.5.2.

You must update the application server to WebSphere Application Server version 8.5.5.5 with IBMRuntime Environment for Java 1.7.3 for OpenPages GRC Platform before upgrading.

You can run the OpenPages Administrative Console deployment tasks multiple times in the event ofissues that occur during the deployment.

The upgrade process replaces your OpenPages application in WebSphere Application Server. Any tuningparameters that you previously configured are reset to the default settings. This process also upgradesyour OpenPages application servers, and installs a new OpenPages CommandCenter with IBM CognosBusiness Intelligence.


Before you begin

Review the following checklist before you upgrade a deployment:


• Ensure that System admin mode is disabled.

For more information, see “Disabling system admin mode” on page 115.• Ensure that services are running.

For more information, see “Verifying that services are running” on page 109.• Ensure that the JAVA_HOME environment variable is set.

JAVA_HOME must point to IBM JRE 1.7.3 for OpenPages GRC Platform in the java_1.7.1_64 folder.• If you are using Oracle, ensure that the password for the Oracle database system is not expired.• If the OpenPages, and workflow database user accounts exist, ensure that the password for each

account has not expired.• You installed the OpenPages Administrative Console on the computer from which you plan to install

OpenPages components. For more information, see Chapter 8, “Installing the OpenPages GRC PlatformAdministrative Console,” on page 95.

• You installed OPAdminConsoleRemote on all application server, reporting server, and search servercomputers. For more information, see “Installing the OPAdminConsoleRemote component” on page 25.

Procedure

1. To start the OpenPages Administrative Console, click Start > All Programs > IBM OpenPages GRCPlatform > IBM OpenPages GRC Platform - Administrative Console.

2. On the Welcome page, select Upgrade deployment to 7.2 and click Start.3. Enter the values in the wizard for your deployment.

Tip: A description and online help for each property is displayed in the Help view when you click theproperty. If the Help view is not visible, click View > Help or press F1. For information about usingthe Administrative Console, in the Help view, click Contents

4. On the Deployment page, enter the following information about your deployment.

• Horizontal Cluster servers (Application) - specify the number of application servers to use. Themaximum number of application servers is 24.

If you are setting up more than one application server in your deployment, you must enterinformation for the administrative server first, followed by each non-administrative server.

• Reporting Servers - specify the number of reporting servers to use. The maximum number ofreporting servers is 14.

If you are using more than one reporting server in your deployment, you set up one active server,and the remaining ones as standby servers.

• Search Servers - if you want to use the global search component, type 1. If you are not deploying asearch server, type 0. The maximum number of search servers is 1.

5. On the Application server page, enter the information for the location where OpenPages GRCPlatform is to be deployed.

If you are using than one application server in your deployment (a horizontal clustered environment),you must enter the server information for the administrative server first, followed by each non-administrative server.

Application server components are upgraded in the location where they are currently installed.

a) The Connection Information is used for your OPAdminConsoleRemote port number on the targetcomputer. The default port number is 9091.

b) For the WebSphere Information group of properties, enter the settings.

Restriction: For Microsoft Windows operating system, if you installed WebSphere ApplicationServer into a directory that has a name that contains spaces, you can enter the short file nameconvention, as shown in the following example.


For C:\Program Files\IBM\WebSphere\AppServer, enter C:\PROGRA~1\IBM\WebSphere\AppServer.

Important: Ensure that you enter the correct information for the WebSphere Admin Usernameand Admin Password. These credentials are used to log in to the WebSphere AdministrativeConsole.

To verify the credentials, log on to the WebSphere Administrative Console (https://was_host_name:secure_port/ibm/console).

The default secure port number for the OpenPages cell is 9043.c) For the OpenPages Application Server Information group of properties, set the Java Home

Directory location to the location of the Java application that is provided with WebSphereApplication Server.

Restriction: You cannot use a path that contains spaces.d) In the Modules Install Information section, ensure you select No Schema.

6. On the reporting server page, enter the information for your IBM Cognos Business Intelligenceinstallation.a) The Connection Information is used for your OPAdminConsoleRemote port number on the target

computer. The default port number is 9091.b) For the CommandCenter Reporting Information group of properties, enter the settings for IBM

Cognos Business Intelligence and choose Command Center installation settings.

To check Cognos BI configuration settings, you can open IBM Cognos Configuration and review theEnvironment properties.

c) For the CommandCenter Reporting Information group of properties, set the Cognos Java Homelocation to the location of the Java application that is provided with IBM Cognos, if you areinstalling on Windows, or to a supported Java if you are installing on Linux or AIX.

d) For the Database Client Information group of properties, enter the Home Directory, and theinstallation location of the database instance for the OpenPages database.

Example: On Linux or AIX operating systems, /home/db2inst1/sqllib or on Windowsoperating systems, C:\ibm\SQLLIB

7. On the Database Server page, enter the information for your database server.a) Select the operating system of the computer on which the database server is installed in the

Server Information section.

By default, the operating system shown for the database server matches the operating systemthat you selected for the application server. If the database server is installed on a differentoperating system you must update it.

For example, if you selected Windows as the operating system for the application server, Windowsis selected for the database server operating system by default. If the database server is installedon Linux, you must update it manually to Linux.

b) For the Database Server Information group of properties, enter the information for the databaseinstance that hosts the OpenPages database.

• Ensure that the installation user has write access to the locations that you specify for theDatabase Path and Catalog Path properties.

• The user accounts for the OpenPages JDBC User Name and the Workflow JDBC User Namemust exist. You must use separate user names for each user account.

Note: If the user names that are defined in the operating system differ from the default JDBCuser names that are shown here, ensure that you update JDBC user names so that they areconsistent.

c) In the Database Creation Information section, select Install now to automatically install theOpenPages database schema when OpenPages GRC Platform is deployed to WebSphereApplication Server or select Already installed if the schema is installed.


The OpenPages database schema must exist before you deploy to WebSphere Application Server.

By default, the location path shown for the database server matches the operating system thatyou selected for the application server. If the database server is installed on a different operatingsystem you must update it.

d) In the Database Setup Information section, ensure the location path of the Storage Directory iscorrect for the operating system that you selected for the application server.

By default, the location path is set to the operating system that you selected for the applicationserver. If the storage directory is installed on a different operating system to the applicationserver, you must update it to the uniform naming convention (UNC) path.

The installation path can contain a maximum of 71 characters on Microsoft Windows operatingsystems or 206 characters on UNIX operating systems.

e) If required, you can change the default user name for the Super Administrator in the OpenPagesAdministrator Information section.

Do not use the following user names that are reserved by OpenPages:


f) Select the appropriate option for OpenPages Configuration Information.

• Select Load under most circumstances.• Select Don't Load, if you already loaded the configuration data.

Example: In test environments that have multiple installations of OpenPages GRC Platform, theconfiguration data might already be loaded.

If you select Don't Load, and the default configuration is not already loaded, you must manuallyload the level-0 schema. Otherwise, you see garbled text when you are in the OpenPagesapplication. For more information, see “Manually loading the configuration data after a newinstallation” on page 372.

Restriction: The database passwords for all users, including the System User Name, Sys UserName, OpenPages JDBC User Name, Workflow JDBC User Name, and Database Creator UserName cannot contain spaces or special characters. Otherwise, some OpenPages scripts, such as theOPBackup command might fail.

8. On the Search Server page, enter the information for your search server.a) The Connection Information is used for your OPAdminConsoleRemote port number on the target

computer. The default port number is 9091.b) Set the Search Server Java Home location to the location of a supported Java installation.c) Select the language abbreviation to use for the Apache Solr search engine language analyzer from

the Language Analyzer list.9. On the Validate Parameters page, click Validate.

Correct the settings that display errors.

Example: For Microsoft Windows operating systems, if you enter an incorrect UNC path for aproperty, you might see an error during the validation phase. Correct the path, and validate theproperties again.

Note: For IBM DB2, the Database Creator User Name and Database Creator Password can bevalidated only after the node is created. Ensure that you enter the correct database creator username and password.

10. Click Finish.11. On the Next Steps tab, do the following:


• Click Calculate Next Steps to determine whether you can proceed with the deployment, andcorrect any errors in your configuration.

• Click Execute Next Step to deploy the components individually.• Click Execute All Remaining Steps to deploy all of the components sequentially.• Click View All Next Steps to view the steps that are remaining in the deployment.

Monitor the progress of the installation in the Log view. A message is displayed to indicate whetherthe installation succeeded. If the installation fails, the OpenPages Administrative Console rolls backthe installation to the last successful checkpoint.

12. Use the Deployment > Topology or Deployment > Next Steps panels to monitor and progressthrough the deployment.

If you click Execute Next Step, click to the Topology or Next Steps panels to calculate or view theremaining tasks in the deployment.

What to do next

Some post-upgrade tasks are required. For more information, see “Post upgrade tasks” on page 123.

If errors occur during the installation, use the Log view to determine the cause of the error. If you closedthe Log view, you can click Deployment > History to view the information.

Click the Config > OM Load tab and check for any errors that are related to the ObjectManager.

You can also check the OP_HOME/bin/logs directory for Object Manager log files, and the<Host_Name>-OPNode1Server1-aurora.log in the OP_HOME/aurora/logs directory on theapplication server computer.

After you fix the errors, return to the Deployment > Topology or Deployment > Next Steps windows tocontinue with the deployment.

Related conceptsUpgrade installation recovery optionsRelated tasksUpdating an Oracle database schema

Upgrade installation recovery optionsIf the upgrade installation fails, the installation program does a partial rollback. The partial rollbackreverts selected installation changes to the last successful checkpoint.

To recover from the failed upgrade installation, choose one of the following options:

• Rerun the upgrade task in the IBM OpenPages GRC Platform Administrative Console and complete theupgrade.

• Manually roll back to the previous version of OpenPages GRC Platform.

Rolling back manually to a previous installationIf the upgrade installation fails, you can manually revert to the successful state of the previous version ofIBM OpenPages GRC Platform.

About this task

Use the following table to replace the script variables with values that are appropriate for yourenvironment.


Table 38: Variable descriptions for rollback scripts


admin_host_name The host name of the administrative server.

admin_username User name of the WebSphere Application Serveradministrator account

admin_password The password of the WebSphere Application Serveradministrator account

OP_SOAP_port The port number for the OpenPages Deployment ManagerSOAP listener.

In the OpenPages Administrative Console, this parameter isthe DMgr Manager SOAP Port.

The value of the SOAP_CONNECTOR_ADDRESS setting inthe <OP_Home>\temp\wasconfig\OpenPagesCell.dmgr.config.props file


IBPM_SOAP_port The port number for the workflow Deployment ManagerSOAP listener.

In the OpenPages Administrative Console, this parameter isthe Workflow DMgr SOAP Port.

The value of the SOAP_CONNECTOR_ADDRESS setting inthe <OP_Home>\temp\wasconfig\IBPMCell.dmgr.config.props file


host_name The name of the computer where you are running therecovery steps.

Procedure

1. Stop the OpenPages services.

• On Microsoft Windows operating systems, go to the OP_Home\bin directory and runStopAllServers.cmd.

• On UNIX operating systems, go to the OP_Home/bin directory and run ./StopAllServers.sh.

If WebSphere Application Server security is enabled, include the user name and password in thecommand.For example, on Microsoft Windows operating systems, run StopAllServers.cmd<admin_username> <admin_password>.

2. Start the OpenPages Deployment Manager.

• On Microsoft Windows operating systems, go to the OP_Home\profiles\OpenPagesDmgr\bindirectory and run startManager.bat.

• On UNIX operating systems, go to the OP_Home\profiles\OpenPagesDmgr\bin directory andrun startManager.sh.

3. Restore the OpenPages and workflow ear files.


• To restore the OpenPages ear file, copy op-apps.ear from OP_HOME\upgrade\backup\openpages\applications to OP_HOME\applications.

• To restore the workflow ear files, copy fujitsu-ibpm-engine.ear, ibpmconsole.ear, andop-ibpm-integration.ear from OP_HOME\upgrade\backup\ibpm\server\deploymentto Workflow_HOME\server\deployment.

4. Deploy the OpenPages application.

• On Microsoft Windows operating systems, go to the OP_Home\upgrade\temp\perlinstalldirectory and run the following command:

<WAS_HOME>\bin\wsadmin.bat -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -lang jython -conntype soap -host <admin_host_name> -port <OP_SOAP_port> -f updateOPApp.py

• On UNIX operating systems, go to the OP_Home/upgrade/temp/perlinstall directory andrun the following command:

<WAS_HOME>/bin/wsadmin.sh -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -lang jython -conntype soap -host <admin_host_name> -port <OP_SOAP_port> -f updateOPApp.py

If WebSphere Application Server security is enabled, include the user name and password in thecommand.

For example, on Microsoft Windows operating systems, run the following command:

<WAS_HOME>\bin\wsadmin.bat -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -user <admin_username> -password <admin_password> -lang jython -conntype soap -host <OP_ADMIN_HOSTNAME> -port <OP_SOAP_port> -f updateOPApp.py

5. Start the Fujitsu Interstage BPM Deployment Manager.

• On Microsoft Windows operating systems, go to the <Workflow_HOME>\profile\IBPMDmgr\bin directory and run startManager.bat.

• On UNIX operating systems, go to the <Workflow_HOME>/profile/IBPMDmgr/bin directoryand run startManager.sh.

6. Deploy the workflow applications.

• On Microsoft Windows operating systems, go to the OP_Home\upgrade\temp\perlinstalldirectory and run the following command:

<WAS_HOME>\bin\wsadmin.bat -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -lang jython -conntype soap -host <admin_host_name> -port <IBPM_SOAP_port> -f updateIBPMApp.py

• On UNIX operating systems, go to the OP_Home/upgrade/temp/perlinstall directory andrun the following command:

<WAS_HOME>/bin/wsadmin.sh -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -lang jython -conntype soap -host <admin_host_name> -port <IBPM_SOAP_port> -f updateIBPMApp.py




WAS_HOME>\bin\wsadmin.bat -wsadmin_classpath commons-configuration-1.6.jar;commons-lang-2.4.jar;commons-collections-3.2.1.jar -user <admin_username> -password <admin_password> -lang jython -conntype soap -host <admin_host_name> -port <IBPM_SOAP_port> -f updateIBPMApp.py

7. Synchronize the OpenPages nodes.

• On Microsoft Windows operating systems, go to the <OP_Home>\profiles\<host_name>-OPNode1\bin directory and run syncNode.bat <admin_host_name> <OP_SOAP_port>.

• On UNIX operating systems, go to the <OP_Home>/profiles/<host_name>-OPNode1/bindirectory and run syncNode.sh <admin_host_name> <OP_SOAP_port>.



syncNode.bat <admin_host_name> <OP_SOAP_port> -user <admin_username> -password <admin_password>

8. Synchronize the workflow nodes.

• On Microsoft Windows operating systems, go to the <Workflow_Home>\profiles\<host_name>-IBPMNode<Node_Number>\bin directory and run syncNode.bat<admin_host_name> <IBPM_SOAP_port>.

• On UNIX operating systems, go to the <Workflow_Home>/profiles/<host_name>-IBPMNode<Node_Number>/bin directory and run syncNode.sh <admin_host_name><IBPM_SOAP_port>.



syncNode.bat <admin_host_name> <IBPM_SOAP_port> -user <admin_username> -password <admin_password>

9. Restore the solutions and services archives in the <OP_Home>\application directory by copyingthem into the corresponding locations in the following directory:

<OP_Home>\profiles\<host_name>-OPNode1\installedApps\OpenPagesCell\op-apps.ear

10. Restore the files under the <OP_Home>\upgrade\backup\ibpm\profiles directory, by copyingthem to the <workflow_Home>\profiles directory.

11. Restore the OpenPages database backup.

For more information about restoring the database backup, see the IBM OpenPages GRC PlatformAdministrator's Guide.

12. Start the OpenPages services.

• On Microsoft Windows operating systems, go to the <OP_Home>\bin directory and runStartAllServers.cmd.

• On UNIX operating systems, go to the <OP_Home>/bin directory and run ./StartAllServers.sh.


Post upgrade tasksComplete the following tasks after you upgrade IBM OpenPages GRC Platform.

• Export the topology.xml file so that you can use it for installing future upgrades and fix packs. Topreserve the session logs to help with diagnosing and debugging installation issues, export thedeployment, which includes the topology.xml file.

For more information, see “Backing up and restoring the Administrative Console workspace” on page173.

• Copy the IBM Global Security Kit files to the IBM DB2 server installations.

This task is required if you are using DB2 for the database server on for Windows operating systems. Formore information, see “Copying the IBM Global Security Kit files to the DB2 server installations onWindows operating systems” on page 173.

• Update the list of valid domain names and host names.

For more information, see “Updating the list of valid domains and host names” on page 124.• Start the services.

For more information, see “Starting services after the upgrade” on page 124.

Upgrade verification tests.• Update the reporting framework.

For more information, see “Updating the reporting framework” on page 125.• Test IBM Cognos Business Intelligence.

For more information, see “Testing IBM Cognos Business Intelligence after the upgrade” on page 126.• Upgrade deployed images and custom query subjects on the reporting server.

For more information, see “Upgrading deployed images and custom query subjects on the reportingserver” on page 126.

• Enable single sign-on if it is configured in the source system.

For more information, see “Enabling single sign-on” on page 240.• “Load the OpenPages ORM data” on page 126.

This task is required if you are upgrading from OpenPages GRC Platform versions 7.0, 7.0.0.1, 7.0.0.2 or7.0.0.3 only, and you previously installed IBM OpenPages Operational Risk Management.

• Apply custom settings to configuration files.

For more information, see “Custom settings in configuration files ” on page 130.• Configure the Process Analysis visualization report for users.

For more information, see “Configuring the Process Analysis Visualization report to launch” on page130.

• If you installed a search server, you must also complete some post installation tasks.

For more information, see “Search server post installation tasks” on page 185.• Clean up the trigger configuration file so that it contains only your custom triggers.

This task is optional.

For more information, see “Removing standard triggers from the trigger configuration file” on page 131.• If you previously installed IBM OpenPages IT Governance, complete the post upgrade tasks.

You are recommended to complete these tasks so that the new features available for OpenPages ITGare available to you.

For more information, see “OpenPages solutions post installation tasks” on page 132.


Updating the list of valid domains and host namesAfter you upgrade IBM OpenPages GRC Platform, you must update the list of valid domains and hostnames to include all application servers. You must also update the public domain that is used for loadbalanced environments on all reporting servers.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Start IBM Cognos Configuration.3. In the Explorer pane, go to Local Configuration > Security > IBM Cognos Application Firewall.4. In the Properties pane, click the Valid domain names or hosts field and click the pencil icon.5. In the Valid domain or hosts window, click Add.6. Enter the names of all OpenPages application servers.7. Click OK.8. Save the configuration and restart the Cognos service.

If you use Windows Services to restart the Cognos service, the service is listed as CommandCenter.

Starting services after the upgradeThe upgrade installer stops all IBM OpenPages GRC Platform servers on the computer where you areupgrading. When the upgrade installer is complete, you must manually restart the servers.

Procedure

1. Start all application and workflow servers.

On Microsoft Windows operating systems, you must start the OpenPagesAdminServer service first.Then, start the other services. Otherwise, start the services from the Windows Start menu shortcut.

For more information about starting services, see Chapter 15, “Starting and stopping servers,” on page201.

2. Start the IBM Cognos Business Intelligence service.

Upgrade verification testsAfter you upgrade IBM OpenPages GRC Platform, verify that the upgrade is successful and the productworks as expected.

Use the following checklist to verify the upgrade.

Table 39: Post-installation verification checklist

Task Guidance

Review all installation logs for errors. The log files are located in the OP_HOME\upgrade\logs directory.

Verify that a backup of the system exists If it does not exist, create a backup of your system byrunning the OPBackup command from the OP_HOME\aurora\bin directory.

Verify that a compressed file was created with thecorrect timestamp. The file is in the OP_Home\openpages-backup-restore directory.

For information about using the backup utility, see theIBM OpenPages GRC Platform Administrator's Guide.


Table 39: Post-installation verification checklist (continued)

Task Guidance

Confirm that the reporting schema andframework generated successfully.

For more information, see “Updating the reportingframework” on page 125.

Confirm that base reports are functioning asexpected.

Log on to the OpenPages application and run the AllDocumentation Cognos report.

If single signon (SSO) is enabled, verify thatuser accounts can access the environment.

Log on to the OpenPages application with an SSO useraccount.

Confirm that you can upload and downloadsample attachments.

Log on to the OpenPages application and upload anddownload a file attachment.

Verify that links in reports reference the correctserver address and use the correct web URLparameters.

Run a report that uses OpenPages links. Select a linkand confirm that the target object is renderedsuccessfully in the OpenPages interface.

For clustered environments, verify that allservers can upload and download attachments.

Upload and download files from both primary andsecondary application servers.

For load-balanced environments, confirm thatbackup scheduling works.

On primary and secondary servers, verify backupscheduling and process times.

Validate that you can access the Cognos portal. Type the web URL http://server_name/ibmcognos from a client system. Confirm that youcan log on to the portal.

Updating the reporting frameworkAfter you upgrade or migrate IBM OpenPages GRC Platform, update the reporting framework.

Procedure

1. In a web browser, open the OpenPages application:

http://openpages_server:port/openpages2. Log on to the OpenPages application as a user with administrative privileges.3. If System Admin Mode is enabled, disable it.4. From the menu bar, click Administration > Reporting Framework > Generation.5. On the Reporting Framework Operations page, click Update.6. In the Reporting Framework Generation window, under Framework Generation, select the

Framework Model and Labels and other options you want for the relational data model.

Restriction: If you are migrating from OpenPages GRC Platform version 5.x or earlier, you mustgenerate the Legacy Framework.

For upgraded systems that have the Legacy Reporting Framework setting enabled, you can generatethe relational data model. Under Legacy Framework Generation, select the Framework Model andLabels options.

For information about enabling the Legacy Framework and enabling computed fields in the ReportingFramework V6, see the IBM OpenPages GRC Platform Administrator's Guide.

7. Click Submit.8. To view the progress of the update, click Refresh.


The Percent Complete column on the Reporting Framework Operations table is updated.

Results

Updating the reporting framework process takes approximately 30 minutes or longer.

Testing IBM Cognos Business Intelligence after the upgradeVerify that IBM Cognos Business Intelligence works with the IBM OpenPages GRC Platform environment.

Procedure

1. Log on to OpenPages GRC Platform and verify that you can connect to the IBM Cognos BusinessIntelligence portal.a) In a web browser, log on to the OpenPages GRC Platform application.b) To test the connection from OpenPages to the IBM Cognos BI portal, click Reporting > Cognos

Connection.c) Close the session.

2. On the IBM OpenPages home page, from the Reporting menu, verify that you can open the Cognosstudios.

3. From the IBM OpenPages application, click Reporting > All Reports, and run some standard andcustom user reports.

Upgrading deployed images and custom query subjects on the reporting serverUpgrade the deployed IBM OpenPages GRC Platform images and custom query subjects to the currentversion of IBM Cognos Business Intelligence.

Procedure

1. Go to the Old_Cognos_HOME|webcontent|skins|branding directory.

Old_Cognos_HOME is the installation location of the previous version of Cognos software.2. Copy the contents of the directory, without overwriting existing images, to the New_Cognos_HOME|webcontent|skins|branding directory.

3. To back up the custom query subjects, go to the Old_CC_HOME|framework|conf directory and copythe files to the New_CC_HOME|framework|conf directory.

Results

If there are no deployed images or custom query subjects, following this procedure will copy no files.

Load the OpenPages ORM data

If you are upgrading or migrating IBM OpenPages GRC Platform from versions 7.0, 7.0.0.1, 7.0.0.2 or7.0.0.3, and your previous installation includes IBM OpenPages Operational Risk Management, you mustload the solutions data to access the triggers, helpers, and reports that you were previously using.

Note: This task is not required if you are upgrading or migrating from version 7.0.0.4 or later versions.

The procedure to follow for loading solutions data differs, depending on whether you customized thetriggers, helpers, and reports in your previous installation.

• For non-customized OpenPages ORM data, see “Loading non-customized OpenPages ORM data” onpage 126.

• For customized OpenPages ORM data, see “Loading customized OpenPages ORM data” on page 128.

Loading non-customized OpenPages ORM data


If you did not customize triggers, helpers, and reports in your previous installation of IBM OpenPagesOperational Risk Management, follow these steps to load the OpenPages ORM data after upgrading ormigrating IBM OpenPages GRC Platform.

Note: This task is not required for upgrading or migrating from version 7.0.0.4 or later versions.

Before you begin

If you are migrating OpenPages GRC Platform, you must copy the OP_HOME\Modules folder from theprevious installation before you start.


Table 40: Descriptions of command parameters

Parameter Name Description

OP_APP_USER_NAME The OpenPages application user name.

OP_APP_USER_PASSWD The password for the OpenPages application user.

COGNOS_DISPATCHER_URL The IBM Cognos Business Intelligence dispatcherURL.

OP_APP_ADMIN_USER_NAME The OpenPages administrator user name.

OP_APP_ADMIN_PASSWD The password for the OpenPages administrator.

Procedure

1. Stop all OpenPages services.2. Go to the OP_HOME\Modules\triggers folder and copy the openpages-ext.jar file to OP_HOME\aurora\op-ext-lib folder.

3. Go to the OP_HOME\Modules\Oracle folder or the OP_HOME\Modules\DB2 folder and copy theOpenPages_Solutions_V6.zip file to the Cognos_HOME\deployment folder.

4. Go to the OP_HOME\Modules\triggers folder and copy the TriggerLoader-op-file-content.zip file to replace the current file in the OP_HOME\Modules\loaderdata\Triggersfolder.

5. Go to the OP_HOME\Modules folder and copy the solutions-sosa-files.zip file to thefollowing folder:

Go to the OP_HOME\applications folder, then extract the file to OP_HOME\profiles\HOST_NAME\-OPNode1\installedApps\OpenPagesCell\op- apps.ear\sosa.war

6. Update the static-modelquerysubjects file.a) Go to the OP_HOME\Modules folder and copy the static-modelquerysubjects_ORM.xml file

to the CC_Home\framework\conf\mqs folder.b) Using the OpenPages application, generate the reporting framework.c) Add the RCSA Alignment Helper field to its filtered list:

• Select Administration > Profiles > Profile_name > Risk Assessment > Filtered List from thenavigation bar.

• Select Assessments > Risk Assessments.

• In the filtered list view, click RCSA Alignment helper to open the helper.7. Start all OpenPages services.8. Load the triggers.

a) Go to the OP_HOME\bin folder.b) Run the following command:


ObjectManager.cmd l c OP_APP_USER_NAME OP_APP_USER_PASSWD OP_HOME\Modules\loaderdata\Triggers TriggerLoader (on Microsoft Windows)

ObjectManager.sh l c OP_APP_USER_NAME OP_APP_USER_PASSWD OP_HOME/Modules/loaderdata/Triggers TriggerLoader (on UNIX)

9. Load the Solution Reports package.a) Go to the CC_HOME\temp\bin folder.b) Run the following command:

ImportReports.bat - a OpenPages_Solutions_V6 -s OpenPagesSecurityRealm -uOP_APP_USER_NAME -p OP_APP_USER_PASSWD -g COGNOS_DISPATCHER_URL (onWindows)

ImportReports.sh - a OpenPages_Solutions_V6 -s OpenPagesSecurityRealm -uOP_APP_USER_NAME -p OP_APP_USER_PASSWD -g COGNOS_DISPATCHER_URL

10. Update the solutions data.a) Go to the OP_HOME\bin folder and update theconfiguration.manager.force.update.application.strings ObjectManager.propertyfrom false to true.

b) Copy the OP_HOME\Modules\loader-data folder to the local system and copy the files to alocal folder.

c) Update the properties file in your local folder:

schema_loader_modules_properties.bat OBJMGR_HOME= OP_HOME\binPATCH_LOADER_DATA= OP_HOME\Modules\loader-data OPXUserName=OP_APP_ADMIN_USER_NAME OPXUserPassword= OP_APP_ADMIN_PASSWD (on Windows)

schema_loader_modules_properties.sh OBJMGR_HOME= OP_HOME/binPATCH_LOADER_DATA= OP_HOME/Modules/loader-data OPXUserName=OP_APP_ADMIN_USER_NAME OPXUserPassword= OP_APP_ADMIN_PASSWD (on UNIX)

d) Run the following command:

openpages-patch-modules-loader-data.bat (on Windows)

openpages-patch-modules-loader-data.sh (on UNIX)e) When the data is successfully loaded, go to the OP_HOME\bin folder and update theconfiguration.manager.force.update.application.strings ObjectManager.propertyfrom true to false.

11. Restart all OpenPages services.

Loading customized OpenPages ORM data

If you customized triggers, helpers, and reports in your previous installation of IBM OpenPagesOperational Risk Management, follow these steps to load the OpenPages ORM data after upgrading ormigrating IBM OpenPages GRC Platform.

Note: This task is not required for upgrading or migrating from version 7.0.0.4 or later versions.

Before you begin

If you are migrating OpenPages GRC Platform, you must copy the OP_HOME\Modules folder from theprevious installation before you start.



Table 41: Descriptions of command parameters

Parameter Name Description

OP_APP_USER_NAME The OpenPages application user name.

OP_APP_USER_PASSWD The password for the OpenPages application user.

COGNOS_DISPATCHER_URL The IBM Cognos Business Intelligence dispatcherURL.

OP_APP_ADMIN_USER_NAME The OpenPages administrator user name.

OP_APP_ADMIN_PASSWD The password for the OpenPages administrator.

Procedure

1. Stop all OpenPages services.2. Merge the openpages-ext.jar files.

a) Go to the OP_HOME\aurora\op-ext-lib folder and extract the openpages-ext.jar file tothe OP_HOME\merge folder.

b) Go to the OP_HOME\Modules\triggers folder and copy the openpages-ext.jar file to the tothe OP_HOME\merge folder, and overwrite files if necessary.

c) Add the folders and files in the OP_HOME\merge folder to the openpages-ext.jar file.d) Copy the updated openpages-ext.jar file to the OP_HOME\aurora\op-ext-lib folder, and

overwrite files if necessary.3. Go to the OP_HOME\Modules\Oracle folder or the OP_HOME\Modules\DB2 folder and copy theOpenPages_Solutions_V6.zip file to the Cognos_HOME\deployment folder.

4. Go to the OP_HOME\Modules\loaderdata\Triggers folder and merge the TriggerLoader-op-file-content.zip file with the current file in the OP_HOME\Modules\triggers folder.

5. Go to the OP_HOME\Modules folder and copy the solutions-sosa-files.zip file to thefollowing folder:

Go to the OP_HOME\applications folder, then extract the file to OP_HOME\profiles\HOST_NAME\-OPNode1\installedApps\OpenPagesCell\op- apps.ear\sosa.war

6. Update the static-modelquerysubjects file.a) Go to the OP_HOME\Modules folder and copy the static-modelquerysubjects_ORM.xml file

to the CC_Home\framework\conf\mqs folder.b) Using the OpenPages application, generate the reporting framework.c) Add the RCSA Alignment Helper field to its filtered list:

• Select Administration > Profiles > Profile_name > Risk Assessment > Filtered List from thenavigation bar.

• Select Assessments > Risk Assessments.

• In the filtered list view, click RCSA Alignment helper to open the helper.7. Start all OpenPages services.8. Load the triggers.

a) Go to the OP_HOME\bin folder.b) Run the following command:

ObjectManager.cmd l c OP_APP_USER_NAME OP_APP_USER_PASSWD OP_HOME\Modules\loaderdata\Triggers TriggerLoader (on Microsoft Windows)

ObjectManager.sh l c OP_APP_USER_NAME OP_APP_USER_PASSWD OP_HOME/Modules/loaderdata/Triggers TriggerLoader (on UNIX)

9. Load the Solution Reports package.


a) Go to the CC_HOME\temp\bin folder.b) Run the following command:

ImportReports.bat - a OpenPages_Solutions_V6 -s OpenPagesSecurityRealm -uOP_APP_USER_NAME -p OP_APP_USER_PASSWD -g COGNOS_DISPATCHER_URL (onWindows)

ImportReports.sh - a OpenPages_Solutions_V6 -s OpenPagesSecurityRealm -uOP_APP_USER_NAME -p OP_APP_USER_PASSWD -g COGNOS_DISPATCHER_URL

10. Update the solutions data.a) Go to the OP_HOME\bin folder and update theconfiguration.manager.force.update.application.strings ObjectManager.propertyfrom false to true.

b) Copy the OP_HOME\Modules\loader-data folder to the local system and copy the files to alocal folder.

c) Go to the loader-data folder in your local folder and run the following command:

schema_loader_modules_properties.bat OBJMGR_HOME= OP_HOME\binPATCH_LOADER_DATA= OP_HOME\Modules\loader-data OPXUserName=OP_APP_ADMIN_USER_NAME OPXUserPassword= OP_APP_ADMIN_PASSWD (on Windows)

schema_loader_modules_properties.sh OBJMGR_HOME= OP_HOME/binPATCH_LOADER_DATA= OP_HOME/Modules/loader-data OPXUserName=OP_APP_ADMIN_USER_NAME OPXUserPassword= OP_APP_ADMIN_PASSWD (on UNIX)

d) Run the following command:

openpages-patch-modules-loader-data.bat (on Windows)

openpages-patch-modules-loader-data.sh (on UNIX)e) When the data is successfully loaded, go to the OP_HOME\bin folder and update theconfiguration.manager.force.update.application.strings ObjectManager.propertyfrom true to false.

11. Restart all OpenPages services.

Configuring the Process Analysis Visualization report to launchYou must complete the following steps to ensure that users can view the Process Analysis Visualizationreport in IBM OpenPages GRC Platform.

Procedure

1. Log on to the OpenPages application interface as a user with administrative privileges.2. Click Administration > Settings > Platform > Reporting Schema > Object URL Generator > Host.3. Update the Application Server Host Name value of the host name for the target server where IBM

Cognos Business Intelligence and CommandCenter are running.4. Re-create the reporting schema.

For more information, see “Creating the reporting schema and framework” on page 174.

Custom settings in configuration filesIf you manually edited any configuration files in the previous version, you must reapply the changes.

To restore customized settings after you upgrade:

1. Ensure that the upgrade works.2. Find the backup copy of the configuration file.3. In the upgrade installation location, open the new configuration file.4. Update the configuration file with the changes you made in the previous product version.


Restoring changes to the application.xml fileIf you preserved settings in the application.xml file, such as removing openpages from theapplication URL, you can restore the settings.

Procedure

1. If necessary, stop the IBM OpenPages GRC Platform services.2. Go to the OP_HOME/profiles/OpenPagesDmgr/config/cells/OpenPagesCell/applications/op-apps.ear/deployments/op-apps/META-INF/application.xml directory

3. Open the file in a text editor and compare it to the backed up version of the file.4. Restore the customized settings.5. For WebSphere Application Server, restore the setting on all nodes in the cluster.

Each node has a version of the application.xml file in a location similar to the following directory:OP_HOME/profiles/node_name1/installedApps/OpenPagesCell/op-apps.ear/META-INF/.

6. Restart the services.

Backing up changes to the web.xml fileIf you changed settings in the web.xml file, such as changing the HTTP session timeout for a user in yourweb application, then you can restore the settings.

For more information about the session timeout settings, see the IBM OpenPages GRC PlatformAdministrator's Guide.

Procedure

1. Log on to the IBM WebSphere Integrated Solutions Console as a server administrator.

http://server_name:port/ibm/console


a) Expand Applications > Application Types and click WebSphere enterprise applications.b) On the Enterprise applications page, click the name of the resource you want to configure.c) On the Enterprise Applications IBM OpenPages -resource-name page, click the Configuration

tab.d) Under the Web Module Properties heading, click Session management.e) On the Enterprise servers IBM OpenPages -resource-name Session management page, under

General Properties find the Session timeout pane.f) Select the Set timeout option, and reset the Set timeout setting to the value of the backup setting.g) Exit the console

2. Restart the services.

Removing standard triggers from the trigger configuration fileAfter you upgrade or migrate IBM OpenPages GRC Platform, you can clean up the trigger configuration fileso that it contains only your custom triggers. This task is optional.

Procedure

1. Edit the following file to remove all standard OpenPages trigger entries.

OP_Home/addon_module/_trigger_config.xml2. Run the following command to load the openpages-solutions.xml file from the OP_Home\bin

folder.



ObjectManager.cmd l c OP_user OP_password OP_Home\addon_module\loaderdata\openpages-solutions.xml


ObjectManager.sh l c OP_user OP_password OP_Home\addon_module\loaderdata\openpages-solutions.xml

3. Click Administration > Settings > Applications > GRCM.4. Update the value of the Trigger Configuration Files property to_trigger_config_.xml,openpages-solutions.xml,OPLC-QuestionnaireAssessment.xml

OpenPages solutions post installation tasksIf your upgrade or migration includes IBM OpenPages solutions, you must complete the following postupgrade or post migration tasks.

• Load the solution trigger files.• Load the OpenPages solution upgrade loader files.• Update the object profiles.

For more information, see OpenPages ITG (Questionnaire and Incident Management) upgrade for 7.2customers (www.ibm.com/support/docview.wss?uid=swg27047260).

Loading the OpenPages GRC Platform solution trigger filesIf you upgraded or migrated IBM OpenPages GRC Platform solutions, you must load the solution triggerfiles.

About this taskFor example, the following procedure loads the trigger files for the OpenPages IT Governance (ITG)solution.

Procedure

1. Run the following command to load the OPLC-incident.xml file from the OP_Home\bin folder.


ObjectManager.cmd l c OP_user OP_password OP_version_Configuration\modules\upgrade\ITG\OPLC-incident.xml


ObjectManager.sh l c OP_user OP_password OP_version_Configuration\modules\upgrade\ITG\OPLC-incident.xml

2. Click Administration > Settings > Applications > GRCM.3. Update the value of the Trigger Configuration Files property to_trigger_config_.xml,openpages-solutions.xml,OPLC-QuestionnaireAssessment.xml.

Loading OpenPages solutions upgrade loader filesYou must load some upgrade files that are used by IBM OpenPages solutions.

About this taskFor example, the following procedure loads files that are used for the OpenPages IT Governance (ITG)solution.




Procedure

1. Copy the /OP_version_Configuration/Upgrade/ITG/loader-data file from the IBMOpenPages GRC Platform installation media to the following folder:

OP_HOME/addon_module/loaderdata2. Go to the OP_HOME/addon_module/ folder, and edit the following file in a text editor:

loaderdata.bat (Microsoft Windows operating systems)

loaderdata.sh (UNIX operating systems)3. In the following line, update the password for the OpenPages application Super Administrator.

SET OPXUserName=Super_Administrator_user_nameSET OPXUserPassword=********

The default user name is OpenPagesAdministrator.

The password for OPXUserName is masked by asterisks (***). Replace the mask with clear text. Afterthe default configuration data is loaded, you can manually mask the password value with asterisks(***).

4. Save and close the file.5. Run the following command:

openpages-itg-modules-upgrade-loader-data.bat (Windows)

openpages-itg-modules-upgrade-loader-data.sh (UNIX)6. Edit the OP_HOME\bin\ObjectManager.property file and update the following settings as shown:

configuration.manager.force.update.object.strings=trueconfiguration.manager.force.update.application.strings=true



Chapter 10. Migrating OpenPages GRC PlatformMigrate your existing version of IBM OpenPages GRC Platform to take advantage of new features,enhancements, and performance improvements.

The decision to perform an upgrade or migration depends on the version of OpenPages GRC Platform thatyou currently have installed, and the version of WebSphere Application Server that you are using.

For more information about the supported software versions for OpenPages GRC Platform, see “Softwareprerequisites” on page 13.

Starting from OpenPages version 5.x

If you have OpenPages version 5.x, you can migrate directly to OpenPages version 7.2.


Starting from OpenPages version 6.x or later installed on WebLogic or WebSphere Application Serverversion 8.0 or 8.5

If you are currently using OpenPages GRC Platform installed on WebLogic or WebSphere ApplicationServer version 8.0 or 8.5, you can migrate directly to OpenPages version 7.2.



Moving from OpenPages version 7.0 installed on Windows on WebLogic

If you are currently using OpenPages GRC Platform installed on Windows and you want to move toLinux or AIX and use WebSphere Application Server, use a migration to move your environment.



Starting from OpenPages version 7.0 or later installed on WebSphere Application Server version8.5.5 or 8.5.5.2

If you have OpenPages GRC Platform version 7.0.0.x or 7.1.0.x, you can upgrade the supportedversion of the OpenPages application that is deployed on WebSphere Application Server.

For more information, see Chapter 9, “Upgrading OpenPages GRC Platform,” on page 97.

Migrate from OpenPages GRC Platform version 5To migrate IBM OpenPages GRC Platform from version 5.x to version 7.2 follow these steps.

1. Prepare the system for migration.



database.


• Export configuration items, OpenPages data, and the IBM Cognos content store from your currentenvironment.



For more information, see “Exporting data from your current environment” on page 136.2. Upgrade the software that is required for OpenPages GRC Platform.

• Upgrade your Oracle database server and database client software to the supported version.• Upgrade IBM Cognos Business Intelligence.

For more information, see “Upgrading Cognos Business Intelligence” on page 109.• Install the supported version of IBM WebSphere Application Server.


For more information on supported software versions, see “Software prerequisites” on page 13.3. Migrate the OpenPages application and databases.

• Restore your OpenPages database to the new version of the database server.• Import the version 5.x database and manually upgrade the OpenPages database schema.

For more information, see “Creating the Oracle database schema and importing the database” onpage 136, and “Updating the Oracle database schema” on page 140.

• Use the OpenPages Administrative Console to migrate your OpenPages deployment.

For more information, see “Migrating an OpenPages GRC Platform deployment” on page 142.• Create the default IBM WebSphere Application Server profiles and update the existing workflow

jobs.

For more information, see “Creating default profiles and updating workflow jobs” on page 146.4. Complete the post migration tasks.

For more information, see “Post migration tasks” on page 162.5. Review the new and changed features to check if there is anything that affects your installation after

migrating.


Exporting data from your current environmentYou can export your configuration items, OpenPages GRC Platform data, and the IBM Cognos contentstore to a migration file. During the migration, you point to this file and your settings are migrated to thenew version.

You can create a new migration file each time you perform an export or you can add more items to anexisting migration file. The migration file is automatically saved to the repository and can optionally besaved to a local client.

For more information about creating a migration file, see “Exporting OpenPages GRC Platform data” onpage 102 and “Exporting the Cognos content store” on page 103,

Creating the Oracle database schema and importing the databaseYou must create the database schema for IBM OpenPages GRC Platform version 6.0.1, then import theOpenPages 5.x database.

Before you begin

Ensure that the passwords for the Oracle database system, OpenPages, and workflow user accounts havenot expired.

Procedure

1. Open a Windows command prompt using the Run as Administrator option.2. Go to the OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory.


3. Create the database schema for version 6.0.1 by running the following script:

sqlplus /nolog @sql-wrapper.sql database-install.sqllog_file oracle_tns_alias dba_user dba_password workflow_user workflow_password op_user op_password datafile_storage_location

The following table describes the parameters that are passed to the SQL wrapper script.

Table 42: Descriptions of parameters that are passed to the SQL wrapper script



logfile.txt

oracle_tns_alias The database alias for theOpenPages database instance,as set during the Oracledatabase installation.

If necessary, you can retrievethis alias from thetnsnames.ora file.

OP



system


openpages



opworkflow


opworkflow

op_user The user name that is used byOpenPages to create and accessthe OpenPages databaseinstance

openpages

op_password The password for theOpenPages database useraccount.

openpages

datafile_storage_location

The storage location for the datafile.

c:\oracle\data\OP

Migrating OpenPages GRC Platform 137

Example:

sqlplus /nolog @sql-wrapper.sql database-install.sql db_upgrade.log OP system oppassword opworkflow opworkflow openpages openpages c:\oracle\data\OP

4. Log on as SYS using sqlplus and run the following script:


5. Navigate to the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64OP_version_Configuration\ Database\ORACLE\SCRIPTS directory and run the following scripts:

sqlplus workflow_user/workflow_password@Alias @sql-wrapper.sql AuroraDbDelete.sql dbdelete.log

sqlplus op_user /op_password@Alias @sql-wrapper.sql AuroraDbDelete.sql dbdelete.log

6. Copy the OpenPages 7.x database dump files to the OP_DATAPUMP_DIRECTORY folder.

You can check the location of the folder by running the following command:

select directory_path from all_directories where directory_name=OP_DATAPUMP_DIRECTORY;

7. Log on as SYSTEM using sqlplus to access the database server and run the following script:

grant read,write on directory OP_DATAPUMP_DIRECTORY to cognos;

8. Import files in this order using the following scripts:

• OpenPages 5.x database dump files.• Workflow database.• OpenPages database.• IBM Cognos content store.

impdp <username>/<password>@<SID> dumpfile=<File_name> directory=OP_DATAPUMP_DIRECTORY exclude=statistics

Attention: After the import is complete, you must gather table statistics for all objectsmanually.

Example: For an OpenPages database dump import using the Oracle Data Pump utility:

impdp openpages/openpages@OP dumpfile=OPENPAGES_2011_08_17_14_04_01.dmp directory=OP_DATAPUMP_DIRECTORY exclude=statistics

Example: For an OPWorkflow database dump import using the Oracle Data Pump utility:

impdp opworkflow/opworkflow@OP dumpfile=OPWORKFLOW_2011_08_17_14_04_01.dmp directory=OP_DATAPUMP_DIRECTORY exclude=statistics

Attention: When you import the IBM OpenPages GRC Platform or workflow database duringupgrade or migration, you may see an error as a result of the default data file size. For moreinformation, see “Issues when importing databases” on page 379.


If you choose to use the original database export and import option for the Cognos content storemigration, run this script:

imp system/<system_password>@<Alias> fromuser=<old_cognos_user> touser=<new_cognos_user> file=<7.x.dmp file location>\crn.dmp log=<log_file>

9. Upgrade the database schema to version 6.0.1.a) Update the ORACLE_HOME to include \bin\sqlplus in the path.

For example, on Windows, set the path to C:\app\OPDB\product\11.2.0\client_1\binb) Navigate to the OP_version_Configuration\Database\Oracle\Upgrade_Scripts\OpenPages-5.x-to-OpenPages-6.0.1.1\6.0.1\Action1 directory and run the followingscript:

On Windows: UpgradeDB.cmd

On UNIX: UpgradeDB.shc) Log on to the current OpenPages application server as a user with administrative privileges.d) Open a Windows command prompt using the Run as Administrator option, or a UNIX shell with

administrative privileges.

You must ensure that Java 1.7 for Linux is available.e) Navigate to the OP_version_Configuration\Database\Oracle\Upgrade_Scripts

directory, then open UpgradeDB.cmd or UpgradeDB.shf) Update JAVA_HOME to the Java 1.7 location.

Tip: For UNIX, use a non-root user, for example the user you created for the OpenPagesinstallation: opuser.

Example:

On Windows:

set JAVA_HOME="C:\IBM\WebSphere\AppServer\java_1.7.1_64"set PATH=$ANT_HOME/bin:$JAVA_HOME/bin:$PATH

On UNIX:

export JAVA_HOME="/opt/IBM/WebSphere/AppServer/java_1.7.1_64"export PATH=$ANT_HOME/bin:$JAVA_HOME/bin:$PATH

g) Run the following script:

On Windows:

OP_version_Configuration\Database\Oracle\Upgrade_Scripts\UpgradeDB.cmd

On UNIX:

/opt/OP_version_Configuration/Database/Oracle/Upgrade_Scripts/UpgradeDB.sh

h) Enter Y to start the script.

i) Enter Y to confirm that the information you entered is correct.j) Specify the version of OpenPages you are upgrading from:

• Enter 1 if you are upgrading from FCM 4.0.2.• Enter 2 if you are upgrading from 5.1.• Enter 3 if you are upgrading from 5.5.2.

k) Press any key to start the data migration.

When the script finishes, the OpenPages and workflow upgrade to version 6.0.1 is complete.


10. Copy the OpenPages storage directory from version 5.x to the target machine and update thedatabase to use new storage folder location.

For more information, see “Sharing a network OpenPages GRC Platform storage directory onWindows operating systems” on page 219 and “Sharing a network OpenPages GRC Platform storagedirectory on AIX or Linux operating systems” on page 221.

11. Apply the OpenPages 6.0.1.1 fix pack update.a) Navigate to the OP_version_Configuration\Database\Oracle\Upgrade_Scripts\OpenPages-5.x-to-OpenPages-6.0.1.1\6.0.1\Action2 directory and run the databaseonly portion.

b) Log on to a computer that has the SQL*Plus utility and access to the database server.c) Access the IBM OpenPages GRC Platform Patch Installer 6.0.1.1 installation media and copy theAction2\Database directory to a local directory.

d) Open a Windows command prompt, or a UNIX shell and navigate to the directory in containing thedatabase patch scripts. By default, the path is patch_copy_directory\Action2\Database

e) Update the workflow schema.

• Launch SQL*Plus as the workflow database user using the following command:

sqlplus workflow_user/workflow_password@SID

• Run the following script:

@OP-6-0-1-1-wfx-schema-upgrade.sql

• Log out of SQL*Plus.• Launch SQL*Plus as the OpenPages database user using the following command:

sqlplus op_user op_password@SID

• Run the following script:

@OP-6-0-1-1-opx-schema-upgrade.sql@advance_schema_version.sql 'OpenPages 6.0.1.1'@advance_application_version.sql 'OpenPages 6.0.1.1'

• Log out of SQL*Plus.

This step creates indexes automatically.

Results

The OpenPages and workflow upgrade to version 6.0.1.1 is now complete.

Updating the Oracle database schemaYou must manually update the database schema sequentially from version 6.x to version 7.2.

Before you begin



Procedure

1. Stop all OpenPages GRC Platform services.2. Log on to a computer that has the SQL*Plus utility and access to the database server.3. Extract the installation files from the OP_version DVD or from your network share location.


4. From the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS directory, find the sql-wrapper.sql file in each of thefollowing upgrade version directories:

• OP601X_TO_OP6100• OP610X_TO_OP6200• OP620X_TO_OP6210• OP621X_TO_OP7000• OP700X_TO_OP7100• OP710X_TO_OP7200

5. Update the sql-wrapper.sql file in each directory with the values for your OpenPages Administratorusername and password:


6. Run the following script from each directory in sequence.






logfile.txt



OP



system


openpages



opworkflow


Table 43: Descriptions of parameters that are passed to the SQL wrapper script (continued)



opworkflow


openpages


openpages

Example:


Migrating an OpenPages GRC Platform deploymentYou use the IBM OpenPages GRC Platform Administrative Console to migrate an OpenPages GRC Platformdeployment. Migrating requires you to create a new deployment, but you can import your settings from amigration file that is generated from your existing deployment.

The migration process moves your OpenPages content to new application servers, installs a newOpenPages CommandCenter with IBM Cognos Business Intelligence, and upgrades your databaseschema.

You can run the OpenPages Administrative Console deployment tasks multiple times in the event ofissues that occur during the deployment.


Before you begin

Ensure that the following conditions are met.

• The computers on which you install OpenPages GRC Platform components have the required softwareinstalled.

For more information about supported software versions for OpenPages GRC Platform, see “Softwareprerequisites” on page 13.

• The computers on which you install OpenPages GRC Platform components do not have a version ofOpenPages already installed.

• System admin mode is disabled

For more information, see “Disabling system admin mode” on page 115.• JAVA_HOME is set

Ensure that the JAVA_HOME environment variable points to IBM Runtime Environment for Java 1.7.3for OpenPages GRC Platform in the java_1.7.1_64 folder.

• If you are using Oracle, ensure that the password for the Oracle database system has not expired.• If the OpenPages and workflow database user accounts exist, ensure that the password for each

account has not expired.


• You installed the OpenPages Administrative Console on the computer from which you plan to installOpenPages components. For more information, see Chapter 8, “Installing the OpenPages GRC PlatformAdministrative Console,” on page 95.

• You installed OPAdminConsoleRemote on all application server, reporting server, and search servercomputers. For more information, see “Installing the OPAdminConsoleRemote component” on page 25.

• You have upgraded your IBM Cognos Business Intelligence environment.

Procedure


2. On the Welcome page, select Migrate deployment to 7.2 and click Start.3. Enter the values in the wizard for your deployment.








5. On the application server page, enter the information for the location where OpenPages GRCPlatform is to be deployed.

If you are using than one application server in your deployment (a horizontal clustered environment),you must enter the server information for the administrative server first, followed by each non-administrative server.


b) For the WebSphere Information group of properties, enter the settings.








Restriction: You cannot use a path that contains spaces.d) In the Modules Install Information section, ensure you select No Schema.e) In the OpenPages Migration Information section, enter full path location (including the file name

and extension) of the migration.zip file that you created from your existing version.

Ensure you copy the zip file to the computer where you are running the OpenPages AdministrativeConsole.

6. On the reporting server page, enter the information for your IBM Cognos Business Intelligenceinstallation.

Note: If you are using more than one reporting server in your deployment, enter the information forthe active server first followed by the standby servers.


b) For the CommandCenter Reporting Information group of properties, enter the settings for IBMCognos Business Intelligence and choose Command Center installation settings.





e) In the CommandCenter Migration Information section, enter the full path location (including thefile name and extension) of the migration.zip file that you created from your existing version.

The zip file contains the information needed to migrate from your existing version. Ensure youcopy the zip file to the computer where you are running the OpenPages Administrative Console.






























10. Click Finish to complete the migration.11. On the Next Steps tab, do the following:







What to do next

Some post-migration tasks are required. For more information, see “Post migration tasks” on page 162.





Creating default profiles and updating workflow jobsYou must create the default IBM WebSphere Application Server profiles and update the existing workflowjobs so they are compatible after upgrade.

Procedure

1. Go to the OP_Home\bin directory and run the following scripts:

• ProfileUpdateutility.cmd|.sh op_user op_passwordservername port

For example:

UpgradeJobTypesManager.cmd -Username OpenPagesAdministrator-Password OpenPagesAdministrator -Host server_hostname -Port 10101 (10201) -TxnTimeout 3600

ProfileUpdateUtility.cmdOpenPagesAdministrator OpenPagesAdministratorservername 10101

• UpgradeJobTypesManager.cmd|.sh -Username op_user -Password op_password -Host admin_host_name -Port OP_SOAP_port -TxnTimeout timeout

2. Restart the OpenPages services.


Migrate from OpenPages GRC Platform version 6To migrate IBM OpenPages GRC Platform from version 6.x to version 7.2, follow these steps.

Important: OpenPages GRC Platform does not support multiple installations on the same logical partition(LPAR) on AIX. If you are migrating on AIX, use a separate LPAR to avoid port conflict issues.




database.



For more information, see “Exporting data from your current environment” on page 136.• If you are using an IBM DB2 reporting server, drop the reporting schema.

For more information, see “Dropping the DB2 reporting schema” on page 102.2. Upgrade the software that is required for OpenPages GRC Platform.







• For more information about supported software versions, see “Software prerequisites” on page 13.3. Migrate the OpenPages application and databases.

• Create the WebSphere Application Server profiles for IBM Runtime Environment for Java forOpenPages GRC Platform.


• Create the reporting schema.

For more information, see “Create the reporting schema for the DB2 server” on page 103.• Import the version 6.x database and manually upgrade the OpenPages database schema.

For more information, see “Import the OpenPages GRC Platform database and upgrade databaseschema” on page 148.

• If you are migrating from version 6.2.1 using a DB2 database server, create the reporting schema.

For more information, see “Create the reporting schema for the DB2 server” on page 103.• Use the OpenPages Administrative Console to migrate your OpenPages deployment.





For more information, see “Migrating an OpenPages GRC Platform deployment” on page 142.4. Complete the post migration tasks.


migrating.


Import the OpenPages GRC Platform database and upgrade database schemaYou must import the IBM OpenPages GRC Platform database and manually update your database schemabefore you can migrate OpenPages GRC Platform.

Creating the Oracle database schema and importing the databaseYou must create the database schema for IBM OpenPages GRC Platform version 7.2, then import theOpenPages 6.x database.

Before you begin


Procedure

1. Open a Windows command prompt using the Run as Administrator option.2. Go to the OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory.3. Create the database schema for version 7.2 by running the following script:






logfile.txt



OP



system





openpages



opworkflow


opworkflow


openpages


openpages



c:\oracle\data\OP

Example:




5. Navigate to the OP_version_Configuration\ Database\ORACLE\SCRIPTS directory and runthe following scripts:




















9. Copy the OpenPages storage directory from version 6.x to the target machine and update the databaseto use new storage folder location.

For more information, see “Sharing a network OpenPages GRC Platform storage directory on Windowsoperating systems” on page 219 and “Sharing a network OpenPages GRC Platform storage directoryon AIX or Linux operating systems” on page 221.

Results

The OpenPages and workflow upgrade to version 7.2 is now complete.

Updating the Oracle database schemaYou must manually update the database schema sequentially from version 6.x to version 7.2.

Before you begin



Procedure

1. Stop all OpenPages GRC Platform services.2. Log on to a computer that has the SQL*Plus utility and access to the database server.3. Extract the installation files from the OP_version DVD or from your network share location.4. From the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration


\Database\ORACLE\UPGRADE_SCRIPTS directory, find the sql-wrapper.sql file in each of thefollowing upgrade version directories:

• OP601X_TO_OP6100• OP610X_TO_OP6200• OP620X_TO_OP6210• OP621X_TO_OP7000• OP700X_TO_OP7100• OP710X_TO_OP7200



6. Run the following script from each directory in sequence.






logfile.txt



OP



system


openpages



opworkflow





opworkflow


openpages


openpages

Example:



Procedure





Procedure




For example, type




Updating the IBM DB2 database schemaYou must manually update the database schema sequentially from version 6.x to version 7.2.


Before you begin



Procedure


server.3. From the \OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts directory, find thesql-wrapper.sql file in each of the following directories:

• OP620X_TO_OP6210• OP621X_TO_OP7000• OP700X_TO_OP7100• OP710X_TO_OP7200



5. Run the following script from each directory in sequence:










The following table describes the DB2 parameters that are passed to the CLPPlus wrapper script.


Table 46: Descriptions of DB2 parameters that are passed to the CLPPlus wrapper script


log_file The log file name that the scriptcreates and writes informationto.

logfile.txt



50000



db2admin


openpages



opworkflow


opworkflow


openpages


openpages

Results



Migrate from OpenPages GRC Platform version 7To migrate IBM OpenPages GRC Platform from version 7.0.0.x or 7.1.x to version 7.2 follow these steps.

Important: OpenPages GRC Platform does not support multiple installations on the same logical partition(LPAR) on AIX. If you are migrating on AIX, use a separate LPAR to avoid port conflict issues.


• Back up the OpenPages GRC Platform database and application files and directories.



database.



For more information, see “Exporting data from your current environment” on page 136.• If you are using an IBM DB2 reporting server, drop the reporting schema.

For more information, see “Dropping the DB2 reporting schema” on page 102.2. Upgrade the software that is required for OpenPages GRC Platform.







For more information on supported software versions, see “Software prerequisites” on page 13.3. Migrate the OpenPages application and databases.

• Create the WebSphere Application Server profiles for IBM Runtime Environment for Java forOpenPages GRC Platform.


• If you are migrating from a DB2 database server, create the reporting schema.

For more information, see “Create the reporting schema for the DB2 server” on page 103.• Import the version 7.0.0.x or 7.1.x database and manually upgrade the OpenPages database

schema.

For more information, see “Import the OpenPages GRC Platform database and upgrade databaseschema” on page 156

• Use the OpenPages GRC Platform Administrative Console to migrate your OpenPages deployment.

For more information, see “Migrating an OpenPages GRC Platform deployment” on page 142.4. Complete the post migration tasks.


migrating.






Import the OpenPages GRC Platform database and upgrade database schemaYou must import the IBM OpenPages GRC Platform database and manually update your database schemabefore you can migrate OpenPages GRC Platform.

Creating the Oracle database schema and importing the databaseYou must create the database schema for IBM OpenPages GRC Platform version 7.2, then import theOpenPages 7.x database.

Before you begin


Procedure

1. Open a Windows command prompt using the Run as Administrator option.2. Go to the OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory.3. Create the database schema for version 7.2 by running the following script:






logfile.txt



OP



system


openpages



opworkflow





opworkflow


openpages


openpages



c:\oracle\data\OP

Example:




5. Navigate to the OP_version_Configuration\ Database\ORACLE\SCRIPTS directory and runthe following scripts:




















9. Copy the OpenPages storage directory from version 7.x to the target machine and update the databaseto use new storage folder location.

For more information, see “Sharing a network OpenPages GRC Platform storage directory on Windowsoperating systems” on page 219 and “Sharing a network OpenPages GRC Platform storage directoryon AIX or Linux operating systems” on page 221.

Results

The OpenPages and workflow upgrade to version 7.2 is now complete.

Updating the Oracle database schemaYou must manually update the database schema from version 7.0.0.x to version 7.2.

Before you begin



Procedure

1. Stop all OpenPages services.2. Log on to a computer that has the SQL*Plus utility and access to the database server.3. Extract the installation files from the OP_version DVD or from your network share location.4. From the \WIN64-OP_version\OpenPages\Win64\OP_version_Non_Embedded_WAS_Oracle_DB2_WIN64\OP_version_Configuration\Database\ORACLE\UPGRADE_SCRIPTS directory, find the sql-wrapper.sql file in each of thefollowing directories:

• OP700X_TO_OP7100• OP710X_TO_OP7200




6. Run the following script from each directory in sequence:






logfile.txt



OP



system


openpages



opworkflow


opworkflow


openpages


openpages

Example:




Procedure





Procedure




For example, type




Updating the IBM DB2 database schemaYou must manually update the database schema from version 7.0.0.x to version 7.2.

Before you begin




Table 49: Description of DB2 parameters


log_file The log file name that the scriptcreates and writes information to.

logfile.txt



50000



Table 49: Description of DB2 parameters (continued)



db2admin


openpages


This account is used byOpenPages GRC Platform tocreate and access the workflowdatabase, and to manageworkflow-related transactions.

opworkflow


opworkflow

op_user The user name that is used tocreate and access the OpenPagesGRC Platform database instance

openpages

op_password The password for the OpenPagesGRC Platform database useraccount.

openpages

Procedure


server.3. Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\ directory, and copy

each of the following directories to the database server:

• OP700X_TO_OP7100• OP710X_TO_OP7200



5. Update the database schema to version 7.1.a) Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\OP700X_TO_OP7100 directory.

b) Run the following script:











6. Update the database schema from version 7.1 to version 7.2.a) Go to the OP_version_Upgrade_WIN64\OP_version_Upgrade_Scripts\OP710X_TO_OP7200 directory.

b) Repeat step 5b to run the script.

Results



Post migration tasksComplete the following tasks after migrating IBM OpenPages GRC Platform.

• Export the topology.xml file so that you can use it for installing future upgrades and fix packs. Topreserve the session logs to help with diagnosing and debugging installation issues, export thedeployment, which includes the toplology.xml file.


• Copy the IBM Global Security Kit files to the IBM DB2 server installations.

This task is required if you are using DB2 for the database server on Windows operating systems. Formore information, see “Copying the IBM Global Security Kit files to the DB2 server installations onWindows operating systems” on page 173.

• Move the migration services and custom implementation files from the source computer to the targetcomputer.

• Enable LDAP if it is configured in the source system.

For information, see “Enabling LDAP” on page 183.• Enable single sign-on if it is configured in the source system.

For more information, see “Enabling single sign-on” on page 240.• Load the OpenPages Operational Risk Management reports.


This task is required if you are migrating from OpenPages GRC Platform versions 6.0 or 6.1 only, and youpreviously installed IBM OpenPages Operational Risk Management. For more information, see “LoadingOpenPages GRC Platform ORM reports” on page 163.

• “Load the OpenPages ORM data” on page 126.

This task is required if you are migrating from OpenPages GRC Platform versions 7.0, 7.0.0.1, 7.0.0.2 or7.0.0.3 only, and you previously installed IBM OpenPages Operational Risk Management.

• Configure the Process Analysis visualization report for users.

For more information, see “Configuring the Process Analysis Visualization report to launch” on page130.

• If you installed a search server, you must also complete some post installation tasks.

For more information, see “Search server post installation tasks” on page 185.• Clean up the trigger configuration file so that it contains only your custom triggers. This task is optional.

For more information, see “Removing standard triggers from the trigger configuration file” on page 131.• If you previously installed IBM OpenPages IT Governance, you must also complete some post migration

tasks.

For more information, see “OpenPages solutions post installation tasks” on page 132.

Loading OpenPages GRC Platform ORM reportsIf you migrated IBM OpenPages GRC Platform from versions 6.0 or 6.1, and you previously installed IBMOpenPages Operational Risk Management, you must manually deploy an IBM Cognos deployment archiveon the reporting server.

Restriction: To move a deployment archive, you need access to the installation directories on thecomputer where IBM Cognos Business Intelligence is installed. This location is set in the configurationtool. The default location is Cognos_HOME/deployment.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Go to the OP_version_Configuration\Reports directory.3. Copy the DrillUpDrillDownReportsWithUpdatedDrilling.zip andDrillUpDrillDownReportsWithFullDrilling.zip files to the IBM Cognos deploymentdirectory.

The default location is the Cognos_HOME\deployment directory.4. From the command prompt, go to the CC_HOME\temp\bin directory.

The default location is the OP_HOME/CommandCenter/temp/bin directory.5. Type the following command:

importReports.bat -a DrillUpDrillDownReportsWithUpdatedDrilling -s OpenPagesSecurityRealm -u <username> -p <password> -g http://<Cognos_server>:<dispatcher_port>/p2pd/servlet/dispatch

Results

You can access the reports in IBM Cognos Connection.


Configuring the Process Analysis Visualization report to launchYou must complete the following steps to ensure that users can view the Process Analysis Visualizationreport in IBM OpenPages GRC Platform.

Procedure

1. Log on to the OpenPages application interface as a user with administrative privileges.2. Click Administration > Settings > Platform > Reporting Schema > Object URL Generator > Host.3. Update the Application Server Host Name value of the host name for the target server where IBM

Cognos Business Intelligence and CommandCenter are running.4. Re-create the reporting schema.

For more information, see “Creating the reporting schema and framework” on page 174.


Chapter 11. Installing a new OpenPages GRCPlatform deployment

Use the Administrative Console to deploy IBM OpenPages GRC Platform to WebSphere Application Server.You can select either IBM DB2 or Oracle as the database for OpenPages.

Use the OpenPages Administrative Console to install or configure the following components:

• OpenPages application to an existing installation of WebSphere Application Server.• OpenPages workflow server and notification components.• OpenPages database schema to an existing installation of IBM DB2.• OpenPages CommandCenter to an existing installation of IBM Cognos Business Intelligence.


Before you begin

Ensure that you have completed the pre-installation tasks required before you deploy OpenPages GRCPlatform. For more information, see Chapter 4, “Preparing your system for installation,” on page 19.

If you are using IBM DB2 for your OpenPages repository:

• Ensure that Oracle compatibility mode is set for the DB2 database instance that is used for theOpenPages repository.

To check whether Oracle compatibility mode is set, run the following command as a DB2 user:

db2set DB2_COMPATIBILITY_VECTOR ORA

If Oracle compatibility mode is not set, the following message is shown:

db2set DB2_COMPATIBILITY_VECTOR DBI1303W Variable not set.• The DB2 client software and DB2 Text Search component are installed.

If you are using Oracle for your OpenPages repository:

• The Oracle Admin client software is installed.• Ensure that the database instance for the OpenPages repository is created.• Ensure that the Oracle database password for the system and sys users have not expired.• If the OpenPages, workflow and Cognos database user accounts exist, ensure that the Oracle database

password for each of these accounts has not expired.

Procedure

1. If you are using IBM DB2, on AIX and Linux operating systems, ensure that DB2_HOME/bin directoryis in the PATH environment variable .profile file of the OpenPages installation user.

export DB2_HOME=<DB2_HOME>. $DB2_HOME/db2profile


3. If the license agreement is displayed, accept the terms and click OK.4. From the Welcome page, click Create a new deployment, and click Start.5. Enter the values in the wizard for your deployment.








7. On the application server page, enter the information for the location where OpenPages GRCPlatform is to be deployed.a) The Connection Information is used for your OPAdminConsoleRemote port number on the target

computer. The default port number is 9091.b) For the WebSphere Information group of properties, enter the settings.







Restriction: You cannot use a path that contains spaces.

Important: For AIX and Linux operating systems, ensure that the WebSphere Application Serverinstallation user account has read, write, and execute permissions for the IBM OpenPages GRCPlatform installation files. For simplicity, use the WebSphere Application Server user account toinstall and run the OpenPages application server installation.

Restriction: Install OpenPages and Fujitsu Interstage BPM software into a directory that containsonly ASCII characters in the path name. The installation path must be the same on the administrativeserver and all non-admin servers.

8. For AIX installations, ensure that the 32 bit JRE directory property points to the location of a 32-bitJava Runtime Environment (JRE).

Tip: To check the version of the JRE:

• Ensure that JAVA_HOME is not set.• Go to the JRE_HOME/bin directory.• Type the following command: java -version


9. On the reporting server page, enter the information for your IBM Cognos Business Intelligenceinstallation.a) The Connection Information is used for your OPAdminConsoleRemote port number on the target

computer. The default port number is 9091.b) For the CommandCenter Reporting Information group of properties, enter the settings for IBM

Cognos Business Intelligence and choose Command Center installation settings.



















Installing a new OpenPages GRC Platform deployment 167















13. Click Finish.14. On the Next Steps tab, do the following:







16. When the installation is complete, export the topology.xml file so that you can use it for installingfuture upgrades and fix packs.

To preserve the session logs to help with diagnosing and debugging installation issues, export thedeployment, which includes the toplology.xml file.


What to do next

Some post-installation tasks are required. For more information, see Chapter 12, “Post installation tasks,”on page 173.





Granting control on SYSTOOLS schema objects to the DB2 database instanceowner on the Windows operating system

After you install IBM OpenPages GRC Platform on Windows operating systems, if the OpenPagesinstallation user is not the same as the DB2 instance owner, the OpenPages installation user must run thedba-grant.sql script. The script explicitly grants control on SYSTOOLS schema objects to DB2database instance owner.

Procedure

1. Log on to the OpenPages GRC Platform application server as the OpenPages installation user.

The OpenPages installation user is the user account that runs the OpenPages Administrative Console.2. Start the DB2 command line processor.

On Windows operating systems, from the command prompt, type db2cmd, or from the Start menu,click All Programs > DB2COPY1 > Command Window - Administrator.

3. Go to the /OP_version_Configuration/Database/DB2/INSTALL_SCRIPTS directory.4. Run the dba-grant.sql script



• password variable is the password of the OpenPages installation user.• instance.owner.username variable is the DB2 database instance owner (the user who creates the

database instance).


The script explicitly grants control on the SYSTOOLS schema objects to DB2 database instance owner.


Testing the connections to the database server and the OpenPages GRCPlatform repository

Test whether the SQL*Net connect string can connect to the database listener by using the TNSPINGutility in the ORACLE HOME/bin directory. The TNSPING utility tests whether the listener is available. Itdoes not test whether the databases behind the listener are working.

To test that the IBM OpenPages GRC Platform repository is created, use SQL*Plus to log on to theOpenPages Oracle database schema.

Procedure

1. To test whether you can log on to Oracle Enterprise Manager Database Control, the web-basedinterface that is used to administer an Oracle database, type the following command:

https://oracle_server_name:port/em


If you are using Oracle 12.1.0.2, the default port number is 5500.2. To test whether a SQL*Net connect string can connect to the listener, type the following command:

tnsping database_instance_name

The utility requests acknowledgement that the service name is valid and that the listener is configuredto handle requests for that service name.

If the configuration is correct, a message is displayed that shows the return time.

If the configuration is not correct, the utility returns an error message. Ensure that you use the correctservice name and that the listener is started on the server computer.

3. To test that the OpenPages repository is created, type the following command:




Installing the OpenPages GRC Platform solutionsYou can install the IBM OpenPages GRC Platform solutions at the same time as you install the OpenPagesGRC Platform application, or separately. The installer updates the application servers and the reportingservers with the metadata, reports, report packages, and profiles.

Preparing the system for installationBefore you install the IBM OpenPages GRC Platform solutions, complete the following pre-installationtasks.

Procedure

1. If you have already installed the OpenPages GRC Platform application, drop the reporting schema.

For more information, see “Dropping the DB2 reporting schema” on page 102.2. Ensure that you have the following information available:

• Risk Assessment Method: Qualitative or Quantitative• Risk Matrix Setup: Total Likelihood Count and Total Impact Count

The Total Likelihood Count identifies the scale of inherent and residual risk likelihood.


The Total Impact Count identifies the scale of inherent and residual risk impact.

The count that is specified determines the number of choices available for inherent and residualimpact and likelihood fields in the risk object. For example, if Total Impact Count is set to 4, thenavailable choices for Inherent Impact, Residual Impact, Audit Inherent Impact, and Audit ResidualImpact are: 1, 2, 3, 4.

During installation, you set the likelihood count and the impact count. You can then modify thesesettings at a later time. Likelihood count is called YMAX in the registry settings and impact count iscalled XMAX. For more information, see the IBM OpenPages GRC Platform Solutions Guide.

3. Optional: Back up your existing installation, including the OpenPages database.

For information about backing up an application and database, see the topics related to backup andrestore utilities for DB2 and Oracle in the IBM OpenPages GRC Platform Administrator's Guide.

Installing the OpenPages GRC Platform solutions dataInstall IBM OpenPages GRC Platform solutions on the Admin server for deployment on all applicationservers.

Procedure

1. Start the OpenPages GRC Platform Administrative Console, and select Deployment > Topology.2. Open the topology that you created for the OpenPages application.3. On the Topology tab, click Change Settings for the application server.4. On the Deployment page, update the Modules Install Information group of properties.

a) To install the OpenPages solutions data, select Default Schema on the admin server.b) Select the assessment method, Qualitative or Quantitative.c) To set up the risk matrix, enter the Total Likelihood Count and Total Impact Count.

5. Click Finish.6. Open the Reporting Server page to continue creating the deployment, or click Calculate Next Steps

to determine if you can proceed with the deployment, and correct any errors in your configuration.

Results

The installation might take several minutes to complete.

To confirm that the installation is successful, check the Status tab and review any log files.

When the installation is complete and you confirm the log files, test the installation. Refer to “Testing theOpenPages GRC Platform solutions installation” on page 171.

Testing the OpenPages GRC Platform solutions installationAfter you install IBM OpenPages GRC Platform solutions, verify that the installation is successful.

Procedure

1. Restart all the services.2. Log on to the OpenPages application.

The home page displays more menus. Each menu contains a list of object types.

Updating the reporting schema and reporting frameworkTo install the IBM OpenPages GRC Platform solutions default schema, you must create the reportingschema and update the reporting framework.

Procedure



http://openpages_server:port/openpages2. Log on to the application as a user with administrative privileges.3. For System Admin Mode, switch from Disabled to Enabled.

4. From the menu bar, click Administration and select Reporting Schema.5. Click Create.6. After the create operation finishes, click System Admin Mode to switch from Enabled to Disabled.7. From the menu bar, click Administration > Reporting Framework > Generation.8. On the Reporting Framework Operations page, click Update.9. In the Reporting Framework Generation window, under Framework Generation, select the



The Percent Complete column on the Reporting Framework Operations table updates thepercentage of completion.

Configuring the temporary folder for reports and notificationsIBM OpenPages GRC Platform reports and notifications use a temporary folder that is configured by thecognos.report.output.dir property in the aurora.properties file. Ensure that the folder is created inthe location specified by the property.

Procedure

1. On the application server, go to the \OpenPages\aurora\conf directory.2. Open the aurora.properties file in a text editor.3. If required, update the cognos.report.output.dir setting.4. Save your changes and close the file.5. If you changed the cognos.report.output property, restart the OpenPages services.


Chapter 12. Post installation tasksAfter you install or upgrade the IBM OpenPages GRC Platform, you must perform some post installationtasks, such as configuring the OpenPages CommandCenter.

You can also modify the installation environment to improve performance, enhance security, or changedefault settings. For example, you can tune the application servers or configure LDAP.

As part of the post installation tasks, you can configure OpenPages GRC Platform to use Secure SocketsLayer (SSL) to ensure that all data passed between the application server and a browser remains private.

For information about SSL configurations and about addition configurations, such as adding a member toa cluster or changing port numbers, see the IBM OpenPages GRC Platform Administrator's Guide.

Backing up and restoring the Administrative Console workspaceYou can back up the IBM OpenPages GRC Platform Administrative Console workspace and restore it toanother system. The workspace includes session logs and the topology.xml file.

Procedure

1. Start the OpenPages Administrative Console on the source system that you want to back up.

Click Start > All Programs > IBM OpenPages GRC Platform > IBM OpenPages GRC Platform -Administrative Console.

2. To export the topology click File > Export Topology. Select the folder in which to save the topologyand type a name for the file.

To export the full deployment, which includes the topology file and all session log data in acompressed file, click File > Export Deployment. Select the folder in which to save the deploymentdata and type a name for the compressed file.

3. Copy the zip file to a folder on the target system to which you want to restore the workspace.

Ensure the folder does not contain any other files.4. Start the OpenPages Administrative Console on the target system.5. Click File > Import Deployment, and select the zip file.6. Click OK.7. When the import is complete, click the Change Settings icon on each page, and update all passwords

as required.

OpenPages GRC Platform CommandCenter post installation tasksAfter you install IBM OpenPages GRC Platform CommandCenter, some post installation tasks arerequired. You must update the CommandCenter configuration files to ensure that OpenPages componentscan communicate with each other.

Copying the IBM Global Security Kit files to the DB2 server installations on Windowsoperating systems

On Windows operating systems, you must copy the 32-bit version of the IBM Global Security Kit (GSK)files to the DB2 server instance location. You must copy the files before you generate the reportingframework.

Procedure

1. Log on to the database server computer.

2. Go to the DB2_HOME\bin directory for the IBM OpenPages GRC Platform database instance andcreate a folder named icc.

3. Copy the contents of the C:\Program Files (x86)\IBM\gsk8\lib directory to the DB2_HOME\bin\icc directory.

Starting the OpenPages GRC Platform Framework Model Generator service on WindowsAfter you install IBM OpenPages GRC Platform, you must complete the following steps to start theFramework Model Generator service on a Microsoft Windows operating system.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Open a command prompt, and navigate to the following folder:

CommandCenter_Home\wlp\bin

3. To stop the service, type the following command: Server.bat stopIBMOpenPagesFrameworkModelGenerator

Wait until this message is shown before you move to step 4:

Stopping server IBMOpenPagesFrameworkModelGenerator.ServerIBMOpenPagesFrameworkModelGenerator stopped.

4. Start the service.

• To start the service from the command prompt, type the following command: net startIBMOpenPagesFrameworkModelGenerator

• To start the service from Windows:

a. Click the Windows Start menu and select All Programs.b. From the Administrative Tools list, select Services.c. To start the service, right-click the IBMOpenPagesFrameworkModelGenerator service and

select Start.

Results

If you started the service from Windows, the status changes to "Running". If you started the service fromthe command prompt, you see this message:

The IBMOpenPagesFrameworkModelGenerator service is starting.The IBMOpenPagesFrameworkModelGenerator service was started successfully.

You can also view the IBM WebSphere Liberty Profile log files in the CommandCenter_Home\wlp\usr\servers\IBMOpenPagesFrameworkModelGenerator\logs folder to check that the OpenPagesFramework Model application loaded correctly.

Creating the reporting schema and frameworkTo see the default IBM OpenPages GRC Platform reports, you must create a reporting schema and updatethe reporting framework.

Before you beginIf you are using clustered environments, ensure you have configured them before you create the reportingschema and framework. For more information, see Chapter 16, “Configure clustered environments,” onpage 217.

Procedure








Results

Updating the reporting framework process takes approximately 30 minutes or longer.

What to do next

You must drop the reporting schema before you install the OpenPages GRC Platform solutions.

OpenPages GRC Platform CommandCenter portal securityAfter installation, you can restrict which user groups are allowed to modify reports. To grant IBMOpenPages GRC Platform CommandCenter administrative rights, create a group in the OpenPagesapplication or use an existing group, such as OPAdministrators. This is optional.

OpenPages standard reports can be overwritten during an upgrade. If you want to modify these standardreports, copy them to your personal folders. From your folders, you can then change the reports andrestrict access to them.

To restrict user access to administrative functions within the Cognos portal, use IBM CognosAdministration. To prevent users from deleting, changing, or saving reports, restrict access to theOpenPages reports that are in Public Folders. You can also restrict users from running reporting tools,such as Report Studio, or from modifying reports.


Creating an open session command block for the OpenPages GRC Platform data sourceFor IBM OpenPages GRC Platform to work, you must create an open session command block for theOpenPages data source.

Procedure

1. In the Internet Explorer browser, type the following URL:

http://cognos_server_name/ibmcognos2. Open IBM Cognos Administration:

a) If the Cognos Welcome page is displayed, click Administer IBM Cognos Content.b) If the IBM Cognos Connection is displayed, click Launch > IBM Cognos Administration.

3. On the Configuration tab, click Data Source Connections.4. Click More next to OpenPages DataSource.5. Click Set properties.

Post installation tasks 175

6. Select the Connection tab.7. Next to the Open session commands, click Set.8. In the XML database commands box, copy the following text:

<commandBlock><commands><sqlCommand><sql>begin OP_SESSION_MGR.SET_ACTOR_ID_PRIVATE (#$account.parameters.openPagesUserId#);end;</sql></sqlCommand></commands></commandBlock>

9. Click OK to save your changes.

Configuring OpenPages GRC Platform to work on a single computer with anOracle database

For test and development environments, you can install IBM OpenPages GRC Platform, the Oracledatabase, the 32-bit Oracle Admin Client, and Cognos Business Intelligence on a single computer.However, some configuration is required.

About this task

You can install the IBM OpenPages GRC Platform on a single computer for predeployment testing or proofof concept demonstrations. For single computer installations, ensure that the correct Oracle Admin Clientis used by each software component.

If you install OpenPages GRC Platform on a single server, you must install two versions of Oracle AdminClient. Both the 32-bit and 64-bit versions are required. The OpenPages application requires the 64-bitOracle Admin Client and the Cognos Business Intelligence Software requires the 32-bit Oracle AdminClient.

Procedure

1. Log on to the Cognos server as a user with administrative privileges.2. Ensure that the ORACLE_HOME environment variable points to the 32-bit Oracle Admin Client.3. Edit the PATH variable to add %ORACLE_HOME%\bin.4. If set, remove the TNS_ADMIN variable.5. From the command line, go to the OP_Home\CommandCenter\framework\conf\ directory.6. Open the framework.properties file in a text editor and ensure that the oracle.client.path property

contains the location of the 32-bit Oracle Admin client bin directory.7. Save and close the file.8. Restart the OpenPages GRC Platform CommandCenter service.


Configuring OpenPages GRC Platform to work on a single computer with aDB2 database

For test and development environments, you can install IBM OpenPages GRC Platform, DB2 database, the32-bit DB2 Client, and Cognos Business Intelligence on a single computer. However, some configurationis required.

About this task

You can install the OpenPages GRC Platform on a single computer for predeployment testing or proof ofconcept demonstrations. For single computer installations, ensure that the correct DB2 Client is used byeach software component.

If you install OpenPages GRC Platform on a single server, you must install the 32-bit DB2 client on thereporting server. The OpenPages application requires the 64-bit DB2 Client and the Cognos BusinessIntelligence Software requires the 32-bit DB2 Client.

Procedure

1. Log on to the Cognos server as a user with administrative privileges.2. From the command line, go to the OP_Home\CommandCenter\framework\conf\ directory.3. Open the framework.properties file in a text editor and ensure that the oracle.client.path property

contains the location of the 32-bit DB2 client bin directory.4. Save and close the file.5. Restart the OpenPages GRC Platform CommandCenter service.

Verification checklistAfter you install the IBM OpenPages GRC Platform application, verify that the installation is working asexpected.

Use the following checklist to verify whether the installation is successful.

Table 50: Post installation verification checklist

Task Guidance

Review all installation logs for errors. For log file locations and names, see “Log files” onpage 363.

Verify that the database parameters arecorrect.

Review the database parameters, such as Characterset=AL32UTF8 and NLS_LENGTH_SEMANTICS=CHAR,to ensure that they are correct.

Verify that a backup copy of the system wasmade after the installation.

If it does not exist, create a backup of your system byrunning the OPBackup command from OP_HOME\aurora\bin directory.

Verify that a compressed file was created with thecorrect time stamp. The file is in the OP_Home\openpages-backup-restore directory.

For information about on using the backup utility, seethe IBM OpenPages GRC Platform Administrator'sGuide.


Table 50: Post installation verification checklist (continued)

Task Guidance

Confirm that the reporting schema andframework that is generated successfully.

For more information, see “Creating the reportingschema and framework” on page 174.

Confirm that base reports are functioning asexpected.

Log on to the OpenPages application and run the AllDocumentation Cognos report.

If single signon (SSO) is enabled, verify thatuser accounts can access the environment.

Log on to the OpenPages application with an SSO useraccount.

If you use TeamMate, confirm that theTeamMate loader-files are implemented andworking.

Test the integration from the TeamMate client.

Confirm that you can upload and downloadsample attachments.

Log on to the OpenPages application and upload anddownload a file attachment.

Verify that links in reports reference the correctserver address and use the correct web URLparameters.

Run a report that uses OpenPages links. Select a linkand confirm that the target object is renderedsuccessfully in the OpenPages interface.

For clustered environments, verify that allservers can upload and download attachments.

Upload and download files from both primary andsecondary application servers.

For load-balanced environments, confirm thatbackup scheduling is working.

Before you restart services on the secondaryserver, make sure that the admin service on theprimary server is started.

On primary and secondary servers, verify backupscheduling and process times.

Test that you can access the IBM CognosBusiness Intelligence portal.

Type the following web URL:

http://server_name/ibmcognos

Confirm that you can log on to the portal.

Confirm that you ran the enable-session-sleep.sql script.

For more information, see “Preventing concurrencyconflicts for installations that use Oracle databases”on page 180.

After backup, confirm that object data iscreated.

Log on to the OpenPages application and createsample Entity, Process, and Risk objects. Delete theseobjects.


Administrative server tuningYou can tune your admin server settings to improve performance.

Enable simultaneous access to OpenPages GRC Platform and Fujitsu Interstage BPMBy default, the IBM WebSphere Application Server does not allow a user to log on to IBM OpenPages GRCPlatform and the Fujitsu Interstage BPM console concurrently. Some configuration is required to allowone user to simultaneously access both applications.

For more information, see “Configuring OpenPages GRC Platform to allow simultaneous access” on page179 and “Configuring Fujitsu Interstage BPM to allow simultaneous access” on page 179.

Configuring OpenPages GRC Platform to allow simultaneous accessYou must configure IBM OpenPages GRC Platform to allow a user to log on to OpenPages applications andFujitsu Interstage BPM at the same time.

Procedure

1. Open a web browser.2. Enter the following URL in the IBM Integrated Solutions Console for the OpenPages GRC Platform

server.

http://OP_server_name:port/ibm/console/

The port is assigned during installation. By default the port used is 9060.

Warning: Do not use localhost for the OP_server_name.3. Click Servers > Server Types > WebSphere application servers.4. On the Application servers page, for each OpenPages GRC Platform server listed:

a) Click the application server you want to configure.b) Enter the WebSphere administrator user name and password.c) On the OpenPages-server-name page, click the Configuration tab.d) Under Container Settings, expand Web Container Settings and then click Web container.e) On the Web container page, click Session management.f) Under Session tracking mechanism, click Enable cookies.g) On the Cookies page, enter opsosa in the Cookie name field.h) Click Apply.i) To commit the changes to the master configuration, in the Messages box, click Save.j) Click OK.

What to do nextYou must also configure Fujitsu Interstage BPM. For more information, see “Configuring Fujitsu InterstageBPM to allow simultaneous access” on page 179.

Configuring Fujitsu Interstage BPM to allow simultaneous accessYou must configure Fujitsu Interstage BPM to allow a user to log on to IBM OpenPages GRC Platformapplications and Fujitsu Interstage BPM at the same time.

Procedure

1. Open a web browser.


2. Type the following URL:

http://OP_server_name:port/ibm/console/

3. Expand Servers > Server Types.4. Click WebSphere application servers from the list.5. On the Application servers page, for each OpenPages server listed:

a) Click the application server you want to configure.b) On the OpenPages-server-name page, click the Configuration tab.c) Under Container Settings, expand Web Container Settings and then click Web container.d) On the Web container page, click Session management.e) Under Session tracking mechanism, click Enable cookies.f) On the Cookies page, enter opibpm in the Cookie name field.g) Click Apply.h) To commit the changes to the master configuration, in the Messages box, click Save.i) Click OK.

What to do nextYou must also configure the OpenPages GRC Platform application. For more information, see “ConfiguringOpenPages GRC Platform to allow simultaneous access” on page 179.

Preventing concurrency conflicts for installations that use Oracle databasesIf two administrators both try to modify settings at the same time, errors might occur. To help avoidconcurrency errors, run the SQL enable-session-sleep.sql script.

A concurrency conflict might result in the following error message:Operation failed, security settings are being concurrently modified by another administrator. Please try again later.

Procedure

1. On a computer that has SQL*Plus and access to the database server, log on as a user with SYSDBApermissions.

2. From the Installer DVD or from your network share location, copy the /OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory to the localsystem.

3. Run the enable-session-sleep.sql script.

On a command line, use the following syntax:

sqlplus /nolog @sql-wrapper enable-session-sleep.sql <log_file_name> <connect_identifier> <sysdba_user_name> <sysdba_user_password> <schema_owner_name>

Example:

sqlplus /nolog @sql-wrapper enable-session-sleep.sql enable-session-sleep.log opx10g sys manager openpages

If the process completes successfully, a message is displayed.

If the script fails, check the log files for error messages.


Optional: Increasing the paging file size on Windows computersOn computers that have 4 GB of RAM, the suggested paging file size is 8 GB.

Procedure

1. Click Start > Run and then type sysdm.cpl, and press Enter.2. Click the Advanced tab, and then in the Performance section, click Settings.3. In the Performance Options window, in the Virtual Memory section, click the Advanced tab, and then

click Change.4. Find the list of drives and select the drive that contains your paging file.

Note: If necessary, clear the Automatically manage page file size for all drives check box.5. Under Paging File Size, select Custom Size.6. Reset both the Initial Size and Maximum Size values to higher values.7. Click Set.8. Click OK.

Optional: Increasing the paging file size on AIX computersOn computers that have 4 GB of RAM, the suggested paging file size is 8 GB.

Procedure

1. On AIX computers, open a shell as user with administrative privileges.2. Type the following command to change the attributes of the paging space:

chps -s LogicalPartitions <PagingSpace_Name>

For example, the following command adds four logical partitions to the pgspce paging space:

chps -s 4 pgspce

Database server tuningTo improve performance, tune the Oracle database. You must change some of default values for Oracleserver parameters. Other changes are suggested in environments where there are heavy user loads.

Tuning the performance of the database instanceTo improve the performance of the Oracle database instance, disable the Oracle skip scan feature and setcursor sharing to force.

The Oracle skip scan feature splits a composite index logically into smaller subindexes. In skip scanning,the initial column of the composite index is not specified in the query. In other words, it is skipped. Forlarger databases where the data changes frequently, skip scanning can be less efficient than a range scan.

The cursor sharing feature specifies how SQL statements are parsed. Issuing many SQL statements thathave literal values can result in many nearly identical statements in the cache. The large result set canslow performance and cause latch problems. Setting cursor sharing to force causes the SQL statementsto be reused if the text is similar except for the literal value.

Procedure

1. Log on to a computer with SQL*Plus and access to the database server.

Note: For AIX installations, use opuser user or another non-root user.2. From the command-line, log on to SQL*Plus.

sqlplus sys/sys_password@SID as sysdba


3. At the SQL prompt, type the following command:

alter system set "_optimizer_skip_scan_enabled"=false scope=both;alter system set cursor_sharing = force scope=both;

4. Log out from SQL*Plus.

Memory tuning guidelines for Oracle databasesIf your application is running in a heavy-load environment, consider allocating as much memory aspossible to the Oracle database instance.

The following table provides general guidelines for memory allocation on a system with 8 GB of RAM ormore.

Table 51: Memory Tuning Guidelines for computer with 8GB of RAM

For this... Allocate...

Operating system 2 GB of physical RAM for the Windows OS.

SGA Size 75% of remaining physical RAM to the SGA_TARGET parameter.

Minimum allocation: 4608 MB (or 4.5 GB).

PGA Size 25% of remaining physical RAM to the PGA_AGGREGATE_TARGETparameter.

Minimum allocation: 1536 MB (or 1.5 GB).

Computer with multiple database instances

Note: If you are planning to run multiple database instances on the same computer, adjust the memory toensure that concurrently running instances fit into the available physical RAM. Using physical memoryavoids swapping to disk.

For example, to run the IBM OpenPages GRC Platform Repository and Cognos Repository services on thesame computer with 8 GB of RAM:

• 2 GB of RAM for the OS• The remaining 6 GB of RAM can be split between the OpenPages GRC Platform Repository and Cognos

Repository as follows:

– OpenPages GRC Platform Repository instance: 2.5 GB SGA + 1 GB PGA– Cognos Repository instance: 1.5 GB SGA + 1 GB PGA

Changing the IBM DB2 varchar limit for IBM Cognos reportsConditional statements are used in IBM OpenPages GRC Platform computed fields that reference datacolumns with varchar values larger than 4000. By default IBM Cognos Business Intelligence uses avarchar limit of 4000. You can ensure that errors do not occur in OpenPages reports by removing thevarchar limit.

If you do not change the varchar limit, errors like the following can appear in the cogserver.log file.

RQP-DEF-0177 An error occurred while performing operation 'sqlPrepareWithOptions' status='-120'UDA-SQL-0458 PREPARE failed because the query requires local processing of the data. The option to allow local processing has not been enabled.UDA-SQL-0476 A VARCHAR column in a comparison exceeds the maximum length allowed by the database. This operation requires local processing of the data.


Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Go to the Cognos_HOME\bin directory.

For example, go to the C:\IBM\cognos\c10_64\bin directory.3. Make a backup copy of the cogdmd2.ini file.4. Open the cogdmd2.ini file in a text editor.5. Find the following statement:

[Exceptions Operators DATABASE:SQL]Varchar_Compare_Limit="4000"

6. Comment out the Varchar_Compare_Limit="4000" statement by adding a semicolon (;) in front ofit.For example,

[Exceptions Operators DATABASE:SQL];Varchar_Compare_Limit="4000"

7. Save and close the file.8. Restart the IBM Cognos BI services.

Enabling LDAPIf you are installing IBM OpenPages GRC Platform into an LDAP environment, you must enable LDAP. TheOpenpages module in the LDAP configuration file, aurora_auth.config, determines whether LDAP isenabled. If you have a load-balanced system, disable LDAP on the primary and secondary servers.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Use your LDAP Directory Server to add users who require access to the OpenPages application or to

the OpenPages environment to the LDAP authentication server.

For more information about the steps required to add OpenPages users to the LDAP server, see thedocumentation for your LDAP Directory Server.

3. Log on to the OpenPages application and create the same users.4. Stop all OpenPages services.5. Go to the directory where you copied the aurora_auth.config file.6. Open the LDAP configuration file, aurora_auth.config, in a text editor.7. Rename the Openpages module to something different, such as Openpages_default.8. Depending on your LDAP server, rename the LDAP module to Openpages

• If you are using a Microsoft Active Directory server, change the OpenpagesAD module name toOpenpages.

• If you are using a Sun One Directory Server, change the OpenpagesIP module name toOpenpages.

9. Specify the correct values for the following properties in the appropriate module:


Table 52: Property settings and description

Property Description

provider.url IP address and port number of the LDAPauthentication server, in the <protocol>://<ip_address>:<port> format.

Note: If you are configuring LDAP over SSL(LDAPS), the protocol is ldaps and the port isthe LDAPS port.

security.search.user.dn The fully qualified name of an administrativeuser on the LDAP server.

security.search.user.credentials The password for the specified user

base.dn The top level of the LDAP directory tree structure(Domain Name) on the LDAP server.

If the users to be authenticated are in multiplelocations within your Active Directory structure,list all locations explicitly. Use the distinguishednames of the locations, each separated by asemi-colon.

user.attr.id The attribute name of the user identifier.

Typically a common name (CN), uid, orsAMAccountName.

For example, Openpages_default{com.openpages.aurora.service.security.namespace.AuroraLoginModule requireddebug=false;};

Openpages{com.openpages.aurora.service.security.namespace.LDAPLoginModule requireddebug=falseprovider.url="ldap://10.128.25.150:389"security.authentication="simple"security.search.user.dn="CN=Administrator,CN=Users,DC=LDAPTesting,DC=local"security.search.user.credentials="openpages"base.dn="CN=Users,DC=LDAPTesting,DC=local"user.attr.id="CN";};

10. Save and close the file.11. Log on to the OpenPages application and change the OpenPages Administrator password to

openpages.12. Restart all OpenPages services.13. Log on to the OpenPages application as one of the users that you created in the LDAP Directory

Server.


Disabling LDAPIf LDAP is enabled on your system, the default Openpages module was renamed. Either the OpenpagesIPor OpenpagesAD was renamed to Openpages. To disable LDAP, change the name of the currentOpenpages module and change the name of the default Openpages module back to Openpages.

Procedure

1. Log on to the application server as a user with administrative privileges.2. Stop all IBM OpenPages GRC Platform services.3. Go to the directory where you copied the aurora_auth.config file.

OP_HOME\aurora\conf4. Open the LDAP configuration file, aurora_auth.config, in a text editor.5. Change the name of the Openpages_default module back to Openpages.6. Change the name of the current Openpages module to something different.7. Save and close the file.

Search server post installation tasksIf you installed a search server with IBM OpenPages GRC Platform, you must complete the following postinstallation tasks.

• Copy the JDBC driver from the database server to the search server.

For more information, see “Copying database driver files to the search server” on page 185.• Set the login information for the search server to access the database server and global search service.

For more information, see “Setting login information for the search server” on page 187.• Set up SSL for the global search service.

For more information, see “Setting up SSL for the global search service” on page 188.• Tune the search server parameter settings.

For more information, see “Search server tuning” on page 191.• Create a reporting schema.

For more information, see “Global search and the reporting schema” on page 192.

Copying database driver files to the search serverAfter you install the search server, you must copy the database driver files to the search server.

Procedure

1. Copy the JDBC database drivers from the database server.

• If you are using an Oracle database server:

a. Go to the following directory:

Oracle_Home\jdbc\lib (on Microsoft Windows operating systems)

Oracle_Home/jdbc/lib (on UNIX operating systems)b. Copy the JDBC file:

If you are using Oracle 11.2.0.4, copy the ojdbc6.jar file.

If you are using Oracle 12.1.0.2, copy the ojdbc7.jar file.• If you are using an IBM DB2 database server:


a. Go to the following directory:

DB2_Home\sqllib\java (on Windows)

DB2_Home/sqllib/java (on UNIX)b. Copy the following files:

db2jcc4.jar

db2jcc_license_cu.jar2. Copy the files to the following directory on the search server:

OP_Home\OpenPages\OPSearch\opsearchtools\lib (on Windows)

OP_Home/OpenPages/OPSearch/opsearchtools/lib (on UNIX)3. Start the IBM OpenPages GRC - Global Search service.

• If the search server is running on Windows, manually start the service.

The service is set to automatically start when Windows restarts.• If the search server is running on UNIX, set up the service by running the following commands.

Important: These steps provide one, simplified method to set up the search service on UNIX. Foryour specific UNIX environment and organization policy, you might use a different method to set upthe search service. If you use a different method, open openpages-search file to check thecommands, and order of the commands, that you must run to start and stop search service.

a. Log on to the search server as root and open a shell.b. Copy the OP_Home/OpenPages/OPSearch/opsearchtools/openpages-search file to

the /etc/init.d/ folder.c. Copy the OP_Home/OpenPages/OPSearch/opsearchtools/openpages-search-cfg file

to the/etc/sysconfig/ folder.d. Set execution mode on the openpages-search file by running the following command:

chmod +x /etc/init.d/openpages-search

e. You can set the service to automatically start when UNIX restarts by running the followingcommands:

command: chkconfig --add openpages-searchcommand: chkconfig openpages-search oncommand: service openpages-search start

f. To manually start search service, run this command:

service openpages-search start

g. To manually stop search service, run this command:

service openpages-search stop

Start or stop the global search server using scripts in version 7.2.0.1 or laterOn both the Windows and UNIX operating systems, there are two scripts to start or stop the global searchserver in OpenPages version 7.2.0.1 and later.

The scripts are named StartSearchServer and StopSearchServer. They are found in the<OP_Home>/OPSearch/opsearchtools/ folder.

To use the two scripts to start and stop the global search server on the Windows operating system, makesure to first disable the Windows service called IBM OpenPages® GRC - Global Search service. Otherwise,the script interferes with the Windows services.


For more information, see “Starting and stopping the global search services” on page 206.

Setting login information for the search serverYou must set user names and passwords so that the search server can access the database server andthe IBM OpenPages GRC Platform global search service (Apache Solr).

About this task

When you set up passwords, they are automatically encrypted to ensure secure and authenticatedaccess.

Procedure

1. To set the login information and encrypt passwords before you enable the OpenPages GRC Platformglobal search component, follow these steps.a) Open a command prompt on the search server.b) Go to the OP_Home/OPSearch/opsearchtools/ folder and run the following commands:

java -jar opsearchtool.jar setdbuserpassword -username current-username -password current-password -newusername new-username -newpassword new-password java -jar opsearchtool.jar setsolruserpassword -newusername new-username -newpassword new-password

The default values for setdbuserpassword -username current-username -passwordcurrent-password are the values that you set for the database and used in OPAdminConsole toconnect to the database.

The values that are provided for current-username and current-password are used toauthenticate the user before you change the username and the password.

If you want to change the user name for the database server or the Solr service, ensure that youspecify a different value for new-username.

It is not necessary to provide the current user name and password to encrypt the password for theSolr service. It uses the current login information of the database server for authentication beforeyou update it.

c) Start the IBM OpenPages GRC - Global Search service.2. You can reset user names and encrypt passwords after the OpenPages GRC Platform global search

component is enabled.

This step is required if your organization stipulates that you update passwords periodically.

a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Disable to disable the global search component.d) Stop the IBM OpenPages GRC - Global Search service.

On Microsoft Windows operating systems, stop the search service.

On UNIX operating systems, run the following command as a root user:


e) Change the database user name or password.

For more information, see "Changing password references" in the IBM OpenPages GRC PlatformAdministrator's Guide.

f) Open a command prompt on the search server, and follow steps 1a to 1b to set the logininformation and encrypt passwords.

g) Start the IBM OpenPages GRC - Global Search service.


On Windows, start the search service.

On UNIX, run the following command as a root user:


h) Open a command prompt on the search server, and follow steps 1a to 1b to set the logininformation and encrypt passwords.

i) From OpenPages, click Administration > Global Searchj) Click Enable to enable the global search component again.

3. If required, set up SSL for the Solr service.

For more information, see “Setting up SSL for the global search service” on page 188

What to do next

When you update the user name and password, the changes are applied only to the search server. Youmust update the database server as well to ensure the login information is synchronized.

Setting up SSL for the global search serviceYou can configure IBM OpenPages GRC Platform global search service (Apache Solr) to use SecureSockets Layer (SSL). SSL ensures that all data passed between the application server and the Solr serviceremains private.

About this taskIf you are setting up the global search component in a test environment, do not enable Secure SocketsLayer (SSL) until you resolve all installation and configuration issues.

For more information on the commands that are used in this task, see the Apache Solr documentationhttps://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-BasicSSLSetup.

Important: IBM is not responsible for third-party content. At the time of publication, the information iscorrect.

Procedure

1. If the global search component is enabled, you must disable it.a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Disable.

2. Stop the IBM OpenPages GRC - Global Search service.




3. Update the java.security file.a) Edit the following file in a text editor:

IBM_JRE_Home\jre\lib\security\java.security (on Windows)

IBM_JRE_Home/jre/lib/security/java.security (on UNIX)b) Uncomment the default SSL factory settings, and comment out the IBM WebSphere settings.

After you edit the file, it looks like this example.

.... # Default JSSE socket factories ssl.SocketFactory.provider=com.ibm.jsse2.SSLSocketFactoryImpl


https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-BasicSSLSetup

ssl.ServerSocketFactory.provider=com.ibm.jsse2. SSLServerSocketFactoryImpl # WebSphere socket factories (in cryptosf.jar) # ssl.SocketFactory.provider=com.ibm.websphere.ssl. protocol.SSLSocketFactory # ssl.ServerSocketFactory.provider=com.ibm.websphere.ssl.protocol .SSLServerSocketFactory ....

4. Create a certificate for the secure connection.a) Go to the OP_Home/OPSearch/solr/server/etc folder and run the following command.

keytool -genkeypair -alias alias -keyalg key_algorithm -keysize keysize -keypass key_pass -storepass keystore_passwd -validity validity -keystore jks_keystore -ext ip_address -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country"

In the following example, the command creates a self-signed certificate in a keystore namedsolr-ssl.keystore.jks. The keystore contains a key with an alias of solr-ssl, a keystorepassword of secret, a truststore password of secret. It specifies Subject Alternative Name(SAN) values of DNS:host1.companya.com and IP:127.0.0.1,192.168.7.1 to include inthe certificate. (SAN values are not mandatory, and might not be specified in your environment).

keytool -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:host1.companya.com,IP:127.0.0.1,IP:192.168.7.1 -dname "CN=localhost, OU=Organizational Unit, O=Organization, L=Location, ST=State, C=Country"

b) Convert the JKS keystore into PKCS12 format.

keytool -importkeystore -srckeystore jks_keystore -destkeystore jks_keystore.p12 -srcstoretype source_keystore_type -deststoretype destination_keystore_type

When prompted, type a destination keystore password, and the source keystore password thatyou specified in the step 4a.

c) Convert the PKCS12 format keystore, including the certificate and the key, into PEM format.

To run this command, openssl must be installed, and added to the PATH environment variable.

openssl pkcs12 -in jks_keystore.p12 -out jks_keystore.pem

When you are prompted for the import password and PEM pass phrase, you can use the samepassword that you specified for the key_pass value in step 4a.

5. Export the certificate.

keytool -export -keystore jks_keystore -alias alias -file solr_certificate

When you are prompted for the keystore password, type the password that you specified for thekey_pass value in step 4a.

6. Update the solr.in file.a) Edit the following file in a text editor:

OP_Home\OPSearch\solr\bin\solr.in.cmd (on Windows)

OP_Home/OPSearch/solr/bin/solr.in.sh (on UNIX)b) Uncomment and set the following SSL properties.

SOLR_SSL_KEY_STORE=etc/jks_keystoreSOLR_SSL_KEY_STORE_PASSWORD=keystore_passwdSOLR_SSL_TRUST_STORE=etc/jks_keystoreSOLR_SSL_TRUST_STORE_PASSWORD=keystore_passwdSOLR_SSL_NEED_CLIENT_AUTH=falseSOLR_SSL_WANT_CLIENT_AUTH=true


On Windows, you might need to use server/etc as the path name for theSOLR_SSL_KEY_STORE and SOLR_SSL_TRUST_STORE properties.

7. Log in to the OpenPages application as a user with administrative privileges, and update the followingregistry setting values to https instead of http.

Administration > Settings > Platform > Search > Admin > Search Server Administration URL

Administration > Settings > Platform > Search > Index > Search Server URL

Administration > Settings > Platform > Search > Request > Search Server URL8. Copy the certificate file that you exported to the following folder on the application server.

WAS_Home/AppServer/java_1.7.1_64/jre/lib/security9. Add the certificate to the IBM JRE keystore file.

a) Open a Windows command prompt by using the Run as Administrator option, or a UNIX shellwith administrative privileges.

b) Back up the WAS_Home/WebSphere/AppServer/java_1.7.1_64/jre/lib/security/cacerts file.

c) Go to WAS_Home/WebSphere/AppServer/java_1.7.1_64/jre/lib/security folder andrun the following command.

keytool -import -alias alias cacerts -file solr_certificate

When prompted, type the keystore password of the cacerts keystore. The default password istypically changeit.

d) Confirm that you want to trust the certificate.e) Restart all OpenPages services.

10. Import the certificate to the IBM WebSphere truststore.a) Log on to the WebSphere Integrated Solutions Console.


The default port is 9060.b) Click Security > SSL certificate and key management > Key stores and certificates >

CellDefaultTrustStore > Signer certificates.c) Click Add.d) Update the following fields:

• Alias - type the value that you specified for the alias in step 9.• File name - type the full path of the solr_certificate file that you imported into thecacerts file in step 9.

Ensure that the data type is set to Base64-encoded ASCII data.e) Click OK.f) Click Save to update the master configuration.g) Restart all OpenPages services.

11. Start the IBM OpenPages GRC - Global Search service.




12. If the global search component was previously enabled, you can now enable it again.a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.


c) Click Enable.

Search server tuningThe standard installation of the IBM OpenPages GRC Platform global search component uses defaultparameter settings. You might need to tune some parameter settings depending on your organization'srequirements and data.

There are two settings that can configure:

• The ports used by the global search component.

For more information, see “Changing port values for the global search component” on page 191.• The amount of memory used by the search engine service and the indexer service.

For more information, see “Allocating memory for the global search component” on page 192.

Changing port values for the global search componentBy default, the IBM OpenPages GRC Platform global search component uses two ports. Port 8983 is usedfor indexing and searching OpenPages data. Port 8985 is used to administer global search.

About this task

If you have a firewall, ensure that these ports are enabled. If your organization uses different ports, youcan change the port values.

Procedure






3. Log in to the OpenPages application as a user with administrative privileges, and update the followingregistry setting values.a) Click Administration > Settings > Applications > Common > Configuration > Show Hidden

Settings and set the value to true.b) Click Administration > Settings > Platform > Search > Admin and update the Search Server

Administration URL default port value (8985) to a value of your choice.c) Click Administration > Settings > Platform > Search > Index and update the Search Server URL

default port value (8983) to a value of your choice.d) Click Administration > Settings > Platform > Search > Request and update the Search Server

URL default port value (8983) to a value of your choice.

Ensure the port value matches the value you specified in step 3c to avoid issues for users.4. Start the IBM OpenPages GRC - Global Search service.




5. If the global search component was previously enabled, you can now enable it again.


a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Enable.

Allocating memory for the global search componentYou can change the amount of memory used by the Apache Solr search engine service and theOpenPages indexer service for the IBM OpenPages GRC Platform global search component.

Procedure






3. Update the memory allocation on the computer on which you installed the search server.

Ensure you have sufficient free memory on the computer. If you set the memory too high and thecomputer does not have enough free memory, you might encounter performance issues.

a) Edit the OP_Home/OPSearch/opsearchtools/openpages_search.properties file in a texteditor.

b) To update the amount of memory (in megabytes) to allocate to the Apache Solr service, edit theOPSearchTool.SolrHeapSize value.

c) To update the amount of memory (in megabytes) to allocate to the OpenPages indexer service, editthe OPSearchTool.IndexerHeapSize value.

4. Start the IBM OpenPages GRC - Global Search service.




5. If the global search component was previously enabled, you can now enable it again.a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Enable.

Global search and the reporting schemaYou must create a reporting schema before you can enable the IBM OpenPages GRC Platform globalsearch component.

About this task

For more information, see “Updating the reporting schema and reporting framework” on page 171.

If you re-create the reporting schema, you must also re-create the search index.

Procedure

1. If the global search component is enabled, you must disable it.


a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Disable.

2. Click Drop, then click Create to re-create the search index.



Chapter 13. Reinstalling the search server on adifferent computer

You can install the search server on one computer only. If it is already installed, and you want to move it toa different computer, follow these steps.

Procedure

1. Uninstall the existing search server.

For more information, see “Uninstalling the search server” on page 323.2. Use the IBM OpenPages Administrative Console to update the details of the search server in your

deployment and run the deployment.

For more information on search server settings, see Chapter 11, “Installing a new OpenPages GRCPlatform deployment,” on page 165.

3. Log in to the OpenPages application as a user with administrative privileges, and update the followingregistry setting values.a) Click Administration > Settings > Platform > Search > Index.b) Update the following fields:

• Language Analyzer - type the language abbreviation to use.• Search Server URL - update the value to http://search_server_host_name:search_server_port

The default port is 8983.c) Click Administration > Settings > Platform > Search > Request.d) Update the Search Server URL field to http://search_server_host_name:search_server_port

Ensure that the port value matches the value that you specified in step 3b to avoid issues for users.

The default port is 8983.e) Click Administration > Settings > Platform > Search > Admin.f) Update the Search Server Administration URL field to http://search_server_host_name:search_server_admin_port



Chapter 14. Installing QRadar integrationThe IBM QRadar integration project is an optional project that you can install to import offenses fromQRadar to IBM OpenPages GRC Platform as incidents.

You must complete the following steps to install and configure the QRadar integration project.

• Ensure IBM QRadar is installed.• Install IBM Tivoli® Directory Integrator 7.1.1.4 from the OpenPages GRC Platform installation media.• Configure Tivoli Directory Integrator to connect to QRadar.

For more information, see “Setting up the QRadar SSL certificate” on page 197.• Import the assembly line.

For more information, see “Importing the assembly line” on page 198.• Configure the property files.

For more information, see “Configuring the connector.properties file” on page 199 and “Configuring theConnector.Passwords properties file” on page 199.

Setting up the QRadar SSL certificateYou must specify the SSL certificate that allows IBM Tivoli Directory Integrator (TDI) to connect to theQRadar server.

Procedure

1. Obtain the QRadar SSL certificate:a) Log in to the QRadar console.b) Use the certificate management tool in your browser to export the QRadar certificate to a file on the

system where TDI is installed. For example, in Internet Explorer, in the Tools menu, select InternetOptions and then the Content tab, then click Certificates.

Alternatively, enter the following command to retrieve the certificate in Base-64 encoded X509format from the QRadar server.

Attention: The command assumes that the openssl command is in the path. Replace hostwith the fully qualified host name of your QRadar server, and replace port with the portnumber being used. If no port number is specified in the URL when logging in to the QRadarconsole, specify port 80 for HTTP, or port 443 for HTTPS.

• Windows (You might need to press CONTROL-C to end the command ): openssl s_client -showcerts -connect host:port | openssl x509 -outform PEM >mycertfile.pem

• UNIX: openssl s_client -showcerts -connect host:port </dev/null 2>/dev/null | openssl x509 -outform PEM > mycertfile.pem

The Base-64 X509 encoded certificate will be in the mycertfile.pem file.2. From the Tivoli Directory Integrator Configuration Editor, add the certificate to Tivoli Directory

Integrator.a) Click Key Manager, then click the Open icon.b) Select JKS from the Key database type list.c) Click Browse, and locate the <TDI_Solutions_user_home>/Solutions/serverapi/testadmin.jks file, then click OK.

d) At the password prompt, type administrator.e) Select Signer Certificates from the Key database content.f) Click Add and browse to the location of the certificate that you obtained in step 1.g) Specify the label for the certificate as administrator, then click the Save icon.h) When you are prompted for the password, type administrator.i) Close the dialog box.

3. Copy testadmin.jks into the following directories. Some of these directories might not exist,depending on the options that were chosen when Tivoli Directory Integrator was installed.

If required, back up the existing file in each directory before you copy the updated version.

<TDI_home>/win32_services/serverapi (Windows platforms only)

<TDI_home>/serverapi

<TDI_Solutions_user_home>/serverapi

Importing the assembly lineTo run the QRadar assembly line, you import the qradar_integration.xml file as a new TivoliDirectory Integrator project.

About this taskAn assembly line is commonly referred to as an AL in the Tivoli Directory Integrator documentation.

Procedure

1. Extract the Tivoli Directory Integrator project file.a) Open qradar-integration.zip from the following location:

<OP_Home>\OpenPages\integrations\ITG (on Windows operating systems)

<OP_Home>/OpenPages/integrations/ITG (on UNIX operating systems)b) Extract the files to a temporary folder.

2. Import qradar_integration.xml from the extracted files as a new project in IBM Tivoli DirectoryIntegrator.a) Click File > Import > IBM Tivoli Directory Integrator > Configuration.b) Click Next.c) Select New Project in the Project list.d) In the Configuration File field, browse to qradar_integration.xml that you extracted and

select it.e) Click Finish.f) In the New Project field, type qradar_integration.

The project is created in your workspace location.g) Click Finish.

3. Copy the connector.properties and Connector-Passwords.properties files from the filesyou extracted in step 1 to the Runtime-qradar_integration folder in your Tivoli DirectoryIntegrator workspace location.

Attention: If the Runtime-qradar_integration folder is not visible in the Tivoli DirectoryIntegrator Configuration Editor, right-click the qradar_integration.xml project in the TDIConfiguration Editor and click the Refresh icon.


Configuring the connector.properties fileYou must update the connector.properties file with the correct configuration for the connectorcomponents.

About this task

The qradar_integration.zip located in the <OP-ROOT>/integrations/ITG folder contains theqradar_integration.xml file. This is the project file that is used to import the qradar_integrationproject into Tivoli Directory Integrator.

There are also two text properties files that can be used for configuring the connector-related propertiesin the respective Resources > Properties components of the qradar_integration project. Theconnector.properties text properties file can be used to set or update the property values in theconnector property store, and the Connector-Passwords.properties text properties file can beused to set or update the property values in the Connector-Passwords property store.

The non-encrypted connector properties are maintained in the connector.properties file. This file isone of the two properties files that you manually copy into the Runtime-qradar_integration folderafter you import the qradar_integration project into your Tivoli Directory Integrator deployment. Theproperties in this file can be used to set or update the values that are stored in the connector propertystore located under the Resources > Properties project folder.

There are three basic sections of connector.properties file: one shared area for email settings; onesection specifically for the QRadar API Connector properties; and one section for the OpenPagesConnector properties. Mandatory fields are marked as REQUIRED in the text properties files, and aremarked with an asterisk (*) when viewed from the TDI Configuration Editor's Connection Editor in theConnection tab for the connector component. You can use the example values shown for each propertyfor hints on what to specify for that property.

Procedure

1. From the Tivoli Directory Integrator Configuration Editor, open the qradar_integration project.2. In the Navigator pane, expand Runtime-qradar_integration.3. Right-click the connector.properties file and open it using the Text Editor option.4. Set or change the property values.5. Save the changes and exit the text editor.6. In the Navigator pane, expand Resources > properties.7. Right-click the connector object and open it using the Properties Editor option.8. Click Read properties from Server.9. Click Send properties to Server.

10. Click the Save icon to save the changes in Tivoli Directory Integrator connector property store.Close the connector editor. If you are prompted to save the properties again, click Yes.

Configuring the Connector.Passwords properties fileYou must update the Connector-Passwords.properties file with the correct OpenPages passwordand QRadar API token values for the connector components.

About this task

There are two encrypted properties used by the connector components, namely the op_conn_passwordproperty and the qradarToken property. Both properties are maintained in the Connector-Passwords.properties file. This file is one of the two properties files that you manually copy into theRuntime-qradar_integration folder after you import the qradar_integration project into your TivoliDirectory Integrator deployment. The properties in this file can be used to set or update the values that

Installing QRadar integration 199

are maintained in the Connector-Passwords password property store located under the Resources >Properties project folder.

Procedure

1. Obtain the QRadar API token value:a) Log in to the QRadar console.b) Click Admin > Authorized Services.c) Copy the Authentication Token value from the REST Service service name line item for use in

step 5.2. From the Tivoli Directory Integrator Configuration Editor, open the qradar_integration project.3. In the Navigator pane, expand Runtime-qradar_integration.4. Right-click the Connector-Passwords.properties file and open it using the Text Editor option.5. Set or change the password-related property values.

a) Enter a clear-text value for the op_conn_password property after the '=' characterb) Enter the value obtained from the QRadar server in step 1 after the '=' character for the

qradarToken property.

Note: Do not remove the {protect}- prefix from any property entry in the file. If you are updatingan already-encrypted value, you can either leave the {encr} prefix after the equal sign (=) character,or you can remove it. If the {encr} prefix is removed, it is automatically reinserted after the equalsign (=) character as part of the encryption processing that occurs during step 11.

6. Save the changes and exit the text editor.7. In the Navigator pane, expand Resources > Properties.8. Right-click the Connector-Passwords object and open it using the Properties Editor option.9. Click Read properties from Server.

10. Click Send properties to Server.11. Click the Save icon to save the changes in Tivoli Directory Integrator Connector-Passwords

password property store. Close the Connector-Passwords editor. If you are prompted to save theproperties again, click Yes.

Note: After this step is completed, the values in the Connector-Passwords password propertystore and the values in the Connector-Passwords.properties text file are automaticallyencrypted. If needed, the {encr} tag is automatically inserted before the property value of eachproperty in the Connector-Properties.properties text file.


Chapter 15. Starting and stopping serversYou can start and stop the IBM OpenPages GRC Platform application servers, the database server, and theCognos server.

Starting application serversYou can start IBM OpenPages GRC Platform in a Windows, AIX, and Linux environments.

In a Windows environment, the services that are required to start the OpenPages GRC Platformapplication servers can be configured to start automatically.

In an AIX and Linux environment, you manually run scripts to start the OpenPages GRC Platformapplication servers.

Important:

• Start the OpenPagesAdminServer service (Windows) or run the OpenPages startManager script (AIX andLinux) first. Then, run the other services and scripts as described in the following procedures.

• If you are running OpenPages in a load-balanced environment, you must start the server on the clusteradministrator first before starting a cluster member.

• If you are using the approval app, reload the approval app configuration after you restart the applicationservers. For more information, see “Loading the approval app configuration” on page 204.

First-time startup

Important: The first time that you start the server, it must precompile all of the included JSPs. Thisinitialization process can take several minutes to complete, but occurs only the first time that the softwarestarts after installation. Future starts take much less time.

Microsoft Windows servicesFor the IBM OpenPages GRC Platform application to run, all of the required Microsoft Windows servicesmust be started and the services of supporting applications must be running.

The table lists OpenPages GRC Platform and Workflow Console Services on Windows using WebSphereApplication Server.

Note: This information applies only to Windows environments.

Table 53: Service descriptions of the workflow console

Service Name Description

IBM WebSphere Application ServerV<WAS_VERSION> - OpenPagesDmgr

Starts or stops the OpenPagesDmgr service.

Note: In a horizontal-cluster environment, cluster membersdo not have an OpenPagesDmgr service.

IBM WebSphere Application ServerV<WAS_VERSION> - <HOST_HAME>-OPNode1

Starts or stops an OpenPages node service.

IBM WebSphere Application ServerV<WAS_VERSION> - <HOST_HAME>-OPNode1Server<SERVER#>

Starts or stops an OpenPages managed service.

In a cluster environment, the number for each managedserver increments by 1.

Table 53: Service descriptions of the workflow console (continued)


IBM WebSphere Application ServerV<WAS_VERSION> - IBPMDmgr

Starts or stops the IBPMDmgr service.

Note: In a horizontal-cluster environment, cluster membersdo not have an IBPMDmgr service.

IBM WebSphere Application ServerV<WAS_VERSION> - <HOST_HAME>-IBPMNode<SERVER#>

Starts or stops an IBPM node service.

IBM WebSphere Application ServerV<WAS_VERSION> - <HOST_HAME>-IBPMNode<SERVER#>Server

Starts or stops an IBPM managed service.

In a cluster environment, the number for each managedserver increments by 1.

Microsoft Windows commandsIn a Microsoft Windows environment, IBM OpenPages GRC Platform includes a number of commands toinitiate and launch the application environment.

The application runs only if all of the services are started and all of the services for all supportingapplications are running.

Note: These commands can be run individually or you can use wrapper commands to start and stopOpenPages GRC Platform.

The following table lists the commands required to start and stop the application.

Table 54: OpenPages GRC Platform and Workflow Console commands on Windows

Script Name Description

startManager.bat Starts the Workflow Console Deployment Manager.

startNode.bat Starts the Workflow Console node agent.

startServer.bat Starts the Workflow Console application server.

stopManager.bat Stops the Workflow Console Deployment Manager.

stopNode.bat Stops the Workflow Console node agent.

stopServer.bat Stops the Workflow Console application server.

startManager.bat Starts the OpenPages Deployment Manager.

startNode.bat Starts the OpenPages node agent.

startServer.bat Starts the OpenPages application server.

stopManager.bat Stops the OpenPages Deployment Manager.

stopNode.bat Stops the OpenPages node agent.

stopServer.bat Stops the OpenPages application server.

startAllServers.bat Starts all OpenPages and Workflow Consoleservices in the correct sequence.

stopAllServers.bat Stops all OpenPages and Workflow Consoleservices in the correct sequence.


AIX and Linux scriptsIn the AIX and Linux environments, IBM OpenPages GRC Platform includes a number of scripts to initiateand launch the application environment.

The application runs only if all of the services are started and all of the services for all supportingapplications are running.

Note: These scripts can be run individually or you can use wrapper scripts to start and stop OpenPagesGRC Platform.

The following table lists the scripts required to start and stop the application.

Table 55: OpenPages GRC Platform and Workflow Console Scripts on AIX and Linux

Script Name Description

startManager.sh Starts the Workflow Console Deployment Manager.

startNode.sh Starts the Workflow Console node agent.

startServer.sh Starts the Workflow Console application server.

stopManager.sh Stops the Workflow Console Deployment Manager.

stopNode.sh Stops the Workflow Console node agent.

stopServer.sh Stops the Workflow Console application server.

startManager.sh Starts the OpenPages Deployment Manager.

startNode.sh Starts the OpenPages node agent.

startServer.sh Starts the OpenPages application server.

stopManager.sh Stops the OpenPages Deployment Manager.

stopNode.sh Stops the OpenPages node agent.

stopServer.sh Stops the OpenPages application server.

startAllServers.sh Starts all OpenPages and Workflow Consoleservices in the correct sequence.

stopAllServers.sh Stops all OpenPages and Workflow Consoleservices in the correct sequence.

Determining application readinessThis procedure lets you determine whether the application is ready to be accessed after starting upservers.

Procedure

1. Open the log file specified in the following table.

Table 56: Log files and their locations

If this... Navigate to this folder... View this log file...

Windows <OP_Home>\OpenPagesDomain\servers\<host_name>-OpenPagesServer1\logs

<host_name>-OpenPagesServer<#>.log

AIX and Linux <OP_Home>/profiles/OpenPagesDmgr/logs/dmgr

startServer.log

Starting and stopping servers 203

Where

<OP_Home> represents the installation location of the OpenPages GRC Platform application.

<host_name> is the name of the server.

<#> is the number of the server.2. Scroll to the end of the log file and search for a message stating that the web application server is

running in Production Mode. If this line appears, the server is running in production mode and theapplication is ready to be accessed.

Loading the approval app configurationAfter you restart the OpenPages servers, you must load the approval app configuration.

Procedure

1. Open http://<hostname>:10108/openpages/app/deck/reloadConfig in your browser.Replace <hostname> with the OpenPages application server name. If you have changed the defaultport number, replace 10108 with the port number that you are using.

2. If you are prompted to log in, enter the OpenPages Administrator user name and password.3. Repeat these steps on every OpenPages server, including the vertical cluster members on all the

application servers.

For example, if you have two vertical cluster members on the admin server and you use the defaultport, open http://<hostname>:10128/openpages/app/deck/reloadConfig in your browser.

Automatically starting application servers in WindowsBy default, all IBM OpenPages GRC Platform and Workflow Console services are configured as Manual,(will not start upon reboot).

You can configure all OpenPages GRC Platform and Workflow Console services to Automatic throughWindows Services to start upon booting, or use scripts on each server to start the services upon reboot.

When you reboot the server, all OpenPages GRC Platform and Workflow Console services start.

Starting all application services in Windows using a scriptThe StartAllServers.cmd script included with IBM OpenPages GRC Platform will start all OpenPagesand Workflow Console services in the proper sequence.

Note: This information applies only to Microsoft Windows environments.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Open a Command Prompt window (using the Run as Administrator option) and do the following:

a) Navigate to the <OP_Home>\bin directory.

Where <OP_Home> is the installation location of the OpenPages GRC Platform application. Bydefault, this is: c:\OpenPages.

b) Run the following command to start the OpenPages GRC Platform and Workflow Console services:

StartAllServers.cmd

When all services have been started, the Command Prompt window closes.


Starting application services individually using Windows servicesIn the Windows environment, you start the IBM OpenPages GRC Platform application by starting therequired OpenPages and Workflow Console services.


Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Click the Windows Start menu and select All Programs.3. From the Administrative Tools list, select Services.4. For WebSphere Application Server, use the following steps.

a) Start the IBM WebSphere Application Server V<WAS_VERSION> - OpenPagesDmgr service, ifpresent.

b) Start the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-OPNode1service.

c) Start the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-OPNode1Server<SERVER#> services, where # represents the number of the managed server.

Note: If there is more than one managed server on the current system, you must start the service(OPNode1Server<SERVER#>) for each managed server in sequence before you proceed to theWorkflow Console services.

d) Start the IBM WebSphere Application Server V<WAS_VERSION> - IBPMDmgr service, if present.e) Start the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-

IBPMNode<SERVER#> service.f) Start the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-

IBPMNode<SERVER#>Server services.

As services are starting, Windows Services may indicate that the services have started, butbackground OpenPages processes may still be running. It may take a few minutes for theOpenPages service to be operational.

Starting all application servers in AIX and Linux using a scriptThe startAllServers.sh script included with IBM OpenPages GRC Platform will start all OpenPagesand Workflow Console services in the proper sequence.

Note: This information applies only to AIX and Linux environments.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Open an AIX or Linux shell window and do the following:

a) Navigate to the <OP_Home>/bin directory.

Where <OP_Home> is the installation location of the OpenPages GRC Platform application. Bydefault, this is: /opt/OpenPages.

b) Run the following script to start OpenPages GRC Platform and Workflow Console services:

./startAllServers.sh


Starting application servers in AIX and Linux individually using scriptsUse the following steps to start the IBM OpenPages GRC Platform and Workflow Console servicesmanually. In the AIX and Linux environments, you run a set of scripts to start the OpenPages application.

Note: This information applies only to AIX and Linux environments.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Use an AIX or Linux shell to navigate to the <OP_Home>/profiles/OpenPagesDmgr/bin directory.3. Enter the following command to launch a script that starts the OpenPages GRC Platform Deployment

Manager:

./startManager.sh

4. After the script completes successfully, navigate to the <OP_Home>/profiles/OpenPagesNode1/bindirectory.

5. Enter the following commands, in the order specified, to launch scripts that start the OpenPages NodeAgent and the OpenPages application server:

./startNode.sh

./startServer.sh OPNode#Server#

Where OPNode# is the node that the current server is in and Server# is the number of the serverwithin that node. For example, OPNode1Server1.

Note: If there is more than one managed server on the current system, you must run the start script (./startServer.sh OPNode#Server#) for each managed server in sequence before proceeding to theWorkflow Console scripts.

6. After the script completes successfully, navigate to the {app_server_root}/Profiles/IBPMDmgr/bindirectory.

7. Enter the following command to launch a script that starts the IBPM Deployment Manager:

./startManager.sh

8. After the script completes successfully, navigate to the {app_server_root}/profiles/IBPMNode1/bindirectory.

9. Enter the following commands, in the order specified, to launch scripts that start the IBPM Node Agentand the IBPM application server:

./startNode.sh

./startServer.sh IBPMNode#server

Where IBPMNode# is the node that the current server is in. Do not specify a server number as only oneserver should exist for each Workflow Console node. For example, IBPMNode1server.

When the scripts complete successfully, the OpenPages GRC Platform application is properly started.

Starting and stopping the global search servicesUse the following steps to start or stop the global search services.

Important: On both Windows and UNIX, if you use the StartSearchServer command or theStopSearchServer command to start or stop the global search services, you cannot use the Windows


or UNIX services and the service must be disabled. In addition, if you need to restart the operating systemon which global search is running, you must first run the command StopSearchServer beforerebooting.

Procedure

1. Start the global search services:

• If the search server is using the Windows operating system, manually start the IBM® OpenPagesGRC - Global Search service.

As of OpenPages version 7.2.0.1, you can start the global search service from a command prompt:

a. Log on to the search server as administrator and open a CMD prompt.b. From the directory <OP_Home>\OPSearch\opsearchtools\, run the following command:StartSearchServer.cmd

• If the search server is using the UNIX operating system, set up the service by running the followingcommands.

Attention: These steps provide one simplified method to set up the search service on UNIX.For your specific UNIX environment and organizational policy, you might use a differentmethod to set up the search service. If you use a different method, open the openpages-search file to check the commands and the order in which they must be run to start andstop search service.

a. Log on to the search server as root and open a shell.b. Copy the <OP_Home>/OpenPages/OPSearch/opsearchtools/openpages-search file to

the /etc/init.d/ folder.c. Copy the <OP_Home>OpenPages/OPSearch/opsearchtools/openpages-search-cfg file

to the /etc/sysconfig/ folder.d. Set execution mode on the file by running the following command: chmod +x /etc/init.d/openpages-search

e. You can set the service to automatically start when UNIX restarts by running the followingcommands:

– chkconfig --add openpages-search– chkconfig openpages-search on– service openpages-search start

f. To manually start search service, run this command: service openpages-search startg. To manually stop search service, run this command: service openpages-search stop

As of OpenPages version 7.2.0.1, you can start the global search service from a command line:

a. Log on to the search server as root and open a shell.b. From the directory <OP_Home>OPSearch/opsearchtools/ run the following command: ./StartSearchServer.sh

2. Stop the global search services:

• If the search server is using the Windows operating system, locate the service that is called IBM®

OpenPages GRC - Global Search and stop it.

As of OpenPages version 7.2.0.1, you can stop the global search service from a command prompt:

a. Log on to the search server as administrator and open a CMD prompt.b. From the directory <OP_Home>\OPSearch\opsearchtools\, run the following command:StopSearchServer.cmd

• If the search server is using the UNIX operating system, use the global search services that you setup to stop it:


a. Log on to the search server as root and open a shell.b. To stop global search services, run this command: service openpages-search stop

As of OpenPages version 7.2.0.1, you can stop the global search service from a command line:

a. Log on to the search server as root and open a shell.b. From the directory <OP_Home>OPSearch/opsearchtools/ run the following command: ./StopSearchServer.sh

Stopping application serversYou can stop the IBM OpenPages GRC Platform application server in the Windows, AIX and Linuxenvironments as required.

IBM WebSphere Application Server global security is enabled by default on the application servers. Whenstopping an application server, you must provide the WebSphere administrative user name and passwordas arguments to all stop scripts on all operating systems.

Stopping the application server prevents IBM OpenPages GRC Platform from being accessed.

Important:

• You must stop the InterstageBPMCS# service(s) (Windows) or run the Fujitsu Interstage BPMstopServer.sh script (AIX and Linux) first and then the other services or scripts as described in thefollowing procedures. Otherwise, you risk losing data or corrupting the installation.

• If you are running OpenPages GRC Platform in a load-balanced environment, stop the server on eachcluster member first before stopping the cluster administrator.

Stopping application servers in a Windows environmentIn a Windows environment, all IBM OpenPages GRC Platform and Workflow Console services can beconfigured to stop automatically or you can stop the services manually, using one of the following threemethods.

Stopping the application server prevents IBM OpenPages GRC Platform from being accessed.

Important:


• If you are running OpenPages GRC Platform in a load-balanced environment, stop the server on eachcluster member first before stopping the cluster administrator.

Automatically stopping application servers in WindowsWindows automatically and gracefully stops the IBM OpenPages GRC Platform application when a servershuts down.


Stopping the application server prevents the OpenPages application from being accessed.

Important:


• If you are running OpenPages GRC Platform in a load-balanced environment, you must stop the serveron each cluster member first before stopping the cluster administrator.


Stopping all application services in Windows using a scriptThe StopAllServers.cmd script included with IBM OpenPages GRC Platform will stop all OpenPagesand Workflow Console services in the proper sequence.

Stopping the application server prevents the OpenPages application from being accessed.

Important:


• If you are running OpenPages in a load-balanced environment, you must stop the server on each clustermember first before stopping the cluster administrator.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Launch a Command Prompt window (using the Run as Administrator option).3. Navigate to the <OpenPages_Home>/bin directory.4. Enter the following command to launch a script that stops the OpenPages and Workflow Console

services:

StopAllServers.cmd <username> <password>

Where <username> and <password> are the administrative user name and password for the IBMWebSphere Application Server.

When all services have been stopped, the Command Prompt window closes.

Stopping application services individually using Windows servicesYou can stop the IBM OpenPages GRC Platform application without shutting down or rebooting themachine.

Stopping the application server prevents the application from being accessed.

Important:



Use the following steps to stop OpenPages services manually.

Important: Stopping the OpenPages GRC Platform Admin service before you stop each managed servercauses the OpenPages application to stop on all servers. This could result in the loss of data and otherproblems.

In the Windows environment, you stop the OpenPages GRC Platform application by stopping the requiredOpenPages and Workflow Console services.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Click the Windows Start menu and select All Programs.3. From the Administrative Tools list, select Services.4. Stop the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-

IBPMNode<SERVER#>Server services, where <SERVER#> represents the number of the managedserver.


5. Stop the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-IBPMNode<SERVER#> services.

6. Stop the IBM WebSphere Application Server V<WAS_VERSION> - IBPMDmgr service, if present.7. Stop the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-

OPNode1Server<SERVER#> services.8. Stop the IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-OPNode1 service.9. Stop the IBM WebSphere Application Server V<WAS_VERSION> - OpenPagesDmgr service, if present.

Results

When the services are stopped successfully, the OpenPages application is properly shut down.

Stopping all application servers in AIX and Linux using a scriptThe stopAllServers.sh script included with IBM OpenPages GRC Platform will stop all OpenPagesand Workflow Console services in the proper sequence.


Important:


• If you are running OpenPages GRC Platform in a load-balanced environment, you must stop the serveron each cluster member first before stopping the cluster administrator.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Use an AIX or Linux shell to navigate to the <OpenPages_Home>/bin directory.3. Enter the following command to launch a script that stops OpenPages GRC Platform and Workflow

Console services:

./stopAllServers.sh <username> <password>


Stopping application servers in AIX and Linux individually using scriptsIn the AIX and Linux environments, you run a set of scripts to stop the IBM OpenPages GRC Platformapplication.


Important:



Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.


2. Navigate to the {app_server_root}/profiles/IBPMNode1/bin directory.3. Enter the following commands, in the order specified, to launch scripts that stop the IBPM application

server and the IBPM Node Agent.

./stopServer.sh -username <username> -password <password> IBPMNode#Server

./stopNode.sh -username <username> -password <password>

Where # is the node number that the current server is in. A server number is not required as only oneserver should exist for each Fujitsu Interstage BPM node.

<username> and <password> are the administrative user name and password for the IBMWebSphere Application Server.

4. After the scripts complete successfully, navigate to the {app_server_root}/profiles/IBPMDmgr/bindirectory.

5. Enter the following command to launch a script that stops the IBPM Deployment Manager:

./stopManager.sh -username <username> -password <password>


6. After the script completes successfully, navigate to the <OpenPages_Home>/profiles/OpenPagesNode1/bin directory.

7. Enter the following commands, in the order specified, to launch a script that stops the OpenPagesapplication server and the OpenPages Node Agent.

./stopServer.sh -username <username> -password <password> OPNode#server#

./stopNode.sh -username <username> -password <password>

Where OPNode# is the node that the current server is in and Server# is the number of the serverwithin that node. For example, OPNode1Server1.


If there is more than one managed server on the current system, you must run the stop server script (./stopServer.sh OPNode#server#) for each managed server before running the stop node agent script (./stopNode.sh). The managed servers can be stopped in any order.

8. After the scripts complete successfully, navigate to the <OpenPages_Home>/profiles/OpenPagesDmgr/bin directory.

9. Enter the following command to launch a script that stops the OpenPages GRC Platform DeploymentManager:

./stopManager.sh -username <username> -password <password>


When the script completes successfully, the OpenPages application is properly shut down.

Starting and stopping the database server in a Windows environmentYou can start or stop database services using Windows services that are associated with the IBMOpenPages GRC Platform Oracle database instance.



Table 57: OpenPages GRC Platform Oracle services on Windows


OracleOPXRepos_server112_se_x64TNSListenerOPX600011GEMx64se

Runs the Oracle Database listener service thatconnects the user to the Oracle Database instance.

OracleService<SID> Used to start and stop the Oracle Databaseinstance.

Where <SID> represents the database instanceidentifier.

Use the following steps to start or stop database services using Windows Services.

Procedure

1. Log on to the database server as a user with administrative privileges.2. Click the Windows Start menu and select All Programs.3. From the Administrative Tools list, select Services.4. For each database service listed in the previous table, do the following:

• To start the server, right-click the service name and select Start.• To stop the server, right-click the service name and select Stop.

Starting and stopping the database server in an AIX and Linux environmentUse the following steps to start or stop the Oracle database server.

Procedure

1. Log on to the database server as a user with administrative privileges.2. In a shell window, navigate to the following directory:

<Oracle_Home>/openpages_data/repository/server112_se_x64/software

Where:

<Oracle_Home> is the installation location of the Oracle database directory.By default, this is /opt/oracle.

3. Execute the following command:

./oprepository.sh <tnsalias_name> <listener_name> <sysdba_password> <argument_value>

Where:

<tnsalias_name> is the TNS alias of the database service.

<listener_name> is the listener service.

<sysdba_password> is the password for the database sys user.

<argument_value> is the argument value that is passed to the database server.

Valid argument values are:

• start• shutdown• abort• restart


Example

The following example starts the database server.

./oprepository.sh AIX61 OPX61GEM openpages start

Starting and stopping the Cognos servicesThere are different procedures to start or stop the Cognos services in the Windows, AIX and Linuxenvironments. The services are the IBM Cognos service and the OpenPages Framework ModelGenerator service

These procedures are:

• “Using the IBM Cognos configuration tool to start and stop the IBM Cognos service” on page 213• “Using the Windows operating system to start and stop the IBM Cognos service” on page 213• “Using the AIX or Linux operating system to start and stop IBM Cognos service” on page 214• “Starting and stopping the OpenPages GRC Platform Framework Model Generator service on Windows”

on page 214• “ Starting and stopping the OpenPages GRC Platform Framework Model Generator service on AIX or

Linux” on page 214

Using the IBM Cognos configuration tool to start and stop the IBM Cognos serviceYou can use the IBM Cognos Configuration tool to start or stop the IBM Cognos service.

Note: The IBM Cognos Configuration tool will display the status of the start-up, which can be helpful withtroubleshooting, if necessary.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Start the IBM Cognos Configuration tool as follows:

a) Open a Command Prompt window (using the Run as Administrator option), or AIX or Linux shell,and navigate to the <Cognos_Home>|bin64 directory.

<Cognos_Home> represents the installation location of the Cognos application. By default, this is:Windows

cogconfig.batAIX and Linux

./cogconfig.shb) Execute one of the following commands to open the tool:

3. Do one of the following:

• To start the server, click Actions | Start. (It may take several minutes for the service to start thefirst time.) If the Start option is not available, the service has already started.

• To stop the service, click Actions | Stop.

Using the Windows operating system to start and stop the IBM Cognos serviceUse the following steps to start or stop the IBM Cognos service in a Windows environment usingWindows Services.

Procedure

1. Log on to the reporting server as a user with administrative privileges.


2. Click the Windows Start menu and select All Programs.3. From the Administrative Tools list, select Services.4. Do one of the following:

• To start the server, right-click the IBM Cognos service and select Start.• To stop the server, right-click the IBM Cognos service and select Stop.

Using the AIX or Linux operating system to start and stop IBM Cognos serviceUse the following steps to start or stop the IBM Cognos service in an AIX or Linux environment usingcommand-line scripts.

Procedure

1. Log on to the reporting server as a non-root user with administrative privileges.2. Launch an AIX or Linux shell and navigate to the bin directory as follows:<Cognos_Home>/bin64

Where<Cognos_Home> is the installation location of the Cognos application.

3. Do one of the following:

• To start the service, enter the following command: ./cogconfig.sh -s• To stop the service, enter the following command: ./cogconfig.sh -stop

Starting and stopping the OpenPages GRC Platform Framework Model Generator serviceon Windows

Use the following steps to start or stop the IBM OpenPages GRC Platform Framework Model Generatorservice in a Microsoft Windows environment.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Click the Windows Start menu and select All Programs.3. From the Administrative Tools list, select Services.4. Do one of the following:

• To start the server, right-click the IBMOpenPagesFrameworkModelGenerator service and selectStart.

• To stop the server, right-click the IBMOpenPagesFrameworkModelGenerator service and selectStop.

Starting and stopping the OpenPages GRC Platform Framework Model Generator serviceon AIX or Linux

Use the following steps to start or stop the IBMOpenPagesFrameworkModelGenerator service in anAIX or Linux environment.

Procedure

1. Log on to the reporting server as a non-root user with administrative privileges.2. Open an AIX or Linux shell as a user with administrative privileges and navigate to the following

directory:

CommandCenter_Home/wlp/bin

Where CommandCenter_Home is the installation location of OpenPages GRC PlatformCommandCenter. By default, this is: /opt/OpenPages/CommandCenter.


3. To start the service, run the following command.

server start IBMOpenPagesFrameworkModelGenerator

4. To stop the service, run the following command.

server stop IBMOpenPagesFrameworkModelGenerator



Chapter 16. Configure clustered environmentsTo accommodate increased user loads, you can scale the application servers and reporting servers in yourIBM OpenPages GRC Platform environment.

Scaling application servers

You can scale application servers horizontally or vertically by adding cluster members to the OpenPagesenvironment. A cluster member consists of an instance of the OpenPages application server and acorresponding instance of the workflow server. Each member runs on a different port.

When you scale, load balancing is required to distribute the incoming requests across the members.

For more information on adding horizontal and vertical cluster members to the OpenPages environment,see the IBM OpenPages GRC Platform Administration Guide.

Scaling the reporting server

You can scale the OpenPages CommandCenter, and the OpenPages reporting server horizontally byinstalling more reporting servers. You must configure the additional Cognos dispatchers to ensure that theincoming requests are distributed across the multiple servers.

Creating a clustered environment

The process to create a clustered OpenPages environment is summarized here:

1. Install and configure the admin server, and each application server and reporting server as a stand-alone system.

If you are using more than one reporting server, ensure that you stop all standby reporting serverswhen you install the active reporting server.

2. Configure each system for load balancing.

Install the load balancer on the OpenPages application server or on an external system.

You can deploy a hardware or software load balancer. The load balancer must support session affinityand port-based URL routing.

Clustered OpenPages GRC Platform ConfigurationsSome configuration tasks are required for clustered IBM OpenPages GRC Platform environments.

Increasing the Oracle connection limitIn clustered environments, you must increase the number of users who can connect to the databaseinstance.

Procedure

1. Log on to the database server as a user with administrative privileges.2. To start the Oracle Enterprise Manager console, open a web browser and type https://oracle_server_name:port/em


If you are using Oracle 12.1.0.2, the default port number is 5500.3. Log on to the Oracle Enterprise Manager console by using the following syntax: sys/[email protected]) For the User Name, enter sys.

b) Enter the password for the sys user.c) From the Connect As list, select SYSDBA.

4. On the Oracle Enterprise Manager home page, click the Server tab.5. Under Database Configuration, click Initialization Parameters.6. On the Initialization Parameters page, click the SPFile tab.7. Locate the Processes parameter.

If necessary, use the search function by entering Processes in the Name field and then clicking Go.8. Enter a value in the Processes field.

In a clustered environment, for best performance allocate sufficient processes for each IBMOpenPages GRC Platform application instance, each corresponding Fujitsu Interstage BPM instance,and each corresponding Cognos instance.

For a two-node OpenPages GRC Platform environment, use the following settings:

OpenPagesConfigure 75 processes for each OpenPages instance.

Workflow serverConfigure 35 processes for each associated workflow server.

CommandCenterConfigure 80 processes for each OpenPages CommandCenter instance.

Database processing usageConfigure 60 processes for database connection processing and background processes.By default, this setting is 250 processes and 280 sessions for a two-node OpenPagesenvironment. If you have two or more application servers, increase the number of processes.

9. Click Apply.

You are prompted to restart the server.10. To restart the server, select Immediate.

Configuring OpenPages GRC Platform applications to use a domain account on Windowsoperating systems

In a clustered environment, the IBM OpenPages GRC Platform application services access a file share.The account that starts the services must have permissions to the file share.

Configuring the OpenPages applications to use a domain account must be done for new installations,upgrades, and migrations.

About this task

By default, on Windows operating systems, services run under the LocalSystem account. This accountcannot access a shared drive on another computer. In a horizontal cluster, configure the OpenPagesapplication services on all application servers to run under a domain account that has access the shareddrive.

For WebSphere Application Server, the following OpenPages application services must have permissionsto the file share:

• IBM WebSphere Application Server V<WAS_VERSION> - OpenPagesDmgr• IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-OPNode1• IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-OPNode1Server<SERVER#>• IBM WebSphere Application Server V<WAS_VERSION> - IBPMDmgr• IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-IBPMNode<SERVER#>• IBM WebSphere Application Server V<WAS_VERSION> - <HOST_NAME>-IBPMNode<SERVER#>Server


Procedure

1. Log on to each application server as a user with administrative privileges.2. Open the Services control panel.3. Stop the OpenPages services.4. For each OpenPages application service, right-click the service name, and select Properties from the

menu.a) In the Properties window, click the Log On tab.b) Select This account.c) Type a domain, account name, and password for at least one user who has access to the shared

drive.d) Click OK to continue.

Configuring file share permissions on AIX or Linux operating systemsFor clustered IBM OpenPages GRC Platform environments that run on AIX or Linux operating systems,configure the same user name and password on all systems. File share permissions are the same on allsystems. If you are using a network file share (NFS), ensure that users have read and write access to thefile share.

Sharing a network OpenPages GRC Platform storage directory on Windows operatingsystems

The IBM OpenPages GRC Platform installation includes a pointer to the OpenPages storage location. Thestorage location is a directory where attached files and forms that are associated with OpenPages objectsare stored.

If you pointed to a location on the local computer, you must change the pointer to a shared networkstorage location. You can use the update-storage script to change the storage directory to a shareddirectory on the same or another server.

If you specified a shared network storage location, this task is not required.

Before you beginFor installations that use an Oracle database, ensure that the SQL Plus utility is available on the managedapplication server.

Procedure

1. Log on to a managed application server as a user with administrative privileges and full access to thelocal server drives.

2. Open a Command Prompt window.3. Copy the OP_version_Configuration directory from the Installer DVD or on your network share

location to the local system.4. Copy the INSTALL_SCRIPTS directory to the local system.

• For Oracle databases, go to the OP_version_Configuration\Database\ORACLE directory.• For DB2 databases, go to the OP_version_Configuration\Database\DB2 directory.

5. For Oracle databases, go to the ORACLE\INSTALL SCRIPTS directory and run the update-storagescript:

sqlplus /nolog @sql-wrapper.sql update-storage.sql log_file_name TNS_alias_name OpenPages_schema_owner_name OpenPages_schema_owner_password storage_type storage_server_name computer_name OpenPages_storage_platform sharename

The following table lists the command-line parameters that must be passed to the SQL wrapper script.

Configure clustered environments 219

Table 58: Update storage wrapper script parameters for Oracle database


log_file_name The location of the log file that is created by the script.

If a location is not specified, the log file is created in thecurrent working directory.

If a log with the same name exists in the same location, thelog is overwritten by the script.

TNS_alias_name The database connection identifier, such as TNS alias name.

OpenPages_schema_owner_name The name of the OpenPages user, created during theOpenPages application installation.

By default, openpages.

OpenPages_schema_owner_password

The password of the OpenPages user.

storage_type Enter either LFS for local file system, or UNC for UniversalNaming Convention or Uniform Naming Convention.

storage_server_name The name of the server where the OpenPages storage islocated.

computer_name The name of the cluster administrator computer.

OpenPages_storage_platform The operating system on the server where the OpenPagesstorage is located.

Enter Windows.

sharename The name of the shared OpenPages storage directory or themount point.

By default, openpages-storage

6. For the DB2 databases, go to the DB2\INSTALL SCRIPTS directory and type the following commandin the DB2 command line processor (CLP)

clpplus -nw <op_db_user><op_db_password>@<database_host>:<database_port>/<database_name> @sql-wrapper update-storage <log-file> <database_server_name> <database_port> <database_name> <op_db_user> <op_db_password> <storage-type> <storage-server-name> <host_name> <os_type> <path-or-UNC-name>

Example: In the following example, openpages-storage is the UNC share name of the storagelocation. The openpages-storage location is accessible to all members in the cluster as \\testdbserver\openpages-storage.

clpplus -nw openpages/password@testdbserver:50000/OPX @sql-wrapper update-storage c:\temp\upd-storage-output.log testdbserver 50000 OPX openpages password UNC testdbserver testdbserver Windows openpages-storage


Table 59: Update storage wrapper script parameters for DB2 database


op_db_user OpenPages user name for accessing the OpenPages database.

op_db_password The OpenPages password for accessing the OpenPages database.

database_host Name of the DB2 server host computer that contains the OpenPagesdatabase.

database_port Port number of the DB2 database instance that is installed on the databaseserver. For DB2, the default port is 50000.

database_name Name of the OpenPages database.

log-file The name of the log file that the script creates and writes information to.

storage-type The type of file storage to be used. Valid values are as follows:

• LFS (local file system)• UNC (Universal Naming Convention)

Important: After you move from LFS to UNC, you cannot go back to usingLFS.

storage-server-name The name of the storage server.

host-name The host name of the computer.

os-type The type of operating system:

Use one of the following options:

• Windows• Unix

path-or-UNC-name The file path or UNC of the storage location.

Sharing a network OpenPages GRC Platform storage directory on AIX or Linux operatingsystems

The IBM OpenPages GRC Platform application installation includes a pointer to the OpenPages storagelocation. The storage location is a directory where attached files and forms that are associated withOpenPages objects are stored.

If you pointed to a location on the local computer, you must change the pointer to a shared networkstorage location. You can use the update-storage script to change the storage directory to a shareddirectory on the same or another server.

If you specified a shared network storage location, this task is not required.

Procedure

1. Mount the storage folder on the admin server to the non-admin server.a) Log on to the OpenPages admin server as the root user or a user that belongs to the System group,

and open a shell.b) Go to the /etc directory, and open the hosts file in a text editor.


c) Add the IP address and name of each OpenPages managed server.d) Save and close the hosts file.e) Create a file with the name exports in the /etc folder.

Important: Ensure that you have full rights to the local installation directory.f) Open the exports file in a text editor and add the full path to the storage folder.

/opt/OpenPages/openpages-storage

g) Export all file systems that are named in /etc/exports directory by using the followingcommand:

exportfs -a

The exportfs command maintains the current table of exported file systems for NFS inthe /var/lib/nfs/etc file.

h) Restart the NFS server.

On AIX operating systems, use the following commands:

stopsrc -g nfsstartsrc -g nfs

On Linux operating systems, use the following command:

service nfs restart

The NFS server processes requests from the NFS clients.i) Use following command to check that the openpages-storage folder is exported and ready for

mounting:

showmount -e

Ensure that the openpages-storage folder is listed.2. Mount the storage directory from the admin server on the managed server.

a) Log on to the OpenPages managed server as the root user or a user that belongs to the Systemgroup.

b) Open a shell as a user with administrative privileges.c) Go to the /etc directory.d) Open the hosts file in a text editor and add the IP address and name of each OpenPages managed

server.e) Save and close the hosts file.f) Run the following command to mount the storage folder:

mount nfsservername mountpoint

• nfsservername is the name of the OpenPages admin server and the location of the openpages-storage directory on the admin server.

• mountpoint is the name and path of the openpages-storage directory on the managed server.

Example:

mount aix61-1-5.openpages.com:/usr/OpenPages/openpages-storage /usr/OpenPages/openpages-storage


3. For Oracle databases, use the following command to change the storage directory that is used by theOpenPages application to a shared directory on the application server:

sqlplus /nolog @sql-wrapper.sql update-storage.sql log_file_name TNS_alias_name OpenPages_schema_owner_name OpenPages_schema_owner_password storage_type storage_server_name computer_name OpenPages_storage_platform sharename

The following table lists the command-line parameters that must be passed to the SQL wrapper script.

Table 60: Update storage wrapper script parameters for Oracle database


log_file_name The location of the log file that is created by the script.

If a location is not specified, the log file is created in thecurrent working directory.

If a log with the same name exists in the same location, thelog is overwritten by the script.

TNS_alias_name The database connection identifier, such as TNS alias name.

OpenPages_schema_owner_name The name of the OpenPages user, created during theOpenPages application installation.

By default, openpages.

OpenPages_schema_owner_password

The password of the OpenPages user.

storage_type Enter LFS for local file system.

storage_server_name The name of the server where the OpenPages storage islocated.

computer_name The name of the cluster administrator computer.

OpenPages_storage_platform The operating system on the server where the OpenPagesstorage is located.

Enter Unix.

sharename The name of the shared OpenPages storage directory or themount point.

The default mount point is openpages-storage

4. For DB2 databases, type the following command to change the storage directory that is used by theOpenPages application to a shared directory on the application server:

clpplus -nw <op_db_user><op_db_password>@<database_host>:<database_port>/<database_name> @sql-wrapper update-storage <log-file> <database_server_name> <database_port> <database_name> <op_db_user> <op_db_password> <storage-type> <storage-server-name> <host-name> <os-type> <path-name>

Example:

clpplus -nw openpages/apassword@testdbserver:50000/OPX @sql-wrapper update-storage /home/op/upd-storage-output.log


testdbserver 50000 OPX openpages password UNCaix11 aix11 Unix /usr/opdata/openpages-storage

Table 61: Update storage wrapper script parameters for DB2 database


op_db_user OpenPages user name for accessing the OpenPages database.

op_db_password The OpenPages password for accessing the OpenPages database.

database_host Name of the DB2 server host computer that contains the OpenPagesdatabase.

database_port Port number of the DB2 database instance that is installed on the databaseserver. For DB2, the default port is 50000.

database_name Name of the OpenPages database.

log-file The name of the log file that the script creates and writes information to.

storage-type The type of file storage to be used. Valid values are as follows:

• LFS (local file system)

storage-server-name The name of the storage server.

host-name The host name of the computer.

os-type The type of operating system:

path-name The file path of the storage location.

Configuring IBM HTTP Server for load balancingIn a typical configuration that uses IBM HTTP Server for load balancing, IBM HTTP Server is installed on aseparate computer.

Web server plug-ins enable IBM HTTP Server to communicate requests for dynamic content, such asservlets, to the application server. A configuration file is generated for each plug-in.

Set the load-balancing port to 80, 443, or between 1024 and 65535. Otherwise, the port will not be set inthe Object URL Generator.

Before you begin

If you are configuring the IBM OpenPages GRC Platform environment for SSL, configure SSL before youconfigure the plugin-cfg.xml file. For more information, see the IBM OpenPages GRC PlatformAdministrator's Guide.

Procedure

1. Log on to the load-balancing server as a user with administrative privileges.2. Copy the OP_version_Configuration directory from the Installer DVD or on your network share

location to the local system.3. Create the web server instances for the OpenPages application and for the workflow server.

a) Log on to the application server as a non-root user who has administrative privileges.


b) In a web browser, type http://admin_server_name:9060/ibm/consolec) Enter the WebSphere administrator user name and password.d) Click Servers > Server Types > Web Servers.e) On the Web Servers page, click New.f) On the Select a node for the Web server page, select the application server from the Select node

list.g) Enter opapp in the Server name field.h) From the Type list, select IBM HTTP Server and click Next.i) On the Confirm new Web server page, review the settings and click Finish.j) In the messages box, click Save to commit the changes to the master configuration file.

k) In a web browser, type http://admin_server_name:9061/ibm/console, and repeat step 3 tocreate a web server instance that uses ibpmapp for the server name.

4. To create the plug-in for the OpenPages server instance, open a web browser and type http://admin_server_name:9060/ibm/console.a) Enter the WebSphere administrator user name and password.b) Click Servers > Server Types > Web Servers.c) Select the OpenPages server instance that you created and then click Generate Plugin.

The plug-in is created and saved to the $IHS_HOME/Plugins/config/webserver_name/directory.

The webserver_name is the OpenPages server instance that you created.d) To create the plug-in for the workflow server, In a web browser, type http://WAS_server_name:9061/ibm/console

e) Click Servers > Server Types > Web Servers.f) Select the workflow server instance that you created and click Generate Plugin.g) Copy both plug-in files to the load-balancing server.

5. On the load-balancing server, create a text file for the merged file.a) Open the plugin-cfg.xml files for the OpenPages and workflow servers.b) Copy the <Config> root element from one of the plugin-cfg.xml file and paste it into the new

file.

Note: Ensure that there is only one <Config> element in merged file.c) Copy the <Log> element from one of the two files, and if required, modify the name, and paste it

into the new file.d) Copy all the <VirtualHostGroup> elements from both files and paste them into the new file.

The <VirtualHostGroup> name must be unique. There must be only one <VirtualHostGroup>.e) Copy all <ServerCluster> elements from both the files and paste them into the new file and ensure

that the names are unique.

Ensure that the Server Name is unique across all clusters.f) In the <Transport> element, ensure that the keyring and stashfile properties use the same

location for all the application servers in the merged file.g) Copy all the <URIGroup> elements from both files and paste them into the new file.

Ensure that the names are unique.h) Copy all the <Route> elements from both files and paste them into the new file.i) Apply any changes that you made to the names of VirtualHostGroup, ServerCluster orURIGroup.

j) Save the new file.


6. Open the httpd.conf file, and add or modify the following line to point to the new merged plug-infile.

WebSpherePluginConfig /usr/IBM/HTTPServer/Plugins/config/OP/merged_file.xml

7. Ensure that the IgnoreAffinityRequests setting in the <ServerCluster> section is set to false:8. Save and close the file.9. Restart the IBM HTTP server.

Adding a load-balancing port to virtual hostsIf the load-balancing port is not 80 or 443, you must set the port in the virtual hosts.

Procedure

1. Log on to the IBM WebSphere Integrated Solutions Console as a server administrator.


The default port is 9060.2. Expand Environment and click Virtual Hosts.3. In the list on the Virtual Hosts page, click default_host.4. On the Virtual Hosts > default_host page, under the Additional Properties heading, click Host

Aliases.5. If the load-balancing port is not present in the table, click New....6. Leave Host Name as *. Update the port to the load-balancing port.7. Click Apply.8. In the Messages box, click Save to commit the changes to the master configuration.9. Restart all OpenPages servers.

Configuring the HTTP Server for SAMLV2.0 single sign-onIf you are using SAML V2.0 for single sign-on, extra configuration is required on the IBM HTTP Serverconfiguration for the SAML V2.0 service provider that you installed on the IBM OpenPages GRC Platformapplication server.

Procedure

1. Open the plugin-cfg-merged.xmlfile in a text editor2. Update the <UriGroup Name="default_host_OpenPagesCluster_URIs"> section with a new

element.

<Uri AffinityCookie="opsosa" AffinityURLIdentifier="opsosa" Name="/samlsps/*"/>


What to do nextEnsure that you replace the application server URL with the load balancing URL for the service providerwhen you configure SAML V2.0. For more information, see “Configuring SAML V2.0 single sign-on” onpage 236.


Configuring property files for load balancing on Windows, AIX, and Linux operatingsystems

Some configuration is required when using IBM HTTP Server as a load balancer in a WebSphereApplication Server environment.

Procedure

1. On the load-balancing web server, go to the /usr/IBM/HTTPServer/modules/ directory.

2. Open the merged plug-in file (plugin-cfg-merged.xml) in a text editor to make the followingchanges:a) Change the IgnoreAffinityRequests setting to true.b) Change the ServerIOTimeout setting for all servers to a value that allows sufficient time for the IBM

OpenPages GRC Platform application to respond to request from a client.c) For users to access the IBPM console and OpenPages simultaneously, in each of the following Uri

groups, change the cookie name.

For OpenPages change the cookie name to opsosa. For IBPM, change the name to opibpm.

<UriGroup Name="default_host_OpenPagesCluster_URIs"><Uri AffinityCookie="opsosa" AffinityURLIdentifier="opsosa" Name="/opws/*"/> <UriGroup Name="default_host_IBPMCluster_URIs"><Uri AffinityCookie="opibpm" AffinityURLIdentifier="opibpm" Name="/ibpmconsole/PortletWrapper/*"/>

d) Save and close the file.

3. Open the httpd.conf file in a text editor and make the following changes:

The default location of the file is /usr/IBM/HTTPServer/conf/httpd.conf.

a) To load the required modules, add or uncomment the following lines

LoadModule negotiation_module modules/mod_negotiation.soLoadModule proxy_module modules/mod_proxy.soLoadModule proxy_ajp_module modules/WebSphereCE/mod_proxy_ajp.soLoadModule proxy_balancer_module modules/WebSphereCE/mod_proxy_balancer.soLoadModule proxy_connect_module modules/mod_proxy_connect.soLoadModule proxy_http_module modules/mod_proxy_http.soLoadModule status_module modules/mod_status.soLoadModule was_ap22_module modules/mod_was_ap22_http.so

b) Modify the ServerName setting to point to the host name where you installed the IBM HTTP WebServer.

ServerName=MYSERVERNAME.DOMAIN.COM

c) Modify the ServerRoot setting to point to the installation location of the Apache Web Server. Forexample,

ServerRoot=/usr/IBM/HTTPServer/htdocs

d) Add the Allow from all attribute to each Directory element.

<Directory>Options Indexes FollowSymLinksAllowOverride NoneOrder allow,denyAllow from all</Directory>

e) Uncomment the parameter ExtendedStatus setting and set the value to On.f) Set the location tags for server-status and server-info.


For example,

<Location /server-status>SetHandler server-statusOrder Deny,AllowDeny from allAllow from all</Location>

<Location /server-info>SetHandler server-infoOrder Deny,AllowDeny from allAllow from all</Location>

4. Save and close the file.5. Restart the IBM HTTP server.

Configuring property files for each OpenPages GRC Platform instanceYou must edit the server properties file on each IBM OpenPages GRC Platform cluster member to point tothe load balancer.

Procedure

1. Log on to the OpenPages cluster member as a non-root user who has administrative privileges.2. Go to the OP_Home/aurora/conf directory.3. Open the aurora.properties file in a text editor.

a) Edit the application.url.path to point to the fully qualified domain name of the load balancer.

application.url.path=http\://op-load-balancer.domain.com\:port/openpages

b) Save and close the file.

4. Open each server_name-OPNode1Server#-server.properties file in a text editor.a) Edit the url.path lines to point to the fully qualified domain name of the load balancer.

url.path.workflow.admin=http\://op-load-balancer.domain.com\: port/ibpmconsoleurl.path.openpages=http\://op-load-balancer.domain.com\:port/openpages

b) Save and close each server.properties file.

5. Open each server_name-OPNode1Server#-sosa.properties file in a text editor.a) Edit the Application.url.path lines to point to the fully qualified domain name of the load balancer.

application.url.path=https\://op-load-balancer.domain.com\:port /openpages

b) Save and close each server.properties file.

6. Open each server_name-IBPMNode#Server-server.properties file in a text editor.a) Edit the url.path lines to point to the fully qualified domain name of the load balancer.

url.path.workflow.admin=http\://op-load-balancer.domain.com\: port/ibpmconsoleurl.path.openpages=http\://op-load-balancer.domain.com\:port/openpages

b) Save and close each server.properties file.7. Restart the web server.


Customizing the load balancer for large data setsFor databases with a large data set, some IBM OpenPages GRC Platform reports might time out beforecompletion. If you experience problems with reports that are timing out, change configuration settings inthe IBM HTTP Web Server configuration file.

Change the following settings:

TimeOutThe number of seconds IBM HTTP Web Server waits to receive a GET request between receipt of TCPpackets on a POST or PUT request and between ACKs on transmissions of TCP packets in responses.

KeepAliveTimeoutThe number of seconds IBM HTTP Server waits for a subsequent request before closing theconnection.

Note: A high value for the setting can cause performance problems, especially if the higher timeoutcauses server processes to wait for idle clients.

Procedure

1. Log on to load balancing web server as a user with administrative privileges.2. Open httpd.conf in a text editor.3. Change the KeepAliveTimeout property to a higher value.

KeepAliveTimeout 1800

4. Add and then set the TimeOut property.

Ensure that the setting prevents timeout errors.

For example, TimeOut 18005. Save and close the file.6. Restart IBM HTTP Web Server.

Load balancing the OpenPages GRC Platform reporting serverIBM OpenPages GRC Platform CommandCenter uses IBM Cognos Business Intelligence, which can scalehorizontally. To scale OpenPages CommandCenter vertically within the same environment, increase thenumber of processes that are available to handle request. Depending on the load, you can configure moredispatchers.

To scale OpenPages CommandCenter horizontally, install more environments and register the IBMCognos dispatchers. Incoming requests are distributed across the multiple environments.

The number of dispatchers you need depends on the operating system, system resources, the number ofusers, and other factors.

For more information about configuring dispatchers for your environment, see the IBM Cognosdocumentation library (http://www-01.ibm.com/support/knowledgecenter/api/redirect/cbi/v10r2m1/index.jsp).

When you design and implement the infrastructure for the IBM Cognos reporting servers, the followingOpenPages components determine how many reporting servers are required for the OpenPages solution:

• The number of computed fields on an object type.• The complexity of the computed fields on an object type.• The number of reporting fragments on an object type.• The complexity of the computed fields on an object type.• The number of embedded reports on the classic home page.• Whether reporting fragments and computed fields are set to appear automatically.


http://www-01.ibm.com/support/knowledgecenter/api/redirect/cbi/v10r2m1/index.jsp

http://www-01.ibm.com/support/knowledgecenter/api/redirect/cbi/v10r2m1/index.jsp

• The number of IBM Cognos reports available to users.• The complexity of IBM Cognos reports available to users.• The custom components using the OpenPages reporting framework.

You should review the IBM Cognos log files and metrics to determine whether more reporting servers arerequired in the environment if timeout errors occur or issues occur as a result of excessive load.

Adding OpenPages GRC Platform servers to the Cognos Application Firewall safe listBy default, the IBM Cognos Application Firewall is enabled. Cognos Application Firewall validates domainand host names to protect URLs that are created. Cognos Application Firewall considers domain namesderived from the environment configuration properties as safe domain names. Use Cognos Configurationto add IBM OpenPages GRC Platform application servers to the list of valid domains and host names.

Procedure

1. Log on to the reporting server as a user with administrative privileges.2. Start IBM Cognos Configuration.3. In the Explorer pane, go to Local Configuration > Security > IBM Cognos Application Firewall.4. In the Properties pane, click the Valid domain names or hosts field and click the pencil icon.5. In the Valid domain or hosts window, click Add.6. Enter the names of all OpenPages application servers.7. Click OK.8. Save the configuration and restart the Cognos service.

If you use Windows Services to restart the Cognos service, the service is listed as CommandCenter.

Communication between OpenPages GRC Platform CommandCenter serversIf you install Cognos on more than one computer, you must configure the distributed installations tocommunicate with each other

Configure the following communication paths:

• Configure the primary Cognos server as the default active server.• All Cognos servers must know the location of the content store database.• All Cognos servers must know the location of the other Cognos servers.• All Cognos servers must use the same cryptographic settings.• All Cognos servers must have their system clock synchronized.

Configuring the primary reporting serverIn a clustered environment, one reporting server acts as the primary server, or default active server, andone or more reporting servers act as secondary servers.

Procedure

1. Ensure that IBM OpenPages GRC Platform CommandCenter is not running on any server.2. On the reporting server that is designated as the primary server, start IBM Cognos Configuration.

Tip: Use the computer with the highest processor speed for the default active server.3. In the Explorer pane, click Environment.4. For the Gateway URI, change the localhost portion of the URL to the name of the primary

reporting server.5. For the Dispatcher URI for Gateway, click the pencil icon next to the Value box.6. In the Current Values list, change the localhost portion of the URL to the name of the primary

Cognos computer.


a) For each additional Cognos computer, click Add.b) Change the localhost portion of the URL to the name of each additional Cognos computer.c) Click OK.

7. For the Content Manager URIs, click the pencil icon next to the Value box.a) In the Current Values list, change the localhost portion of the URL to the name of the primary

Cognos computer.b) For each additional Cognos computer, click Add.c) Change the localhost portion of the URL to the name of each additional Cognos computer.d) Click OK.

8. In the Explorer pane, click Security > Cryptography.9. In the Properties pane, under CSK settings, ensure that Store symmetric key locally? is set toTrue.The keystore must be created on the default active Cognos computer

10. Click File > Save.11. Click Actions > Start.

When the services start, this computer becomes the default active Cognos computer.

Configuring secondary serversIn a clustered environment, configure one or more reporting servers to act as secondary servers.

Procedure

1. Ensure that Cognos is running on the primary Cognos server.2. On the reporting server that is designated as secondary server, start IBM Cognos Configuration.3. In the Explorer pane, click Environment.4. In the Environment - Group Properties pane, click Gateway URI.5. In the Value field, change the localhost portion of the URL to the name of the primary Cognos

computer.6. In the Environment - Group Properties pane, click Dispatcher URI for Gateway.

a) Click the pencil icon next to the Value box.b) In the Current Values list, change the localhost portion of the URL to the name of the primary

Cognos computer.c) For each additional Cognos computer, click Add.d) Change the localhost portion of the URL to the name of each additional Cognos computer.e) Click OK.

7. In the Environment - Group Properties pane, click Content Manager URIs.a) Click the pencil icon next to the Value box.b) In the Current Values list, change the localhost portion of the URL to the name of the primary

Cognos computer.c) For each additional Cognos computer, click Add.d) Change the localhost portion of the URL to the name of each additional Cognos computer.e) Click OK.

8. In the Explorer pane, under Security, click Cryptography.9. In the Properties pane, under CSK settings, set Store symmetric key locally to False.

Note: The keystore is created on the primary Cognos computer. There can be only one keystore in aload balanced Cognos installation.

10. In the Explorer window, under Security, Cryptography, click Cognos.


11. Under the Certificate Authority settings property group, set the Password property to match theone that you configured on the primary Cognos server.

Ensure that all other cryptographic settings match the settings that you configured on the primaryCognos computer.

12. In the Explorer pane, under Data Access > Content Manager, click Content Store.13. Ensure that the values for the content store match the primary Cognos computer14. Click File > Save.15. Click Actions > Start.

Configuring an Apache load balancer or proxy serverIf you are using an external proxy server for load balancing, you must add a proxy redirection directive tothe httpd.conf file on the proxy server. Requests sent to the proxy server are redirected to the serverspecified in the httpd.conf file.

Procedure

1. Log on to the load balancer server as a user who has administrative privileges.2. Go to the Apache_Home\conf\ directory, and open the httpd.conf file in an editor.3. Add the following lines:

<Location /ibmcognos/>ProxyPass http://primary_reporting_server/ibmcognos/SetEnv force-proxy-request-1.0 1 SetEnv proxy-nokeepalive 1</Location>

Note: You must include the trailing forward slash in the ProxyPass directive when specifying theCognos virtual directory (/ibmcognos/).


Using a reverse proxy server for load balancingIf you are using a reverse proxy server for load balancing, you must add aProxyPassReverseCookieDomain value to the httpd.conf file on the reverse proxy server.

Procedure

1. Log on to the load balancer server as a user who has administrative privileges.2. Go to the Apache_Home\conf\ directory, and open the httpd.conf file in an editor.3. Add a ProxyPassReverseCookieDomain value to the file as follows:

# ProxyProxyPass /openpages http://<hostname>:<port>/openpagesProxyPassReverse /openpages http://<hostname>:<port>/openpages

ProxyPass /ibmcognos http://<hostname>:<port>/ibmcognosProxyPassReverse /ibmcognos http://<hostname>:<port>/ibmcognos

ProxyPassReverseCookieDomain <internal.domain.com> <public.domain.com>

4. Save and close the file.5. Restart the web server.


Changing the CommandCenter host settingsYou must update configuration files to use the IBM OpenPages GRC Platform CommandCenter servername and port settings.

Procedure

1. Log on to the OpenPages GRC Platform application server as a user with administrative privileges.2. Open a browser window and type the following URL to go to the OpenPages application:

http://OP_server_name:port/openpages3. Log on to the OpenPages application as a user with administrative privileges.4. Under Administration, select Settings.

a) Expand the OpenPages > Platform > Reporting Schema > Object URL Generator.b) Click Host.c) In the Value field, update the setting to point to the OpenPages server.

Note: If you use the Cognos in a load-balanced environment, you must type the fully qualifieddomain name of the load balancing server. If required, change the port.

5. Stop OpenPages services.6. On the application server, go to the OP_Home\aurora\conf directory.7. In the cognos.framework.refresh.servlet=http\://localhost\:8080/crf-refresher

property, replace localhost\:8080 with the reporting server name and port.

cognos.framework.refresh.servlet=http\://ccserver\:8080/crf-refresher8. In the cognos.server=http\://localhost:80/cognos8/cgi-bin/cognos.cgi property,

replace localhost:80 with the reporting server name and port number.

cognos.server=http\://ccserver:80/cognos8/cgi-bin/cognos.cgi9. Add the following value to the logout.url.cognos= property:

http\://CommandCenter_server_name\CommandCenter_port\/cognos/cgi-bincognos.cgi? b_action\=xts.run&m\=portal/logoff.xts&h_CAM_action\=logoff

Example:

logout.url.cognos=http\://ccserver\:8080/cognos/cgi-bincognos.cgi? b_action\=xts.run&m\=portal/logoff.xts&h_CAM_action\=logoff

10. Save your changes and exit the editor.



Chapter 17. Single sign-on integration for OpenPagesGRC Platform application server and the reportingserver

IBM OpenPages GRC Platform can integrate into a number of single sign-on solutions, such as CASiteMinder. You can also configure the reporting server for single sign-on.

To integrate single sign-on, configure the settings in the OpenPages GRC Platform application interface.

You can use one of the following options for configuring single sign-on:

• Header-based single sign-on.

For more information, see “Configuring header-based single sign-on” on page 235.• SAML V2.0 single sign-on.

For more information, see “Configuring SAML V2.0 single sign-on” on page 236.

Attention: OpenPages user names are case-sensitive. If you are using single sign-on (SSO) orLDAP authentication, the user name you choose here must match the user name you enter in theSSO or LDAP system.

Configuring header-based single sign-onTo integrate header-based single sign-on for IBM OpenPages GRC Platform applications, complete thefollowing steps.

Procedure

1. Start the OpenPages GRC Platform services.2. Log on to the OpenPages application interface as a user with administrative privileges.3. Update the Show Hidden Settings setting.

a) Click Administration > Settings > Common > Configuration.b) Set the value of Show Hidden Settings to true:

4. Update the Class Name, Session Attribute, and Username Attribute settings.a) Click Platform > Security > Single Sign On > Implementations > Header-based.b) Set the value of Class Name to com.openpages.singlesignon.HTTPHeaderBasedModule.c) Update the value of Session Attribute to match the session attribute for your single sign-on

system.

The following examples show values for the Session Attribute parameter.

• Using SiteMinder 6.0, the value of the Session Attribute parameter is SMSERVERSESSIONID• Using Tivoli Access Manager 6.1, the value of the Session Attribute parameter is iv_creds

d) Update the value of Username Attribute to match the user name attribute for your single sign-onsystem.

The following examples show values for the Username Attribute parameter.

• Using SiteMinder 6.0, the value of the Username Attribute is SMUSER• Using Tivoli Access Manager 6.1, the value of the Username Attribute is iv_user

5. Reset the value of Show Hidden Settings to false.6. Click Save.

7. Update the default file name and redirect to the following path: /home.do (rather than /openpagesor /openpages/log.on.do).

What to do nextYou must now enable single sign-on and set the password to never expire.

Configuring SAML V2.0 single sign-onTo integrate SAML V2.0 single sign-on (SSO) for IBM OpenPages GRC Platform applications, complete thefollowing steps.

Before you begin

You must install IBM WebSphere SAML web single sign-on (SSO). To do this, install the WebSphere SAMLAssertion Consumer Service (ACS) as a service provider, then enable the SAML Trust AssociationInterceptor (TAI) in WebSphere.

After you enable your WebSphere system for SAML V2.0 SSO, you must configure your SAML V2.0 IdentityProvider (IdP) to trust the ACS. For more information, see the IBM WebSphere documentation (http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/twbs_enablesamlsso.html)

At a high level, you need to do the following tasks:

• Install SAML ACS in WebSphere by using the wsadmin command line or WebSphere administrativeconsole

• Install SAML Trust Association Interceptor (TAI) in WebSphere by using the wsadmin command line• Determine the Identity Provider (IdP) that are you using for authentication, for example Microsoft Active

Directory Federation Services (AD FS) or another SAMLv2 identity service provider.• Import the IdP metadata and signed certificate into WebSphere.• Configure the custom properties of the SAML Trust Association Interceptor to meet the requirements of

your environment.• Export the SAML Trust Association Interceptor metadata for the WebSphere service. You will later

import the metadata to your IdP.

For more information, see Configuring single sign-on (SSO) partners in the WebSphere documentation(http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/twbs_configuresamlssopartners.html)

When you configure the custom properties of the SAML Trust Association Interceptor, configure thefollowing properties at a minimum. The properties that you need to set depend on the Identity Provider(IdP) that are you using and your OpenPages server topology. For more information, see the WebSpheredocumentation SAML web single sign-on (SSO) trust association interceptor (TAI) custom properties(http://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/rwbs_samltaiproperties.html)


http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/twbs_enablesamlsso.html

http://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/twbs_configuresamlssopartners.html

http://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/rwbs_samltaiproperties.html

Table 62: Required Trust Association Interceptor (TAI) custom properties for OpenPages

Property name Description

acsURL Specifies an endpoint URL, the location to which the assertion is sent,according to partner requirements.

This property specifies the URL of the assertion consumer service (ACS) orbusiness application.

For example, if you are using the WebSphere ACS, the URL would be the URLof the assertion consumer service (ACS):

https://<hostname>:<sslport>/samlsps/<any URI pattern string>

login.error.page Specifies a URL that is an endpoint and that accepts SAML authenticationrequests. In other words, the URL must resolve to the page where theauthentication is done.

This property specifies the error page, IdP login page, or custom mappingclass to which an unauthenticated client request is redirected.

EntityID Specifies a globally unique name for the SAML entity, either an IdentityProvider (IdP) or a Service Provider (SP).

This property is used to verify the AudienceRestriction in the SAMLassertion.

By default, this property is set to the value sso_<id>.sp.aclUrl.

SingleSignOnUrl Specifies the URL of the SSO service of the Identity Provider (IdP).

By default this property is set by importing the IdP metadata.

filter Specifies a condition that is checked against the incoming HTTP request, todetermine whether the HTTP request is selected for a SAML web SSOpartner.

Follow these examples when you configure the custom properties.

1. Setting sp.filter for the OpenPages application:

• For example:

Name=sso_1.sp.filter,value=remote-address!=remote-address!=127.0.0.1;request-url%=/openpages

• If you want to use SSO on OPX, you must update the custom properties, because SSO cannot beused on OpenPages GRC Platform and OPX at the same time. For example:

Name=sso_1.sp.filter,value=remote-address!=9.37.228.211;remote-address!=127.0.0.1;request-url%=/opx

• If you have shortened the OpenPages GRC Platform URL, create an alternative filter to exclude thefollowing request-url paths.

Note: In this example, the context URL is /. Modify the code to suit your environment.

Name=sso_1.sp.filter, value=request-url!=/opx;request-url!=/grc/api;request-url!=/opLogin;request-url!=/securityHelper;

Single sign-on integration for OpenPages GRC Platform application server and the reporting server 237

request-url!=/publishweb;request-url!=/opws

For more information, see "Shortening the URL for OpenPages GRC Platform" in the IBM OpenPagesGRC Platform Administrator's Guide.

2. Setting values for load balancing:

If you are using a load balancing configuration, you must update the custom properties to include theload balancer URL for each service provider URL. For example:

Name=sso_1.sp.acsUrl = https://<load_balancer_url>/samlsps/opName=sso_1.sp.EntityID = https://<load_balancer_url>/samlsps/opName=sso_1.sp.targetUrl = https://<load_balancer_url>/openpages/home.do

After you configure the custom properties, apply and save the changes.

Stop the OpenPages GRC Platform services, perform a syncNode operation, and then start theOpenPages GRC Platform services.

Procedure

1. Edit the following file in a text editor:

<OP_Home>/profiles/OpenPagesDmgr/config/cells/OpenPagesCell/applications/op-apps.ear/deployments/op-apps/sosa.war/WEB-INF/web.xml

2. Uncomment the following section in the web.xml file:

<security-constraint id="SecurityConstraint"> <web-resource-collection id="WebResourceCollection"> <web-resource-name>Protected with AllAuthenticated role</web-resource-name> <url-pattern>/opLogin</url-pattern> </web-resource-collection> </security-constraint> <security-constraint id="SecurityConstraint"> <web-resource-collection id="WebResourceCollection"> <web-resource-name>Protected with AllAuthenticated role</web-resource-name> <url-pattern>/securityHelper</url-pattern> </web-resource-collection> </security-constraint> <security-constraint id="SecurityConstraint"> <web-resource-collection id="WebResourceCollection"> <web-resource-name>Protected with AllAuthenticated role</web-resource-name> <url-pattern>/log.on.do</url-pattern> </web-resource-collection> </security-constraint> <security-constraint id="SecurityConstraint"> <web-resource-collection id="WebResourceCollection"> <web-resource-name>Protected with AllAuthenticated role</web-resource-name> <url-pattern>/*</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint id="AuthConstraint"> <role-name>AllAuthenticated</role-name> </auth-constraint> </security-constraint> <security-role> <description>AllAuthenticated role</description> <role-name>AllAuthenticated</role-name> </security-role> <login-config> <auth-method>BASIC</auth-method> <realm-name>customRealm</realm-name> </login-config>

3. Add OpenPages GRC Platform users to the All Authenticated in trusted realms role in WebSphere.a) Open the WebSphere administrative console.


b) Go to Applications > WebSphere Enterprise Applications > op-apps > Security role to user/group mapping.

c) Check the box for AllAuthenticated.d) Click Map Special Subjects, and then click All Authenticated in Trusted Realms.e) Click Apply, and then click Save.

4. Stop the OpenPages GRC Platform services.5. Start the OpenPages Deployment Manager.6. Synchronize the OpenPages nodes.

• On Microsoft Windows operating systems, go to the <OP_Home>\profiles\<host_name>-OPNode1\bin directory and run syncNode.bat <admin_host_name> <OP_SOAP_port>.

• On UNIX operating systems, go to the <OP_Home>/profiles/<host_name>-OPNode1/bindirectory and run syncNode.sh <admin_host_name> <OP_SOAP_port>.



syncNode.bat <admin_host_name> <OP_SOAP_port> -user <admin_username> -password <admin_password>

7. Start the OpenPages GRC Platform services.8. Open a web browser and go to the current OpenPages application.9. Log on as a user with administrative permissions.

10. Update the Show Hidden Settings setting.a) Click Administration > Settings > Common > Configuration.b) Set the value of Show Hidden Settings to true:

11. Click Platform > Security > Single Sign On > Implementations.12. Set the value to HTTP-User-based.

What to do nextYou must now enable single sign-on and set the password to never expire.

Configuring the single signon logout destinationTo securely log out from an IBM OpenPages GRC Platform application session where single signon isenabled, configure the system to redirect the user.

Logging out of the OpenPages GRC Platform application does not automatically log the user out of a singlesignon system. If you use Back in the web browser to reenter the OpenPages application, your session isre-created. The session uses the existing, valid third-party credentials.

Procedure

1. Log on to the OpenPages application interface as a user with administrative privileges.2. Under Administration, select Settings.3. Expand the OpenPages > Platform > Security.4. Click Logout URL to open the detail page.5. In the Value box, type a fully qualified URL.6. Click Save.


Enabling single sign-onAfter you configure single sign-on, you must enable it and set the password to never expire on the userprofile.

Procedure

1. Complete the following steps to enable single sign-on.a) Click Administration > Settings > Platform > Security > Single Sign On > Implementations.b) Set the value of OP to true.c) Set the value of SOX to true.

2. Set the password to never expire.

You must complete these steps for each user individually.

a) Click Administration > Security > Users, Groups and Domains.b) Click Workflow, Reporting and Others.c) Click a user from the Users tab, and click Edit.d) Ensure the User must change password at next logon option is not selected.e) Select the Password never expires option.f) Click Save.

Disabling single sign-on for OpenPages GRC PlatformYou can disable single sign-on for IBM OpenPages GRC Platform.

Procedure

1. Start the OpenPages GRC Platform services.2. Open a web browser and go to the current OpenPages application.3. Log on as a user with administrative permissions.4. From the Administration menu, select Settings.5. In all versions, disable single sign-on as follows:

a) Expand the OpenPages > Platform > Security > Single Sign On.b) Click OP to open its detail page.c) In the Value field on the setting detail page, set the value to false.d) Click Save.e) Click SOX to open its detail page.f) In the Value field on the setting detail page, set the value to false.g) Click Save.

Configuring single signon for a reporting serverIf you are using single sign-on (SSO), update the jsp responsible for the single signon redirections bydeploying a new file.

Load the JavaServer Pages through the ObjectManager tool by using the CommandCenter-integration-op-config.xml file. The file is on the OpenPages installation DVD.


Procedure

1. Log on to a computer that has SQL*Plus and access to the database server.

Note: For AIX installations, log on as the opuser or a non-root user who has administrative privileges.2. From the Installer DVD or on your network share location, copy the OP_version_Configuration\loader-data\commandcenter directory to the local system.

3. Go to the OP_Home/bin directory.4. Run the following command:

ObjectManager load config OpenPagesAdministrator password path-to-loader-file CommandCenter-integration



Chapter 18. Fix packsA fix pack is a cumulative collection of fixes that is made available between scheduled refresh packs,manufacturing refreshes, or releases. It is intended to allow customers to move to a specific maintenancelevel.

Fix Pack 7.2.0.2The documentation for the installation of OpenPages Fix Pack 7.2.0.2 consists of four main sections:preinstallation tasks, installation tasks, postinstallation tasks, and additional tasks.

For more information on new features in Fix Pack 7.2.0.2, see the New features in version 7.2.0.2 topic inthe OpenPages GRC Platform New Features Guide 7.2.0.

You can find information about defect corrections on the OpenPages GRC Platform 7.2 Fix List (http://www.ibm.com/support/docview.wss?uid=swg27047061#tab_72FP2) page.

For additional information about OpenPages 7.2, see the Release Notes.

Installation process overview for Fix Pack 7.2.0.2The installation process for IBM OpenPages GRC Platform Fix Pack 7.2.0.2 consists of a series ofprocedures, which are divided into preinstallation, installation, and postinstallation stages. Someprocedures are mandatory; others might be optional, depending on your configuration.

You can install Fix Pack 7.2.0.2 directly onto IBM OpenPages GRC Platform 7.2. Alternatively, you caninstall Fix Pack 7.2.0.2 after installing Fix Pack 7.2.0.1.

During the installation process for Fix Pack 7.2.0.2, you have the option to use the OpenPagesAdministrative Console to upgrade the OpenPages database automatically. Alternatively, you can chooseto upgrade it manually.

The following procedures are mandatory.Preinstallation stage

1. Perform backups, including the solutions helpers and Dojo toolkit. For more information, seeBackups for the existing environments for Fix Pack 7.2.0.2

2. Make sure that the OpenPages servers are running, including OpenPages application servers andreporting servers.

Installation stage

1. Update the OpenPages Administrative Console. For more information, see Updating theOpenPages Administrative Console for Fix Pack 7.2.0.2.

2. Install Fix Pack 7.2.0.2. For more information, see Installing Fix Pack 7.2.0.2.

Postinstallation stage

1. Restore the solutions helpers and Dojo toolkit. For more information, see Restoring the solutionshelpers and Dojo toolkit for Fix Pack 7.2.0.2.

2. Install solutions updates. For more information, see Applying the solutions fix pack for Fix Pack7.2.0.2.

The following procedures are optional or conditional.Configure lifecycles

For more information, see New configurable lifecycles (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_nfg.7.2.0.doc/c_op_nfg_72fp1_lc_config.html).

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_nfg.7.2.0.doc/c_op_nfg_72fp2_overview.html

http://www.ibm.com/support/docview.wss?uid=swg27047061#tab_72FP2

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_nfg.7.2.0.doc/c_op_nfg_72fp1_lc_config.html

Install and configure the approval appFor more information, see Chapter 20, “Approval app,” on page 329.

Install and configure IBM OpenPages Loss Event EntryFor more information, see Loss Event Entry.

Re-create the reporting schemaThis procedure is required if you are using IBM DB2 and you have added fields, for example, if youinstalled and configured the approval app. For more information, see Re-creating the reportingschema for Fix Pack 7.2.0.2.

Re-create the reporting frameworkThis procedure is required if you added new fields, for example, if you installed and configured theapproval app or IBM OpenPages Loss Event Entry, and you want to report on the new fields. For moreinformation, see Re-creating the framework generation for Fix Pack 7.2.0.2.

Re-create the global search indexThis procedure is required if you previously enabled the Global Search feature. For more information,see Re-creating the global search index for Fix Pack 7.2.0.2.

Preinstallation tasks for Fix Pack 7.2.0.2Before you can apply the OpenPages Fix Pack Installer for 7.2.0.2, you must have OpenPages 7.2.0.0 or7.2.0.0 Interim Fix 1 installed, and optionally Fix Pack 7.2.0.1.

Backups for the existing environments for Fix Pack 7.2.0.2Before you can apply the OpenPages Fix Pack Installer for 7.2.0.2, you must back up the OpenPagesapplication environment, the Cognos environment, and the database.

OpenPages backup and CommandCenter backup utilitiesBefore you apply the OpenPages Fix Pack Installer for 7.2.0.2, use the OpenPages backup (OPBackup)utility on each application server. Use the CommandCenter backup (OPCCBackup) utility on eachreporting server.

To complete a DB2 database backup, use DB2 backup tools. To complete an Oracle database backup, usethe OPBackup utility. For more information, see the following sections in the IBM® OpenPages® GRCPlatform Administrator Guide:

• Using IBM OpenPages GRC Platform utilities with IBM DB2 databases (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_db2_using_utilities.html?lang=en

• Using IBM OpenPages GRC Platform utilities with Oracle databases (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_using_utilities.html?lang=en)

Run the OpenPages backup (OPBackup) and CommandCenter backup (OPCCBackup) utilities tocompletely back up your OpenPages database and application, and CommandCenter Content Store andfiles.

If global search is enabled, disable it before you run OPBackup. For more information, see UsingOPBackup and OPRestore when global search is enabled (http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_search_op_backup.html) in the IBM® OpenPages® GRC Platform Administrator Guide.

For more information about how to configure the Oracle Data Pump directory for the first-time use, seethe The OPBackup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_opbackup_utility.html?cp=SSFUEU_7.2.0%2F2-0-17-6&lang=en) and Using the Cognos Backup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_ccbackup_utility.html?lang=en) chapters in the IBM® OpenPages® GRC PlatformAdministrator Guide.


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_db2_using_utilities.html?lang=en

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_using_utilities.html?lang=en

http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_search_op_backup.html


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_opbackup_utility.html?cp=SSFUEU_7.2.0%2F2-0-17-6&lang=en

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_ccbackup_utility.html?lang=en

Backing up the solutions helpers and Dojo toolkitBefore you can apply the OpenPages Fix Pack Installer for 7.2.0.2, you must back up the solutions helpersand Dojo toolkit.

About this task

The fix pack installer backs up and restores the session-timeout setting configured in the web.xmland the context-root setting configured in the application.xml file. If you made more changes tothe OpenPages web configuration XML files, you must back up these changes.

Procedure

1. Create a backup folder for backing up the solutions helpers and the Dojo toolkit, for example,C:\OpenPages\patch\helper_backup.

2. Copy the JSP helpers and Dojo toolkits (both shipped with product and customized) to the backupfolder in the following locations:

• \dojo_1.10.4\dojo\• \dojo_1.10.4\dojox\• \dojo_1.10.4\dijit\

You can find these folders in the following location: <openpages installation folder>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war.

3. If you deployed a customized toolkit or helpers (for example, Helper JSPs or images) in locations otherthan the locations in step 2, back them up so that you can restore them after the fix pack installation iscompleted.

Backing up directories and filesBefore you can apply the OpenPages Fix Pack Installer for 7.2.0.2, you must back up your directories andfiles.

About this task

This task applies to both Windows and UNIX environments.

Important: For information about starting and stopping servers, see Starting and stopping servers (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_starting_and_stopping_servers.html?lang=en).

Procedure

1. Log in to the admin and non-admin servers as a user with administrative privileges and full access tothe local server drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example, opuser.

2. Stop all OpenPages servers, including the following, on each server in your environment:

• OpenPages application and workflow servers• IBM Cognos server• OpenPages Framework Model Generator server• OpenPages Global Search server

3. Create the following backup directories in a location that is different from the installation location. Forexample:Operating system Example backup directory path

Windows C:\OpenPages7200Backup\OpenPages

C:\OpenPages7200Backup\Fujitsu\InterstageBPM

Fix packs 245

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_starting_and_stopping_servers.html?lang=en

Operating system Example backup directory path

C:\OpenPages7200Backup\Cognos\cognos\c10_64

C:\OpenPages7200Backup\CommandCenter

C:\OpenPages7200Backup\OPSearch

AIX or Linux /opt/OpenPages7200Backup/OpenPages

/opt/OpenPages7200Backup/Fujitsu/InterstageBPM

/opt/OpenPages7200Backup/Cognos/cognos/c10_64

/opt/OpenPages7200Backup/CommandCenter

/opt/OpenPages7200Backup/OPSearch

Important: If you are installing Fix Pack 7.2.0.2 on top of OpenPages 7.2, use the folder nameOpenPages7200Backup when you create the backup directory path. Alternatively, if you are installingFix Pack 7.2.0.2 on top of an earlier fix pack that has been applied, create a folder path name thatcontains the OpenPages version number that you are backing up, for example,OpenPages7201Backup. The following steps assume that you are installing Fix Pack 7.2.0.2 on top ofOpenPages 7.2.0.0; use the folder name OpenPages7201Backup if you are installing Fix Pack 7.2.0.2on top of Fix Pack 7.2.0.1.

4. Copy the following directories and files from the <OP_Home> installation directory to the backupdirectory location OpenPages7200Backup\OpenPages:

• <OP_Home>\applications• <OP_Home>\aurora• <OP_Home>\bin• <OP_Home>\profiles• <OP_Home>\openpagesregistry.xml

5. Copy the entire <Workflow_Home> installation directory to the backup directory locationOpenPages7200Backup\Fujitsu\InterstageBPM.

6. Copy the following directories from the <Cognos_Home> installation directory to the backup directorylocation OpenPages7200Backup\Cognos\cognos\c10_64:

• <Cognos_Home>\webapps\p2pd\WEB-INF\lib• <Cognos_Home>\configuration

7. Copy the following Command Center directories and file from the <CC_Home> installation directory tothe backup directory location OpenPages7200Backup\Command Center:

• <CC_Home>\wlp• <CC_Home>\tools\bin• <CC_Home>\openpagesregistry.xml

8. Copy the following directories and file from the <SEARCH_Home> installation directory to the backupdirectory location OpenPages7200Backup\OpSearch:

• <SEARCH_Home>\opsearchtools• <SEARCH_Home>\openpagesregistry.xml

9. Start all servers, including the following:

• OpenPages application and workflow server• IBM Cognos server• OpenPages Framework Model Generator server• OpenPages Global Search server


Installation tasks for Fix Pack 7.2.0.2Before you apply the OpenPages Fix Pack Installer for 7.2.0.2, make sure that you have all requiredbackup folders and files.

Preparing for the installation of Fix Pack 7.2.0.2To ensure that the application of the OpenPages Fix Pack Installer for 7.2.0.2 is able to perform allnecessary steps, you must perform some preparation tasks.

Procedure

1. If the Search index was created before applying this fix pack, with all OpenPages servers running,complete the following steps to drop the Search index:a) Log in to OpenPages with an administrative account.b) Click Administration > Global Search and click Disable.c) Click Administration > Global Search and click Drop.

2. If you did not install Fix Pack 7.2.0.1, complete the following steps to stop the search services:

• For Windows, from Windows Services locate the service that is called IBM OpenPages GRC - GlobalSearch and stop it.

• For UNIX, in a command line enter the following commands:

– cd <OP_Home>/OPSearch/opsearchtools/– java -jar opsearchtool.jar stopIndexing -indexname openpages– java -jar opsearchtool.jar stopIndexing -indexname folderacl– java -jar opsearchtool.jar stopSolr

3. If you installed Fix Pack 7.2.0.1, complete the following steps to stop the search services:

• For Windows, go to the <OP_Home>/OPSearch/opsearchtools/ directory and typeStopSearchServers.cmd.

• For UNIX, go to the <OP_Home>/OPSearch/opsearchtools/ directory and type ./StopSearchServers.sh.

4. For either Windows or UNIX, verify that global search is fully stopped by taking the following steps:a) In the directory <OP_Home>/OPSearch/opsearchtools/, examine the filesopsearchtool_openpages.state and opsearchtool_folderacl.state and verify that thePID value is -1.

b) From a browser, point to your search server at ports 8983 and 8985 and make sure that the Solrsearch platform cannot be reached, for example, https://<search-server>:8983/ andhttps://<search-server>:8985/.

If the stop verification fails, repeat the preceding step and then follow the steps in Global searchsetup or administration fails (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_op_ig_trbl_sch_svr_reset.html?lang=en).

5. Ensure that there are no long running OpenPages processes, for example:

• performing a FastMap import• creating the Global Search index

6. If you have a DB2-based database server, and if you plan to use the approval app, complete thefollowing steps to drop the reporting schema.

Important: If you do not plan to use the approval app, do not complete this step.

a) Log in to OpenPages with an administrative account.b) Enable System Admin Mode (SAM).c) Click Administration > Reporting Schema and click Drop.

Fix packs 247

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_op_ig_trbl_sch_svr_reset.html?lang=en

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_op_ig_trbl_sch_svr_reset.html?lang=en

d) Click Refresh until the process is 100% complete.e) Disable SAM.

7. If you plan to upgrade the OpenPages database to version 7.2.0.2 manually, stop all IBM OpenPagesApplication servers (admin and non-admin), Reporting servers (active and standby), and the Searchserver. For information about starting and stopping servers, see Starting and stopping servers (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_starting_and_stopping_servers.html?lang=en).

Important: If you plan to upgrade the OpenPages database to version 7.2.0.2 automatically throughthe Administrative Console, you do not need to complete this step.

8. Verify that the Search server is not running. Under some conditions it can take a few minutes for thesearch ports to become completely deactivated after you stop the search server. To verify that thesearch services are fully stopped, enter the following URLs into your browser and verify that the SolrAdmin page does not appear with either URL. You might need to repeat these tests a few times. Froma browser, point to your search server at ports 8983 and 8985, for example, https://<search-server>:8983/ and https://<search-server>:8985/, and make sure that the Solr searchplatform cannot be reached.

Updating the OpenPages Administrative Console for Fix Pack 7.2.0.2To apply the OpenPages Fix Pack Installer for 7.2.0.2, you must update the IBM OpenPages 7.2 installerpackage or the IBM OpenPages 7.2.0.1. package to 7.2.0.2 in the IBM Installation Manager (IIM).

Before you begin

Before you proceed, make sure that you have completed the following steps:

• Make sure that you are using IBM Installation Manager version 1.8.2 or later.• Make sure that OpenPages Administrative Console, version 7.2 or 7.2.0.1, is already installed.• Make sure that OpenPages Administrative Console Remote 7.2, is already installed on each server that

is included in your deployment. If it is not currently installed, you must install that package before youcan apply the 7.2.0.2 fix pack.

• If the repository for OpenPages Administrative Console 7.2 is not already in the list of IIM repositories,add the repository for the OpenPages Administrative Console 7.2, and then continue the OpenPagesAdministrative Console fix pack installation. For more information, see Updating OpenPagesAdministrative Console to version 7.2.0.1 fails to find required license files.

• Make sure that you review the Critical installation and configuration issues for IBM OpenPages GRCPlatform before you proceed with the OpenPages fix pack installation.

Procedure

1. Download the OpenPages 7.2.0.2 fix pack installer package from IBM Fix Central.2. Run IIM on your OpenPages Administrative Console machine.3. Click File > Preferences.4. Register the OpenPages 7.2.0.2 fix pack repository and click OK.5. In the IIM main window, click Update.6. Under the Package Group Name, select the OPAdminConsole package group name and click Next.

The Update Packages window opens.7. Under Update, select the 7.2.0.2 version for the OPAdminConsole.8. Accept the terms in the license agreement and click Next.9. Under Features, select the 7.2.0.2 fix pack feature and click Next.

10. Review the summary and click Update to run the IIM update installer.11. After the IIM installation completes, click Finish.



http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_trblshtng_files.html




Updating the database server manually for Fix Pack 7.2.0.2When you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can manually update the databaseserver by running the batch and shell scripts that are included in the media kit. The procedure depends onwhether you are updating from OpenPages 7.2 or from OpenPages 7.2.0.1.

About this task

It is not mandatory to update the database server manually. You can use the Administrative Console toupdate the database automatically, if you prefer.

Procedure

To update the database server manually, run the batch and shell scripts that are included in the media kit.

Applying Fix Pack 7.2.0.2 for the OpenPages database on DB2When you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can manually update your DB2database server by running the batch and shell scripts that are included in the media kit.

Before you begin

Make sure that all IBM OpenPages servers are shut down before you run a script.

Procedure

1. Ask the database administrator to ensure that no connections exist to the database with the DB2 listapplications command.

• If there is only one connection (the current DBA user), and if the current DBA connection does nothave any active transactions, it is safe to upgrade the database.

• If there are multiple connections, it is not safe to upgrade the database. Make sure that allconnections other than the current DBA connection are closed before you proceed. One option toclose connections to the DB2 instance is to stop and start the DB2 instance. For more information,see the Install and configure DB2 text search (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_db2_installandconfigure_textsearch.html?lang=en) chapter in the IBM® OpenPages® GRCPlatform Administrator Guide.

2. If you are upgrading from 7.2 to 7.2.0.2, complete the following steps.a) Copy the SQL scripts from <kit>\OP_7.2.0.2_Patch_Scripts\DB2\PATCH_SCRIPTS to the

server where you run the SQL scripts.

Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Alsobe sure that the mode for each .sh file is enabled torun properly. To do so, run the followingcommand in the directory where the files were copied into: chmod +x *.sh

b) Update the following properties in the OP-7-2-0-x-database-patch-properties.bat|.shfiles:

OP_DATABASE_USERNAME=<OpenPages Database Username>OP_DATABASE_PASSWORD=<OpenPages Database Password>WF_DATABASE_USERNAME=<OpenPages Workflow Database Username>WF_DATABASE_PASSWORD=<OpenPages Workflow Database Password>DATABASE_HOST_NAME=<DB2 Host Name>DATABASE_INSTANCE_PORT=<DB2 Instance Port>DATABASE_NAME=<DB2 Name>

c) Update the following properties in the sql-wrapper.sql file to match the values for theinstallation you are upgrading:

define opx_op_admin_name=’OpenPagesAdministrator’define opx_op_admin_pwd=’OpenPagesAdministrator’define opx_base_currency_iso_code=’USD’define opx_dflt_stor_srv_root=’c:\OpenPages\openpages-storage’

Fix packs 249

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_db2_installandconfigure_textsearch.html?lang=en

d) If you are using Windows, open the DB2 command line processor (db2cmd).e) Run the OP-7-2-0-1-database-patch.bat|.sh file.f) Run the OP-7-2-0-2-database-patch.bat|.sh file.g) To protect security, remove passwords from configuration files.

3. If you are upgrading from 7.2.0.1 to 7.2.0.2, complete the following steps.a) Copy the SQL scripts from <kit>\OP_7.2.0.2_Patch_Scripts\DB2\PATCH_SCRIPTS to the

server where you run the SQL scripts.

Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Alsobe sure that the mode for each .sh file is enabled torun properly. To do so, run the followingcommand in the directory where the files were copied into: chmod +x *.sh

b) Update the following properties in the OP-7-2-0-x-database-patch-properties.bat|.shfile:


c) Update the following properties in the sql-wrapper.sql file to match the values for theinstallation you are upgrading:


d) If you are using Windows, open the DB2 command line processor (db2cmd).e) Run the OP-7-2-0-2-database-patch.bat|.sh file.f) To protect security, remove passwords from configuration files.

Applying Fix Pack 7.2.0.2 for the OpenPages database on OracleWhen you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can manually update your Oracledatabase server by running the batch and shell scripts that are included in the media kit.

Before you begin


Procedure

1. If you are upgrading from 7.2 to 7.2.0.2, complete the following steps.a) Copy the SQL Scripts from <kit>\OP_7.2.0.2_Patch_Scripts\ORACLE\PATCH_SCRIPTS to

the server where you run the SQL scripts.

Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Alsobe sure that the mode for each .sh file is enabled to run properly. To do so, run the followingcommand in the directory where the files were copied into: chmod +x *.sh

b) Update the following properties in the OP-7-2-0-X-database-patch-properties.bat|.shfile:

OP_DATABASE_USERNAME=<OpenPages Database Username>OP_DATABASE_PASSWORD=<OpenPages Database Password>WF_DATABASE_USERNAME=<OpenPages Workflow Database Username>WF_DATABASE_PASSWORD=<OpenPages Workflow Database Password>DATABASE_ALIAS=<OpenPages database Alias>


c) Update the following properties in sql-wrapper.sql to match the values for the installation youare upgrading:

define opx_op_admin_name='OpenPagesAdministrator' define opx_op_admin_pwd='OpenPagesAdministrator' define opx_base_currency_iso_code='USD'define opx_dflt_stor_srv_root='c:\OpenPages\openpages-storage'

d) Run the OP-7-2-0-1-database-patch.bat|.sh file.e) Run the OP-7-2-0-2-database-patch.bat|.sh file.f) To protect security, remove passwords from configuration files.

2. If you are upgrading from 7.2.0.1 to 7.2.0.2, complete the following steps.a) Copy the SQL Scripts from <kit>\OP_7.2.0.2_Patch_Scripts\ORACLE\PATCH_SCRIPTS to

the server where you run the SQL scripts. ADD IMPORTANTb) Update the following properties in the OP-7-2-0-X-database-patch-properties.bat|.sh

file:


c) Update the following properties in sql-wrapper.sql to match the values for the installation youare upgrading:


d) Run the OP-7-2-0-2-database-patch.bat|.sh file.e) To protect security, remove passwords from configuration files.

Installing Fix Pack 7.2.0.2After you update the IBM OpenPages Administrative Console to version 7.2.0.2, you can apply theOpenPages Fix Pack Installer for 7.2.0.2.

Procedure

1. Start the OpenPages 7.2 Administrative Console Remote tool on each server in your deployment, andthen start the OpenPages Administrative Console tool.

2. Complete one of the following steps:

• If you have the topology.xml file from the OpenPages 7.2 or 7.2.0.1 installation, proceed to step3.

• If you do not have the topology.xml file from the OpenPages 7.2 or 7.2.0.1 installation, you mustmanually enter the fields for all of the Welcome screens, as described in “Backing up and restoringthe Administrative Console workspace” on page 173. You must make sure that all fields are set tothe same values that were specified when 7.2 was installed or upgraded. Then proceed to step 4.

3. On the Welcome tab, complete the following steps:a) To import the topology file from the previous installation, click Open an existing deployment, and

then click Start.The Select a deployment dialog box opens.

b) Click Browse, select the directory that contains the topology.xml file from the 7.2 installation, andclick OK.

c) To close the Select a deployment dialog box, click OK.4. Return to the Welcome tab, click Install IBM OpenPages GRC Platform Fix Pack 7.2.0.2 in the

Deploy tasks section, and click Start.

Fix packs 251

5. Review the Deployment Information page, and then click Admin Server.6. On the Admin Server page, complete the following steps:

a) Change the Module data field to No Schema.b) If you have a horizontal cluster, click Non-Admin Server and review the inputs.

7. Click Report (Active) and review the inputs on the Report (Active) page. If you have reporting loadbalancing, click Report (Standby) and review the inputs. Then click Database Server.

8. On the Database Server page, you can choose to upgrade the existing database server automaticallyor manually. Complete one of the following steps:

• If you want to use the OpenPages Administrative Console to upgrade the existing database serverautomatically, select Install Now.

– If the database is Oracle, complete the Data Home Directory field, and also Base Currency andStorage Directory fields.

– If the database is DB2, complete the Database Path and Catalog Path fields.9. You can also choose to load configuration data automatically or manually. Complete one of the

following steps:

• If you want to use the OpenPages Administrative Console to load configuration data, select Load.• If you want to load the configuration data manually, select Don't Load. Choose this option, for

example, if you customized application strings. After you install the fix pack, load the data manually.For more information, see “Loading the application and object strings for Fix Pack 7.2.0.2” on page254.

10. Verify the OpenPages administrator username and password.11. Click Search Server.12. Review the inputs in the Search Server page and click Validation. On the Validation Parameters

page, click Validate to make sure that the properties you entered are valid.13. Click Finish.14. Click Calculate Next Step to determine the next step of the installation, or click View All Remaining

Steps to see a list of all remaining steps. When the calculation is done, complete one of the followingsteps:

• To run all remaining steps of the fix pack installation, click Execute All Remaining Steps. When allsteps of the fix pack installation are complete, the reported status is Your OpenPagesdeployment has been completed.

• To run just the reported step, click Execute Next Step or click the hyperlink in the RecommendedNext Step area. The reported status of executing a single step is Install completedsuccessfully.

15. Repeat step 12 until the reported status is Your OpenPages deployment has beencompleted.

16. Export the topology.xml file so that you can use it for installing future upgrades and fix packs.

To preserve the session logs to help with diagnosing and debugging installation issues, export thedeployment, which includes the toplology.xml file.


17. Restart all the servers, including the application server, reporting servers, and the search server.18. If you are using the approval app, load the approval app configuration.

a) Open http://<hostname>:10108/openpages/app/deck/reloadConfig in your browser.Replace <hostname> with the OpenPages application server name. If you have changed thedefault port number, replace 10108 with the port number that you are using.

b) If you are prompted to log in, enter the OpenPages Administrator user name and password.


c) Repeat these steps on every OpenPages server, including the vertical cluster members on all theapplication servers.For example, if you have two vertical cluster members on the admin server and you use thedefault port, open http://<hostname>:10128/openpages/app/deck/reloadConfig inyour browser.

What to do next

Perform the postinstallation tasks. For more information, see “Postinstallation tasks for Fix Pack 7.2.0.2”on page 253.

Log files for Fix Pack 7.2.0.2If errors occur when you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can review the fix packinstaller log files.

The installer creates a folder named patch\Deploy<data_time stamp>. This folder contains log filesnamed session.log and aurora.log, and you can find valuation information in those files.

For more information, see Log files (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_installation_guide.7.2.0.doc/c_tools_and_adminsitrative_console_logs.html?lang=en).

Postinstallation tasks for Fix Pack 7.2.0.2After you apply the OpenPages Fix Pack Installer for 7.2.0.2, you must complete some additional tasks.

Restoring the solutions helpers and Dojo toolkit for Fix Pack 7.2.0.2After you apply the OpenPages Fix Pack Installer for 7.2.0.2, you must restore the solutions helpers andDojo toolkit.

Procedure

1. Under <openpages installation folder>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war, copy the solutions helpers and Dojo toolkits from thebackup folder to the following locations:


Important: If you backed up your solution helpers and Dojo toolkit to a different location, as describedin Backing up the solutions helpers and Dojo toolkit for Fix Pack 7.2.0.2, copy the files from thatlocation.

2. If you backed up other changes to the OpenPages web configuration XML files, restore those changesalso.

Applying the solutions fix pack for Fix Pack 7.2.0.2After you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can apply the solutions fix pack to fixsome solutions issues.

Loading the XML file for the RCM solution for Fix Pack 7.2.0.2If you are using IBM OpenPages Regulatory Compliance Management (RCM) solution, you can load theXML file for RCM.

About this task

Even if you already applied OpenPages Fix Pack 7.2.0.1, you must complete this procedure becauseissues were discovered with the OPS_RCM_Compliance_Assessment_object-profile-view-op-config.xml file in the 7.2.0.1 Fix Pack.

Fix packs 253

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_installation_guide.7.2.0.doc/c_tools_and_adminsitrative_console_logs.html?lang=en

Procedure

1. Copy the OPS_RCM_Compliance_Assessment_object-profile-view-op-config.xml file from<OP 7202 Kit>\Modules\RCM to <OP Installation Folder>\patch.

2. Navigate to the <OP Installation Folder>\bin.3. Run the following ObjectManager tool command to load the XML: ObjectManager.cmd|.sh l c<OpenPages Administrator User> <OpenPages Administrator Password> <OPInstallation Folder>\patch OPS_RCM_Compliance_Assessment_object-profile-view

Important: For more information on how to run the Object Manager tool, see Running ObjectManagercommands (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_running_objectmanager_commands.html?lang=en).

Loading the out-of-box solutions reports for Fix Pack 7.2.0.2After you apply the OpenPages Fix Pack Installer for 7.2.0.2, you must load the out-of-box solutionreports.

About this task

If you have already applied OpenPages Fix Pack 7.2.0.1 and loaded the out-of-box solution reports at thattime, you do not need to complete this procedure.

Procedure

1. Log in to the reporting server as a user with administrative privileges.2. Go to the <Fix Pack Kit>\Modules\DB2 or ORACLE directory.3. Copy the OpenPages_Solutions_V6.zip file based on the database you are using to the IBM

Cognos deployment directory. The default location is the <Cognos_Home>\deployment directory.4. From the command prompt/shell, go to the <CC_Home>/temp/bin directory. The default location

is the <OP_Home>/CommandCenter/temp/bin directory.5. Type the following command: importReports.bat|.sh -a OpenPages_Solutions_V6 -sOpenPagesSecurityRealm -u <username> -p <password> -g http://<Cognos_server>:<dispatcher_port>/p2pd/servlet/dispatch

Loading the application and object strings for Fix Pack 7.2.0.2After you apply the OpenPages Fix Pack Installer for 7.2.0.2, you can load the common-app-strings-7-2-0-2 loader file.

About this task

New application and object strings are loaded automatically as part of the installation of Fix Pack 7.2.0.2.Existing application and object strings are not automatically updated. This is done to ensure that anycustomizations that you may have made to existing strings are not overwritten.

By following this procedure, you are enabling the ObjectManager utility to allow existing strings to beupdated, which could overwrite customizations that you might have made. Check the contents of thecommon-app-strings-7-2-0-2-op-config.xml file to determine if any strings that you modified areincluded in that file. If so, and if you decide you want to remake the customizations, you can use theAdministration > Export Configuration feature to export the customized strings for later reference tohelp you remake the modifications after you complete this section.

Before you proceed with the steps in this section, ensure that you follow the steps outlined in the Loadingthe application and object strings using a loader file topic (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_post_install_loader_file.html). You must do this if you either did not apply Fix Pack 7.2.0.1, orif you applied Fix Pack 7.2.0.1 but you did not perform those specific postinstallation steps.


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_running_objectmanager_commands.html?lang=en


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_post_install_loader_file.html

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_post_install_loader_file.html

Procedure

1. Log in to the Application server as a user with administrative privileges.2. Go to the <OpenPages Installation directory>/bin directory.3. Update the following properties in the ObjectManager.properties file and save the file:

• Set the configuration.manager.force.update.object.strings property to true.• Set the configuration.manager.force.update.application.strings property to true.

4. Run the following command: objectmanager.cmd|.sh l c <OpenPages Administratoruser> <OpenPages Administrator password> <OpenPages Installation directory>/patch/addon_module/loaderdata common-app-strings-7-2-0-2

5. After the ObjectManager loading is complete, review the log and make sure it completed.6. Update the following properties in the ObjectManager.properties file and save the file:

• Set the configuration.manager.force.update.object.strings property to false.• Set the configuration.manager.force.update.application.strings property to false.

Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.2The Attestation Creation Report is a report that runs regularly. IBM OpenPages completes tasks thatresult in an email that is sent to the appropriate employees who must confirm that they read andunderstood a particular policy.

About this task

To ensure that the Attestation Creation Report runs correctly, you must update yourPCM_Attestation_Creation.jsp file. If the file is not updated, you might see a Java error, or thereport might contain confusing messages. For more information, see Ensuring that the AttestationCreation Report runs correctly (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_attestation_report.html).

If you already applied OpenPages Fix Pack 7.2.0.1 and you completed the procedure at that time, you donot need to complete this procedure.

Re-creating the reporting schema for Fix Pack 7.2.0.2If your database server is DB2-based, and if you dropped the reporting schema as part of yourpreparation for applying the OpenPages Fix Pack Installer for 7.2.0.2, you must re-create the reportingschema.

About this task

Important: If you did not drop the reporting schema as part of your installation preparation in Preparingfor the fix pack installation, do not complete this procedure.

Procedure

1. Log in to OpenPages with an administrative account.2. Enable System Admin Mode (SAM).3. Click Administration > Reporting Schema and click Create.4. Click Refresh until the process is 100% complete.5. Disable SAM.

Fix packs 255

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_attestation_report.html


Re-creating the framework generation for Fix Pack 7.2.0.2During the application of the OpenPages Fix Pack Installer for 7.2.0.2, if you installed and configured theapproval app or IBM OpenPages Loss Event Entry, and you want to report on the new fields, you mustregenerate the reporting framework.

About this task

For more information, see Generating the reporting framework V6 (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_generating_the_reporting_framewk.html?lang=en)

Re-creating the global search index for Fix Pack 7.2.0.2If you had global search enabled in IBM OpenPages 7.2 or 7.2.0.1, and you then applied the OpenPagesFix Pack Installer for 7.2.0.2, you must re-create the global search index.

Before you begin

Before you follow these steps, notify your users that the global search feature will be disabled andunavailable during this task.

Procedure

1. If you already dropped the search index as part of preparing for running the GRC Platform OpenPagesFix Pack Installer for 7.2.0.2 as described in step 1 of the procedure in Preparing for the installation ofFix Pack 7.2.0.2, skip to step 2. Otherwise you must drop the Search index now. Complete thefollowing steps:a) Start the Search server. For information about starting and stopping servers, see Starting and

stopping servers (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_starting_and_stopping_servers.html?lang=en).

b) Log in to OpenPages with an administrative account.c) Click Administration > Global Search and click Disable.d) Click Administration > Global Search > and click Drop.e) Proceed to step 2 to re-create the search index.

2. Start the Search server if it is not already started.3. Log in to OpenPages with an administrative account.4. Click Administration > Global Search and click Create.

Additional tasks for Fix Pack 7.2.0.2You might want to complete additional tasks for the OpenPages Fix Pack Installer for 7.2.0.2

Performing a silent installation for Fix Pack 7.2.0.2You can run a silent installation from the command line by using inputs that you export from the IBMOpenPages Administrative Console.

Before you begin

Ensure that you have prepared your systems for deploying OpenPages GRC Platform.

Procedure

1. Create a topology file that defines your deployment. To minimize errors, define the topology in theOpenPages Administrative Console and export the topology file. In a Linux/DB2 environment, you canuse the <OP_Home>\Install\silent-installer\topology.xml file as a sample.


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_generating_the_reporting_framewk.html?lang=en



Tip: You can validate the configuration in the Administrative Console before you export the topologyfile.

2. Create a deployment directory. You can use an empty directory to ensure that you have a cleanenvironment. Or you can use an existing deployment directory that you saved from the AdministrativeConsole. If you use a deployment directory that is saved from the Administrative Console, you do notneed to provide a separate topology file.

3. Update the following properties:

<prop key="DeployTask" value="patch"/>

<prop key="IsDBSchemaAlreadyInstalled" value="yes"/>

<prop key="LoadModuleSchema" value="no"/>

4. For the IsDBSchemaAlreadyInstalled property, complete one of the following steps:

• If you manually updated the database, use the following value:


• If you want the silent installation to update the database, use the following value:

<prop key="IsDBSchemaAlreadyInstalled" value="no"/>

5. Run the silent installation from the command line.6. Check the logs directory to ensure that the installation is successful.

Manually uninstalling OpenPages Fix Pack 7.2.0.2After you back up your directories and files, you can manually uninstall the OpenPages Fix Pack for7.2.0.2, if necessary.

About this task

The following procedure assumes that you are installing Fix Pack 7.2.0.2 on top of OpenPages 7.2.0.0. Italso assumes that the backup folders use the name OpenPages7200Backup. Specify the name youchose when you created the backup directories in the Backing up directories and files topic.

Important: For information about starting and stopping servers, see Starting and stopping servers (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_starting_and_stopping_servers.html?lang=en).

Procedure

1. Stop all servers including the following:


2. To restore OpenPages application directories and files, complete the following steps:

Fix packs 257


a) Log on to the admin server as a user with administrative privileges and full access to the localserver drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example opuser.

b) Navigate to the <OP_Home> installation directory, where <OP_Home> represents the installationlocation of the OpenPages application, by default C:\OpenPages for Windows, and /opt/OpenPages for AIX or Linux.

c) Delete the following directories and file from the <OP_Home> installation directory, and then copythe corresponding directories and file from the backup directory location into the <OP_Home>installation directory to restore them.

Delete this directory or filein <OP_Home>…

Copy the corresponding directory or file from the backuplocation into <OP_Home>…

applications Copy the applications directory fromOpenPages7200Backup\OpenPages\applications into<OP_Home>

aurora Copy the aurora directory from OpenPages7200Backup\OpenPages\aurora into <OP_Home>

bin Copy the bin directory from OpenPages7200Backup\OpenPages\bin into <OP_Home>

profiles Copy the profiles directory from /opt/OpenPages7200Backup/OpenPages/profiles into<OP_Home>

openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup\OpenPages\openpagesregistry.xml into <OP_Home>

3. To restore the workflow directory, complete the following steps:a) Navigate to the <Workflow_Home> installation directory, where <Workflow_Home> represents

the installation location of the Fujitsu Interstage BPM server, by default C:\Fujitsu\InterstageBPM for Windows and /opt/Fujitsu/InterstageBPM for AIX or Linux.

b) Delete the <Workflow_Home> root directory, and then copy the corresponding<Workflow_Home> root installation directory from the backup directory location into the<Workflow_Home> installation directory to restore it:

Delete this installationdirectory…

Copy the corresponding directory or file from the backuplocation into <Workflow_Home>…

<Workflow_Home> Copy the root Fujitsu\InterstageBPM directory fromOpenPages7200Backup\Fujitsu\InterstageBPM into the<Workflow_Home> location.

4. To restore the IBM Cognos directories, complete the following steps:a) Log on to the reporting server as a user with administrative privileges and full access to the local

server drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example opuser.

b) Navigate to the <Cognos_Home> installation directory where <Cognos_Home> represents theinstallation location of the IBM Cognos application, by default C:\OpenPages\Cognos\c10_64for Windows and /opt/OpenPages/Cognos/c10_64 for AIX or Linux.

c) Delete the following directories from the <Cognos_Home> installation directory, and then copy thecorresponding directories from the backup directory location into the <Cognos_Home> installationdirectory to restore them:


Delete this directory in<Cognos_Home>…

Example backup path

webapps\p2pd\WEB-INF\lib

For example, copy the lib directory fromOpenPages7200Backup\Cognos\lib into <Cognos_Home>\webapps\p2pd\WEB-INF

configuration For example, copy the configuration directory fromOpenPages7200Backup\Cognos\configuration into<Cognos_Home>

5. To restore the OpenPages Command Center directories and files, complete the following steps:a) On the reporting server, navigate to the <CC_Home> installation directory, where <CC_Home>

represents the installation location of the OpenPages Cognos application, by defaultC:\OpenPages\CommandCenter for Windows, and /opt/OpenPages/Command Center forAIX or Linux.

b) Delete the following directories and file from the <CC_Home> installation directory, and then copythe corresponding directories and file from the backup directory location into the <CC_Home>installation directory to restore them:

Delete this directory in<CC_Home>…

Example backup path

wlp For example, copy the wlp directory fromOpenPages7200Backup\CommandCenter\wlp into<CC_Home>

tools\bin For example, copy the bin directory fromOpenPages7200Backup\CommandCenter\bin into<CC_Home>\tools

openpagesregistry.xml For example, copy the openpagesregistry.xml file fromOpenPages7200Backup\CommandCenter\openpagesregistry.xml

6. To restore the OpenPages Global Search Server directories and files, complete the following steps:a) On the Search server, navigate to the <SEARCH_Home> installation directory, where<SEARCH_Home> represents the installation location of the OpenPages Search application, bydefault C:\OpenPages\OpSearch for Windows, and /opt/OpenPages/OpSearch for AIX orLinux.

b) Delete the following directories and file from the <SEARCH_Home> installation directory, and thencopy the corresponding directories and file from the backup directory location into the<SEARCH_Home> installation directory to restore them:

Delete this directory in<SEARCH_Home>…

Copy the corresponding directory or file from the backuplocation into <SEARCH_Home> …

opsearchtools Copy the opsearchtools directory fromOpenPages7200Backup\OPSearch\opsearchtools into<SEARCH_Home>

openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup\OPSearch\openpagesregistry.xml

7. To restore the database, run the OpenPages restore (OPRestore) and CommandCenter restore(OPCCRestore) utilities to restore the database to the previous IBM OpenPages GRC Platform 7.2.0.1level.

Note: For more information on how to use the restore utilities, see Using the Cognos Restore utility.8. Start all servers, including the following:

Fix packs 259

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_db2_about_the_opccrestore_utility.html?lang=en

• OpenPages Application and Workflow server• IBM Cognos server• OpenPages Framework Model Generator server• OpenPages Global Search server


For more information on new features in Fix Pack 7.2.0.3, see the “New features in version 7.2.0.3” onpage 1 topic in the OpenPages GRC Platform New Features Guide 7.2.0.


For additional information about OpenPages 7.2, see the Release Notes.


You can install Fix Pack 7.2.0.3 directly onto IBM OpenPages GRC Platform 7.2. Alternatively, you caninstall Fix Pack 7.2.0.3 after installing Fix Pack 7.2.0.1 or 7.2.0.2.



1. Perform backups, including the solutions helpers and Dojo toolkit. For more information, see“Backups for the existing environments for Fix Pack 7.2.0.3” on page 261.

2. Make sure that the OpenPages application servers and reporting servers are running

Installation stage

1. Prepare the servers for the fix pack. For more information, see “Preparing for the installation of FixPack 7.2.0.3” on page 264.

2. Update the OpenPages Administrative Console. For more information, see “Updating theOpenPages Administrative Console for Fix Pack 7.2.0.3” on page 265.

3. Install Fix Pack 7.2.0.3. For more information, see “Installing Fix Pack 7.2.0.3” on page 268.


1. Restore the solutions helpers and Dojo toolkit. For more information, see “Restoring the helpers,images, Dojo toolkits, and other files for Fix Pack 7.2.0.3” on page 270.

2. Install solutions updates. For more information, see “Applying the solutions fix pack for Fix Pack7.2.0.3” on page 270.








Re-create the reporting schemaThis procedure is required if you are using IBM DB2 version 10.5 and you have added fields, forexample, if you installed and configured the approval app. For more information, see “Re-creating thereporting schema for Fix Pack 7.2.0.3” on page 274.

Re-create the reporting frameworkThis procedure is required if you added new fields, for example, if you installed and configured theapproval app or IBM OpenPages Loss Event Entry, and you want to report on the new fields. For moreinformation, see “Re-creating the framework generation for Fix Pack 7.2.0.3” on page 274.

Re-create the global search indexThis procedure is required if you previously enabled the Global Search feature and you are upgradingfrom version 7.2.0.0. This procedure is not required if you are upgrading from 7.2.0.1 or 7.2.0.2. Formore information, see “Recreating the global search index after upgrading from 7.2.0.0” on page 274.

Upgrade IBM DB2This procedure is optional. Fix Pack 7.2.0.3 supports IBM DB2 version 11.1. DB2 10.5 is alsosupported. For more information, see “Upgrade IBM DB2” on page 53.

Note: If you upgrade IBM DB2 to version 11.1, you must also upgrade IBM Cognos BusinessIntelligence to version 10.2.2 Fix Pack 6 or later.

Preinstallation tasks for Fix Pack 7.2.0.3Before you can apply the Fix Pack Installer for 7.2.0.3, you must have IBM OpenPages GRC Platform7.2.0.0 or 7.2.0.0 Interim Fix 1 installed, and optionally Fix Pack 7.2.0.1 or Fix Pack 7.2.0.2.

Backups for the existing environments for Fix Pack 7.2.0.3Before you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must back upthe OpenPages application environment, the Cognos environment, and the database.

OpenPages backup and CommandCenter backup utilitiesBefore you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, use the OpenPagesbackup (OPBackup) utility on each application server. Use the CommandCenter backup (OPCCBackup)utility on each reporting server.

To complete a DB2 database backup, use DB2 backup tools. To complete an Oracle database backup, usethe OPBackup utility. For more information, see the following sections in the IBM® OpenPages® GRCPlatform Administrator Guide:




If global search is enabled, disable it before you run OPBackup. For more information, see UsingOPBackup and OPRestore when global search is enabled (http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_search_op_backup.html) in the IBM® OpenPages® GRC Platform Administrator Guide.

For more information about how to configure the Oracle Data Pump directory for the first-time use, seethe The OPBackup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_opbackup_utility.html?cp=SSFUEU_7.2.0%2F2-0-17-6&lang=en) and Using the Cognos Backup utility (http://www.ibm.com/

Fix packs 261







support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_ccbackup_utility.html?lang=en) chapters in the IBM® OpenPages® GRC PlatformAdministrator Guide.

Backing up helpers, images, Dojo toolkits, and other filesBefore you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must back upthe solution helpers, images, Dojo toolkits, and other files.

About this task

The fix pack installer backs up and restores the session-timeout setting that is configured in theweb.xml and the context-root setting that is configured in the application.xml file. If you mademore changes to the OpenPages web configuration XML files, you must back up these changes.

Also, do this task if any of the following conditions apply:

• You installed the Solutions schema• You received custom deliverables from the IBM OpenPages Technical Services Team• You have custom code

Procedure

1. Create a backup folder for backing up the solutions helpers, images, and the Dojo toolkits, for example,C:\OpenPages\patch\helper_backup.

2. Copy the JSP helpers and Dojo toolkits (both included with the product and customized) to the backupfolder in the following locations:


You can find these folders in the following location: <OP_HOME>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war.


Backing up directories and filesBefore you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must back upyour directories and files.

About this task


Important: For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

Procedure

1. Log in to the admin and non-admin application servers as a user with administrative privileges and fullaccess to the local server drives. For AIX or Linux, use a non-root user, such as the user you created forthe IBM OpenPages GRC Platform installation, for example, opuser.

2. Stop all OpenPages servers, including the following:














Important: If you are installing Fix Pack 7.2.0.3 on top of IBM OpenPages GRC Platform 7.2, use thefolder name OpenPages7200Backup when you create the backup directory path. Alternatively, if youare installing Fix Pack 7.2.0.3 on top of a fix pack that has been applied, create a folder path name thatcontains the OpenPages version number that you are backing up, for example,OpenPages7201Backup. The following steps assume that you are installing Fix Pack 7.2.0.3 on top ofOpenPages 7.2.0.0.






7. Copy the following Command Center directories and file from the <CC_Home> installation directory tothe backup directory location OpenPages7200Backup\Command Center:

• <CC_Home>\wlp• <CC_Home>\tools\bin• <CC_Home>\openpagesregistry.xml




• OpenPages application and workflow server

Fix packs 263

• IBM Cognos server• OpenPages Framework Model Generator server• OpenPages Global Search server

Installation tasks for Fix Pack 7.2.0.3Before you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, make sure that you haveall required backup folders and files.

Preparing for the installation of Fix Pack 7.2.0.3To ensure that the application of the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3 is able toperform all necessary steps, you must perform some preparation tasks.

Procedure

1. If you are upgrading from 7.2.0.0 and you used global search in 7.2.0.0, with all OpenPages serversrunning, complete the following steps to drop the search index:a) Log in to OpenPages with an administrative account.b) Click Administration > Global Search and click Disable.c) Click Administration > Global Search and click Drop.d) Stop the search services.

• For Windows, from Windows Services locate the service that is called IBM OpenPages GRC -Global Search and stop it.


cd <OP_Home>/OPSearch/opsearchtools/java -jar opsearchtool.jar stopIndexing -indexname openpagesjava -jar opsearchtool.jar stopIndexing -indexname folderacljava -jar opsearchtool.jar stopSolr

2. If you are using 7.2.0.1 or later, complete the following steps to stop the search services:a) If you used the global search script to start global search, use the StopSearchServers.cmd|.sh

script:

• For Windows, go to the <OP_Home>/OPSearch/opsearchtools/ directory and typeStopSearchServers.cmd.


b) If you used the operating system services to start global search, stop the services.


• For UNIX, at a command line, run the following commands:





If the stop verification fails, repeat the preceding step and then follow the steps in “ Forcing a resetof global search” on page 367.



5. If you have a DB2-based database server, determine if you need to drop the reporting schema.

If you plan to upgrade to DB2 version 11.1 before you install the approval app or IBM OpenPages LossEvent Entry, you do not need to drop the reporting schema.

If you do not plan to install the approval app or IBM OpenPages Loss Event Entry, you do not need todrop the reporting schema.

If you are using DB2 version 10.5 and you plan to install the approval app or IBM OpenPages LossEvent Entry, complete the following steps to drop the reporting schema.

a) Log in to OpenPages with an administrative account.b) Enable System Admin Mode (SAM).c) Click Administration > Reporting Schema and click Drop.d) Click Refresh until the process is 100% complete.e) Disable SAM.

6. If you plan to upgrade the OpenPages database to version 7.2.0.3 manually, stop all OpenPagesapplication servers (admin and non-admin), reporting servers (active and standby), and the searchserver. For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

Important: If you plan to upgrade the OpenPages database to version 7.2.0.3 automatically by usingthe Administrative Console, you do not need to complete this step.

Updating the OpenPages Administrative Console for Fix Pack 7.2.0.3To apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must update the IBMOpenPages installer package to 7.2.0.3 in IBM Installation Manager (IIM).

Before you begin


• Make sure that you are using IBM Installation Manager version 1.8.2 or later.• Make sure that OpenPages Administrative Console, version 7.2, 7.2.0.1, or 7.2.0.2 is already installed.• Make sure that OpenPages Administrative Console Remote 7.2, is already installed on each server that

is included in your deployment. If it is not currently installed, you must install that package before youcan apply the 7.2.0.3 fix pack.

Note: If the repository for OpenPages Administrative Console 7.2 is not already in the list of IIMrepositories, add the repository for the OpenPages Administrative Console 7.2, and then continue theOpenPages Administrative Console fix pack installation. For more information, see Updating OpenPagesAdministrative Console to version 7.2.0.1 fails to find required license files.


Procedure

1. Download the IBM OpenPages GRC Platform 7.2.0.3 fix pack installer package from IBM Fix Central.2. Run IIM on your OpenPages Administrative Console machine.3. Click File > Preferences.4. Register the OpenPages 7.2.0.3 fix pack repository and click OK.5. In the IIM main window, click Update.

Fix packs 265





6. Under the Package Group Name, select the OPAdminConsole package group name and click Next.The Update Packages window opens.

7. Under Update, select the 7.2.0.3 version for the OPAdminConsole.8. Accept the terms in the license agreement and click Next.9. Under Features, select the 7.2.0.3 fix pack feature and click Next.


Updating the database server manually for Fix Pack 7.2.0.3When you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you can manually updatethe database server by running the batch and shell scripts that are included in the media kit. Theprocedure depends on whether you are updating from OpenPages 7.2, 7.2.0.1, or 7.2.0.2.

About this task


Procedure

To update the database server manually, run the batch and shell scripts that are included in the media kit.

Applying Fix Pack 7.2.0.3 for the OpenPages database on DB2When you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you can manually updateyour IBM DB2 database by running the batch or shell scripts that are included in the media kit.

Before you begin

Make sure that all IBM OpenPages GRC Platform servers are shut down before you run a script.

Procedure

1. Ask the database administrator to ensure that no connections exist to the database by using the DB2list applications command.


• If there are multiple connections, it is not safe to upgrade the database. Make sure that allconnections other than the current DBA connection are closed before you proceed. One option toclose connections to the DB2 instance is to stop and start the DB2 instance. For more information,see the Install and configure DB2 text search (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_db2_installandconfigure_textsearch.html?lang=en) chapter in the IBM® OpenPages® GRCPlatform Administrator Guide.

2. Copy the SQL scripts from <kit>\OP_7.2.0.3_Patch_Scripts\DB2\PATCH_SCRIPTS to theserver where you run the SQL scripts.

Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Also besure that the mode for each .sh file is enabled to run properly. To do so, run the following command inthe directory where the files were copied: chmod +x *.sh

3. Update the following properties in the OP-7-2-0-X-database-patch-properties.bat|.sh file:




4. Update the following properties in the sql-wrapper.sql file to match the values for the installationyou are upgrading:


5. If you are upgrading from 7.2.0.0 to 7.2.0.3, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-1-database-patch.bat|.sh file.c) Run the OP-7-2-0-2-database-patch.bat|.sh file.d) Run the OP-7-2-0-3-database-patch.bat|.sh file.e) To protect security, remove passwords from configuration files.

6. If you are upgrading from 7.2.0.1 to 7.2.0.3, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-2-database-patch.bat|.sh script.c) Run the OP-7-2-0-3-database-patch.bat|.sh script.d) To protect security, remove passwords from configuration files.

7. If you are upgrading from 7.2.0.2 to 7.2.0.3, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-3-database-patch.bat|.sh script.c) To protect security, remove passwords from configuration files.

Applying Fix Pack 7.2.0.3 for the OpenPages database on OracleWhen you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you can manually updateyour Oracle database by running the batch or shell scripts that are included in the media kit.

Before you begin


Procedure

1. Copy the SQL scripts from <kit>\OP_7.2.0.3_Patch_Scripts\ORACLE\PATCH_SCRIPTS to theserver where you run the SQL scripts.


2. Update the following properties in the OP-7-2-0-x-database-patch-properties.bat|.sh file:


3. Update the following properties in sql-wrapper.sql to match the values for the installation you areupgrading:


4. If you are upgrading from 7.2.0.0 to 7.2.0.3, complete the following steps.a) Run the OP-7-2-0-1-database-patch.bat|.sh file.

Fix packs 267

b) Run the OP-7-2-0-2-database-patch.bat|.sh file.c) Run the OP-7-2-0-3-database-patch.bat|.sh file.d) To protect security, remove passwords from configuration files.

5. If you are upgrading from 7.2.0.1 to 7.2.0.3, complete the following steps.a) Run the OP-7-2-0-2-database-patch.bat|.sh file.b) Run the OP-7-2-0-3-database-patch.bat|.sh file.c) To protect security, remove passwords from configuration files.

6. If you are upgrading from 7.2.0.2 to 7.2.0.3, complete the following steps.a) Run the OP-7-2-0-3-database-patch.bat|.sh file.b) To protect security, remove passwords from configuration files.

Installing Fix Pack 7.2.0.3After you update the IBM OpenPages Administrative Console to version 7.2.0.3, you can apply the IBMOpenPages GRC Platform Fix Pack Installer for 7.2.0.3.

Before you begin

• Ensure that the global search services are stopped and that the index is dropped (if required). For moreinformation, see “Preparing for the installation of Fix Pack 7.2.0.3” on page 264.

• Ensure that all OpenPages application servers (admin and non-admin) and reporting servers (active andstandby) are running. For information about starting and stopping servers, see Chapter 15, “Starting andstopping servers,” on page 201.

Procedure

1. Start the OpenPages 7.2 Administrative Console Remote tool on each server in your deployment, andthen start the OpenPages Administrative Console tool.


• If you have the topology.xml file from the OpenPages 7.2, 7.2.0.1, or 7.2.0.2 installation,proceed to step 3.

• If you do not have the topology.xml file from the OpenPages 7.2, 7.2.0.1, or 7.2.0.2 installation,you must manually enter the fields for all of the Welcome screens, as described in “Backing up andrestoring the Administrative Console workspace” on page 173. You must make sure that all fieldsare set to the same values that were specified when 7.2 was installed or upgraded. Then proceed tostep 4.


then click Start.The Select a deployment dialog box opens.

b) Click Browse, select the directory that contains the topology.xml file from the 7.2, 7.2.0.1, or7.2.0.2 installation, and click OK.

c) To close the Select a deployment dialog box, click OK.4. Return to the Welcome tab, click Install IBM OpenPages GRC Platform Fix Pack 7.2.0.3 in the

Deploy tasks section, and click Start.5. Review the Deployment Information page, and then click Admin Server.6. On the Admin Server page, complete the following steps:


7. Click Report (Active) and review the inputs on the Report (Active) page. If you have reporting loadbalancing, click Report (Standby) and review the inputs. Then click Database Server.



• If you want to use the OpenPages Administrative Console to upgrade the existing database serverautomatically, select Install Now.

– If the database is Oracle, complete the Data Home Directory field, and also the Base Currencyand Storage Directory fields.

– If the database is DB2, complete the Database Path and Catalog Path fields.• If you have already upgraded the database server manually, select Already installed.

9. You can also choose to load configuration data automatically or manually. Complete one of thefollowing steps:


example, if you customized application strings. After you install the fix pack, load the data manually.For more information, see “Loading the application and object strings for Fix Pack 7.2.0.3” on page273.

10. Verify the OpenPages administrator username and password.11. Click Search Server.12. Review the inputs in the Search Server page and click Validation.13. On the Validation Parameters page, click Validate to make sure that the properties you entered are

valid.14. Click Finish.15. Click Calculate Next Step to determine the next step of the installation, or click View All Remaining


• To run all remaining steps of the fix pack installation, click Execute All Remaining Steps. When allsteps of the fix pack installation are complete, the reported status is Your OpenPagesdeployment has been completed.

• To run just the reported step, click Execute Next Step or click the hyperlink in the RecommendedNext Step area. The reported status of executing a single step is Install completedsuccessfully.

16. Repeat step 13 until the reported status is Your OpenPages deployment has beencompleted.


To preserve the session logs to help with diagnosing and debugging installation issues, export thedeployment, which includes the topology.xml file.




b) If you are prompted to log in, enter the OpenPages Administrator user name and password.c) Repeat these steps on every OpenPages server, including the vertical cluster members on all the

application servers.For example, if you have two vertical cluster members on the admin server and you use thedefault port, open http://<hostname>:10128/openpages/app/deck/reloadConfig inyour browser.

Fix packs 269

What to do next


Log files for Fix Pack 7.2.0.3If errors occur when you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you canreview the fix pack installer log files.

The installer creates a folder named patch\Deploy<data_time stamp>. This folder contains log filesnamed session.log and aurora.log, and you can find valuation information in those files.

For more information, see “Log files” on page 363.

Postinstallation tasks for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must complete someadditional tasks.

Restoring the helpers, images, Dojo toolkits, and other files for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must restore thesolutions helpers, images, Dojo toolkits, and other files that you backed up.

About this task

Do this task to restore backups of the following:

• Changes to the OpenPages web configuration XML files• Solutions schema• Custom deliverables from the IBM OpenPages Technical Services Team• Custom code

Procedure

1. Copy the solutions helpers, images, and Dojo toolkits from the backup directory to the followinglocations:

• <OP_HOME>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war\dojo_1.10.4\dojo\

• <OP_HOME>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war\dojo_1.10.4\dojox\

• <OP_HOME>\profiles\<Node Name>#\installedApps\OpenPagesCell\op-apps.ear\sosa.war\dojo_1.10.4\dijit\


Applying the solutions fix pack for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you can apply thesolutions fix pack to fix some solutions issues.

If you are upgrading from 7.2.0.0, do these tasks:

• “Loading the out-of-box solutions reports for Fix Pack 7.2.0.3” on page 271• “Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.3” on page 271• “Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.3” on page 271• “Loading the XML file for the RCM solution for Fix Pack 7.2.0.3” on page 272• “Loading the application and object strings for Fix Pack 7.2.0.3” on page 273• “Updating trigger definitions” on page 273



• “Loading the XML file for the RCM solution for Fix Pack 7.2.0.3” on page 272• “Loading the application and object strings for Fix Pack 7.2.0.3” on page 273• “Updating trigger definitions” on page 273


• “Updating trigger definitions” on page 273

Loading the out-of-box solutions reports for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must load the out-of-box solution reports.

About this task

If you have already applied OpenPages Fix Pack 7.2.0.1 or 7.2.0.2 and loaded the out-of-box solutionreports at that time, you do not need to complete this procedure.

Procedure

1. Log in to the reporting server as a user with administrative privileges.2. Go to the <Fix Pack Kit>\Modules\DB2 or ORACLE directory.3. Copy the OpenPages_Solutions_V6.zip file based on the database you are using to the IBM

Cognos deployment directory. The default location is the <Cognos_Home>\deployment directory.4. From a command line, go to the <CC_Home>/temp/bin directory. The default location is the<OP_Home>/CommandCenter/temp/bin directory.

5. Type the following command:

importReports.bat|.sh -a OpenPages_Solutions_V6 -s OpenPagesSecurityRealm -u <username> -p <password> -g http://<Cognos_server>:<dispatcher_port>/p2pd/servlet/dispatch

Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.3To ensure that the Attestation Creation Report runs correctly, you must update yourPCM_Attestation_Creation.jsp file.

About this task

If you already applied OpenPages Fix Pack 7.2.0.1 or 7.2.0.2 and you completed the procedure at thattime, you do not need to complete this procedure.

If the file is not updated, you might see a Java error, or the report might contain confusing messages. Formore information, see Ensuring that the Attestation Creation Report runs correctly (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_fix_pack_7201_installer.7.2.0.1.doc/t_op_72fp1_attestation_report.html).

The Attestation Creation Report is a report that runs regularly. IBM OpenPages GRC Platform completestasks that result in an email that is sent to the appropriate employees who must confirm that they haveread and understood a particular policy.

Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must update theOPLC-Incident.xml file if you use lifecycles for Incident objects.

About this taskIf you have already applied OpenPages Fix Pack 7.2.0.1 or 7.2.0.2 and updated the OPLC-Incident.xml file or deployed the approval app, you do not need to complete this procedure.

Fix packs 271


If you plan to deploy the approval app, skip this step because it is done later when you load the approvalapp profile.

Procedure

1. Open a browser window and log on to the OpenPages GRC Platform server (typically /opx) as a userwith administrative privileges.

2. Click Browse files under the Files heading.3. Click TriggerConfigFiles, and then click OPLC-Incident.xml.4. Check out and download the file.5. Open the file in a text editor and look for following code:

<attribute name="email.body.string.key" value="lifecycle.incident.email.content"/> <attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment"/>

6. Replace these lines with the following lines:

<attribute name="email.body.string.key" value="lifecycle.incident.op.email.content"/> <attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment, OPLC-Std:LCDueDate,OPLC-3StageEsc:LCStatus"/>

7. Save the file as OPLC-Incident.xml.8. In OPX, click Check In File and select the OPLC-Incident.xml file you updated. Add a comment

and click Finish.9. Restart all OpenPages servers.

For more information, see Chapter 15, “Starting and stopping servers,” on page 201.

ResultsYou can now continue to use lifecycles on Incident objects.

Loading the XML file for the RCM solution for Fix Pack 7.2.0.3If you are using the IBM OpenPages Regulatory Compliance Management (RCM) solution, you can loadthe XML file for RCM.

About this task

Complete this procedure if you are upgrading from 7.2.0.0 or 7.2.0.1.

If you already applied Fix Pack 7.2.0.2, you do not need to do this procedure.

Procedure

1. Copy the OPS_RCM_Compliance_Assessment_object-profile-view-op-config.xml file from<OP 7203 Kit>\Modules\RCM to <OP_HOME>\patch.

2. Navigate to the <OP_HOME>\bin directory.3. Run the following ObjectManager tool command to load the XML:

ObjectManager.cmd|.sh l c <OpenPages Administrator User> <OpenPages Administrator Password> <OP Installation Folder>\patch OPS_RCM_Compliance_Assessment_object-profile-view

Important: For more information on how to run the ObjectManager tool, see Running ObjectManagercommands (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_running_objectmanager_commands.html?lang=en).




Loading the application and object strings for Fix Pack 7.2.0.3After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you can load thecommon-app-strings-7-2-0-2 loader file.

About this task

Complete this procedure if you are upgrading from 7.2.0.0 or 7.2.0.1. You do not need to do thisprocedure if you are upgrading from 7.2.0.2 and you already loaded the application strings.

By following this procedure, you are enabling the ObjectManager utility to allow existing strings to beupdated, which could overwrite customizations that you might have made. Check the contents of thecommon-app-strings-7-2-0-2-op-config.xml file to determine if any strings that you modified areincluded in that file. If so, and if you decide you want to remake the customizations, you can use theAdministration > Export Configuration feature to export the customized strings for later reference tohelp you remake the modifications after you complete this section.

Procedure

1. Log in to the application server as a user with administrative privileges.2. Go to the <OP_HOME>/bin directory.3. Update the following properties in the ObjectManager.properties file and save the file:


4. If you did not apply Fix Pack 7.2.0.1 or if you applied Fix Pack 7.2.0.1 but you did not load theapplication strings at that time, load the 7.2.0.1 application strings.Run the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OpenPages Installation directory>/patch/addon_module/loaderdata/7201_loader_data common-app-strings-7-2-0-1

5. After the ObjectManager loading is complete, review the log and make sure that the processcompleted.

6. Load the 7.2.0.2 application strings.Run the following command:



8. Update the following properties in the ObjectManager.properties file and save the file:


Updating trigger definitionsFollow these steps to update trigger definitions with changes to KPI and KRI triggers.

Procedure

1. Open a browser window and log on to the OpenPages GRC Platform server (typically /opx) as a userwith administrative privileges.

2. Click Browse files under the Files heading.3. Click TriggerConfigFiles, and then click openpages-solutions.xml.4. Click Download Files.

Fix packs 273

5. Open the openpages-solutions.xml file. in a text editor.6. Look for the update.fields.status.2 attribute with the following value:

"OPSS-KRI-Shared.Collection Status=Awaiting Collection,OPSS-KRIVal.Value, OPSS-KRIVal.Value Date,OPSS-KRIVal.Approve Reject"

7. Replace the attribute value with the following:

"OPSS-KRI-Shared.Collection Status=Awaiting Collection, OPSS-KRIVal.Value,OPSS-KRIVal.Value Date,OPSS-KRIVal.Approve Reject, OPSS-KRI.Value,OPSS-KRI.Value Date,OPSS-KRI.Indicator Trend=Not Determined, OPSS-KRI-Shared.Breach Status=Not Determined"

8. Look for the update.fields.status.2 attribute with the following value:

"OPSS-KPI-Shared.Collection Status=Awaiting Collection,OPSS-KPIVal.Value, OPSS-KPIVal.Value Date,OPSS-KPIVal.Approve Reject"


"OPSS-KPI-Shared.Collection Status=Awaiting Collection, OPSS-KPIVal.Value,OPSS-KPIVal.Value Date,OPSS-KPIVal.Approve Reject, OPSS-KPI.Value,OPSS-KPI.Value Date,OPSS-KPI.Indicator Trend=Not Determined, OPSS-KPI-Shared.Breach Status=Not Determined"

10. In OPX, check out the openpages-solutions.xml file.11. Upload and check in the openpages-solutions.xml file that you edited.12. Restart all OpenPages servers.


Re-creating the reporting schema for Fix Pack 7.2.0.3If you are using IBM DB2 and if you dropped the reporting schema as part of your preparation for applyingthe IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, you must re-create the reporting schema.

About this task

Important: If you did not drop the reporting schema as part of your installation preparation in Preparingfor the fix pack installation, do not complete this procedure.

Procedure

1. Log in to OpenPages as a user with administrative privileges.2. Enable System Admin Mode (SAM).3. Click Administration > Reporting Schema and click Create.4. Click Refresh until the process is 100% complete.5. Disable SAM.

Re-creating the framework generation for Fix Pack 7.2.0.3During the application of the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.3, if you installedand configured the approval app or IBM OpenPages Loss Event Entry, and you want to report on the newfields, you must regenerate the reporting framework.


Recreating the global search index after upgrading from 7.2.0.0If you upgraded from 7.2.0.0 and you had global search enabled in 7.2.0.0, you must re-create the globalsearch index.

If you are upgrading from 7.2.0.1 or 7.2.0.2, you do not need to do this procedure.



Before you begin


Procedure

1. Start the global search service, if it is not already started.For more information, see “Starting and stopping the global search services” on page 206.

2. Log in to OpenPages with an administrative account.3. Click Administration > Global Search and click Create.

Additional tasks for Fix Pack 7.2.0.3You might want to complete additional tasks for the IBM OpenPages GRC Platform Fix Pack Installer for7.2.0.3.


Before you begin

Ensure that you have prepared your systems for deploying IBM OpenPages GRC Platform.

Procedure

1. Create a topology file that defines your deployment. To minimize errors, define the topology in theOpenPages Administrative Console and export the topology file. In a Linux/DB2 environment, you canuse the OP_7.2.0.3_Non_Embedded\Install\silentInstall\Topology_for_linux_DB2_Patch.xml file as a sample.










Fix packs 275




Manually uninstalling OpenPages Fix Pack 7.2.0.3After you back up your directories and files, you can manually uninstall the IBM OpenPages GRC PlatformFix Pack for 7.2.0.3, if necessary.

About this task

The following procedure assumes that you are installing Fix Pack 7.2.0.3 on top of OpenPages 7.2.0.0. Italso assumes that the backup folders use the name OpenPages7200Backup. Specify the name youchose when you created the backup directories in the Backing up directories and files topic.

Procedure


• OpenPages application servers and workflow server• IBM Cognos server• OpenPages Framework Model Generator server• OpenPages Global Search server

Note: For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

2. To restore OpenPages application directories and files, complete the following steps:a) Log on to the admin application server as a user with administrative privileges and full access to the

local server drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example opuser.





applications Copy the applications directory fromOpenPages7200Backup\OpenPages\applications into<OP_Home>

aurora Copy the aurora directory from OpenPages7200Backup\OpenPages\aurora into <OP_Home>

bin Copy the bin directory from OpenPages7200Backup\OpenPages\bin into <OP_Home>

profiles Copy the profiles directory from /opt/OpenPages7200Backup/OpenPages/profiles into<OP_Home>




openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup\OpenPages\openpagesregistry.xml into <OP_Home>






<Workflow_Home> Copy the root Fujitsu\InterstageBPM directory fromOpenPages7200Backup\Fujitsu\InterstageBPM into the<Workflow_Home> location.

4. To restore the IBM Cognos directories, complete the following steps:a) Log on to the reporting server as a user with administrative privileges and full access to the local





Example backup path




5. To restore the OpenPages Command Center directories and files, complete the following steps:a) On the reporting server, navigate to the <CC_Home> installation directory, where <CC_Home>



Fix packs 277


Example backup path




6. To restore the OpenPages Global Search Server directories and files, complete the following steps:a) On the search server, navigate to the <SEARCH_Home> installation directory, where<SEARCH_Home> represents the installation location of the OpenPages search application, bydefault C:\OpenPages\OpSearch for Windows, and /opt/OpenPages/OpSearch for AIX orLinux.






7. To restore the database, run the OpenPages restore (OPRestore) and CommandCenter restore(OPCCRestore) utilities to restore the database to the previous IBM OpenPages GRC Platform 7.2 level.

Note: For more information on how to use the restore utilities, see Using the Cognos Restore utility.8. Start all servers, including the following:




For more information on new features in Fix Pack 7.2.0.4, see the OpenPages GRC Platform New FeaturesGuide 7.2.0.





For additional information about IBM OpenPages GRC Platform 7.2, see the Release Notes.


You can install Fix Pack 7.2.0.4 directly onto IBM OpenPages GRC Platform 7.2. Alternatively, you caninstall Fix Pack 7.2.0.4 after installing Fix Pack 7.2.0.1, 7.2.0.2, or 7.2.0.3.



1. Perform backups, including the solutions helpers, images, and Dojo toolkits. For more information,see “Backups for the existing environments for Fix Pack 7.2.0.4” on page 280.

2. Make sure that the OpenPages application servers and reporting servers are running3. If you are using Oracle and you have Field Level Security (FLS) or Record Level Security (RLS)

security rules enabled, do one of the following steps.

a. Run the openpages_global_rule_disable.sql script to disable security rules. Note that ifyou choose this option, then you must use the openpages_global_rule_enable.sql scriptto re-enable security rules after the install. For information about using the scripts, see thedocument Installation of OpenPages 7.2.0.4 on Oracle will fail when security rules are definedand enabled (www.ibm.com/support/docview.wss?uid=swg21999290).

b. Manually disable security rules. For more information, see “Preparing for the installation of FixPack 7.2.0.4” on page 283.

c. Drop the reporting schema. For more information, see “Preparing for the installation of Fix Pack7.2.0.4” on page 283.

Installation stage

1. Prepare the servers for the fix pack. For more information, see “Preparing for the installation of FixPack 7.2.0.4” on page 283.

2. Update the OpenPages Administrative Console. For more information, see “Updating theOpenPages Administrative Console for Fix Pack 7.2.0.4” on page 285.

3. Install Fix Pack 7.2.0.4. For more information, see “Installing Fix Pack 7.2.0.4” on page 288.


1. Restore the solutions helpers, images, and Dojo toolkits. For more information, see “Restoring thehelpers, images, Dojo toolkits, and other files for Fix Pack 7.2.0.4” on page 290.

2. Install solutions updates. For more information, see “Applying the solutions fix pack for Fix Pack7.2.0.4” on page 290.





Fix packs 279




Re-create the reporting schemaThis procedure is required if you are using IBM DB2 version 10.5 and you have added fields, forexample, if you installed and configured the approval app.

It is also required if you are using Oracle and you dropped the reporting schema before installing7.2.0.4. For more information, see “Re-creating the reporting schema and re-enabling security rulesfor Fix Pack 7.2.0.4” on page 294.

Re-enable security rulesThis procedure is required if you are using Oracle and you disabled Field Level Security (FLS) orRecord Level Security (RLS) security rules before installing 7.2.0.4.

If you disabled security rules using the openpages_global_rule_disable.sql script, you mustuse the openpages_global_rule_enable.sql script to re-enable them. For more information,see the document Installation of OpenPages 7.2.0.4 on Oracle will fail when security rules are definedand enabled (www.ibm.com/support/docview.wss?uid=swg21999290).

If you manually disabled security rules, then you must manually re-enable them. For moreinformation, see “Re-creating the reporting schema and re-enabling security rules for Fix Pack7.2.0.4” on page 294.

Re-create the reporting frameworkThis procedure is required if you added new fields, for example, if you installed and configured theapproval app or IBM OpenPages Loss Event Entry, and you want to report on the new fields. For moreinformation, see “Re-creating the framework generation for Fix Pack 7.2.0.4” on page 295.

Re-create the global search indexThis procedure is required if you previously enabled the Global Search feature and you are upgradingfrom version 7.2.0.0. This procedure is not required if you are upgrading from 7.2.0.1 or later. Formore information, see “Recreating the global search index after upgrading from 7.2.0.0” on page 295.

Upgrade IBM DB2This procedure is optional. Fix Pack 7.2.0.3 and later fix packs support IBM DB2 version 11.1. DB210.5 is also supported. For more information, see “Upgrade IBM DB2” on page 53.


Preinstallation tasks for Fix Pack 7.2.0.4Before you can apply the Fix Pack Installer for 7.2.0.4, you must have IBM OpenPages GRC Platform7.2.0.0 or 7.2.0.0 Interim Fix 1 installed, and optionally Fix Pack 7.2.0.1 or later.

Backups for the existing environments for Fix Pack 7.2.0.4Before you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must back upthe OpenPages application environment, the Cognos environment, and the database.

OpenPages backup and CommandCenter backup utilitiesBefore you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, use the OpenPagesbackup (OPBackup) utility on each application server. Use the CommandCenter backup (OPCCBackup)utility on each reporting server.

To complete an IBM DB2 database backup, use the DB2 backup tools. To complete an Oracle databasebackup, use the OPBackup utility. For more information, see the following sections in the IBM®

OpenPages® GRC Platform Administrator Guide:









If global search is enabled, disable it before you run OPBackup. For more information, see UsingOPBackup and OPRestore when global search is enabled (http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_search_op_backup.html) in the IBM OpenPages GRC Platform Administrator's Guide.

For more information about how to configure the Oracle Data Pump directory for the first-time use, seethe The OPBackup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_opbackup_utility.html?cp=SSFUEU_7.2.0%2F2-0-17-6&lang=en) and Using the Cognos Backup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_ccbackup_utility.html?lang=en) chapters in the IBM OpenPages GRC PlatformAdministrator's Guide.

Backing up helpers, images, Dojo toolkits, and other filesBefore you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must back upthe solutions helpers, images, Dojo toolkits, and other files.

About this task



• You installed the Solutions schema• You received custom deliverables from the IBM OpenPages Technical Services Team• You have custom code

Procedure

1. Create a backup folder for backing up the helpers, images, and the Dojo toolkits.For example, C:\OpenPages\patch\helper_backup.





Backing up directories and filesBefore you can apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must back upyour directories and files.

About this task


Important: For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

Fix packs 281





Procedure

1. Log in to the admin and non-admin application servers as a user with administrative privileges and fullaccess to the local server drives. For AIX or Linux, use a non-root user, such as the user you created forthe IBM OpenPages GRC Platform installation, for example, opuser.














Important: If you are installing Fix Pack 7.2.0.4 on top of IBM OpenPages GRC Platform 7.2, use thefolder name OpenPages7200Backup when you create the backup directory path. Alternatively, if youare installing Fix Pack 7.2.0.4 on top of a fix pack that has been applied, create a folder path name thatcontains the OpenPages version number that you are backing up, for example,OpenPages7201Backup. The following steps assume that you are installing Fix Pack 7.2.0.4 on top ofOpenPages 7.2.0.0.






7. Copy the following CommandCenter directories and file from the <CC_Home> installation directory tothe backup directory location OpenPages7200Backup\CommandCenter:

• <CC_Home>\wlp


• <CC_Home>\tools\bin• <CC_Home>\openpagesregistry.xml





Installation tasks for Fix Pack 7.2.0.4Before you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, make sure that you haveall required backup folders and files.

Preparing for the installation of Fix Pack 7.2.0.4To ensure that the application of the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4 is able toperform all necessary steps, you must perform some preparation tasks.

Procedure

1. If you are upgrading from 7.2.0.0 and you used global search in 7.2.0.0, with all OpenPages serversrunning, complete the following steps to drop the search index:a) Log in to OpenPages as a user with administrative privileges.b) Click Administration > Global Search and click Disable.c) Click Administration > Global Search and click Drop.d) Stop the search services.




2. If you are upgrading from 7.2.0.1 or later, complete the following steps to stop the search services:a) If you used the global search script to start global search, use the StopSearchServers.cmd|.sh

script:

• For Windows, go to the <OP_Home>\OPSearch\opsearchtools\ directory and typeStopSearchServers.cmd.




• For UNIX, at a command line, run the following command:


3. For either Windows or UNIX, verify that global search is fully stopped by taking the following steps:

Fix packs 283

a) In the directory <OP_Home>/OPSearch/opsearchtools/, examine the filesopsearchtool_openpages.state and opsearchtool_folderacl.state and verify that thePID value is -1.





5. If you have a DB2 database server, determine if you need to drop the reporting schema.




a) Log in to OpenPages as a user with administrative privileges.b) Enable System Admin Mode (SAM).c) Click Administration > Reporting Schema and click Drop.d) Click Refresh until the process is 100% complete.e) Disable SAM.

6. If you are using an Oracle database, and you have Field Level Security (FLS) or Record Level Security(RLS) security rules enabled, do one of the following procedures.

• Run the openpages_global_rule_disable.sql script to disable security rules. Note that if youchoose this option, then you must use the openpages_global_rule_enable.sql script to re-enable security rules after the install. For information about using the script, see the documentInstallation of OpenPages 7.2.0.4 on Oracle will fail when security rules are defined and enabled(www.ibm.com/support/docview.wss?uid=swg21999290).

• Manually disable security rules by following these steps.

a. Log in to OpenPages as a user with administrative privileges.b. Enable System Admin Mode (SAM).c. Click Administration > Security Rules.d. Select the object type that contains the security rule that you want to disable, and disable it.e. Disable SAM.

• Drop the reporting schema. See step 5 for information about how to drop the reporting schema.7. If you plan to upgrade the OpenPages database to version 7.2.0.4 manually, stop all OpenPages

application servers (admin and non-admin), reporting servers (active and standby), and the searchserver. For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

Important: If you plan to upgrade the OpenPages database to version 7.2.0.4 automatically by usingthe Administrative Console, you do not need to complete this step.



Updating the OpenPages Administrative Console for Fix Pack 7.2.0.4To apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must update the OpenPagesinstaller package to 7.2.0.4 in IBM Installation Manager (IIM).

Before you begin


• Make sure that you are using IBM Installation Manager version 1.8.2 or later.• Make sure that OpenPages Administrative Console, version 7.2 or later is already installed.• Make sure that OpenPages Administrative Console Remote 7.2 is already installed on each server that is

included in your deployment. If it is not currently installed, you must install that package before you canapply the 7.2.0.4 fix pack.

Note: If the repository for OpenPages Administrative Console 7.2 is not already in the list of IIMrepositories, add the repository for the OpenPages Administrative Console 7.2, and then continue theOpenPages Administrative Console fix pack installation. For more information, see Updating OpenPagesAdministrative Console to version 7.2.0.1 fails to find required license files.


Procedure

1. Download the IBM OpenPages GRC Platform 7.2.0.4 fix pack installer package from IBM Fix Central.2. Run IIM on your OpenPages Administrative Console computer.3. Click File > Preferences.4. Register the OpenPages 7.2.0.4 fix pack repository and click OK.5. In the IIM main window, click Update.6. Under the Package Group Name, select the OPAdminConsole package group name and click Next.

The Update Packages window opens.7. Under Update, select the 7.2.0.4 version for the OPAdminConsole.8. Accept the terms in the license agreement and click Next.9. Under Features, select the 7.2.0.4 fix pack feature and click Next.


Update the database server manually for Fix Pack 7.2.0.4When you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you can manually updatethe database server by running the batch and shell scripts that are included in the media kit. Theprocedure depends on the version that you are updating from.


Applying Fix Pack 7.2.0.4 for the OpenPages database on OracleWhen you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you can manually updateyour Oracle database by running the batch or shell scripts that are included in the media kit.

Before you begin

Make sure that all OpenPages servers are shut down before you run a script.

Procedure

1. Copy the SQL scripts from <kit>\OP_7.2.0.4_Patch_Scripts\ORACLE\PATCH_SCRIPTS to theserver where you run the SQL scripts.

Fix packs 285





Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Also, besure that the mode for each .sh file is enabled to run properly. To do so, run the following command inthe directory where the files were copied: chmod +x *.sh



3. Update the following properties in sql-wrapper.sql to match the values for the installation you areupgrading, for example:


4. If you are upgrading from 7.2.0.0 to 7.2.0.4, complete the following steps.a) Run the OP-7-2-0-1-database-patch.bat|.sh file.b) Run the OP-7-2-0-2-database-patch.bat|.sh file.c) Run the OP-7-2-0-3-database-patch.bat|.sh file.d) Run the OP-7-2-0-4-database-patch.bat|.sh file.e) To protect security, remove passwords from configuration files.

5. If you are upgrading from 7.2.0.1 to 7.2.0.4, complete the following steps.a) Run the OP-7-2-0-2-database-patch.bat|.sh file.b) Run the OP-7-2-0-3-database-patch.bat|.sh file.c) Run the OP-7-2-0-4-database-patch.bat|.sh file.d) To protect security, remove passwords from configuration files.

6. If you are upgrading from 7.2.0.2 to 7.2.0.4, complete the following steps.a) Run the OP-7-2-0-3-database-patch.bat|.sh file.b) Run the OP-7-2-0-4-database-patch.bat|.sh file.c) To protect security, remove passwords from configuration files.

7. If you are upgrading from 7.2.0.3 to 7.2.0.4, complete the following steps.a) Run the OP-7-2-0-4-database-patch.bat|.sh file.b) To protect security, remove passwords from configuration files.

Applying Fix Pack 7.2.0.4 for the OpenPages database on DB2When you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you can manually updateyour IBM DB2 database by running the batch or shell scripts that are included in the media kit.

Before you begin


Procedure



• If there are multiple connections, it is not safe to upgrade the database. Make sure that allconnections other than the current DBA connection are closed before you proceed. One option toclose connections to the DB2 instance is to stop and start the DB2 instance. For more information,


see the Install and configure DB2 text search (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_db2_installandconfigure_textsearch.html?lang=en) chapter in the IBM® OpenPages® GRCPlatform Administrator Guide.

2. Copy the SQL scripts from <kit>\OP_7.2.0.4_Patch_Scripts\DB2\PATCH_SCRIPTS to theserver where you run the SQL scripts.




4. Update the following properties in the sql-wrapper.sql file to match the values for the installationyou are upgrading, for example:


5. If you are upgrading from 7.2.0.0 to 7.2.0.4, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-1-database-patch.bat|.sh file.c) Run the OP-7-2-0-2-database-patch.bat|.sh file.d) Run the OP-7-2-0-3-database-patch.bat|.sh file.e) Run the OP-7-2-0-4-database-patch.bat|.sh file.f) To protect security, remove passwords from configuration files.

6. If you are upgrading from 7.2.0.1 to 7.2.0.4, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-2-database-patch.bat|.sh script.c) Run the OP-7-2-0-3-database-patch.bat|.sh file.d) Run the OP-7-2-0-4-database-patch.bat|.sh file.e) To protect security, remove passwords from configuration files.

7. If you are upgrading from 7.2.0.2 to 7.2.0.4, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-3-database-patch.bat|.sh file.c) Run the OP-7-2-0-4-database-patch.bat|.sh file.d) To protect security, remove passwords from configuration files.

8. If you are upgrading from 7.2.0.3 to 7.2.0.4, complete the following steps.a) If you are using Windows, open the DB2 command line processor (db2cmd).b) Run the OP-7-2-0-4-database-patch.bat|.sh file.c) To protect security, remove passwords from configuration files.

Fix packs 287


Installing Fix Pack 7.2.0.4After you update the Administrative Console to version 7.2.0.4, you can apply the IBM OpenPages GRCPlatform Fix Pack Installer for 7.2.0.4.

Before you begin

• Ensure that the global search services are stopped and that the index is dropped (if required). For moreinformation, see “Preparing for the installation of Fix Pack 7.2.0.4” on page 283.


Procedure

1. Start the OpenPages 7.2 Administrative Console Remote tool on each server in your deployment, andthen start the OpenPages Administrative Console.


• If you have the topology.xml file from the OpenPages 7.2, 7.2.0.1, 7.2.0.2, or 7.2.0.3installation, proceed to step 3.

Tip: For best results, use the topology.xml file from the most recent installation.• If you do not have the topology.xml file, you must manually enter the fields for all of the

Welcome screens, as described in “Backing up and restoring the Administrative Consoleworkspace” on page 173. You must make sure that all fields are set to the same values that werespecified when 7.2 was installed or upgraded. Then, proceed to step 4.


then click Start.The Select a Deployment dialog box opens.

b) Click Browse, select the directory that contains the topology.xml file from the most recent7.2.x installation, and click OK.

c) Click OK.4. Return to the Welcome tab, click Install IBM OpenPages GRC Platform Fix Pack 7.2.0.4 in the

Deploy tasks section, and then click Start.5. Review the Deployment Information page, and then click Admin Server.6. On the Admin Server page, complete the following steps:


7. Click Report (Active) and review the inputs on the Report (Active) page. If you have reporting loadbalancing, click Report (Standby) and review the inputs. Click Database Server.


• If you want to use the OpenPages Administrative Console to update the existing databaseautomatically, select Install Now.


– If the database is DB2, complete the Database Path and Catalog Path fields.• If you already upgraded the database manually, select Already installed.


• If you want to use the OpenPages Administrative Console to load configuration data, select Load.


• If you want to load the configuration data manually, select Don't Load. Choose this option, forexample, if you customized application strings. After you install the fix pack, load the data manually.For more information, see “Loading the application and object strings manually for Fix Pack7.2.0.4” on page 293.




• To run all remaining steps of the fix pack installation, click Execute All Remaining Steps. When allsteps of the fix pack installation are complete, the reported status is Your most recentOpenPages deployment has been completed. Some tips on what to do next are alsodisplayed.

• To run just the reported step, click Execute Next Step or click the hyperlink in the RecommendedNext Step area. The reported status of a single step is Install completed successfully.

16. Repeat step 13 until the reported status is Your most recent OpenPages deployment hasbeen completed.






b) If you are prompted to log in, enter the OpenPages Administrator user name and password.c) Repeat these steps on every OpenPages server, including the vertical cluster members on all the

application servers.For example, if you have two vertical cluster members on the admin server and you use thedefault port, open http://<hostname>:10128/openpages/app/deck/reloadConfig inyour browser.

What to do next


Log files for Fix Pack 7.2.0.4If errors occur when you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you canreview the fix pack installer log files.

The installer creates a directory named patch/Deploy<data_time stamp>. This directory containslog files named session.log and aurora.log. You can find information in these files.


Fix packs 289

Postinstallation tasks for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must complete someadditional tasks.

Restoring the helpers, images, Dojo toolkits, and other files for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must restore thesolutions helpers, images, Dojo toolkits, and other files that you backed up.

About this task



Procedure


• <OP_HOME>/profiles\<Node Name>#\installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dojo/

• <OP_HOME>/profiles/<Node Name>#\installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dojox/

• <OP_HOME>/profiles/<Node Name>#\installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dijit/


3. If you backed up the Solutions schema, custom deliverables from the IBM OpenPages TechnicalServices Team team, or custom code restore them.

Applying the solutions fix pack for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you can apply thesolutions fix pack to fix some solutions issues.


• “Loading the out-of-box solutions reports for Fix Pack 7.2.0.4” on page 291• “Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.4” on page 291• “Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.4” on page 291• “Loading the XML file for the RCM solution for Fix Pack 7.2.0.4” on page 292• “Loading the application and object strings manually for Fix Pack 7.2.0.4” on page 293• “Updating trigger definitions” on page 294


• “Loading the XML file for the RCM solution for Fix Pack 7.2.0.4” on page 292• “Loading the application and object strings manually for Fix Pack 7.2.0.4” on page 293• “Updating trigger definitions” on page 294


• “Loading the application and object strings manually for Fix Pack 7.2.0.4” on page 293• “Updating trigger definitions” on page 294



• “Loading the application and object strings manually for Fix Pack 7.2.0.4” on page 293• “Updating trigger definitions” on page 294

Loading the out-of-box solutions reports for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must load the out-of-box solution reports.

About this task

If you have already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and loaded the out-of-box solution reports at that time, you do not need to complete this procedure.

Procedure

1. Log in to the reporting server as a user with administrative privileges.2. Go to the <Fix Pack Kit>/Modules/DB2 or ORACLE directory.3. Copy the OpenPages_Solutions_V6.zip file based on the database you are using to the IBM

Cognos deployment directory. The default location is the <Cognos_Home>/deployment directory.4. From a command line, go to the <CC_Home>/temp/bin directory. The default location is the<OP_Home>/CommandCenter/temp/bin directory.



Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.4To ensure that the Attestation Creation Report runs correctly, you must update yourPCM_Attestation_Creation.jsp file.

About this task

If you already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and you completed theprocedure at that time, you do not need to complete this procedure.



Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must update theOPLC-Incident.xml file if you use lifecycles for Incident objects.

About this taskIf you have already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and updated theOPLC-Incident.xml file or deployed the approval app, you do not need to complete this procedure.


Fix packs 291


Procedure

1. Open a browser window and log on to the IBM OpenPages GRC Platform server (typically /opx) as auser with administrative privileges.


<attribute name="email.body.string.key" value="lifecycle.incident.email.content"/> <attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment"/>

6. Replace the lines with the following lines:

<attribute name="email.body.string.key" value="lifecycle.incident.op.email.content"/> <attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment, OPLC-Std:LCDueDate,OPLC-3StageEsc:LCStatus"/>





Loading the XML file for the RCM solution for Fix Pack 7.2.0.4If you are using the IBM OpenPages Regulatory Compliance Management (RCM) solution, you can loadthe XML file for RCM.

About this task


If you already applied Fix Pack 7.2.0.2 or later, you do not need to do this procedure.

Procedure

1. Copy the OPS_RCM_Compliance_Assessment_object-profile-view-op-config.xml file from<OP 7204 Kit>/Modules/RCM to <OP_HOME>/patch.

2. Navigate to the <OP_HOME>/bin directory.3. Run the following ObjectManager tool command to load the XML:

ObjectManager.cmd|.sh l c <OpenPages Administrator User> <OpenPages Administrator Password> <OP Installation Folder>/patch OPS_RCM_Compliance_Assessment_object-profile-view





Loading the application and object strings manually for Fix Pack 7.2.0.4After you apply the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you can load theapplication strings.

About this task

Do this task if any of the following conditions are true:

• You chose not to load the configuration data automatically when you installed the fix pack• You chose to load the configuration data during the fix pack installation, but errors occurred when the

data was loaded• You did not load the application strings when you applied a previous fix pack (either by using the fix

pack installer or by loading them manually) and you want to load them manually now

By following this procedure, you are enabling the ObjectManager utility to allow existing strings to beupdated, which could overwrite customizations that you might have made. Check the contents of thecommon-app-strings-<version>-op-config.xml file to determine if any strings that you modifiedare included in that file. If so, and if you decide you want to remake the customizations, you can use theAdministration > Export Configuration feature to export the customized strings for later reference tohelp you remake the modifications after you complete this section.

Procedure








Note: Fix Pack 7.2.0.3 did not include changes to the application strings, so you do not need to loadapplication strings from Fix Pack 7.2.0.3.


8. Load the 7.2.0.4 application strings.Run the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OpenPages Installation directory>/patch/addon_module/loaderdata common-app-strings-7-2-0-4

Fix packs 293




Updating trigger definitionsFollow these steps to update the trigger definitions with changes to KPI and KRI triggers..

About this task

If you are upgrading from 7.2.0.3 and you have already updated the trigger definitions, you do not need todo this procedure.

Procedure


2. Click Browse files under the Files heading.3. Click TriggerConfigFiles, and then click openpages-solutions.xml.4. Click Download Files.5. Open the openpages-solutions.xml file. in a text editor.6. Look for the update.fields.status.2 attribute with the following value:

"OPSS-KRI-Shared.Collection Status=Awaiting Collection,OPSS-KRIVal.Value, OPSS-KRIVal.Value Date,OPSS-KRIVal.Approve Reject"




"OPSS-KPI-Shared.Collection Status=Awaiting Collection,OPSS-KPIVal.Value, OPSS-KPIVal.Value Date,OPSS-KPIVal.Approve Reject"





Re-creating the reporting schema and re-enabling security rules for Fix Pack 7.2.0.4If you are using IBM DB2 and if you dropped the reporting schema as part of your preparation for applyingthe IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, you must re-create the reporting schema.If you are using Oracle and you dropped the reporting schema before installing 7.2.0.4, recreate thereporting schema. If you disabled Field Level Security (FLS) or Record Level Security (RLS) security rulesinstead of dropping the reporting schema, re-enable security rules.


About this task

Important: If you are using IBM DB2, and you did not drop the reporting schema as part of yourinstallation preparation in “Preparing for the installation of Fix Pack 7.2.0.4” on page 283, do notcomplete this procedure.

Procedure

1. Log in to OpenPages as a user with administrative privileges.2. Enable System Admin Mode (SAM).3. To re-create the reporting schema:

a) Click Administration > Reporting Schema and click Create.b) Click Refresh until the process is 100% complete.

4. To re-enable security rules do one of the following:a) If you disabled security rules by running the openpages_global_rule_disable.sql script,

then re-enable security rules using the openpages_global_rule_enable.sql script. Forinformation about using the script, see the document Installation of OpenPages 7.2.0.4 on Oraclewill fail when security rules are defined and enabled (www.ibm.com/support/docview.wss?uid=swg21999290).

b) If you disabled security rules manually, then re-enable them manually. Click Administration >Security Rules. Select the object type that contains the security rule that you want to enable andenable the security rule.

5. Disable SAM.

Re-creating the framework generation for Fix Pack 7.2.0.4During the application of the IBM OpenPages GRC Platform Fix Pack Installer for 7.2.0.4, if you installedand configured the approval app or IBM OpenPages Loss Event Entry, and you want to report on the newfields, you must regenerate the reporting framework.



If you are upgrading from 7.2.0.1 or later, you do not need to do this procedure.

Before you begin


Procedure



Additional tasks for Fix Pack 7.2.0.4You might want to complete additional tasks for the IBM OpenPages GRC Platform Fix Pack Installer for7.2.0.4.

Fix packs 295





Before you begin


Procedure

1. Create a topology file that defines your deployment. To minimize errors, define the topology in theOpenPages Administrative Console and export the topology file. In a Linux/DB2 environment, you canuse the OP_7.2.0.4_Non_Embedded\Install\silentInstall\Topology_for_linux_DB2_Patch.xml file as a sample.













Manually uninstalling OpenPages Fix Pack 7.2.0.4After you back up your directories and files, you can manually uninstall the IBM OpenPages GRC PlatformFix Pack for 7.2.0.4, if necessary.

About this task

The following procedure assumes that you are installing Fix Pack 7.2.0.4 on top of OpenPages 7.2.0.0. Italso assumes that the backup directories use the name OpenPages7200Backup. Specify the name thatyou chose when you created the backup directories in the “Backing up directories and files” on page 281topic.


Procedure




2. To restore OpenPages application directories and files, complete the following steps:a) Log on to the admin application server as a user with administrative privileges and full access to the

local server drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example opuser.





applications Copy the applications directory fromOpenPages7200Backup/OpenPages/applications into<OP_Home>

aurora Copy the aurora directory from OpenPages7200Backup/OpenPages/aurora into <OP_Home>

bin Copy the bin directory from OpenPages7200Backup/OpenPages/bin into <OP_Home>

profiles Copy the profiles directory from OpenPages7200Backup/OpenPages/profiles into <OP_Home>

openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup/OpenPages/openpagesregistry.xml into <OP_Home>






<Workflow_Home> Copy the root Fujitsu/InterstageBPM directory fromOpenPages7200Backup/Fujitsu\InterstageBPM into the<Workflow_Home> location.

4. To restore the IBM Cognos directories, complete the following steps:

Fix packs 297

a) Log on to the reporting server as a user with administrative privileges and full access to the localserver drives. For AIX or Linux, use a non-root user, such as the user you created for the IBMOpenPages GRC Platform installation, for example opuser.




Example backup path




5. To restore the OpenPages CommandCenter directories and files, complete the following steps:a) On the reporting server, navigate to the <CC_Home> installation directory, where <CC_Home>




Example backup path




6. To restore the OpenPages Global Search Server directories and files, complete the following steps:a) On the search server, navigate to the <SEARCH_Home> installation directory, where<SEARCH_Home> represents the installation location of the OpenPages search application, bydefault C:\OpenPages\OpSearch for Windows, and /opt/OpenPages/OpSearch for AIX orLinux.








Note: For more information, see Using the Cognos Restore utility.8. Start all servers, including the following:



Fix Pack 7.2.0.5 and later fix packsUse the tasks in this section if you are installing OpenPages Fix Pack 7.2.0.5 or later. The installationprocess consists of four main tasks: preinstallation tasks, installation tasks, postinstallation tasks, andadditional tasks.

You can find information about defect corrections on the OpenPages GRC Platform 7.2 Fix List (http://www.ibm.com/support/docview.wss?uid=swg27047061) page.

For additional information about IBM OpenPages GRC Platform 7.2, see the Release Notes.

Installation process overview for Fix Pack 7.2.0.5 or laterUse the tasks in this section if you are installing OpenPages Fix Pack 7.2.0.5 or later. The installationprocess consists of a series of procedures, which are divided into preinstallation, installation, andpostinstallation stages. Some procedures are mandatory; others might be optional, depending on yourconfiguration.

You can install Fix Pack 7.2.0.5 or later directly onto IBM OpenPages GRC Platform 7.2. Alternatively, youcan install Fix Pack 7.2.0.5 or later after installing an earlier 7.2.0.x fix pack.

During the installation process, you have the option to use the OpenPages Administrative Console toupgrade the OpenPages database automatically. Alternatively, you can choose to upgrade it manually.


1. If you use the Apache POI libraries, see Potential remediation of Custom Triggers and Helpersrequired (http://www.ibm.com/support/docview.wss?uid=swg22005130).

2. Perform backups, including the solutions helpers, images, and Dojo toolkits. For more information,see “Backups for the existing environments” on page 300.

3. If you are using Oracle, prepare the database for the fix pack. For more information, see “Preparingan Oracle database for an OpenPages fix pack” on page 303.

4. Make sure that the OpenPages application servers and reporting servers are running.

Fix packs 299





Installation stage

1. Prepare the servers for the fix pack. For more information, see “Preparing for the installation of FixPack 7.2.0.5 or later” on page 304.

2. Update the OpenPages Administrative Console. For more information, see “Updating theOpenPages Administrative Console for Fix Pack 7.2.0.5 or later” on page 305.

3. Install the fix pack. For more information, see “Installing Fix Pack 7.2.0.5 or later” on page 308.


1. Restore the solutions helpers, images, and Dojo toolkits. For more information, see “Restoring thehelpers, images, Dojo toolkits, and other files for Fix Pack 7.2.0.5 or later” on page 310.

2. Install solutions updates. For more information, see “Applying the solutions fix pack for Fix Pack7.2.0.5 or later” on page 311.





Re-create the reporting schemaThis procedure is required if you are using IBM DB2 version 10.5 and you have added fields, forexample, if you installed and configured the approval app. For more information, see “Recreating thereporting schema for Fix Pack 7.2.0.5 or later” on page 317.

Re-create the reporting frameworkThis procedure is required if you added new fields, for example, if you installed and configured theapproval app or IBM OpenPages Loss Event Entry, and you want to report on the new fields. For moreinformation, see “Re-generation of the reporting framework for Fix Pack 7.2.0.5 or later” on page 317.

Re-create the global search indexThis procedure is required if you previously enabled the Global Search feature and you are upgradingfrom version 7.2.0.0. This procedure is not required if you are upgrading from 7.2.0.1 or later. Formore information, see “Recreating the global search index after upgrading from 7.2.0.0” on page 317.

Upgrade IBM DB2This procedure is optional. Fix Pack 7.2.0.3 and later fix packs support IBM DB2 version 11.1. DB210.5 is also supported. For more information, see “Upgrade IBM DB2” on page 53.


Preinstallation tasks for Fix Pack 7.2.0.5 or laterBefore you can apply a fix pack, you must have IBM OpenPages GRC Platform 7.2.0.0 or 7.2.0.0 InterimFix 1 installed, and optionally Fix Pack 7.2.0.1 or later.

Backups for the existing environmentsBefore you apply the IBM OpenPages GRC Platform fix pack, back up the OpenPages applicationenvironment, the Cognos environment, and the database.

Do these tasks if you are installing fix pack 7.2.0.5 or a later fix pack.



OpenPages backup and CommandCenter backup utilitiesBefore you apply the IBM OpenPages GRC Platform fix pack, use the OpenPages backup (OPBackup)utility on each application server. Use the CommandCenter backup (OPCCBackup) utility on eachreporting server.

To complete an IBM DB2 database backup, use the DB2 backup tools. To complete an Oracle databasebackup, use the OPBackup utility. For more information, see the following sections in the IBM®

OpenPages® GRC Platform Administrator Guide:




If global search is enabled, disable it before you run OPBackup. For more information, see UsingOPBackup and OPRestore when global search is enabled (http://www.ibm.com/support/knowledgecenter/en/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_search_op_backup.html) in the IBM OpenPages GRC Platform Administrator's Guide.

For more information about how to configure the Oracle Data Pump directory for the first-time use, seethe The OPBackup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_opbackup_utility.html?cp=SSFUEU_7.2.0%2F2-0-17-6&lang=en) and Using the Cognos Backup utility (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_the_ccbackup_utility.html?lang=en) chapters in the IBM OpenPages GRC PlatformAdministrator's Guide.

Backing up helpers, images, Dojo toolkits, and other filesBefore you apply the IBM OpenPages GRC Platform fix pack, back up the solutions helpers, images, Dojotoolkits, and other files.

About this task



• You installed the solutions schema• You received custom deliverables from the IBM OpenPages Technical Services Team• You have custom code

Procedure

1. Create a backup folder for backing up the helpers, images, and the Dojo toolkits.For example, C:\OpenPages\patch\helper_backup.


• /dojo_1.10.4/dojo/toolkit• /dojo_1.10.4/dojox/toolkit• /dojo_1.10.4/dijit/toolkit

Fix packs 301









Backing up directories and filesBefore you apply the IBM OpenPages GRC Platform fix pack, back up your directories and files.

About this task


Procedure

1. Log in to the application servers, the CommandCenter servers, and the search server as a user withadministrative privileges and full access to the local server drives. For AIX or Linux, use a non-rootuser, such as the user you created for the IBM OpenPages GRC Platform installation, for example,opuser.


• OpenPages application servers• OpenPages Framework Model Generator service• IBM Cognos servers• OpenPages search server













Important: If you are installing the fix pack on top of IBM OpenPages GRC Platform 7.2, use the foldername OpenPages7200Backup when you create the backup directory path. Alternatively, if you areinstalling the fix pack on top of an earlier 7.2.x fix pack, create a folder path name that contains theOpenPages version number that you are backing up, for example, OpenPages7201Backup. Thefollowing steps assume that you are installing a fix pack on top of OpenPages 7.2.0.0.

Further, if you are backing up multiple servers of the same type (such as admin and non-adminapplication servers, or active and standby CommandCenter servers) use a separate backup directorystructure for each server.


4. Copy the following directories and files from each <OP_Home> application server installation directoryto the backup directory location OpenPages7200Backup/OpenPages:

• <OP_Home>/applications• <OP_Home>/aurora• <OP_Home>/bin• <OP_Home>/profiles• <OP_Home>/openpagesregistry.xml

5. Copy the entire <Workflow_Home> installation directory from each application server to the backupdirectory location OpenPages7200Backup/Fujitsu/InterstageBPM.

6. Copy the following CommandCenter directories from the <Cognos_Home> installation directory to thebackup directory location OpenPages7200Backup/Cognos/cognos/c10_64:

• <Cognos_Home>/webapps/p2pd/WEB-INF/lib• <Cognos_Home>/configuration

7. Copy the following CommandCenter directories and file from the <CC_Home> installation directory tothe backup directory location OpenPages7200Backup/CommandCenter:

• <CC_Home>/wlp• <CC_Home>/tools/bin• <CC_Home>/openpagesregistry.xml

8. Copy the following search server directories and file from the <SEARCH_Home> installation directory tothe backup directory location OpenPages7200Backup/OpSearch:

• <SEARCH_Home>/opsearchtools• <SEARCH_Home>/openpagesregistry.xml

9. Start all OpenPages servers, including the following: :



Preparing an Oracle database for an OpenPages fix packIf you are using Oracle for the OpenPages database, ask your database administrator to prepare thedatabase for the IBM OpenPages GRC Platform fix pack.

About this task

Do this procedure if:

• You are installing fix pack 7.2.0.5, or• You are installing fix pack 7.2.0.6 or later onto 7.2.0.4 or an earlier 7.2.x fix pack.

You do not need to do this task if you ran the OP-<version>-dba_prereq.sql script during a previousfix pack installation.

Procedure

1. Copy the OP-<version>-dba_prereq.sql script from the <fix_pack_kit>/OP_<version>_Non_Embedded/OP_<version>_Patch_Scripts/Oracle/PATCH_SCRIPTSdirectory to the Oracle database server.

For example, if you are installing fix pack 7.2.0.6, copy the OP-7-2-0-6-dba_prereq.sql script.

Fix packs 303

2. Log in to SQL*Plus as a user that has SYSDBA privileges.

sqlplus sys/<sys-password>@<OP_db_name> as sysdba

Example:

sqlplus sys/passw0rd@op as sysdba

3. Run the OP-<version>-dba_prereq.sql script.Replace <schema_name> with the name of the OpenPages database schema.

@OP-<version>-dba_prereq.sql <schema_name>

Example:

@OP-7-2-0-6-dba_prereq.sql openpage

What to do nextYou can now install the fix pack.

Installation tasks for Fix Pack 7.2.0.5 or laterBefore you apply a fix pack, make sure that you have all required backup folders and files.

Do these tasks if you are installing 7.2.0.5 or a later fix pack.

Preparing for the installation of Fix Pack 7.2.0.5 or laterTo ensure that the IBM OpenPages GRC Platform fix pack installer can perform all necessary steps, youmust do some preparation tasks.

Procedure

1. If you are upgrading from 7.2.0.0 and you used global search in 7.2.0.0, with all OpenPages serversrunning, complete the following steps to drop the search index:a) Log in to OpenPages with an administrative account.b) Click Administration > Global Search and click Disable.c) Click Administration > Global Search and click Drop.d) Stop the search services.




2. If you are upgrading from 7.2.0.1 or later, complete the following steps to stop the search services:a) If you used the global search script to start global search, use the StopSearchServers.cmd|.sh

script:

• For Windows, go to the <OP_Home>\OPSearch\opsearchtools\ directory and typeStopSearchServers.cmd.





• For UNIX, at a command line, run the following command:







5. If you have a DB2 database server, determine if you need to drop the reporting schema.





6. If you plan to upgrade the OpenPages database manually to the fix pack version, stop all OpenPagesapplication servers (admin and non-admin), reporting servers (active and standby), and the searchserver. For information about starting and stopping servers, see Chapter 15, “Starting and stoppingservers,” on page 201.

Important: If you plan to upgrade the OpenPages database to the fix pack version automatically byusing the Administrative Console, you do not need to complete this step.

Updating the OpenPages Administrative Console for Fix Pack 7.2.0.5 or laterTo apply the IBM OpenPages GRC Platform fix pack, you must update the OpenPages installer package tothe fix pack version by using IBM Installation Manager (IIM).

Before you begin


• Make sure that you are using IBM Installation Manager version 1.8.2 or later.• Make sure that OpenPages Administrative Console, version 7.2 or later is already installed.• Make sure that OpenPages Administrative Console Remote 7.2 is already installed on each server that is

included in your deployment. If it is not currently installed, you must install that package before you canapply the fix pack.

Note: If the repository for OpenPages Administrative Console 7.2 is not already in the list of IIMrepositories, add the repository for the OpenPages Administrative Console 7.2, and then continue the

Fix packs 305

OpenPages Administrative Console fix pack installation. For more information, see Updating OpenPagesAdministrative Console to version 7.2.0.1 fails to find required license files.


Procedure

1. Download the IBM OpenPages GRC Platform fix pack installer package from IBM Fix Central.2. Run IIM on your OpenPages Administrative Console computer.3. Click File > Preferences.4. Register the OpenPages fix pack repository that you downloaded and click OK.5. In the IIM main window, click Update.6. Under the Package Group Name, select the OPAdminConsole package group name and click Next.

The Update Packages window opens.7. Under Update, select the fix pack version for the OPAdminConsole.8. Accept the terms in the license agreement and click Next.9. Under Features, select the fix pack version and click Next.


Update the database server manually for Fix Pack 7.2.0.5 or laterWhen you apply a fix pack, you can manually update the database server by running the batch and shellscripts that are included in the media kit. The procedure depends on the version that you are updatingfrom.


Applying a fix pack to the OpenPages database on Oracle (7.2.0.5 or later)When you apply a fix pack, you can manually update your Oracle database by running the batch or shellscripts that are included in the media kit.

Before you begin

Make sure that all OpenPages servers are shut down before you run a script.

Procedure

1. Copy the SQL scripts from <kit>/OP_<version>_Patch_Scripts/ORACLE/PATCH_SCRIPTS tothe server where you run the SQL scripts.

Important: When you edit shell scripts to be run on UNIX, be sure to set fileformat=unix. Also, besure that the mode for each .sh file is enabled to run properly. To do so, run the following command inthe directory where the files were copied: chmod +x *.sh



3. Update the following properties in sql-wrapper.sql to match the values for the installation you areupgrading, for example:







4. Run the database patch scripts in sequence. Ensure that each script completes successfully beforeyou run the next patch script.

Examples:

• If you are upgrading from 7.2.0.5 to 7.2.0.6, run the OP-7-2-0-6-database-patch.bat|.shscript

• If you are upgrading from 7.2.0.0 to 7.2.0.6, run the following scripts:

– OP-7-2-0-1-database-patch.bat|.sh– OP-7-2-0-2-database-patch.bat|.sh– OP-7-2-0-3-database-patch.bat|.sh– OP-7-2-0-4-database-patch.bat|.sh– OP-7-2-0-5-database-patch.bat|.sh– OP-7-2-0-6-database-patch.bat|.sh

5. To protect security, remove passwords from configuration files.

Applying a fix pack to the OpenPages database on DB2 (7.2.0.5 or later)When you apply a fix pack, you can manually update your IBM DB2 database by running the batch or shellscripts that are included in the media kit.

Before you begin


Procedure



• If there are multiple connections, it is not safe to upgrade the database. Make sure that allconnections other than the current DBA connection are closed before you proceed. One option toclose connections to the DB2 instance is to stop and start the DB2 instance. For more information,see the Install and configure DB2 text search (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_db2_installandconfigure_textsearch.html?lang=en) topic in the IBM® OpenPages® GRCPlatform Administrator Guide.

2. Copy the SQL scripts from <kit>/OP_<version>_Patch_Scripts/DB2/PATCH_SCRIPTS to theserver where you run the SQL scripts.




4. Update the following properties in the sql-wrapper.sql file to match the values for the installationyou are upgrading, for example:

define opx_op_admin_name=’OpenPagesAdministrator’define opx_op_admin_pwd=’OpenPagesAdministrator’

Fix packs 307


define opx_base_currency_iso_code=’USD’define opx_dflt_stor_srv_root=’c:\OpenPages\openpages-storage’

5. If you are using Windows, open the DB2 command line processor (db2cmd).6. Run the database patch scripts in sequence. Ensure that each script completes successfully before

you run the next patch script.

Examples:

• If you are upgrading from 7.2.0.5 to 7.2.0.6, run the OP-7-2-0-6-database-patch.bat|.shscript

• If you are upgrading from 7.2.0.0 to 7.2.0.6, run the following scripts:

– OP-7-2-0-1-database-patch.bat|.sh– OP-7-2-0-2-database-patch.bat|.sh– OP-7-2-0-3-database-patch.bat|.sh– OP-7-2-0-4-database-patch.bat|.sh– OP-7-2-0-5-database-patch.bat|.sh– OP-7-2-0-6-database-patch.bat|.sh

7. To protect security, remove passwords from configuration files.

Installing Fix Pack 7.2.0.5 or laterAfter you update the Administrative Console to the fix pack version, you can apply the fix pack to IBMOpenPages GRC Platform.

Before you begin

• Ensure that the global search services are stopped and that the index is dropped (if required). For moreinformation, see “Preparing for the installation of Fix Pack 7.2.0.5 or later” on page 304.


Procedure

1. Start the OpenPages 7.2 Administrative Console Remote tool on each server in your deployment, andthen start the OpenPages Administrative Console.


• If you have the topology.xml file from the OpenPages 7.2 installation or from a 7.2.0.x fix packinstallation, proceed to step 3.

Tip: For best results, use the topology.xml file from the most recent installation.• If you do not have the topology.xml file, you must manually enter the fields for all of the

Welcome screens, as described in “Backing up and restoring the Administrative Consoleworkspace” on page 173. You must make sure that all fields are set to the same values that werespecified when 7.2 was installed or upgraded. Then, proceed to step 4.


then click Start.The Select a Deployment dialog box opens.

b) Click Browse, select the directory that contains the topology.xml file from the most recent7.2.x installation, and click OK.

c) Click OK.4. Return to the Welcome tab, click Install IBM OpenPages GRC Platform Fix Pack <version> in the

Deploy tasks section, and then click Start.


5. Review the Deployment Information page, and then click Admin Server.6. On the Admin Server page, change the Module data field to No Schema.7. If you have a horizontal cluster, click Non-Admin Server and review the inputs.8. Click Report (Active) and review the inputs on the Report (Active) page. If you have reporting load

balancing, click Report (Standby) and review the inputs. Click Database Server.9. On the Database Server page, you can choose to upgrade the existing database server automatically

or manually. Complete one of the following steps:

• If you want to use the OpenPages Administrative Console to update the existing databaseautomatically, select Install Now.


– If the database is DB2, complete the Database Path and Catalog Path fields.• If you already upgraded the database manually, select Already installed.



example, if you customized application strings. After you install the fix pack, load the data manually.For more information, see “Loading the application and object strings manually for Fix Pack 7.2.0.6or later” on page 315.




• To run all remaining steps of the fix pack installation, click Execute All Remaining Steps. When allsteps of the fix pack installation are complete, the reported status is Your most recentOpenPages deployment has been completed. Some tips on what to do next are alsodisplayed.

• To run just the reported step, click Execute Next Step or click the hyperlink in the RecommendedNext Step area. The reported status of a single step is Install completed successfully.

17. Repeat step “16” on page 309 until the reported status is Your most recent OpenPagesdeployment has been completed.




19. Restart all the servers, including the application servers, reporting servers, and the search server.20. If you are using the approval app, load the approval app configuration.


b) If you are prompted to log in, enter the OpenPages Administrator user name and password.

Fix packs 309

c) Repeat these steps on every OpenPages server, including the vertical cluster members on all theapplication servers.For example, if you have two vertical cluster members on the admin server and you use thedefault port, open http://<hostname>:10128/openpages/app/deck/reloadConfig inyour browser.

What to do next

Perform the postinstallation tasks. For more information, see “Postinstallation tasks for Fix Pack 7.2.0.5or later” on page 310.

Log files for Fix Pack 7.2.0.5 or laterIf errors occur when you apply the fix pack, you can review the fix pack installer log files.

The OpenPages Administrative Console creates a directory that is named sessions. To find thesessions directory, look in the directory where the topology.xml file is stored on the computer whereyou ran the Administrative Console.

The sessions directory contains subdirectories that are named using time stamps. Each subdirectorycontains a session.log file, and possibly other log files. A session.log file is created for each actionthat was performed by the OpenPages Administrative Console


Postinstallation tasks for Fix Pack 7.2.0.5 or laterAfter you apply a fix pack, you must complete some additional tasks.

Do these tasks if you are installing 7.2.0.5 or a later fix pack.

Restoring the helpers, images, Dojo toolkits, and other files for Fix Pack 7.2.0.5 or laterAfter you apply the fix pack, you must restore the solutions helpers, images, Dojo toolkits, and other filesthat you backed up.

About this task



Procedure


• <OP_HOME>/profiles/<Node Name>#/installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dojo/toolkit

• <OP_HOME>/profiles/<Node Name>#/installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dojox/toolkit

• <OP_HOME>/profiles/<Node Name>#/installedApps/OpenPagesCell/op-apps.ear/sosa.war/dojo_1.10.4/dijit/toolkit

Attention: Do not overwrite files in the dojo_1.10.4/dojo, dojo_1.10.4/dojox, ordojo_1.10.4/dijit directories.



3. If you backed up the solutions schema, custom deliverables from the IBM OpenPages TechnicalServices Team team, or custom code restore them.

Applying the solutions fix pack for Fix Pack 7.2.0.5 or laterAfter you apply the fix pack, you can apply the solutions fix pack to fix some solutions issues.

1. If you are upgrading from 7.2.0.0, do these tasks, and then proceed to step 2:

• “Loading the out-of-box solutions reports for Fix Pack 7.2.0.5 or later” on page 311• “Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.5 or later” on page

311• “Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.5 or later”

on page 3122. If you are upgrading from 7.2.0.0 or 7.2.0.1, do this task, and then proceed to step 3:

• “Loading the XML file for the RCM solution for Fix Pack 7.2.0.5 or later” on page 3123. If you are upgrading from 7.2.0.0, 7.2.0.1, or 7.2.0.2 do this task, and then proceed to step 4 or step 5:

• “Updating trigger definitions” on page 3134. If you are installing Fix Pack 7.2.0.5, do this task:

• “Loading the application and object strings manually for Fix Pack 7.2.0.5” on page 3145. If you are installing fix pack 7.2.0.6 or a later fix pack, do these tasks:

• “Loading the application and object strings manually for Fix Pack 7.2.0.6 or later” on page 315• “Updating the Timesheet Entry helper” on page 316• Review the readme file in the fix pack kit to determine if any additional post installation tasks are

required.

Loading the out-of-box solutions reports for Fix Pack 7.2.0.5 or laterAfter you apply the fix pack, you must load the out-of-box solution reports.

About this task

If you have already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and loaded the out-of-box solution reports at that time, you do not need to complete this procedure.

Procedure

1. Log in to the reporting server as a user with administrative privileges.2. Go to the <Fix Pack Kit>/Modules/DB2 or ORACLE directory.3. Copy the OpenPages_Solutions_V6.zip file based on the database you are using to the IBM

Cognos deployment directory. The default location is the <Cognos_Home>/deployment directory.4. From a command line, go to the <CC_Home>/temp/bin directory. The default location is the<OP_Home>/CommandCenter/temp/bin directory.



Ensuring that the Attestation Creation Report runs correctly for Fix Pack 7.2.0.5 or laterTo ensure that the Attestation Creation Report runs correctly, you must update yourPCM_Attestation_Creation.jsp file.

About this task

If you already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and you updated the file atthat time, you do not need to complete this procedure.

Fix packs 311



Updating the XML trigger file to enable lifecycles for Incident objects for Fix Pack 7.2.0.5 or laterAfter you apply the fix pack, you must update the OPLC-Incident.xml file if you use lifecycles forIncident objects.

About this taskIf you have already applied IBM OpenPages GRC Platform Fix Pack 7.2.0.1 or later and updated theOPLC-Incident.xml file or deployed the approval app, you do not need to complete this procedure.


Procedure



<attribute name="email.body.string.key" value="lifecycle.incident.email.content"/><attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment"/>

6. Replace the lines with the following lines:

<attribute name="email.body.string.key" value="lifecycle.incident.op.email.content"/><attribute name="email.body.parameter.fields" value="OPLC-Std:LCAssignee, name, description, OPSS-Inc:Severity, OPSS-Inc:Priority,OPLC-Std:LCComment, OPLC-Std:LCDueDate,OPLC-3StageEsc:LCStatus"/>





Loading the XML file for the RCM solution for Fix Pack 7.2.0.5 or laterIf you are using the IBM OpenPages Regulatory Compliance Management (RCM) solution, you can loadthe XML file for RCM.

About this task


If you already applied Fix Pack 7.2.0.2 or later, you do not need to do this procedure.



Procedure

1. Copy the OPS_RCM_Compliance_Assessment_object-profile-view-op-config.xml file from<fix pack kit>/OP_<version>_Non_Embedded/Modules/RCM to <OP_HOME>/patch.

2. Navigate to the <OP_HOME>/bin directory.3. Run the following ObjectManager tool command to load the XML:

ObjectManager.cmd|.sh l c <OpenPages Administrator User> <OpenPages Administrator Password> <OP_HOME>/patch OPS_RCM_Compliance_Assessment_object-profile-view


Updating trigger definitionsFollow these steps to update trigger definitions with changes to KPI and KRI triggers.

About this task

If you applied fix pack 7.2.0.3 or a later fix pack and you have already updated the trigger definitions, youdo not need to do this procedure.

Procedure


2. Click Browse files under the Files heading.3. Click TriggerConfigFiles, and then click openpages-solutions.xml.4. Click Download Files.5. Open the openpages-solutions.xml file. in a text editor.6. Look for the update.fields.status.2 attribute with the following value:

"OPSS-KRI-Shared.Collection Status=Awaiting Collection, OPSS-KRIVal.Value,OPSS-KRIVal.Value Date,OPSS-KRIVal.Approve Reject"




"OPSS-KPI-Shared.Collection Status=Awaiting Collection, OPSS-KPIVal.Value,OPSS-KPIVal.Value Date,OPSS-KPIVal.Approve Reject"





Fix packs 313



Loading the application and object strings manually for Fix Pack 7.2.0.5After you apply the fix pack, you can load the application strings.

About this task

This task applies to fix pack 7.2.0.5.






Procedure



4. If you did not apply pre-7.2.0.5 fix packs or if you applied earlier fix packs but did not load theapplication strings at that time, load the application strings for each fix pack in sequence.

Use the following syntax:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OpenPages Installation directory>/patch/addon_module/loaderdata/<version>_loader_data common-app-strings-<version>

The available files are:

• common-app-strings-7-2-0-1• common-app-strings-7-2-0-2• common-app-strings-7-2-0-4



6. Load the application strings and application fixes for Fix Pack 7.2.0.5:a) Run the following command to load the application strings:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OpenPages Installation directory>/patch/addon_module/loaderdata common-app-strings-7-2-0-5

b) Run the following command to load the application fixes.

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password>


<OpenPages Installation directory>/patch/addon_module/loaderdata common-app-fixes-7-2-0-5

c) After the ObjectManager loading is complete, review the log and make sure that the processcompleted.



Loading the application and object strings manually for Fix Pack 7.2.0.6 or laterAfter you apply the fix pack, you can load the application strings.

About this task

This task applies to fix pack 7.2.0.6 and later fix packs.






Procedure



4. If you did not apply previous 7.2.x fix packs or if you applied earlier fix packs but did not load theapplication strings at that time, load the application strings for each fix pack in sequence.


objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata/<version>_loader_data common-app-strings-<version>

For example, if you are installing Fix Pack 7.2.0.6 onto 7.2.0.0, load the following files:

• common-app-strings-7-2-0-1• common-app-strings-7-2-0-2• common-app-strings-7-2-0-4• common-app-strings-7-2-0-5



Fix packs 315

6. If you did not apply previous 7.2.x fix packs or if you applied earlier fix packs but did not load theapplication fixes at that time, load the application fixes for each fix pack in sequence.


objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata/<version>_loader_data common-app-fixes-<version>

For example, if you are installing Fix Pack 7.2.0.6 onto 7.2.0.0, load the following files:

• common-app-fixes-7-2-0-57. Load the application strings and fixes for the current fix pack.

a) Load the application strings by running the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata common-app-strings-<version>

For example, if you are installing Fix Pack 7.2.0.6, run the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata common-app-strings-7-2-0-6

b) Load the application fixes by running the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata common-app-fixes-<version>

For example, if you are installing Fix Pack 7.2.0.6, run the following command:

objectmanager.cmd|.sh l c <OpenPages Administrator user> <OpenPages Administrator password> <OP_HOME>/patch/addon_module/loaderdata common-app-fixes-7-2-0-6

c) After the ObjectManager loading is complete, review the log and make sure that the processcompleted.



Updating the Timesheet Entry helperIf you are installing fix pack 7.2.0.6 and you use solutions, you need to update the Timesheet Entryhelper.

Procedure

1. Stop all IBM OpenPages application servers.2. Log on to the admin application server as a user with administrative privileges.3. Go to the <OP_HOME>/profiles/<appserver_name>-OPNode<#>/installedApps/OpenPagesCell/op-apps.ear/sosa.war/report/ directory.

4. Copy the OPS_TimesheetEntry.jsp file to your backup directory.5. If you customized the Timesheet Entry helper, do these steps:

a) Create a temporary directory on the admin application server.


b) Copy the OPS_TimesheetEntry.jsp file from the fix pack kit to the temporary directory that youcreated.

The OPS_TimesheetEntry.jsp file is in the <Fix Pack Kit>/OP_<version_Non_Embedded>/Modules directory.

c) Edit the OPS_TimesheetEntry.jsp file that you copied from the installation kit. Re-apply yourcustomizations.

d) Save and close the file.e) Copy the updated OPS_TimesheetEntry.jsp from the temporary directory to the <OP_HOME>/profiles/<appserver_name>-OPNode<#>/installedApps/OpenPagesCell/op-apps.ear/sosa.war/report/ directory.

6. If you did not customize the Timesheet Entry helper, copy the OPS_TimesheetEntry.jsp file to the<OP_HOME>/profiles/<appserver_name>-OPNode<#>/installedApps/OpenPagesCell/op-apps.ear/sosa.war/report/ directory.

The OPS_TimesheetEntry.jsp file is in the <Fix Pack Kit>/OP_<version_Non_Embedded>/Modules directory.

7. Repeat these steps on all non-admin application servers.8. When all of the application servers are updated, restart the admin and non-admin application servers.

Recreating the reporting schema for Fix Pack 7.2.0.5 or laterIf you are using IBM DB2 and if you dropped the reporting schema as part of your preparation for applyingthe IBM OpenPages GRC Platform fix pack, you must re-create the reporting schema.

About this task

Important: If you did not drop the reporting schema as part of your installation preparation in “Preparingfor the installation of Fix Pack 7.2.0.5 or later” on page 304, do not complete this procedure.

Procedure

1. Log in to OpenPages as a user with administrative privileges.2. Enable System Admin Mode (SAM).3. Click Administration > Reporting Schema and click Create.4. Click Refresh until the process is 100% complete.5. Disable SAM.

Re-generation of the reporting framework for Fix Pack 7.2.0.5 or laterDuring the application of the fix pack, if you installed and configured the approval app or IBM OpenPagesLoss Event Entry, and you want to report on the new fields, you must regenerate the reporting framework.



If you are upgrading from 7.2.0.1 or later, you do not need to do this procedure.

Before you begin


Fix packs 317


Procedure



Additional tasks for Fix Pack 7.2.0.5 or laterYou might want to complete additional tasks for the IBM OpenPages GRC Platform fix pack.

These tasks apply to fix pack 7.2.0.5 and later fix packs.

Performing a silent installation for Fix Pack 7.2.0.5 or laterYou can run a silent installation from the command line by using inputs that you export from the IBMOpenPages Administrative Console.

Before you begin


Procedure

1. If you have the topology.xml file from your most recent 7.2 or 7.2 fix pack installation, proceed tostep 3.

2. If you do not have the topology.xml file, re-create it. Use the OpenPages Administrative Console toredefine the topology.

You must specify the same values that were specified during your most recent installation, upgrade, orfix pack update for OpenPages 7.2. For example, if you specify a short host name value, but a fullyqualified domain name (FQDN) was specified when the topology was originally defined, one or more ofthe existing IBM WebSphere profiles might break. If this problem occurs, see “IBM WebSphere profileerrors or SOAP port conflicts after you change an application server host name” on page 380.

a) Click the Deployment tab.b) Click File > New > New Deployment. Specify the directory where you want to store the new

deployment information.c) Click the Welcome tab.d) Click Install IBM OpenPages GRC Platform Fix Pack <version>, and then click Start.e) Enter the properties for each server in your deployment. Use the same values that were used when

the topology.xml file was originally defined.f) Validate the properties.g) Click Finish.

A topology.xml file that represents your deployment is saved in the directory that you specifiedin step “2.b” on page 318.












Manually uninstalling OpenPages Fix Pack 7.2.0.5 or laterAfter you back up your directories and files, you can manually uninstall the fix pack, if necessary.

About this task

The following procedure assumes that you installed the fix pack on top of OpenPages 7.2.0.0. It alsoassumes that the backup directories use the name OpenPages7200Backup. Specify the name that youchose when you created the backup directories in the “Backing up directories and files” on page 302topic.

Procedure




2. To restore OpenPages application directories and files, complete the following steps on eachapplication server:a) Log on to the application server as a user with administrative privileges and full access to the local






applications Copy the applications directory fromOpenPages7200Backup/OpenPages/applications into<OP_Home>

aurora Copy the aurora directory from OpenPages7200Backup/OpenPages/aurora into <OP_Home>

bin Copy the bin directory from OpenPages7200Backup/OpenPages/bin into <OP_Home>

Fix packs 319



profiles Copy the profiles directory from OpenPages7200Backup/OpenPages/profiles into <OP_Home>

openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup/OpenPages/openpagesregistry.xml into <OP_Home>

3. To restore the workflow directory, complete the following steps on each application server:a) Navigate to the <Workflow_Home> installation directory, where <Workflow_Home> represents





<Workflow_Home> Copy the root Fujitsu/InterstageBPM directory fromOpenPages7200Backup/Fujitsu/InterstageBPM into the<Workflow_Home> location.

4. To restore the IBM Cognos directories, complete the following steps on each reporting server:a) Log on to the reporting server as a user with administrative privileges and full access to the local





Example backup path

webapps/p2pd/WEB-INF/lib

For example, copy the lib directory fromOpenPages7200Backup/Cognos/lib into <Cognos_Home>/webapps/p2pd/WEB-INF

configuration For example, copy the configuration directory fromOpenPages7200Backup/Cognos/configuration into<Cognos_Home>

5. To restore the OpenPages CommandCenter directories and files, complete the following steps on eachreporting server:a) On the reporting server, navigate to the <CC_Home> installation directory, where <CC_Home>





Example backup path

wlp For example, copy the wlp directory fromOpenPages7200Backup/CommandCenter/wlp into <CC_Home>

tools/bin For example, copy the bin directory fromOpenPages7200Backup/CommandCenter/bin into <CC_Home>/tools

openpagesregistry.xml For example, copy the openpagesregistry.xml file fromOpenPages7200Backup/CommandCenter/openpagesregistry.xml

6. To restore the OpenPages search server directories and files, complete the following steps:a) On the search server, navigate to the <SEARCH_Home> installation directory, where<SEARCH_Home> represents the installation location of the OpenPages search application, bydefault C:\OpenPages\OpSearch for Windows, and /opt/OpenPages/OpSearch for AIX orLinux.




opsearchtools Copy the opsearchtools directory fromOpenPages7200Backup/OPSearch/opsearchtools into<SEARCH_Home>

openpagesregistry.xml Copy the openpagesregistry.xml file fromOpenPages7200Backup/OPSearch/openpagesregistry.xml


For information about these utilities, see the IBM OpenPages GRC Platform Administrator's Guide.8. Start all servers, including the following:



Fix packs 321


Chapter 19. Uninstalling OpenPages GRC PlatformUse the uninstallation program and available scripts to remove the IBM OpenPages GRC Platformsoftware.

If you use global search, uninstall global search before you uninstall IBM OpenPages GRC Platform.

Uninstalling the search serverComplete these steps to uninstall the search server.

Procedure

1. If the global search component is enabled, you must disable it and drop the index.a) Log on to OpenPages as a user with administrative privileges.b) Click Administration > Global Search.c) Click Disable.d) Click Drop.

When you drop the index, all indexed data is deleted. You can restore the index by clicking Create.

Search settings are not deleted. For example, object types and fields that are set or not set forsearch are preserved.

2. Log on to OpenPages as a user with administrative privileges.3. Remove the IBM OpenPages GRC - Global Search service.

On Microsoft Windows operating systems, follow these steps.

a. Stop the search service if it is running.b. Open a command line with administrative privileges and run this command: sc delete solrsrv

On UNIX operating systems, follow these steps only if you added openpages-search file to theinit.d folder.

a. Run the following command as a root user: service openpages-search stopb. Find and delete the /etc/init.d/openpages-search file and the /etc/syscofig/openpages-search-cfg file.

4. Delete the <Search_Home folder.

Uninstalling OpenPages GRC Platform on Microsoft Windows operatingsystems

To uninstall OpenPages GRC Platform on computers that are running Microsoft Windows operatingsystems, you must stop the services, remove the application from the WebSphere Application Server, andthen delete the profiles.

To uninstall the workflow server, use the uninstallation program for Fujitsu Interstage BPM.

To remove the databases, see the IBM OpenPages GRC Platform Administrator's Guide. Also, see the IBMDB2 or Oracle documentation.

Note: Uninstalling might not remove all installation files. The installation directory remains on yourcomputer until you delete it.

Procedure

1. Stop the OpenPages and workflow (Fujitsu Interstage BPM) services.a) Log on to the OpenPages application server as a user with administrative privileges.b) Go to the OP_HOME\bin directory.c) Run the following command:

StopAllServers.cmd <username> <password>


2. Uninstall OpenPages CommandCenter.a) Log on to the reporting server as a user with administrative privileges.b) Stop the Cognos service.

Use IBM Cognos Configuration to stop the service, or run the following command:

Cognos_HOME\bin64\cogconfigw.exe -stop -utf8 -logc) To remove the OpenPages CommandCenter wlp service, go the CC_HOME\wlp\bin directory and

run the following command:

server.bat stop IBMOpenPagesFrameworkModelGeneratord) Restore the original Cognos files.

• Copy the cogstartup.xml file from CC_HOME\crn_backup to COGNOS_HOME\configuration directory.

• Copy the fm.ini file from CC_HOME\crn_backup to COGNOS_HOME\configuration directory.e) Delete the COGNOS_HOME\configuration\OpenPagesSecurityProvider_OpenPagesSecurityRealm.properties file.

f) Delete the following files from COGNOS_HOME\webapps\p2pd\WEB-INF\lib directory:

• aurora-tools.jar• op-cc-backup-security.jar• OpenPagesSecurityProvider.jar• opwebservices_client.jar

3. Remove the WebSphere Application Server profile for the OpenPages and workflow applications:a) To list all the profiles on the server, go the WAS_HOME\bin directory and type the following

command:

manageprofiles.bat -listProfiles

A list of the profiles is displayed. For example, on an admin server where you deployed two servers,the following message is displayed:[OpenPagesDmgr, servername-OPNode1, IBPMDmgr, servername-IBPMNode1, servername-IBPMNode2]

b) Run one of the following commands to delete the profiles.

• If other profiles exist that you do not want to delete, remove each profile individually by runningthe following command:

manageprofiles.bat -delete -profileName profile• If only OpenPages and workflow profiles exist, remove all profiles by running the following

command:

manageprofiles.bat -deleteAll4. Uninstall the workflow server.


a) Click Start > All Programs > Interstage Business Process Manager > Uninstall, right-clickUninstall, and click Run as Administrator.

5. Remove Microsoft Windows services for OpenPages and workflow servers.a) Log on to the OpenPages administrative server as a user with administrator privileges.b) Click Start > All Programs > Accessories, right-click Command Prompt, and click Run as

Administrator.c) Go to the <WAS_HOME>\bin directory.

For example, go to the C:\IBM\WebSphere\AppServer\bin directory.d) Run the following command to remove the OpenPagesDmgr service:

wasservice -remove OpenPagesDmgr

e) Run the following command to remove the OPNode1 service:

wasservice -remove <HOST_NAME>-OPNode1

f) Run the following command to remove any additional OpenPages server services:

wasservice -remove <HOST_NAME>-OPNode1Server<SERVER#>

g) Run the following command to remove the IBPMDmgr service:

wasservice -remove IBPMDmgr

h) Run the following command to remove each IBPM node service:

wasservice -remove <HOST_NAME>-IBPMNode<SERVER#>

i) Run the following command to remove each IBPM server service:

wasservice -remove <HOST_NAME>-IBPMNode<SERVER#>Server

6. Remove the OpenPages, CommandCenter, and Fujitsu installation directories.7. Restart the computer.

Related tasksUninstalling OpenPages GRC Platform with an Oracle database before you reinstallIn test or development environments, you might be required to uninstall IBM OpenPages GRC Platform orremove the OpenPages database in Oracle database server before you reinstall. You must completelyuninstall before you reinstall.

Uninstalling OpenPages GRC Platform on Linux or AIX computersTo uninstall IBM OpenPages GRC Platform on Linux or AIX computers, you must stop the services, removethe application from the WebSphere Application Server, and then delete the profiles.

To uninstall the workflow server, use the uninstallation program for Fujitsu Interstage BPM.

To remove the databases, see the IBM OpenPages GRC Platform Administrator's Guide. Also, see the IBMDB2 or Oracle documentation.

Note: Uninstalling might not remove all installation files. The installation directory remains on yourcomputer until you delete it.

Procedure

1. Stop the OpenPages and workflow (Fujitsu Interstage BPM) services.a) Log on to the OpenPages application server as a user with administrative privileges.b) Go to the OP_HOME/bin directory.

Uninstalling OpenPages GRC Platform 325

c) Run the following command:

./stopAllServers.sh <username> <password>


2. Uninstall OpenPages CommandCenter.a) Log on to the reporting server as a user with administrative privileges.b) Stop the Cognos service.

Use IBM Cognos Configuration to stop the service, or run the following command:

Cognos_HOME/bin64/cogconfig.sh -stop -utf8 -logc) To stop the OpenPages Framework Generator, type the following command:

cd CC_HOME/wlp/bin ./server stop IBMOpenPagesFrameworkModelGenerator

d) Restore the original Cognos files.

• Copy the cogstartup.xml file from CC_HOME/crn_backup to COGNOS_HOME/configuration directory.

• Copy the fm.ini file from CC_HOME/crn_backup to COGNOS_HOME/configuration directory.e) Delete the COGNOS_HOME/configuration/OpenPagesSecurityProvider_OpenPagesSecurityRealm.properties file.

f) Delete the following files from COGNOS_HOME/webapps/p2pd/WEB-INF/lib directory:

• aurora-tools.jar• op-cc-backup-security.jar• OpenPagesSecurityProvider.jar• opwebservices_client.jar

3. Remove the WebSphere Application Server profile for the OpenPages and workflow applications:a) To list all the profiles on the server, go the WAS_HOME/bin directory and type the following

command:

./manageprofiles.sh -listProfiles

A list of the profiles is displayed. For example, on an admin server where you deployed two servers,the following message is displayed:[OpenPagesDmgr, servername-OPNode1, IBPMDmgr, servername-IBPMNode1, servername-IBPMNode2]

b) Run one of the following commands to delete the profiles.

• If other profiles exist that you do not want to delete, remove each profile individually by runningthe following command:

./manageprofiles.sh -delete -profileName profile• If only OpenPages and workflow profiles exist, remove all profiles by running the following

command:

./manageprofiles.sh -deleteAll4. Uninstall the workflow server.

a) Go to the Workflow_Home/_uninst/ directory, and run ./uninstall.sh -silent.5. Remove the OpenPages, CommandCenter, and Fujitsu installation directories.6. Restart the computer.

Related tasksUninstalling OpenPages GRC Platform with an Oracle database before you reinstall


In test or development environments, you might be required to uninstall IBM OpenPages GRC Platform orremove the OpenPages database in Oracle database server before you reinstall. You must completelyuninstall before you reinstall.

Uninstalling OpenPages GRC Platform 327


Chapter 20. Approval appThe approval app is an optional feature that leverages the power of IBM OpenPages and provides an easy-to-use interface for quickly taking action on a review, approval, or attestation request with confidence andfull knowledge of the context surrounding the request. The approval app works with objects that are setup for the configurable lifecycle.

By using the approval app, a casual or infrequent user of IBM OpenPages GRC Platform is now able tomake well-informed decisions for GRC tasks guided by information from the system quickly and easily,without the need for extensive training in OpenPages. If you want to see all of the items sent to you in theapproval app, you can go to your To Do list by clicking the IBM OpenPages GRC Platform logo. You simplymake the decision (or respond to certification language or questions), with your comments if necessary,and click the relevant button to submit. You can use this feature on tablets and mobile devices as well, forincreased flexibility.

The approval app requires IBM OpenPages GRC Platform version 7.2.0.1 or later.

Deployment process overview for the approval appBefore you can use the approval app, you need to load and configure it.

The approval app is installed when you install IBM OpenPages GRC Platform version 7.2.0.1 or later. Youneed to complete the following tasks before you can use the approval app.

Note: You must install IBM OpenPages GRC Platform version 7.2.0.1 or later before you deploy theapproval app.

1. Complete the predeployment tasks for the approval app. Check system requirements and back up yourenvironment. For more information, see “Predeployment tasks for the approval app” on page 330.

2. Make sure you have all the object types and field groups - along with the associations - loaded ontoyour system. For more information, see “Ensuring that you have the fields and field groups required forthe approval app profile ” on page 331.

3. If you want to configure the approval app profile for selected object types only, you must exclude theobject types that you don't want. For more information, see “Excluding object types from the approvalapp profile ” on page 332.

4. For IBM DB2 databases only: Determine if you need to drop the reporting schema.

If you are using IBM DB2 version 10.5, and you do not have any of the object types mentioned inprerequisite 1 and you must load the object types and associations, drop the reporting schema beforeloading the approval app profile. For more information, see Creating or recreating the reporting schemain the IBM OpenPages GRC Platform Version 7.2.0 Administrator's Guide.

Note: If you are using IBM OpenPages GRC Platform version 7.2.0.3 or later with IBM DB2 version11.1, you do not need to drop the reporting schema.

5. Load the approval app profile. For more information, see “Loading the approval app profile ” on page338.

6. Complete the approval app deployment. For more information, see “Completing the approval appdeployment” on page 340.

7. Configure the approval app. For more information, see “Configuring the JSON file for the approvalapp ” on page 340.

Depending on your environment, you might need to perform some additional tasks.

1. For IBM DB2 databases only: If you dropped the reporting schema, recreate it. For more information,see Creating or recreating the reporting schema.

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_create_or_recreating_the_reporting_schema.html?lang=en

2. If you want to report on the fields and field groups for the approval app, regenerate the reportingframework. For more information, see Regenerating the reporting framework.

3. If you regenerated the reporting schema and you use Global Search, recreate the search index. Youalso need to recreate the search index if you needed to add the object types, fields, and field groupsrequired for the approval app. See “Re-creating the global search index for Fix Pack 7.2.0.2” on page256.

Predeployment tasks for the approval appBefore you deploy the approval app, ensure that your system meets the system requirements, back upIBM OpenPages GRC Platform files, and gather information required to complete the installation.

Ensure that IBM OpenPages GRC Platform 7.2.0.1 or later is installed

If you want to be able to restore your environment to its current state, back up the OpenPages applicationenvironment, the IBM Cognos environment, and the database. For more information, see “Backups for theexisting environments for Fix Pack 7.2.0.2” on page 244.

Gather the following information. You need this information to complete the installation.

• The username and password of the OpenPages administrator on the admin application server• The path of the OpenPages home directory, OP_Home

Preparing for the deployment of the approval appYou must perform some preparation tasks before you deploy the approval app.

Procedure

1. Ensure that there are no long running OpenPages processes, such as a FastMap import process or aglobal search indexing process.

2. Check the status of the IBM OpenPages GRC Platform servers. Verify that the following servers arerunning: the OpenPages application servers (admin and non-admin), reporting servers (active andstandby), the Framework Model Generator, the database server, and the search server (optional).

For information about starting and stopping servers, see Chapter 15, “Starting and stopping servers,”on page 201.

3. If you are using IBM DB2, determine whether you need to drop the reporting schema.

If you are using IBM OpenPages GRC Platform version 7.2.0.3 or later with DB2 11.1, you do not needto drop the reporting schema.

If you are using DB2 version 10.5, complete the following steps to drop the reporting schema.


Supported data types and field types in the approval appThese data types and field types are supported by the approval app.

Note: If a field type is configured but not supported, the field type is ignored, that is, no error is produced.

• Date


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_generating_the_reporting_framewk.html

• Boolean• Integer• Decimal• Currency. For more information about the currency data type, see Data types.• The following system fields: Name, Description, Created By, Created On, Modified By, and Modified On.• All text field types: URL, text box, text area, rich text. Includes support for rendering mathematical

equations in rich text fields.• All seven actor field display types: User Dropdown, User Selector, User/Group Selector, Multi User

Selector, Multi User Group Selector, and Multi Group Selector.• Business entity selector (IBM OpenPages 7.2.0.2 or later)• File attachments, with a link to view each attachment.• Single-select enumerated fields and multi-select enumerated fields.• Primary Parent hierarchy fields and Business Entity hierarchy fields.• Hidden dependent fields.

If you have set up Field Level Security in OpenPages for specific fields, the value of the field in theapproval app is hidden by a black bar with the word Confidential on it. For more information, see FieldLevel Security.

The approval app does not support the following data types and field types:

• Report fragments• Computed fields• The following system fields: Folder or Location, Comments, Derived fields, and Orphan fields.

Ensuring that you have the fields and field groups required for the approvalapp profile

Make sure that you have all of the out-of-the-box fields and field groups required for the approval appprofile loaded onto your system.

About this task

The approval app profile supports four object types (objects in parentheses are the related objects):

• SOXControl (SOXBusEntity, SOXDocument, SOXTest, SOXIssue, SOXRisk, SOXProcess)• SOXIssue (SOXBusEntity, SOXTask (Action Item), SOXDocument)• Incident (SOXBusEntity, SOXIssue, SOXDocument)• LossEvent (SOXBusEntity, LossImpact, LossRecovery, SOXIssue, SOXRisk, SOXDocument, SOXProcess)

These object types use the following field groups, as well as the field groups that are loaded as a part ofapproval app installation:SOXRisk

Uses OPSS-Rsk, OPSS-Risk, OPSS-Risk-Qual, OPSS-Risk-Quant, OPSS-Risk-Accp.SOXTest

Uses OPSS-Shared-Test, OPSS-Test.SOXTask

Uses OPSS-AI.SOXIssue

Uses OPSS-Iss.SOXControl

Uses OPSS-Ctl, OPSS-Ctl-Fin.

Approval app 331

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_about_data_types.html?lang=en

https://www-01.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_fieldlevelsecurity.html

https://www-01.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_fieldlevelsecurity.html

IncidentUses OPSS-Inc, OPSS-Inc-IT.

LossEventUses OPSS-LossEv, OPSS-Shared-Basel.

LossImpactUses OPSS-LossIm.

LossRecoveryUses OPSS-LossRe.

You can also choose to configure the approval app profile only for selected object types. For moreinformation, see “Excluding object types from the approval app profile ” on page 332.

Note: This topic lists the objects, field groups, and fields that you need to add if you have the 7.2 solutionsschema. If you do not have the 7.2 solutions schema or if you customized the solutions schema,additional changes might be required. For more information, see “Notes for users who do not have the 7.2solutions schema” on page 337.

Procedure

Click Administration > Object Types and check that all of the object types are listed on the system.

You can also review the approval app Automated Form Configuration (AFCON) spreadsheet to make surethat you have everything you need on your system. You can find the AFCON spreadsheet in the approvalapp working directory, along with the other loader files.

• For OpenPages GRC Platform 7.2.0.1, the approval app working directory is: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/.

• For OpenPages GRC Platform 7.2.0.2 or later, the approval app working directory is: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/.

Excluding object types from the approval app profileYou can choose to configure the approval app profile for selected object types only and exclude others.

About this task

It states in “Ensuring that you have the fields and field groups required for the approval app profile ” onpage 331 that the approval app profile supports four object types.

You can choose to exclude any of these object types from the approval app profile. For example:

• You might not need Incidents because you don't use the Incident object type.• You might have a customized process for an existing Loss Event object type to which you don't want to

make any changes, but you might want to use the other object types for the approval app.

For a specific example of how to remove the LossEvent object type, see “Excluding the Loss Event objecttype from the approval app profile ” on page 334.

Important: If you exclude an object type, you must also remove any objects associated exclusively withthe object type.

Use the following steps to exclude an object from the four objects supported by the approval app profile.

Procedure

1. In the Load_End_User_App_Schema file, comment out the commands that load files related to theobject types from the loader file. This excludes loading those objects while loading the approval appprofile.

• For a Windows computer: in the Load_End_User_App_Schema.bat file, comment out the blockof code relevant to the object type you want to exclude by adding REM at the beginning of each line.


• For a Linux computer: In the Load_End_User_App_Schema.sh file, comment out the the block ofcode relevant to the object type you want to exclude by adding # at the beginning of each line.

For an example of the code to be commented out, see step 1 in “Excluding the Loss Event object typefrom the approval app profile ” on page 334.

2. Edit the deck_config.json file to exclude the object types.a) Locate the deck_config.json file.

• For OpenPages GRC Platform 7.2.0.1, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/deck-config-opx-op-file-content.zip.

• For OpenPages GRC Platform 7.2.0.2 or later, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/deck-config-opx-op-file-content.zip.

b) Unzip deck-config-opx-op-file-content.zip.c) Locate the End User Applications Config folder.d) Locate the deck_config.json file.e) Make a backup copy of deck_config.json in case you need to repeat any steps.

For more information, see “Configuring the JSON file for the approval app ” on page 340.

After you edit and save the file deck_config.json, you must copy it back to the End UserApplications Config directory and zip it back into deck-config-opx-op-file-content.zip.

3. Edit the Deck_AFCON_7.2.0.1.xlsx spreadsheet to remove the object, the associated objects, andthe related views.

• For OpenPages GRC Platform 7.2.0.1, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/.

• For OpenPages GRC Platform 7.2.0.2 or later, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/.

Note: Before you start to edit the AFCON spreadsheet, make a backup copy of the AFCONspreadsheet. If you run into difficulties, you can start again from the backup copy.

4. Follow the steps in the AFCON user manual to generate the .xml file from the updated AFCONspreadsheet for the approval app profile.The AFCON tool generates four .xml files:

• IBM_OP_DECK_object-profile-op-config.xml• IBM_OP_DECK_object-strings-op-config.xml• IBM_OP_DECK_rule-based-security-op-config.xml• IBM_OP_DECK_schema-op-config.xml

5. Rename the IBM_OP_DECK_object-profile-op-config.xml file to deck-profile-op-config.xml and paste it in the approval app working directory. Ignore all of the other files.

• For OpenPages GRC Platform 7.2.0.1, store the file in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/.

• For OpenPages GRC Platform 7.2.0.2 or later, store the file in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/.

Alternatively, you can edit the profile .xml file manually to match your requirements. You must removethe object type and its associated parent and child object types in the following sections:objectProfile and ObjectProfileViewSet.

6. Using the OPX tool, download openpages-solutions.xml from OPX from the folder called Files> TriggerConfigFiles. The OpenPages version 7.2 file is dated December 2015. Make a backupcopy of openpages-solutions.xml and name it openpages-solutions-72.xml.

If you want to exclude Loss Event but you want to include Issue, you must copy the triggers for Issuefrom OpenPages version 7.2.0.1 or later and replace the triggers for Issue in the OpenPages version7.2 version of the file.

Approval app 333

Now you are ready to load the approval app profile. For more information, see “Loading the approvalapp profile ” on page 338.

Important: For IBM DB2 version 10.5 databases only: you must drop the reporting schema. If you donot have any of the object types that are mentioned in “Ensuring that you have the fields and fieldgroups required for the approval app profile ” on page 331 and you must load the object types andassociations, then you must drop the reporting schema before you load the approval app profile. Formore information, see Creating or recreating the reporting schema (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_create_or_recreating_the_reporting_schema.html?lang=en).

Excluding the Loss Event object type from the approval app profileIf your organization currently uses the Loss Event object type and you don't want to make changes to thatprocess, but you want to use the approval app for the other object types, this task provides detailed stepson how to exclude the Loss Event object type from the approval app.

About this task

It states in “Ensuring that you have the fields and field groups required for the approval app profile ” onpage 331 that the approval app profile supports four object types. One of these is the Loss Event objecttype.

You may want to exclude the Loss Event object type for the following reasons:

• You may already be using the Loss Event object type and its triggers.• You don't have the Loss Event object type deployed in OpenPages.

Important: If you exclude an object type, you must also remove any objects associated exclusively withthe object type. For example, if you want to exclude the Loss Event object type, you must remove theassociated objects LossImpact and LossRecovery. However, note that you must keep the objectsSOXIssue, SOXDocument, SOXRisk, SOXProcess, and SOXBusEntity because they are also associated toSOXControl, which is still included in the profile.

Use the following steps to exclude the Loss Event object type from the four objects supported by theapproval app profile.

Procedure

1. In the Load_End_User_App_Schema file, comment out the commands that load files related to theLoss Event object type from the loader file. This excludes loading the Loss Event object type whileloading the approval app profile.

• For a Windows computer: in the Load_End_User_App_Schema.bat file, comment out thefollowing block of code by adding REM at the beginning of each line:

REM To load the files for LossEventREM echo Loading Schema for LossEvent...REM call ObjectManager l c %login_username% %login_password% "%loader_data_folder%" "deck-schema-lossevent" "%loader_data_folder%\%log_file%" 2>&1REM echo Loading Lifecycle Schema for LossEvent...REM call ObjectManager l c %login_username% %login_password% "%loader_data_folder%" "deck-lifecycle-lossevent" >> "%loader_data_folder%\%log_file%" 2>&1

• For a Linux computer: In the Load_End_User_App_Schema.sh file, comment out the followingblock of code by adding # at the beginning of each line:

# To load the files for LossEvent# print "Loading Schema for LossEvent..."# ./ObjectManager.sh l c $login_username $login_password $loader_data_folder "deck-schema-lossevent" >> "${loader_data_folder}/${log_file}" 2>&1# print "Loading Lifecycle Schema for LossEvent..."# ./ObjectManager.sh l c $login_username $login_password $loader_data_folder "deck-lifecycle-lossevent" >> "${loader_data_folder}/${log_file}" 2>&1



2. Edit the deck_config.json file to exclude the Loss Event object type.a) Locate the deck_config.json file.

• For OpenPages GRC Platform 7.2.0.1, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/deck-config-opx-op-file-content.zip.

• For OpenPages GRC Platform 7.2.0.2 or later, the file is stored in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/deck-config-opx-op-file-content.zip.

b) Unzip deck-config-opx-op-file-content.zip.c) Go to the folder End User Applications Config.d) Locate the file deck_config.json.e) Make a backup copy of deck_config.json in case you need to repeat any steps.

For more information, see “Configuring the JSON file for the approval app ” on page 340.

To exclude the Loss Event object type, remove "LossEvent" from the objectTypes block:

Before:

"objectTypes" : ["SOXControl","SOXIssue","LossEvent","Incident"],

After:

"objectTypes" : ["SOXControl","SOXIssue","Incident"],

Also, remove the following code from the objects block:

{ "type" : "LossEvent", "fieldTitle" : "Name", "fieldDesc" : "Description", "lifecycle" : { "enabled" : true, "stageMap" : { "Awaiting Approval" : {"showInList": true}, "Awaiting Approval L1" : {"showInList": true}, "Awaiting Approval L2" : {"showInList": true} } }, "widgetList" : [ { "name" : "details", "type" : "activityView", "activityView" : "OP-Deck-LE", "parentViews" : [ { "type" : "SOXRisk", "activityView" : "OP-Deck-LE-Risk" } ] } ] },

After you edit and save the file deck_config.json, you must copy it back to the /End UserApplications Config folder and zip it back into deck-config-opx-op-file-content.zip.

3. Edit the Deck_AFCON_7.2.0.1.xlsx spreadsheet to remove the Loss Event object, the associatedobjects, and the related views.



Note: Before you start to edit the AFCON spreadsheet, make a backup copy of the AFCONspreadsheet. If you run into difficulties, you can start again from the backup copy.

Approval app 335

a) Delete the worksheets Loss Event, Loss Impact, Loss Recovery, AV - OP-Deck-LE, andAV - OP-Deck-LE-Risk.

b) From the Labels - Object Types worksheet, delete the rows related to Loss Event, LossImpact, and Loss Recovery.

c) From the Default Views worksheet, delete the rows related to Loss Event, Loss Impact, and LossRecovery.

d) From the Overviews worksheet, delete the rows related to Loss Event, Loss Impact, and LossRecovery (Note: No change in the case of Loss Event).

e) From the Date Dimension Associations worksheet, delete the rows related to the fieldgroups associated to Loss Event, Loss Impact, and Loss Recovery. In this case, delete all rowsrelated to OPSS-LossEv, OPSS-LossIm, and OPSS-LossRe.

f) From the Navigational Views Order worksheet, delete the rows related to Loss Event, LossImpact, and Loss Recovery.

g) From the Object Views Order worksheet, delete the rows related to Loss Event, Loss Impact,and Loss Recovery.

4. Follow the steps in the AFCON user manual to generate the .xml files from the updated AFCONspreadsheet for the approval app profile.The AFCON tool generates four .xml files:

• IBM_OP_DECK_object-profile-op-config.xml• IBM_OP_DECK_object-strings-op-config.xml• IBM_OP_DECK_rule-based-security-op-config.xml• IBM_OP_DECK_schema-op-config.xml

5. Rename the IBM_OP_DECK_object-profile-op-config.xml file to deck-profile-op-config.xml and paste it in the approval app working directory. Ignore all the other files.



Alternatively, you can edit the profile .xml file manually to match your requirements. You must removethe object type and its associated parent and child object types in the following sections:objectProfile and ObjectProfileViewSet.

6. Before you proceed to step 7, make sure that you understand the following background informationabout copying the SOXIssue trigger content from OpenPages version 7.2.0.1 or later to theopenpages-solutions.xml file from OpenPages version 7.2.

When OpenPages version 7.2 is installed, the openpages-solutions.xml file is loaded into OPX inthe TriggerConfigFiles folder.

For the present example where Loss Event is excluded from the approval app, you must modify theopenpages-solutions.xml file from OpenPages version 7.2 and replace the trigger content for theSOXIssue object with the trigger content for the SOXIssue object from the version of openpages-solutions.xml from OpenPages version 7.2.0.1 or later.

Because you are excluding the Loss Event object type from the approval app, you want to retain theOpenPages 7.2 triggers from the OpenPages 7.2 Loss Event triggers, while updating the SOXIssuetriggers with the newer version needed for the approval app.

For the SOXIssue object, the triggers in OpenPages version 7.2.0.1. or later are changed to work withthe approval app. So you must copy the SOXIssue trigger content from the OpenPages version 7.2.0.1or later openpages-solutions.xml file into the openpages-solutions.xml file in OpenPagesversion 7.2 and then save the file.


7. Using the OPX tool, download openpages-solutions.xml from OPX from the folder called Files> TriggerConfigFiles. The file for OpenPages version 7.2 is dated December 2015. Make abackup copy of openpages-solutions.xml and name it openpages-solutions-72.xml.

8. Edit the openpages-solutions.xml file.



a) Unzip deck-lifecycle-trigger-op-file-content.zip.b) Make a backup copy of openpages-solutions.xml in case you need to modify it again. Name itopenpages-solutions-7201.xml and save it.

c) Edit openpages-solutions.xml from OpenPages version 7.2.0.1 or later and copy the lines455-489:

<!-- T-009 Issue Life Cycle Status Update Trigger Begin —>...</trigger>

d) Edit openpages-solutions.xml from OpenPages version 7.2. Using the lines you copied in step8c, replace the matching .xml snippet in the existing OpenPages version 7.2 version that youdownloaded from OPX and save it.

e) Take the openpages-solutions.xml you saved in step 8d and copy it back to the approval appworking directory.

• For OpenPages GRC Platform 7.2.0.1, store the file in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/deck-lifecycle-trigger-op-file-content/openpages-solutions.xml.

• For OpenPages GRC Platform 7.2.0.2 or later, store the file in: <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/deck-lifecycle-trigger-op-file-content/openpages-solutions.xml.

f) Zip the file deck-lifecycle-trigger-op-file-content.zip and be sure that deck-lifecycle-trigger-op-file-content.zip is under the approval app working directory.



Now you are ready to load the approval app profile. For more information, see “Loading the approvalapp profile ” on page 338.

Important: For IBM DB2 version 10.5 databases only: you must drop the reporting schema. If you donot have any of the object types that are mentioned in “Ensuring that you have the fields and fieldgroups required for the approval app profile ” on page 331 and you must load the object types andassociations, then you must drop the reporting schema before you load the approval app profile. Formore information, see Creating or recreating the reporting schema (http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/t_adm_create_or_recreating_the_reporting_schema.html?lang=en).

Notes for users who do not have the 7.2 solutions schemaIf you do not have the 7.2 solutions schema in your environment or if you customized the solutionsschema, you might need to add or modify objects, field groups, and fields before you load the approvalapp profile.

For example, if you installed version 7.1 with solutions and then upgraded to 7.2, your environment hasthe 7.1 solutions schema. The 7.1 solutions schema might not have all of the objects, field groups, andfields that you need for the approval app.

Approval app 337


Examine the approval app Automated Form Configuration (AFCON) spreadsheet,Deck_AFCON_<version>.xls. Do the following checks:

• Make sure that you have the objects, field groups, and fields for the approval app.• Make sure that the attributes match, for example make sure that the display type of each field is defined

correctly.• Make sure that you have any prerequisites for the objects, field groups, and fields.

You can find the Deck_AFCON_<version>.xls spreadsheet in the OP_<version>_Non_Embedded\OP_<version>_Configuration\Approval_App\ directory.

Loading the approval app profileYou can use a batch script or shell script that groups all ObjectManager load commands and runs them allin one run to load the approval app profile.

Before you beginBefore you load the approval app profile, you must install IBM OpenPages GRC Platform 7.2.0.1 or later.

Make sure your system has the required fields and field groups as described in “Ensuring that you havethe fields and field groups required for the approval app profile ” on page 331.

If you use IBM DB2 version 10.5, you must drop the reporting schema before you load the profile. If youdo not have any of the object types that are mentioned in “Ensuring that you have the fields and fieldgroups required for the approval app profile ” on page 331 and you must load the object types andassociations, then you must drop the reporting schema before you load the approval app profile.

About this task

Besides the approval app profile, this script makes the following changes:

• Loads schema changes for three object types (SOXControl, SOXIssue, LossEvent)• Loads lifecycle schema changes for 4 object types (Incident, SOXControl, SOXIssue, LossEvent)• Loads Certification Questions (for SOXControl)• Loads deck_config.json to OPX• Loads the lifecycle trigger definition XML files (see step 1)

Procedure

1. Before you load the approver app profile, update the Trigger Configuration Files registry setting.a) Click Administration > Settings > GRCM > Trigger Configuration Files.b) Update the value for the Trigger Configuration Files setting by adding the files OPLC-[object-name].xml, separated by commas, for each of the four object types that are included in the profile.

For example, if your profile includes all the four object types that are described in “Ensuring thatyou have the fields and field groups required for the approval app profile ” on page 331, you addthese files to the Trigger Configuration Files setting in this format:

OPLC-Incident.xml,OPLC-LossEvent.xml,OPLC-SOXControl.xml,OPLC-SOXIssue.xml

Note: if you exclude any object types from the approval app, do not include the related OPLC-<object type>.xml file in the registry.

This sets the lifecycle for the included object types on the system. Lifecycles define the stages thatan object type can follow. At each stage, the system:

• Identifies a lifecycle assignee• Defines the actions available to move to a different stage


• Automatically sends an email to the new lifecycle assignee (LCAssignee)• Defines other attributes that are related to the current stage

2. If you have an existing profile with an LCAssignee field for the object types that are supported by thelifecycle, perform the following steps to specify the display type of the field as Multi Valued User/Group Selector.a) Go to the profile in which you want to make changes: Administrator > Profiles.b) Click the object type that includes the LCAssignee field.c) Click LCAssignee.d) In the Object Field Information section, click Edit.e) From the Display Type drop-down, click Multi Valued User/Group Selector.f) Click Save.

This specifies the display type of the LCAssignee field for all the object types that are supported by thelifecycle to be Multi Valued User/Group Selector. You can now have multiple assignees.

Tip: You can check if you have an existing profile with an LCAssignee field. LCAssignee is a specificfield in a specific field group OPLC-Std. In version 7.2, this field was only in Incident and QuestionnaireAssessment object types. You can look in each object type and see if it includes the OPLC-Std fieldgroup. Then, for each of those object types, look in each profile that object type is included in.

3. Load the approval app profile.

• To load the approval app profile on a Windows computer:

a. Go to the approval app working directory.

– For OpenPages GRC Platform 7.2.0.1, go to <OP_HOME>/patch/addon_module/loaderdata/end_user_app/.

– For OpenPages GRC Platform 7.2.0.2 or later, go to <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/.

b. Update openpages_domain_folder, login_username, and login_password properties inEnvironment_Variables.bat.

c. Run Load_End_User_App_Schema.bat.d. For security purposes, remove the password from the Environment_Variables.bat file.

• To load the approval app profile on a Linux computer:

a. Go to the approval app working directory.

– For OpenPages GRC Platform 7.2.0.1, go to <OP_HOME>/patch/addon_module/loaderdata/end_user_app/.

– For OpenPages GRC Platform 7.2.0.2 or later, go to <OP_HOME>/patch/addon_module/loaderdata/end_user_app/approval_app/.

b. Update openpages_domain_folder, login_username, and login_password properties inEnvironment_Variables.sh.

c. Run Load_End_User_App_Schema.sh.d. For security purposes, remove the password from the Environment_Variables.sh file.

4. Complete the approval app deployment. For information, see “Completing the approval appdeployment” on page 340.

5. Perform any conditional tasks required by your environment.

Note: If you are installing other IBM OpenPages components, such as a fix pack or IBM OpenPagesLoss Event Entry, perform these steps after all components are installed.

a) For IBM DB2 databases only: If you dropped the reporting schema, recreate it. For moreinformation, see Creating or recreating the reporting schema.

b) If you want to report on the fields and field groups for the approval app, regenerate the reportingframework. For more information, see Regenerating the reporting framework.

Approval app 339



c) If you recreated the reporting schema and you use Global Search, recreate the search index. Youalso need to recreate the search index if you needed to add the objects, fields, and field groupsrequired for the approval app. See “Re-creating the global search index for Fix Pack 7.2.0.2” onpage 256.

Completing the approval app deploymentComplete the remaining steps to deploy the approval app.

Procedure

1. Restart the OpenPages server on all application servers. For information about starting and stoppingservers, see Chapter 15, “Starting and stopping servers,” on page 201.

2. Load the approval app configuration.a) Open http://<hostname>:10108/openpages/app/deck/reloadConfig in your browser.

Replace <hostname> with the IBM OpenPages GRC Platform application server name. If you havechanged the default port number, replace 10108 with the port number that you are using.

b) If you are prompted to log in, enter the OpenPages Administrator user name and password.3. Perform any conditional tasks required by your environment.

For more information, see “Conditional steps for the approval app” on page 347.

ResultsThe approval app is deployed.

Configuring the JSON file for the approval appYou use the deck_config.json file as a place to configure object types, fields, and so on, for theapproval app.

About this task

The deck_config.json is preconfigured to be ready for use. If you want, there are other changes thatyou can make. For more information, see “Customizing the JSON file for the approval app ” on page 346.

The following table contains the property list and instructions for the deck_config.json file properties.

Table 63: Properties in deck_config.json

Property Needed Parent Property Description Value (example)

profile exactly 1 root property Name of theOpenPages profileused by the approvalapp

approval app

objectTypes 1 to many root property List of the approvalapp supported objecttypes (system names)

SOXControl

objects 1 perobjectType

root property List of properties foreach object type

[{}]

type 1 objects Type of the OpenPagesobject system name

SOXControl


Table 63: Properties in deck_config.json (continued)


fieldTitle 1 objects Field to be used as thename of the object

Name

fieldDesc 1 objects Field to be used as thedescription of theobject

Description

lifecycle 1 objects List of lifecycleproperties for object

{}

enabled 1 lifecycle Boolean to enableobject for the approvalapp

true

stageMap 1 lifecycle List of the approvalapp enabled lifecyclestages

{}

"Attestation" 1 to many stageMap List of properties forthe approval appenabled lifecycle stage

{}

showInList 1 "Attestation" Boolean to displaystage in the approvalapp

true

questionFieldLists 1 "Attestation" List of question fieldproperties forcertification

[{}]

rule 1 to many questionFieldLists Rule to determinewhether a question isused

default

fields 1 per rule questionFieldLists List of question fieldsfor certification

[{}]

systemName 1 to many fields OpenPages systemname of certificationquestion field

OPSS-Ctl-Cert:DesEff

displayType 1 persystemName

fields the approval app-specific display typefor the certificationfield

Text Area

widgetList 1 objects List of properties forthe controlling views inOpenPages

[{}]

name 1 widgetList Name of the approvalapp section controlledby a view

details

type 1 widgetList Type of the OpenPagesview controlling theapproval app section

ActivityView

Approval app 341

Table 63: Properties in deck_config.json (continued)


activityView 1 widgetList Name of theOpenPages viewcontrolling theapproval app section

OP-Deck-Control

parentViews 0 to 1 widgetList List of OpenPagesviews displayed in theapproval app RelatedContent section

[{}]

type 1 to many parentViews Type of the OpenPagesparent object systemname

SOXRisk

activityView 1 per type parentViews Name of theOpenPages viewcontrolling theapproval app section

OP-Deck-LE-Risk

dueDateGroup 1 root property List of properties forgrouping the items inthe approval app

{}

defaultField 1 dueDateGroup Field to be used as theDue Date field

OPLC-Std:LCDueDate

group 0 to 1 defaultField List of propertiescontrolling the dateranges for grouping inthe approval app

[{}]

number 1 to many group Date range for groupeditems

14

unit 1 per number group Unit of measurementfor group date range(day, month, or year)

day

maxTodoObjects 1 root property Number of items to bedisplayed in theapproval app

25

Debugging the deck_config.json file

You can debug the deck_config.json file by logging into OpenPages as an administrator and pasting aURL (http://<yourIP>:10108/openpages/app/deck/reloadConfig) in the browser. If there is anerror in the deck_config.json file, a message displays that shows details about the error, such as theerror number, exception type, line number, and error description. The error is logged in the aurora log aswell. You can then locate and fix the error in the deck_config.json file.

Procedure

1. Log in to OPX (http://<hostname>:10108/opx).2. Under Files, click Browse files.3. Open the End User Applications Config folder to find the deck_config.json file.4. Configure the deck_config.json file according to the preceding table.


The following example shows a typical deck_config.json file.

{ "profile": "Deck", "objectTypes" : ["SOXControl","SOXIssue","LossEvent","Incident"], "objects" : [ { "type" : "SOXControl", "fieldTitle" : "Name", "fieldDesc" : "Description", "lifecycle" : { "enabled" : true, "stageMap" : { "Attestation" : { "showInList": true, "questionFieldLists" : [ { "rule" : "default", "fields" : [{ "systemName":"OPSS-Ctl-Cert:DesEff", "displayType":"Radio Button/Checkbox" }, { "systemName":"OPSS-Ctl-Cert:DesEffExplain", "displayType":"Text Area" }, { "systemName":"OPSS-Ctl-Cert:DocAccurate", "displayType":"Radio Button/Checkbox" }, { "systemName":"OPSS-Ctl-Cert:DocAccurateExplain", "displayType":"Text Area" }, { "systemName":"OPSS-Ctl-Cert:OpEff", "displayType":"Radio Button/Checkbox" }, { "systemName":"OPSS-Ctl-Cert:OpEffExplain", "displayType":"Text Area" }, { "systemName":"OPSS-Ctl-Cert:Change", "displayType":"Radio Button/Checkbox" }, { "systemName":"OPSS-Ctl-Cert:ChangeExplain", "displayType":"Text Area" }] } ] } } }, "widgetList" : [ { "name" : "details", "type" : "activityView", "activityView" : "OP-Deck-Control", "parentViews" : [ { "type" : "SOXRisk", "activityView" : "OP-Deck-Control-Risk" } ] } ] }, { "type" : "SOXIssue", "fieldTitle" : "Name", "fieldDesc" : "Description", "lifecycle" : { "enabled" : true, "stageMap" : { "Close Request" : {"showInList": true}, "Due Date Change Request" : {"showInList": true} } }, "widgetList" : [

Approval app 343

{ "name" : "details", "type" : "activityView", "activityView" : "OP-Deck-Issue" } ] }, { "type" : "LossEvent", "fieldTitle" : "Name", "fieldDesc" : "Description", "lifecycle" : { "enabled" : true, "stageMap" : { "Awaiting Approval" : {"showInList": true}, "Awaiting Approval L1" : {"showInList": true}, "Awaiting Approval L2" : {"showInList": true} } }, "widgetList" : [ { "name" : "details", "type" : "activityView", "activityView" : "OP-Deck-LE", "parentViews" : [ { "type" : "SOXRisk", "activityView" : "OP-Deck-LE-Risk" } ] } ] }, { "type" : "Incident", "fieldTitle" : "Name", "fieldDesc" : "Description", "widgetList" : [ { "name" : "details", "type" : "activityView", "activityView" : "OP-Deck-Incident" } ], "lifecycle" : { "stageMap" : { "Review" : {"showInList": true}, "Escalation Review": {"showInList": true} } } } ], "dueDateGroup" : { "group" : [{"number": 5, "unit": "day"},{"number": 30, "unit": "day"}] }, "maxTodoObjects" : 25}

Approval app certification questionsApproval app certification questions provide an opportunity to prompt a user taking a lifecycle action torespond to questions that certify the details of what they are agreeing to. Certification questions can alsoremind them of the requirements of the certification or attestation they are performing.

The following table shows the supported field data types:

Field data type Supported Details Validdeck_config.jsondisplayType value

Currency X

Enumerated String X Single-select only Radio Button/Checkbox

Simple String X Text and Text Area


Field data type Supported Details Validdeck_config.jsondisplayType value

Long String X Medium String Size only Text and Text Area

Attention:

• Certification questions display the field guidance as the Question in the approval app—not as thefield label, as the field guidance does in OpenPages.

• For the approval app, if a field-level security (FLS) rule is applied on a question, the question isstill displayed on the card page for the lifecycle stage that is configured in thedeck_config.json file, even if the user does not meet the FLS rule to view the question. Whenthe user submits the question, the user sees the following message: You do not havepermission to write on the field <field name>.

The following list shows some example certification questions.

Certification Language without valuesUse a single-select Enumerated String field. This causes the question to appear without any values toselect.

Single select checkboxUse a single-select Enumerated String field with a single value. This causes the question to appearwith a single check box.

Make a follow up question requiredUse Requiredness field dependencies in OpenPages.

Note: The approval app does not support both Requiredness and Visibility dependencies at the sametime.

Hide a follow up question unless a specific Enum value is selectedUse Visibility field dependencies in OpenPages.

Note: The approval app does not support both Requiredness and Visibility dependencies at the sametime.

For a transition, make the lifecycle comment or other Simple/Long string required

"<SOME_STAGE>" : { "transitionMap" : { "<SOME_TRANSITION>" : { "requiresValidation" : true } }, "questionFieldLists" : [ { "rule" : "default", "fields" : [{ "systemName":"<COMMENT/OTHER FIELD NAME>", "displayType":"Text Area", "requiredValue" : "NON_EMPTY" }] } ] }

Make a Simple/Long string field appear in a single-line text box

"<SOME_STAGE>" : { "questionFieldLists" : [ { "rule" : "default", "fields" : [{ "systemName":"<FIELD NAME>", "displayType":"Text" }] }

Approval app 345

] }

Make a Simple/Long string field appear in a multi-line text area

"<SOME_STAGE>" : { "questionFieldLists" : [ { "rule" : "default", "fields" : [{ "systemName":"<FIELD NAME>", "displayType":"Text Area" }] }

Customizing the JSON file for the approval appThe deck_config.json file is ready after you install IBM OpenPages GRC Platform 7.2.0.1 or later, butyou can customize it.

About this task

The deck_config.json is preconfigured to be ready for use. If you want, there are changes that you canmake. For example, the parentViews property is optional: its default value is 0, in which case no parentobjects are shown even though the parentViews property supports multiple parent views.

This configuration example shows how to define what appears in the Related Content section for theController object.

"parentViews" : [ {"type" : "SOXBusEntity","activityView" : "OP-Deck-Control-BE"}, {"type" : "SOXRisk","activityView" : "OP-Deck-Control-Risk"} ]

The following examples show various cases of properties that are supported but might not be enabled bydefault.

Example: Grouping a To Do list for 5 and 30 days

"dueDateGroup" : { "group" : [{"number": 5, "unit": "day"},{"number": 30, "unit": "day"}] }

Example: Making the comment field a required field for specified transitions

The comments field is not required in the standard configuration, and users can transition in a detail pagewithout adding a comment.

You might submit an action in the approval app and see a message similar to the following: Success!Your <action> and comments have been submitted to <recipient>, even though there areno comments.

You can configure the comment field to be a required field for specified transitions in thedeck_config.json file. In the following case, the comment field is required for the Review De-escalatetransition of the Escalation Review lifecycle stage.

"Escalation Review" : {"transitionMap" : {"Review De-escalate" : {"requiresValidation" : true} },"questionFieldLists" : [{


"rule" : "default","fields" : [{"systemName":"OPLC-Std:LCComment","displayType":"Text Area","requiredValue" : "NON_EMPTY"}]},{"rule" : "default","fields" : [{"systemName":"DECK-Questions:EnumQuestion","displayType":"Radio Button/Checkbox"}]}]}

Example: Approval app stage with certification questions

"stageMap" : { "Attestation" : { "showInList": true, "questionFieldLists" : [ { "rule" : "default", "fields" : [{ "systemName":"OPSS-Ctl-Cert:DesEff", "displayType":"Radio Button/Checkbox" }, { "systemName":"OPSS-Ctl-Cert:DesEffExplain", "displayType":"Text Area" }] } ] } }

Conditional steps for the approval appDepending on your environment, you might need to perform some additional tasks.

Perform these tasks after you complete all other deployment tasks. If you are installing other IBMOpenPages components, such as a fix pack or IBM OpenPages Loss Event Entry, perform these steps afterall components are installed.

For IBM DB2 databases only: If you dropped the reporting schema, recreate it. For more information, seeCreating or recreating the reporting schema.

If you want to report on the fields and field groups for OpenPages Loss Event Entry, regenerate thereporting framework. For more information, see Regenerating the reporting framework.

If you recreated the reporting schema and you use Global Search, recreate the search index. You alsoneed to recreate the search index if you needed to add the objects, fields, and field groups required forthe approval app. See “Re-creating the global search index for Fix Pack 7.2.0.2” on page 256.

Approval app 347




Chapter 21. Loss Event EntryUsers across an organization can create loss events quickly and easily with IBM OpenPages Loss EventEntry. It is easy to use and task-focused for users with no experience with OpenPages.

Users can access OpenPages Loss Event Entry without a sign-in account for OpenPages. You can set up alink to OpenPages Loss Event Entry on your organization's intranet. When users click the link, they see theuser interface in the language of their choice, and dates and numbers are formatted in ways that arefamiliar to them. Users can immediately begin entering information. When they submit a loss event, aconfirmation email is sent to them.

Loss Event Entry is integrated fully with OpenPages GRC Platform. The following is an example of theworkflow:

• Create a loss event in OpenPages Loss Event Entry.• Triage, investigate, and enrich the loss event information in OpenPages GRC Platform.• Review and approve the loss event in the approval app.

For more information, see OpenPages Loss Event Entry.

OpenPages Loss Event Entry requires IBM OpenPages GRC Platform version 7.2.0.2 or later.

Installation process overview for Loss Event EntryDuring the installation of IBM OpenPages Loss Event Entry, you can choose to load the default datarequired for OpenPages Loss Event Entry automatically or manually. The default data includes the fieldgroups, fields, users, role templates, profile, and other data needed for OpenPages Loss Event Entry.

If you want to load OpenPages Loss Event Entry data automatically, complete the following steps:

1. If you are using IBM DB2 version 10.5, drop the reporting schema.

Note: If you are using Global Search, stop the search server before you drop the schema.

If you are using IBM OpenPages GRC Platform version 7.2.0.3 or later with IBM DB2 11.1, you do notneed to drop the reporting schema.

2. Install OpenPages Loss Event Entry.3. Change OpenPages Loss Event Entry user passwords.4. Configure OpenPages Loss Event Entry.

If you want to load OpenPages Loss Event Entry data manually, complete the following steps. Choose thisoption if you want to customize the field groups, fields, users, groups, profile, and other data used inOpenPages Loss Event Entry.

1. If you are using DB2 10.5, drop the reporting schema.



2. Install OpenPages Loss Event Entry.3. Load the OpenPages Loss Event Entry data manually.4. Change OpenPages Loss Event Entry user passwords.5. Configure OpenPages Loss Event Entry.

Depending on your environment, you might also need to perform additional tasks. If you are installingother OpenPages components, such as a fix pack or the approval app, perform the following tasks onlyonce, after you have installed all components.

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.op_grc_nfg.7.2.0.doc/c_op_nfg_72fp2_lee1.html

1. If you are using IBM DB2 and you dropped the reporting schema, recreate the reporting schema.2. If you want to report on the OpenPages Loss Event Entry fields and field groups, regenerate the

reporting framework.3. If you recreated the reporting schema and you use Global Search, recreate the search index. You also

need to recreate the search index if you needed to add the objects, fields, and field groups required forOpenPages Loss Event Entry.

Preinstallation tasks for Loss Event EntryBefore you install IBM OpenPages Loss Event Entry, ensure that your system meets the systemrequirements, back up IBM OpenPages GRC Platform files, and gather information required to completethe installation.

Ensure that the following software is installed:

• IBM OpenPages GRC Platform 7.2.0.2 or later• IBM Installation Manager 1.8.2 or later

If you want to be able to restore your environment to its current state, back up the OpenPages applicationenvironment, the IBM Cognos environment, and the database. For more information, see “Backups for theexisting environments for Fix Pack 7.2.0.2” on page 244.

Gather the following information. You need this information to complete the installation.

• The username and password of the OpenPages administrator on the admin application server• The path of the OpenPages home directory, OP_HOME

Installation tasks for Loss Event Entry

Preparing for the installation of Loss Event EntryTo ensure that the IBM OpenPages Loss Event Entry Installer is able to perform all necessary steps, youmust perform some preparation tasks.

Procedure

1. Ensure that there are no long running OpenPages processes, such as a FastMap import process or aglobal search indexing process.

2. Check the status of the IBM OpenPages GRC Platform servers. Verify that the following servers arerunning: the OpenPages application servers (admin and non-admin), reporting servers (active andstandby), the Framework Model Generator, and the database server.

For information about starting and stopping servers, see Chapter 15, “Starting and stopping servers,”on page 201.

Installing Loss Event EntryYou must run the IBM OpenPages Loss Event Entry installation program on the OpenPages adminapplication server.

Procedure

1. Make sure that the OpenPages servers are running. See “Preparing for the installation of Loss EventEntry” on page 350.

2. Download the IBM OpenPages Loss Event Entry installer package. For more information, seeDownloading IBM OpenPages GRC Platform Version 7.2 from Passport Advantage.

3. Extract the package files.



4. On the admin application server, run IBM Installation Manager.5. Add the Loss Event Entry repository to IBM Installation Manager.

a) Click File > Preferences.b) Click Repositories and then click Add Repository.c) Select the OpenPages Loss Event Entry installer package.d) Click the repository.config file.e) Click OK.f) Click OK to return to the main IBM Installation Manager page.

6. Click Install.7. Select IBM OpenPages Loss Event Entry and Version 7.2, and click Next.8. Accept the license agreement and click Next.9. Click Next.

Note: The installation directory does not impact the installation process. The files are installed to thesame directory as the OpenPages GRC Platform installation (OP_HOME).

10. In the Features list, make sure that IBM OpenPages Loss Event Entry 7.2 is selected and click Next.11. In the Enter the location of your OpenPages installation field, enter the path to the OpenPages

home directory, OP_HOME. Type the path or click Browse to select the directory. This directorycontains the openpagesregistry.xml file and the bin subdirectory.

12. In the User Name field, enter the user name for the administrator account on the OpenPagesapplication server.

13. In the Password field, enter the password for the administrator account on the OpenPagesapplication server.

14. Click one of the options for loading the default data. The default data includes the default users,groups, role templates, fields, field groups, profile, and other data used in OpenPages Loss EventEntry.

• If you choose to load the data automatically, the installation program loads the default data used inOpenPages Loss Event Entry.

• If you choose not to load the default data automatically, the installation program creates the fileson your system but does not load them. You must load the data files manually before you useOpenPages Loss Event Entry. Select this option if you want to customize the data before loading it.For information about loading the data manually, see “Manual data loading for Loss Event Entry” onpage 354.

15. Click Next. If any errors appear on the page, follow the instructions to fix them before you continue.16. Click Finish.

What to do next

• If you chose not to load the data automatically, load the data manually before performing thepostinstallation tasks. See “Manual data loading for Loss Event Entry” on page 354.

• If you chose to load the data automatically, continue with “Postinstallation tasks for Loss Event Entry”on page 352.

Log files for Loss Event EntryIf errors occur when you install IBM OpenPages Loss Event Entry, you can review the log files.

The ObjectManager log files generated when loading the default data for OpenPages Loss Event Entry arelocated in <OP_HOME>/LossEventEntry/logs/.

Loss Event Entry 351

Postinstallation tasks for Loss Event EntryAfter you install IBM OpenPages Loss Event Entry, you need to complete some additional tasks.

Certain prerequisites must be met to configure and use OpenPages Loss Event Entry.

• Modifying the web.xml files• Setting passwords• Configuring OpenPages Loss Event Entry

If you chose not to load the OpenPages Loss Event Entry default data automatically during the installationprocess, load the data manually before performing the postinstallation tasks.

Modifying the web.xml files for Loss Event EntryAfter you have installed IBM OpenPages Loss Event Entry, you need to modify the web.xml files for theapplication.

Procedure

1. Log on to the IBM OpenPages application server as a user with administrative permissions.2. Stop all IBM OpenPages services.3. Go to the <OP_Home>/profiles/<server_name>-OPNode1/installedApps/OpenPagesCell/op-apps.ear/sosa.war/WEB-INF directory.

• <OP_Home> is the installation location of the IBM OpenPages application. By default, this isc:\OpenPages on Windows, and /opt/OpenPages on UNIX.

• <server_name> is the name of the application server.4. In a text editor, open the web.xml file and insert the lines shown in bold above XSSFilter.

<context-param> <param-name>sm.authentic.key</param-name> <param-value>SMSERVERSESSIONID</param-value> </context-param><context-param> <param-name>sm.username.key</param-name> <param-value>SMUSER</param-value> </context-param>

<filter> <filter-name>AppFilter</filter-name> <filter-class>com.ibm.openpages.components.apps.AppFilter </filter-class> </filter>

<filter-mapping> <filter-name>AppFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

<filter> <filter-name>XSSFilter</filter-name> <filter-class>com.openpages.apps.common.tools.xss.XSSFilter</filter-class> <init-param> <param-name>com.openpages.xss.CHECK_POST</param-name> <param-value>true</param-value> </init-param> <init-param> <param-name>com.openpages.xss.REDIRECT_URL</param-name> <param-value>/malicious.jsp</param-value> </init-param> </filter>

5. Save the file and close the editor.6. Go to the <OP_Home>/profiles/OpenPagesDmgr/config/cells/OpenPagesCell/applications/op-apps.ear/deployments/op-apps/sosa.war/WEB-INF directory.

7. Repeat steps 4 and 5.


8. If this is a load-balanced environment, repeat steps 1-5 on each application server in the load-balanced environment.

9. Restart all IBM OpenPages services.

Setting passwords for Loss Event Entry usersAfter you have installed IBM OpenPages Loss Event Entry, you need to configure the passwords for theOpenPages Loss Event Entry users.

Before you begin

If you chose not to load the default data automatically during the installation process, load the datamanually before setting passwords.

About this task

When you set passwords in the configuration tool and save your changes, the passwords are updated inOpenPages GRC Platform. Passwords are encrypted.

Procedure

1. Start the configuration tool. Go to http://<server_name>:<app_port>/openpages/app/jspview/lossevent#/editconfig

2. Log in with a user account that is a member of the OPAdministrators group.3. Under the Locales section, expand each locale and enter a password.

Configuration of Loss Event EntryYou can configure IBM OpenPages Loss Event Entry to meet the needs of your organization.

The configuration tool enables you to customize OpenPages Loss Event Entry. See Configuring OpenPagesLoss Event Entry.

Conditional steps for Loss Event EntryDepending on your environment, you might need to perform some additional tasks.

Perform these tasks after you complete all installation and post-installation tasks. If you are installingother IBM OpenPages components, such as a fix pack or the approval app, perform these steps after allcomponents are installed.

For IBM DB2 databases only: If you dropped the reporting schema, re-create it. For more information, seeCreating or recreating the reporting schema.

If you want to report on the fields and field groups for OpenPages Loss Event Entry, regenerate thereporting framework. For more information, see Regenerating the reporting framework.

If you recreated the reporting schema and you use Global Search, recreate the search index. You alsoneed to recreate the search index if you needed to add the objects, fields, and field groups required forOpenPages Loss Event Entry. See “Re-creating the global search index for Fix Pack 7.2.0.2” on page 256.

Additional tasks for Loss Event Entry

Silent installation for Loss Event EntryYou can run a silent installation by using the Silent mode in IBM Installation Manager.

Before you perform a silent installation, ensure that you have prepared your system for deploying IBMOpenPages Loss Event Entry.

You can generate a response file by using IBM Installation Manager, or you can create one manually. Atemplate for creating a response file, called response_template.xml, is stored in the OpenPages Loss


http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_configuring_loss_event_entry.html

http://www.ibm.com/support/knowledgecenter/SSFUEU_7.2.0/com.ibm.swg.ba.cognos.administrators_guide.7.2.0.doc/c_adm_configuring_loss_event_entry.html



Event Entry installer package in the OP_7.2_LOS_EV_EN directory. The response file must contain thefollowing code. Replace the variables with the values for your environment:

Profile NameThe name of the profile you want to use for Loss Event Entry

Install locationThe installation directory has no impact on the installation. Loss Event Entry is installed to the samedirectory as the OpenPages installation, OP_HOME. Specify a directory that does not exist in yourenvironment.

Path to OpenPages homeThe absolute path to the OpenPages home directory, OP_HOME. This directory should contain the fileopenpagesregistry.xml and the subdirectory bin.

OpenPages administrator user nameThe user name of the administrator account on the OpenPages admin application server.

OpenPages administrator passwordThe password for the administrator account on the OpenPages admin application server.

true or falseChoose an option for loading the default data for OpenPages Loss Event Entry. Enter true to load alldefault data, or enter false to manually load data later.

<?xml version='1.0' encoding='UTF-8'?><agent-input> <server> <repository location='((Path to repository for OpenPages Loss Event Entry))'/> </server> <profile id='((Profile Name))' installLocation='((Install location))'> <data key='user.OPHome,com.ibm.openpages.lossevententry' value='((Path to OpenPages home))'/> <data key='user.OPAdminUsername,com.ibm.openpages.lossevententry' value='((OpenPages administrator user name))'/> <data key='user.OPAdminPassword,com.ibm.openpages.lossevententry' value='((OpenPages administrator password))'/> <data key='user.LoadAll,com.ibm.openpages.lossevententry' value='((true or false))'/> </profile> <install> <offering profile='((Profile Name))' id='com.ibm.openpages.lossevententry'/> </install></agent-input>

For more information about how to generate a response file to run the installer silently, see Response files(http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.2/com.ibm.silentinstall12.doc/topics/c_silent_response_files.html).

Manual data loading for Loss Event EntryIf you did not load the Loss Event Entry default data when you installed IBM OpenPages Loss Event Entry,you can load the data manually. You also need to load the data manually if you have customized the datafiles.

Before you load the data, ensure that you have the object types and field groups required by the LossEvent Entry profile.

Objects and field groups required for the Loss Event Entry profileTo load the Loss Event Entry profile successfully, you need to make sure you have all of the requiredobject types, field groups, and fields loaded in your system.

Click Administration > Object Types and check that all of the following object types are listed.

• LossEvent• LossImpact• LossRecovery• SoxBusEntity


http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.2/com.ibm.silentinstall12.doc/topics/c_silent_response_files.html

• SoxDocument• Preference

These object types use the following field groups:

• OPSS-LossEv (LossEvent)• OPSS-Shared-Basel (LossEvent)• OPSS-LossIm (LossImpact)• OPSS-LossRe (LossRecovery)• OPSS-Pref (Preference)

You can also review the OpenPages Loss Event Entry Automated Form Configuration (AFCON)spreadsheet to make sure that you have everything you need on your system. You can find the AFCONspreadsheet in the <OP_Home>/LossEventEntry/ directory, along with the other loader files.

If you are using IBM DB2 version 10.5 and you needed to create these object types or field groups, dropthe reporting schema before loading the Loss Event Entry profile. After you have loaded the files andcreated the profile, recreate the reporting schema. For more information, see “Re-creating the reportingschema for Fix Pack 7.2.0.2” on page 255.

Note: This topic discusses the objects and field groups that you need to add if you have the 7.2 solutionsschema. If you do not have the 7.2 solutions schema or if you customized the solutions schema,additional changes might be required. For more information, see “Notes for users who do not have the 7.2solutions schema” on page 355.

Notes for users who do not have the 7.2 solutions schemaIf you do not have the 7.2 solutions schema in your environment or if you customized the solutionsschema, you might need to add or modify objects, field groups, and fields before you use IBM OpenPagesLoss Event Entry.

For example, if you installed version 7.1 with solutions and then upgraded to 7.2, your environment hasthe 7.1 solutions schema. The 7.1 solutions schema might not have all of the objects, field groups, andfields that you need for Loss Event Entry.

Examine the OpenPages Loss Event Entry Automated Form Configuration (AFCON) spreadsheet. Look forany gaps:

• Are any objects, field groups, or fields for Loss Event Entry missing from your schema?• Do the attributes match? For example, is the display type of each field defined correctly?• Does your schema have the prerequisites for the objects, field groups, and fields for Loss Event Entry?

You can find the AFCON spreadsheet in the <OP_Home>/LossEventEntry/ directory.

Address each gap that you identify. For example, if your schema is missing a field, you could add the fieldto your schema or you could remove the field from the profile that you use for Loss Event Entry. You canmake changes by using the OpenPages application or by using the AFCON tool.

Loading the Loss Event Entry data manuallyYou can load the data used by IBM OpenPages Loss Event Entry manually. For example, if you havecustomized the data, such as the fields or field groups, you need to load the data manually to apply yourchanges.

Before you begin

If you are using an IBM DB2 version 10.5 database, you must drop the reporting schema before loadingthe data.




About this task

You can load Loss Event Entry data manually using a script:Load_LossEvent_Entry_App_Schema.bat (Windows) orLoad_LossEvent_Entry_App_Schema.sh (UNIX).

The script performs the following actions:

• Adds a new user group, called Loss Event Entry• Adds nine users, and adds the new users to the Loss Event Entry user group

The user accounts connect IBM OpenPages Loss Event Entry to OpenPages GRC Platform. Each useraccount is associated with a specific locale. When a user starts OpenPages Loss Event Entry, the user islogged in to OpenPages automatically with the user account for their locale.

– LEE_EN_US– LEE_EN_GB– LEE_IT_IT– LEE_PT_BR– LEE_FR_FR– LEE_ES_ES– LEE_DE_DE– LEE_ZH_TW– LEE_ZH_CN

• Adds a new role template, called Loss Event Entry

The role template controls access to OpenPages GRC Platform by users of OpenPages Loss Event Entry.

– The role template includes six object types: LossEvent, LossImpact, LossRecovery, SoxBusEntity,SoxDocument, and Preference.

– The role template configures the following security permissions:

- Read access to all six object types- Write access for LossEvent, LossImpact, LossRecovery and SoxDocument only- Associate access to SoxBusEntity, LossEvent, LossImpact, LossRecovery and SoxDocument only- Delete access to none of the object types- No application permissions

• Adds two new field groups and associates them with the LossEvent object.

– OPSS-LE-BE includes fields to identify the entities involved in the loss event being created– OPSS-LE-Contact includes fields for the submitter of the loss event to provide their identifying

information• Adds a new profile, Loss Event Entry

The profile includes creation views for LossEvent, LossImpact, and LossRecovery. This profile drives theviews in OpenPages Loss Event Entry.

• Assigns the Loss Event Entry profile to each of the nine new users• Assigns the Loss Event Entry role template to each of the nine new users, at the root business entity

security context point.

The XML files are located in the directory <OP_HOME>/LossEventEntry/. The following list describesthe files:

• lossevent-entry-users-op-config.xml (Users and groups)• lossevent-entry-role-template-op-config.xml (Role Templates)• lossevent-entry-schema-op-config.xml (Schema)


• lossevent-entry-profile-op-config.xml (Loss Event Entry Profile)• lossevent-entry-config-opx-op-config.xml (JSON configuration file)• OpenPages-uUpgrade-registry-entries-7202-LEE-op-config.xml (Registry setting)• lossevent-entry-app-string-keys-op-config.xml (Application text)

Procedure

1. Load the Loss Event Entry data (users, groups, fields, field groups, and so on).

To load the Loss Event Entry data on a Microsoft Windows computer, perform the following steps:

a) Go to <OP_Home>/LossEventEntry/.b) Open the Environment_Variables.bat file and update the openpages_domain_folder,login_username, and login_password properties.

c) Run Load_LossEvent_Entry_App_Schema.bat.d) For security purposes, remove the password from the Environment_Variables.bat file.

To load the Loss Event Entry data on a UNIX computer, perform the following steps:

a) Go to <OP_Home>/LossEventEntry/.b) Open the Environment_Variables.sh file and update the openpages_domain_folder,login_username, and login_password properties.

c) Run Load_LossEvent_Entry_App_Schema.sh.d) For security purposes, remove the password from the Environment_Variables.sh file.

2. Optional: Add LossEvent to the list of object types that are disabled for the Add New wizard.OpenPages Loss Event Entry is more full-featured than the Add New wizard for loss events. You mightwant all users, including those that have access to OpenPages GRC Platform, to use OpenPages LossEvent Entry to report loss events.a) Go to Administrator > Settings > GRCM > Add New Wizard.b) Expand GRCM > Add New Wizard.c) Click Object Types Disabledd) In the Value field, add the LossEvent object to the list.e) Click Save.

3. Optional: Configure auto-naming for the LossEvent, LossRecovery, and LossImpact object types.OpenPages Loss Event Entry users are unlikely to know the naming convention for new loss events,loss impacts, and loss recoveries. To avoid failures caused by duplicate names, enable auto-naming forthese object types.a) Go to Administrator > Settings.b) Expand Applications > GRCM > Auto Naming.c) Expand the object type, and then expand Auto-named. Set New Object to true and Can be Edited

to false.4. Modify the web.xml files for OpenPages Loss Event Entry. See “Modifying the web.xml files for Loss

Event Entry” on page 352.5. Restart the OpenPages server on all application servers. For information about starting and stopping

servers, see Chapter 15, “Starting and stopping servers,” on page 201.6. Set the passwords for the nine new users. See “Setting passwords for Loss Event Entry users” on page

353.7. For IBM DB2 databases only: if you dropped the reporting schema, recreate it. For more information,

see Creating or recreating the reporting schema.

Note: If you are installing other items, such as a fix pack, perform this step only once, after you haveinstalled all components.



8. If you want to report on the fields and field groups for OpenPages Loss Event Entry, regenerate thereporting framework. For more information, see Regenerating the reporting framework.


9. If you recreated the reporting schema and you use Global Search, recreate the search index. You alsoneed to recreate the search index if you needed to add the objects, fields, and field groups required forOpenPages Loss Event Entry. See “Re-creating the global search index for Fix Pack 7.2.0.2” on page256.




Appendix A. Silent installationsYou run a silent installation from the command line by using inputs that you export from the IBMOpenPages GRC Platform administrative console.

Before you begin

Ensure that you have prepared your systems for deploying OpenPages GRC Platform.

For more information, see Chapter 4, “Preparing your system for installation,” on page 19.

Procedure

To deploy the software by using a silent installation:

1. Create a topology file that defines your deployment.

To minimize errors, define the topology in the OpenPages GRC Platform administrative console andexport the topology file. In a Linux/DB2 environment, you can use the OP_home\OP_version_Configuration\Install\silent-installer\topology.xml file as a sample.For more information about the parameters in the topology file, see Chapter 11, “Installing a newOpenPages GRC Platform deployment,” on page 165.

Tip: You can validate the configuration in the administrative console before you export the topologyfile.

2. Create a deployment directory.

You can use an empty directory to ensure that you have a clean environment. Or you can use anexisting deployment directory that you saved from the administrative console.

If you use a deployment directory that is saved from the administrative console, you do not need toprovide a separate topology file.

3. Run the silent installation from the command line.

Check the logs directory to ensure that the installation is successful.

Related conceptsLog filesUse the log files to help troubleshoot problems that occur during the installation.

Creating a topology file for a silent installationTo create a topology file, configure a deployment in the IBM OpenPages GRC Platform administrativeconsole, and then export the file.

You do not have to save a topology file if you are using an existing deployment folder for your silentinstallation.

Procedure

1. Use the OpenPages GRC Platform administrative console to specify the settings for a deployment.2. After you have entered all of the information, click File > Export Topology.3. Select a location, enter a filename, and click Save.

Creating a deployment directoryYou must specify a deployment directory when you use a silent installation for IBM OpenPages GRCPlatform. The directory must exist before you run the installation.

You can use an empty directory to ensure that you have a clean environment. Or you can use an existingdeployment directory that you saved from the administrative console.

If you use an existing deployment directory, ensure that you complete the configuration in the OpenPagesGRC Platform administrative console before you run the silent installation.

Procedure

Do one of the following steps:

• Create an empty directory.• From the administrative console, Select the Deployment tab. Then, click File > New > New

Deployment, and select a location for the deployment directory.

Running a silent installationYou run an IBM OpenPages GRC Platform silent installation from the command line.

Procedure

1. Go to the directory where you installed the OpenPages GRC Platform administrative console.For example, on Microsoft Windows operating systems, go to the C:\Program Files (x86)\IBM\opadminconsole\opadminconsole directory. On Linux operating systems, go to the /opt/ibm/opadminconsole/opadminconsole directory.

2. Run the silent installation by using the following command:

• On Microsoft Windows operating systems, use:

opadminconsole.exe -consoleLog -nosplash -application com.ibm.openpages.config.admin.ui.silent -i <SD_INPUT> -o <SD_OUTPUT>

• On Linux operating systems, use:

opadminconsole.sh -consoleLog -nosplash -application com.ibm.openpages.config.admin.ui.silent -i <SD_INPUT> -o <SD_OUTPUT>

Where:

• SD_INPUT is the topology file that you exported from the OpenPages GRC Platform administrativeconsole.

• SD_OUTPUT is an empty directory or a deployment directory you saved from the OpenPages GRCPlatform administrative console.

Note: If you are using an existing deployment directory, you can omit the -i <SD_INPUT> value.

If errors occur during the silent installation, you can check the silent.log file. To recover from anerror, correct the problem, and run the silent installation again.

Tip: A sample batch and script file is provided in the opadminconsole\silent_install directory.You may want to create your own.


Appendix B. Troubleshooting problemsTroubleshooting is a systematic approach to solving a problem. The goal of troubleshooting is todetermine why something does not work as expected and how to resolve the problem.

Review the following table to help you or customer support resolve a problem.

Table 64: Troubleshooting actions to prevent problems

Action Description

Apply all known fix packs, service levels, orprogram temporary fixes (PTF).

A product fix might be available to fix the problem.

Ensure that the configuration is supported. Review the software and hardware requirements inthe Supported Environments document (http://www.ibm.com/support/docview.wss?uid=swg27039467).

Look up error message codes by selecting theproduct from the IBM Support Portal(www.ibm.com/support/entry/portal) and thentyping the error message code into the Searchsupport box.

Error messages give important information to help youidentify the component that is causing the problem.

Reproduce the problem to ensure that it is notjust a simple error.

If samples are available with the product, you mighttry to reproduce the problem by using the sampledata.

Check the installation directory structure andfile permissions.

The installation location must contain the appropriatefile structure and the file permissions.

For example, if the product requires write access tolog files, ensure that the directory has the correctpermission.

Review relevant documentation, such asrelease notes, technotes, and proven practicesdocumentation.

Search the IBM knowledge bases to determinewhether your problem is known, has a workaround, orif it is already resolved and documented.

Review recent changes in your computingenvironment.

Sometimes installing new software might causecompatibility issues.

If you still need to resolve problems, you must collect diagnostic data. This data is necessary for an IBMtechnical-support representative to effectively troubleshoot and assist you in resolving the problem. Youcan also collect diagnostic data and analyze it yourself.

Troubleshooting resourcesTroubleshooting resources are sources of information that can help you resolve a problem that you havewith a product. Many of the resource links provided can also be viewed in a short video demonstration.

To view the video version, search for "troubleshooting" through either Google search engine or YouTubevideo community.


http://www.ibm.com/support/entry/portal/

Support PortalThe IBM Support Portal is a unified, centralized view of all technical support tools and information for allIBM systems, software, and services.

Use IBM Support Portal to access all the IBM support resources from one place. You can adjust the pagesto focus on the information and resources that you need for problem prevention and faster problemresolution. Familiarize yourself with the IBM Support Portal by viewing the demo videos (https://www.ibm.com/blogs/SPNA/entry/the_ibm_support_portal_videos).

Find the IBM OpenPages GRC Platform content that you need by selecting your products from the IBMSupport Portal (www.ibm.com/support/entry/portal).

Service requestsService requests are also known as Problem Management Records (PMRs). Several methods exist tosubmit diagnostic information to IBM Software Technical Support.

To open a service request, or to exchange information with technical support, view the IBM SoftwareSupport Exchanging information with Technical Support page (www.ibm.com/software/support/exchangeinfo.html). Service requests can also be submitted directly by using the Service requests (PMRs)tool (www.ibm.com/support/entry/portal/Open_service_request) or one of the other supported methodsthat are detailed on the exchanging information page.

OpenPages GRC Platform Customer CenterThe IBM Customer Center provides specific information, updates, and troubleshooting resources for IBMOpenPages GRC Platform.

To view OpenPages troubleshooting information, access the OpenPages Customer Center (www.ibm.com/software/analytics/openpages/customercenter).

Fix CentralFix Central provides fixes and updates for your system software, hardware, and operating system.

Use the pull-down menu to go to your product fixes on Fix Central (www.ibm.com/support/fixcentral). Youmight also want to view Getting started with Fix Central (www.ibm.com/systems/support/fixes/en/fixcentral/help/getstarted.html).

Knowledge basesYou can often find solutions to problems by searching IBM knowledge bases. You can optimize yourresults by using available resources, support tools, and search methods

You can find useful information by searching the information center for IBM Cognos, but sometimes youmust look beyond the information center to resolve problems.

IBM Support Portal

The portal provides tools and information for all IBM systems, software, and services. The IBMSupport Portal provides you with access to the IBM electronic support portfolio from one place. Youcan customize the pages to focus on the information and resources that you need for problemprevention and faster problem resolution.

Find the IBM OpenPages GRC Platform content that you need by selecting your products from the IBMSupport Portal (www.ibm.com/support/entry/portal).

From the IBM Support Portal, you can search technotes and APARs (problem reports).

IBM masthead search

Use the IBM masthead search by typing your search string into the Search field at the beginning ofany ibm.com page.


https://www.ibm.com/blogs/SPNA/entry/the_ibm_support_portal_videos



http://www.ibm.com/software/support/exchangeinfo.html

http://www.ibm.com/software/support/exchangeinfo.html

http://www.ibm.com/support/entry/portal/Open_service_request

http://www.ibm.com/support/entry/portal/Open_service_request

http://www.ibm.com/software/analytics/openpages/customercenter/

http://www.ibm.com/support/fixcentral/

http://www.ibm.com/systems/support/fixes/en/fixcentral/help/getstarted.html



External search engines

Search for content by using any external search engine, such as Google, Yahoo, or Bing. If you use anexternal search engine, your results are more likely to include information that is outside theibm.com® domain. However, sometimes you can find useful problem-solving information about IBMproducts in newsgroups, forums, and blogs that are not on ibm.com.

Tip: Include "IBM" and the name of the product in your search if you are looking for information aboutan IBM product.

Log filesUse the log files to help troubleshoot problems that occur during the installation.

You can review the log files for the current session individually or you can collect them to review later.

Session directory

Logs that relate to the IBM OpenPages GRC Platform installation are created in the \opadminconsole\workspace\.metadata\.plugins\com.ibm.openpages.config.install.ui\sessionsdirectory.

The sessions directory might contain multiple log folders, where each log folder's name consists of aseries of numbers. The bigger the number, the more recent the session. You can use the modified date onthe folder to identify the most recent log files.

Silent installations

For silent installations, the log file is in the \opadminconsole\silent_install directory.

The log file name corresponds to the script name appended to _log. For example, if you run thewas_win_ora_deploy_server.cmd script, the log file is namedwas_win_ora_deploy_server_log.

Log files exported from the user interface

If you encounter a problem that you cannot resolve immediately, you can click Export in the Log view topreserve the information. The current property settings, the default settings, and a log file that containsdeployment actions and results are exported to a compressed file. The compressed file containsinformation that is needed to troubleshoot installation issues.

Collect log files and diagnostic dataIf you are using version 7.2.0.4 or later, you can use the LogCollector tool to collect log files anddiagnostic data from the IBM OpenPages GRC Platform environment and from OpenPages databases.

The LogCollector tool collects log files and diagnostic data on an application server.

In a horizontal cluster environment, run the tool on each application server in your environment.

In a vertical cluster, with multiple application servers installed on the same machine, the tool gathers logsfrom all servers. The tool gathers logs from reporting servers only when they are installed on the samemachine as one of the application servers. If the search server is also installed on the same machine, forexample in a development environment, the tool also collects the search server logs.

The LogCollector tool is in the OP_HOME/bin directory.

The tool uses the following command options:

--configuration or -c to specify a configuration file path. If you do not include this option, the defaultis LogCollector.xml. Using --configuration or -c is optional.

Note: For all command options, the long name command option uses two hyphens (--), whereas the shortname uses only 1 hyphen (-).

--database or -d to collect log and diagnostic data from only the database.

Troubleshooting problems 363

--file or -f to collect only log and diagnostic files.

--property or -p to set property values. Using --property or -p is optional.

You must include -p for each property that you use. For example, -p DB_OP_USER username -pDB_OP_PASSWORD password. The properties that you can use are:

Property Description

DB_OP_USER The OpenPages database user name

DB_OP_PASSWORD The OpenPages database user's password

DB_TYPE The database type. This value can be db2 ororacle.

DB_URL The database JDBC URL.

--target or -t to specify a target package file. If you do not include this option, the default isLogCollector_<timestamp>.zip. Using --target or -t is optional.

--help or -h to display command help.

Example: Getting all information

1. Log in as the Super Administrator user.2. Open a Command Prompt window.3. Go to the OP_HOME\bin directory. For example, on Microsoft Windows operating systems, go toC:\OpenPages\bin. On UNIX operating systems, go to /opt/OpenPages/bin.

4. Enter the following command:

On Microsoft Windows operating systems: LogCollector.cmd

On UNIX operating systems: ./LogCollector.sh

The tool with generate a package file that is named LogCollector_<timestamp>.zip in theC:\OpenPages\bin directory or the /opt/OpenPages/bin directory.

Example: Specifying a target package file

1. Log in as the Super Administrator user.2. Open a Command Prompt window.3. Go to the OP_HOME\bin directory. For example, on Microsoft Windows operating systems, go toC:\OpenPages\bin. On UNIX operating systems, go to /opt/OpenPages/bin.


On Microsoft Windows operating systems: LogCollector.cmd -t LogCollector.zip

On UNIX operating systems: ./LogCollector.sh -t LogCollector.zip

The tool will generate a package file that is named LogCollector.zip in the C:\OpenPages\bindirectory or the /opt/OpenPages/bin directory.

Example: Getting information from an IBM DB2 database

1. Log in as the Super Administrator user.2. Open a Command Prompt window.


3. Go to the OP_HOME\bin directory. For example, on Microsoft Windows operating systems, go toC:\OpenPages\bin. On UNIX operating systems, go to /opt/OpenPages/bin.


On Microsoft Windows operating systems: LogCollector.cmd -d -p DB_TYPE db2 -p DB_URLjdbc:db2://localhost:50000/OPX -p DB_OP_USER openpage -p DB_OP_PASSWORDpassword

On UNIX operating systems: ./LogCollector.sh -d -p DB_TYPE db2 -p DB_URLjdbc:db2://localhost:50000/OPX -p DB_OP_USER openpage -p DB_OP_PASSWORDpassword

The tool will generate a package file that is named LogCollector_<timestamp>.zip in theC:\OpenPages\bin directory or the /opt/OpenPages/bin directory.

Order of starting and stopping servicesTo restart the servers in an IBM OpenPages GRC Platform environment, you must stop and start them insequence. Restarting the servers in order ensures that the OpenPages application server and IBM CognosBusiness Intelligence can connect to the database server.

Use the following sequence to stop the servers:

1. Stop the services on the Cognos BI reporting server.2. Stop the services on the OpenPages application server.3. Stop the services on the database server

Use the following sequence to start the servers:

1. Start the services on the database server.2. Start the services on the OpenPages application server.3. Start the services on the Cognos reporting server.

Reusing property settings for similar deploymentsUse a saved or exported property file as a template for similar installations. You can import the savedproperty file to the current installation, or use the exported file as response file for a silent installation.

Procedure

1. Save the property settings from another, similar installation to a property file by using one of thefollowing options:

• Export the property file to the file system.• Copy the properties and then save them to a file.

2. Import the property settings in the saved file to the current installation deployment option, or use thesaved file as input for a silent installation.

Manually creating the reporting tablespace and user for Oracle databasesAfter you create the Cognos content store, you can manually create the content store user and thecontent store tablespace. This user must be able to create, alter, and drop tables, triggers, views,procedures, and sequences, and have the CONNECT and RESOURCE roles.

Procedure

1. Log on to the reporting server as a user with administrative privileges.


Note: For Linux operating systems, log in as a non-root user.2. From the IBM OpenPages GRC Platform Installer version for your network share location, copy theOP_version_Configuration\Database\ORACLE\COGNOS directory to the local system.

3. Log on to SQL*Plus by using the following command:

sqlplus system/system_password@oracle_tns_alias

To create the tablespace in the OpenPages database instance, enter the oracle_tns_alias of theOpenPages database. The database alias for the OpenPages database instance, as set during theOracle database installation, is oracle_tns_alias. If necessary, you can retrieve this alias from thetnsnames.ora file.

If you created a separate database instance for the content store, create the tablespace in the contentstore database instance. Enter the oracle_tns_alias of the content store database.

4. At the SQL prompt, type the following command:

@cognosdbcreate.sql cognos_user cognos_password oracle_data_home tablespace_name log_file

Table 65: Parameter descriptions for cognosdbcreate.sql script for Oracle databases


cognos_user Specifies the new user name for the content store database

cognos_password Specifies the password for the cognos_user

oracle_data_home Specifies the location of the Oracle data home directory for thecontent store database instance.

On Windows operating systems: ORACLE_BASE\oradata\SID

tablespace_name Specifies the name of the exported tablespace.

log_file Specifies the file name and location of the log file to create.

Known problems and solutions for global searchIssues that are related to the IBM OpenPages GRC Platform global search component are most commonlyencountered when you are setting it up or when it is updated to synchronize the search index for changesthat are made to the OpenPages GRC Platform schema (such as adding or removing object types orfields).

You can normally resolve these issues by clicking View Log to see the log message for the failed globalsearch operation.

The most common failure is that the search service is not started, for which you see this error:"Connection refused: connect". Ensure that the search service is started or restart to try to resolve theissue.

If you cannot resolve an issue, complete the following steps before you contact IBM Support.

1. Go to the OP_Home/OPSearch/opsearchtools/ folder and run the following commands:

mkdir "diag"java -jar opsearchtool.jar collectDiagData -diagpath diag

2. Add the contents of the new folder that is created under the diag folder to a compressed file.3. Send the compressed file and some details about your issue to IBM Support.


Forcing a reset of global searchIn some rare cases, it might be necessary to reset the IBM OpenPages GRC Platform global searchcomponent if you cannot restore it from the global search administration page. These issues mightprevent you from successfully completing tasks in the global search administration page. To resolve theseissues, complete the following steps.

Procedure

1. Log on to the search server as a user with administrative privileges.2. Open a command line on the search server.3. Go to the <OP_Home>/OPSearch/opsearchtools/ directory to run the commands in the following

steps.

Attention: At the successful completion of each command, the statement "Normalcompletion of command" should appear. If it does not, contact Customer Support to diagnosethe issue.

4. Ensure that Solr is running and is reachable on port 8983. If Solr is not running, then run the followingcommand to start it.

On Microsoft Windows operating systems, run

opsearchtool.cmd startSolr

On UNIX operating systems, run

./opsearchtool.sh startSolr

5. Run the following commands to stop indexing.


opsearchtool.cmd stopIndexing -indexname openpagesopsearchtool.cmd stopIndexing -indexname folderacl


./opsearchtool.sh stopIndexing -indexname openpages

./opsearchtool.sh stopIndexing -indexname folderacl

6. Verify that no opsearchtool.jar processes are running.

On Microsoft Windows operating systems, use the task manager to see whether anyopsearchtool.jar processes are running. If there are, terminate them.

On UNIX operating systems, use the ps command to see whether any opsearchtool.jarprocesses are running. If there are, terminate them.

7. Run the following commands to clear any PID states that might still be set if the opsearchtool.jarprocesses did not end successfully.


opsearchtool.cmd clearState -indexname openpagesopsearchtool.cmd clearState -indexname folderacl


./opsearchtool.sh clearState -indexname openpages

./opsearchtool.sh clearState -indexname folderacl

8. Run the following commands to reset global search.



opsearchtool.cmd resetSolr -indexname openpagesopsearchtool.cmd resetSolr -indexname folderaclopsearchtool.cmd resetDbopsearchtool.cmd stopSolropsearchtool.cmd startSolr


./opsearchtool.sh resetSolr -indexname openpages

./opsearchtool.sh resetSolr -indexname folderacl

./opsearchtool.sh resetDb

./opsearchtool.sh stopSolr

./opsearchtool.sh startSolr

9. Log on to OpenPages as a user with administrative privileges.10. Click Administration > Global Search.11. Click Create to re-create the search index.

What to do next

Resetting the global search component does not change your global search settings, such as object types,fields that are enabled for search, registry settings, or property settings. The reset disables the globalsearch component. You must enable it again to make it available to users.

Installation issues and solutionsError messages and log files provide you with information about errors that occur during the installationprocess. Use the error messages and log files to determine which part of the process failed.

Review common problem scenarios, recovery methods, and ways to get help if you encounter a problemduring software installation. You can diagnose problems when the installation and configuration isunsuccessful.

Update to IBM Installation Manager 1.8 is blocked when the data location is the same asthe installation location

Starting in IBM Installation Manager version 1.8, you are blocked from using a data location when thislocation is within the Installation Manager's installation location.

About this task

In older IBM Installation Manager versions, you are not blocked from using a data location withinInstallation Manager's installation location. When you try to update an older version, that was installed byusing a data location within Installation Manager's installation location, you receive an error message.

For example, if the older Installation Manager version was installed to the /opt/IBM/IM directory byusing the /opt/IBM/IM/dataLocation directory as the data location, the following error message isdisplayed when you update to Installation Manager version 1.8:

CRIMA1261E ERROR: The installation directory ("/opt/IBM/IM") must not be thesame directory, a parent directory, or sub-directory of the InstallationManager data directory ("/opt/IBM/IM/dataLocation")

This issue occurs when one of the following scenarios occur:

1. Using an IBM Installation Manager version earlier than 1.8 (for example, 1.7.3), you install theInstallation Manager that uses a data location within the installation location. For example:

installc -acceptLicense -dataLocation /opt/IBM/IM/dataLocation -installationDirectory /opt/IBM/IM


2. Using an Installation Manager version 1.8 or higher installer, you update the installed InstallationManager. For example:

Installc -acceptLicense -dataLocation /opt/IBM/IM/dataLocation

Putting the data location within the installation location violates basic assumptions about the separationof the installation artifacts and the runtime data of the Installation Manager, which can lead to errors.Installation Manager 1.8 was intentionally changed to no longer allow this situation. When the softwaredetects this situation, it displays the preceding error message.

To resolve this issue, you must reinstall the Installation Manager in a new installation location that doesnot collide with the data location.

Unfortunately, Installation Manager's -reinstallim option does not work in this particular casebecause the data location is incorrectly located in Installation Manager's installation location. You mustmanually reinstall Installation Manager as follows:

Procedure

1. Delete the IBM Installation Manager installation location.

Normally, this means deleting the entire /opt/IBM/IM directory (the installation location in thepreceding example), but because the data location was incorrectly put within Installation Manager'sinstallation location, only the subdirectories of the /opt/IBM/IMdirectory other than the data locationdirectory should be deleted: eclipse, license, and properties. The /opt/IBM/IM/dataLocation directory must remain untouched.

2. Run IBM Installation Manager version 1.8 or higher installer to reinstall Installation Manager, takingcare to specify an installation location that does not collide with the data location. For example:

installc -acceptLicense -dataLocation /opt/IBM/IM/dataLocation -installationDirectory /opt/IBM/IM/installLocation

3. To confirm that all previously installed products are still available, start the installed InstallationManager and click File > View Installed Packages to see the list of installed products.

Note: The instructions for manually reinstalling Installation Manager are derived from Manuallyreinstalling Installation Manager, except that in this case, care must be taken not to delete the datalocation that was incorrectly put in the Installation Manager's installation location.

OpenPages GRC Platform migration utility failsWhen you export IBM OpenPages GRC Platform data using the migration utility, if there are solutions andservices files missing from your environment, the export fails.

To export your data successfully, remove the following files from the op_backup.manifest file:

• OP_HOME\application\services-sosa-files.zip• OP_HOME\application\solutions-sosa-files.zip• OP_HOME\application\services-publishweb-files.zip• OP_HOME\application\solutions-publishweb-files.zip• OP_HOME\application\services-opx-files.zip• OP_HOME\application\solutions-opx-files.zip

REST API security check does not completeWhen you deploy IBM OpenPages GRC Platform, it checks that REST API security is enabled. An errormight occur with the security check running in an infinite loop.

About this task

To resolve this issue, disable the REST API security check from the Administrative Console.


http://www-01.ibm.com/support/knowledgecenter/SSDV2W_1.8.0/com.ibm.cic.agent.ui.doc/topics/t_manually_installing.html%23manual

http://www-01.ibm.com/support/knowledgecenter/SSDV2W_1.8.0/com.ibm.cic.agent.ui.doc/topics/t_manually_installing.html%23manual

Procedure

1. Click Start > All Programs > IBM OpenPages GRC Platform > IBM OpenPages GRC Platform -Administrative Console.

2. Click File > Preferences.3. In the Process section, select Skip for the Skip OpenPages REST API option.4. Click Set.

Issues with enabling global security

If you have issues with enabling REST API security or IBM WebSphere Application Server global security,see the following topic:

http://www-01.ibm.com/support/knowledgecenter/SSFUEU_7.1.0/com.ibm.swg.ba.cognos.op_installation_guide.7.1.0.doc/c_op_ig_upg_rest_api.html

Install the 32-bit Oracle 12.1.0.2 client and 64-bit Oracle 12.1.0.2 database server on thesame computer

If the 64-bit Oracle 12.1.0.2 database server is installed, and you want to install the 32-bit Oracle12.1.0.2 client on the same computer, where no previous version of the Oracle client exists, you mustcomplete the following configuration steps:

1. Manually set the following registry key to the location of the Oracle Inventory directory of thecomputer on which you are performing the upgrade installation:

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\inst_loc

For example:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ORACLE]"inst_loc"="D:\app\OPDB\product\12.1.0\dbhome_1\inventory"

2. Edit the following file:

inst_loc\ORA 12.1.0.2\win64\Client\client32\install\oraparam

Update the MSVCREDIST_LOC parameter:

MSVCREDIST_LOC=vcredist_x86.exe

If the 32-bit Oracle 11.2.0.4 client is already installed on the computer, you can upgrade to the 32-bitOracle 12.1.0.2 client without any issues.

Issues with importing data to Oracle 12.1.0.2 using Oracle data pumpIf you are using IBM OpenPages GRC Platform 7.1.0.1 or later version, when you import data from anOracle 11.2.0.4 source into an Oracle 12.1.0.2 target, you might encounter a data pump import error.

Processing object type SCHEMA_EXPORT/TABLE/INDEX/STATISTICS/INDEX_STATISTICSORA-39083: Object type INDEX_STATISTICS failed to create with error:ORA-01403: no data foundORA-01403: no data found

To import the data successfully, use the following solution. It is assumed that you are using a clean targetdatabase as the import destination.

Import the data using the exclude=statistics command.




For example:

impdp user/password@db full=Y DIRECTORY=dp dir DUMPFILE=dp file logfile=log file exclude=statistics

When the import is complete, you must gather table statistics for all objects manually.

Memory issue when installing OpenPages GRC Platform Administrative Console on LinuxWhen you install the IBM OpenPages GRC Platform on Linux, you might see an out-of-memory errorbecause the number of user processes is automatically restricted to 1024.

To resolve this issue, you must delete the highlighted comment from the 90-nproc.conf file:

# Default limit for number of user's processes to prevent # accidental fork bombs. # See rhbz #432903 for reasoning.* soft nproc 1024 root soft nproc unlimited

Unable to install OpenPages GRC Platform Administrative Console using WinZipIf you use WinZip to extract files, the IBM Installation Manager fails when it extracts the TAR files requiredto install the IBM OpenPages GRC Platform Administrative Console.

To overcome this issue, you can configure WinZip to correctly extract TAR files as follows:

1. Open WinZip.2. Click Options > Configuration.3. On the Miscellaneous tab, clear the TAR file smart CR/LF conversion check box.

Alternatively, you can use a different file extraction utility, such as 7-Zip.

SQL0569N Authorization ID "user_name" does not uniquely identify a user, a group or arole in the system error

The IBM OpenPages GRC Platform Administrative Console might indicate that the installation issuccessful. However, you might see a message similar to the following text in the session.log file:SQL0569N Authorization ID "user_name" does not uniquely identify a user, a group or a role in the system error

Ensure that on Linux and AIX operating systems, the user name for the OpenPages or workflow databaseuser account is not the same as the group name. For example, opuser:opuser is not allowed.

Tip: When you deploy OpenPages applications to WebSphere, ensure that you review the session.logfile for errors. After the installation is complete, you can export the log files from the Log view in theOpenPages Administrative Console interface. You can also view the log files related to the OpenPagesapplication installations in the path\opadminconsole\workspace\.metadata\.plugins\com.ibm.openpages.config.install.ui\sessions directory.

OpenPages GRC Platform and software that is installed in a directory that containsspaces

If you installed software that IBM OpenPages GRC Platform uses into a directory with spaces, you mustuse the Windows short file name convention for the home directory location.

For example, in the OpenPages Administrative Console, when you configure the home directory for theWebSphere Application Server Home Directory, instead of entering the C:\Program Files\IBM\WebSphere\AppServer directory, enter C:\PROGRA~1\IBM\WebSphere\AppServer.

Note: You cannot browse to an installation location that contains spaces.


Garbled characters are displayed on the OpenPages GRC Platform home page when youlog in for the first time

You might see garbled characters on the IBM OpenPages GRC Platform home page (http://server_name:port/openpages) if the DB2 database does not have sufficient memory.

The following SQL errors are in the OP_Home\aurora\log files or the OP_Home\bin\logs\ObjectManager.log file:com.ibm.db2.jcc.am.SqlException: DB2 SQL Error: SQLCODE=-20442, SQLSTATE=57011, SQLERRMC=null, DRIVER=3.64.104

To resolve the problem, increase the memory that is available to DB2 database by running the followingcommands, one by one, as the database instance owner:

db2 connect to <database_name> user <DB2_instance_owner> using <password>db2 update db cfg for <database_name> using APPLHEAPSZ 512 APPL_MEMORY 80000db2 terminatedb2start

Reload the configuration data. For more information, see “Manually loading the configuration data after anew installation” on page 372.

If the problem still exists, keep doubling the sizes for the APPLHEAPSZ and APPL_MEMORY settings, upto 2048,000 or acquire more memory (RAM).

Example: APPLHEAPSZ 1024 APPL_MEMORY 160000


Example: APPLHEAPSZ 2048 APPL_MEMORY 320000


Manually loading the configuration data after a new installationThe installation program for IBM OpenPages GRC Platform automatically loads the application data andenables user access to the standard Cognos Business Intelligence reports. In limited situations, you canmanually load the level-0 schema.

Before you begin

OpenPages GRC Platform must be installed.

The OpenPages and workflow (IBPM) services must be running.

About this task

When you install the OpenPages application, on the Storage and Configuration Information page, youare prompted to choose whether to load configuration data.

If you select No, and the default configuration is not already loaded, you must manually load the level-0schema and the OpenPages CommandCenter data.

Procedure

To manually load the level-0 schema, use the following steps:1. Log on to the OpenPages admin server as a user with administrative privileges.2. Go to the OP_HOME/addon_module/loaderdata directory.3. Make a backup copy of the schema_loader_properties.bat file.


4. Open the original schema_loader_properties file in a text editor.5. In the following line, update the password for the OpenPages application Super Administrator.



The password for the OPXUserName user is masked by asterisks (***). Replace the mask with cleartext. After the default configuration data is loaded, you can manually mask the password value withasterisks (***).

6. Save and close the file.7. To load the default OpenPages GRC Platform configuration, run the openpages-level0-loader-data.bat script.

Tip: Redirect the output to a log file so that you can conveniently track the progress:

openpages-level0-loader-data.bat > openpages-level0-loader-data.log

The script takes some time to finish loading the data. For example, the data might take two hours toload.


Manually loading the configuration data after an upgradeWhen you upgrade IBM OpenPages GRC Platform from an earlier version to version 7.2, then OpenPagesGRC Platform automatically loads the application data and enables user access to the standard CognosBusiness Intelligence reports. In limited situations, you can manually load the level-0 schema.

Before you begin

OpenPages GRC Platform must be installed.

The OpenPages and workflow (IBPM) services must be running.

About this task

When you upgrade the OpenPages application, on the Storage and Configuration Information page, youare prompted to choose whether to load configuration data.

If you select No, and the default configuration is not already loaded, you must manually load the level-0schema and the OpenPages CommandCenter data.

Procedure

To manually load the level-0 schema, use the following steps:1. Log on to the OpenPages admin server as a user with administrative privileges.2. Go to the OP_HOME/addon_module/loaderdata directory.3. Make a backup copy of the schema_loader_properties.bat file.4. Open the original schema_loader_properties file in a text editor.5. In the following line, update the password for the OpenPages application Super Administrator.



The password for the OPXUserName user is masked by asterisks (***). Replace the mask with cleartext. After the default configuration data is loaded, you can manually mask the password value withasterisks (***).



7. Depending on your upgrade path, run the batch files in the order that is listed:Upgrade path Files to run

5.0 to 7.2 a. openpages-op51x-upgrade-loader-data.sh |.batb. openpages-op55x-upgrade-loader-data.sh |.batc. openpages-op600-upgrade-loader-data.sh |.batd. openpages-op601-upgrade-loader-data.sh |.bate. openpages-op6011-upgrade-loader-data.bat|.shf. openpages-op700x-loader-data.bat|.sh|

g. openpages-op710x-loader-data.bat|.shh. openpages-patch-loader-data.bat|.sh|

5.1.x to 7.2 a. openpages-op55x-upgrade-loader-data.sh |.batb. openpages-op600-upgrade-loader-data.sh |.batc. openpages-op601-upgrade-loader-data.sh |.batd. openpages-op6011-upgrade-loader-data.bat|.she. openpages-op700x-loader-data.bat|.sh|f. openpages-op710x-loader-data.bat|.sh

g. openpages-patch-loader-data.bat|.sh|

5.5.x to 7.2 a. openpages-op600-upgrade-loader-data.sh |.batb. openpages-op601-upgrade-loader-data.sh |.batc. openpages-op6011-upgrade-loader-data.bat|.shd. openpages-op700x-loader-data.bat|.she. openpages-op710x-loader-data.bat|.shf. openpages-patch-loader-data.bat|.sh

6.0.1 to 7.2 a. openpages-op700x-loader-data.bat|.shb. openpages-op710x-loader-data.bat|.shc. openpages-patch-loader-data.bat|.sh

6.1.x to 7.2 a. openpages-op700x-loader-data.bat|.shb. openpages-op710x-loader-data.bat|.shc. openpages-patch-loader-data.bat|.sh

6.2.1 to 7.2 a. openpages-op700x-loader-data.bat|.shb. openpages-op710x-loader-data.bat|.shc. openpages-patch-loader-data.bat|.sh

7.0.0 to 7.2 a. openpages-op710x-loader-data.bat|.shb. openpages-patch-loader-data.bat|.sh

7.1.0 to 7.2 a. openpages-patch-loader-data.bat|.sh



Dropping the DB2 database for the OpenPages GRC Platform repositoryIn development environments, if you encounter problems when you try to create the database objects forthe IBM OpenPages GRC Platform repository, you can run clean up scripts. Use the scripts to drop thedatabase and uncatalog the node.

Note: In most situations, uncataloging the node is unnecessary.

Procedure

1. Log on to the OpenPages GRC Platform application server.2. Go to the location where you extracted the installation files.

• On Windows operating systems, go to the following directory:




• For Linux operating systems, go to the following directory:


3. On Windows operating systems, start the DB2 command line processor by typing db2cmd.

4. To drop the database, run the drop-opx-db-clt script.

• On Windows operating systems, type the following command:

drop-opx-db-clt.bat <database-name> <node-name> <instance.owner.username> <instance.owner.password>

• In AIX or Linux operating systems, type the following command:

drop-opx-db-clt.sh <database-name> <node-name> <instance.owner.username> <instance.owner.password>

Table 66: Scripts to drop the database and to uncatalog the node

Description Script

Drop thedatabase

drop-opx-db-clt.(bat|sh) <database-name> <node-name> <instance.owner.username> <instance.owner.password>

Uncatalogthe node

db2-uncatalog-node.(bat|sh) <node-name>

Updating the services for multiple DB2 instancesDB2 database instances must be able to communicate through the network. If you have multiple DB2instances on the same computer, ensure that the SVCENAME and listener port are configured. Otherwise,connection errors might occur.

To verify that the DB2 database instances are configured for network communication:

• DB2SET must show TCPIP for the DB2COMM setting.• The SVCENAME in the DBM configuration must show a valid TCP service name and TCP port number.


If you changed either the DB2 registry (DBSET) or the Database Manager configuration, ensure that youstop and restart DB2.

Procedure

1. Log on to the database server as the DB2 instance owner.2. To reserve a TCP port for the service, append the information to the services file.

On Windows, edit the %systemroot%\system32\drivers\etc\services file

On AIX or Linux, edit the /etc/services file.

To reserve TCP port 5500 for the service named db2c_opdb, append the following line to the end ofthe services file:

db2c_opdb 5500/tcp

3. Update the database manager configuration.

db2 update database manager configuration using svcename 550004. Ensure that TCP communication is set for the database instance.

db2cmd -i -wdb2set DB2COMM=npipe,tcpipdb2stopdb2start

5. Stop and then restart the DB2 server.

db2stopdb2start

OP-03620: The Reporting Schema has not been instantiated errorYou log on to the IBM OpenPages GRC Platform home page, and the following error message is displayed.The Home Page cannot be viewed without a valid Reporting Schema. Please contact your System Administrator. OP-03620: The Reporting Schema has not been instantiated. Please instantiate it before executing this operation.

This error occurs if the reporting schema has not yet been created.

To resolve the problem, enable System Admin Mode, and generate the reporting schema.

Procedure








Errors extracting installation filesWhen you extract compressed files from the installation media, you might see this error: Error0x80010135: File path too long

The error is caused when you use Windows Explorer or WinZip to extract files and it encounters a file paththat exceeds the maximum character limit.

To resolve this problem, use a decompression utility such as 7-Zip, that can handle long file paths.Otherwise, extract the files to the root directory or to the c:/temp directory.

Error updating password encryption module during the installationIf a password encryption module error is displayed in the IBM OpenPages GRC Platform AdministrativeConsole after installation, update the password manually.

If the installation program encounters an encryption password algorithm error, the following message isdisplayed in the user interface:Error updating password encryption algorithm. Please update the password encryption algorithm manuallyafter the installation.

For more information about manually configuring the password encryption algorithm in the UpdatePassword Encryption Algorithm (UPEA) tool, see the IBM OpenPages GRC Platform Administrator's Guide.

Incorrect Java locations causes validation errorsIn the IBM OpenPages GRC Platform Administrative Console, you validate the configuration informationfor your deployment, and you receive an error stating that the console cannot find the Java homedirectory in location specified.

This error can occur if you have incorrectly set the Java locations in the Administrative Console.

To correct this error, ensure that you complete the following actions:

• Set the Java Home Directory location in the OpenPages Application Server Information section to thelocation of the Java that is provided with WebSphere Application Server.

• Set the Cognos Java Home location in the CommandCenter Reporting Information section to thelocation of the Java that is provided with IBM Cognos, if you are installing on Windows, or to asupported Java if you are installing on Linux or AIX.

Uninstalling OpenPages GRC Platform with an Oracle database before you reinstallIn test or development environments, you might be required to uninstall IBM OpenPages GRC Platform orremove the OpenPages database in Oracle database server before you reinstall. You must completelyuninstall before you reinstall.

Procedure

1. On a computer that has SQL*Plus, log on as a user, such as SYSTEM, who has database administrationpermissions.

2. Run the following SQL statements:

drop user <workflow_user> CASCADE;drop user <openpages_user> CASCADE;drop user <cognos_user> CASCADE;

Note: Drop the cognos_user if the OpenPages database and the Cognos content store schemas are inthe same Oracle database. If you use a separate database for the Cognos content store, dropping thecognos_user is not required.


3. Run the following SQL statements to drop the default tablespaces and data files:

drop tablespace AURORA including contents and datafiles;drop tablespace INDX including contents and datafiles;drop tablespace AURORA_SNP including contents and datafiles;drop tablespace AURORA_TEMP including contents and datafiles;drop tablespace AURORA_NL including contents and datafiles;drop tablespace AURORA_NLI including contents and datafiles;drop tablespace AURORA_CLOB_DATA including contents and datafiles;drop tablespace AURORA_DOMAIN_INDX including contents and datafiles;drop tablespace IFLOWDB including contents and datafiles;drop tablespace IFLOWTEMPDB including contents and datafiles;drop tablespace COGNOS including contents and datafiles;

4. Run the following script to drop the Oracle data pump storage directory.

drop directory <OP_DATAPUMP_DIRECTORY>;

5. Uninstall OpenPages GRC Platform.

• For Windows operating systems, see “Uninstalling OpenPages GRC Platform on Microsoft Windowsoperating systems” on page 323.

• For Linux operating systems, see “Uninstalling OpenPages GRC Platform on Linux or AIXcomputers” on page 325

6. If required, remove environment variables that reference OpenPages GRC Platform, or Cognos BI, orboth products.

7. Restart the servers.8. Remove the existing OpenPages GRC Platform application or Cognos BI installation directories.

The following table lists examples of the installation directories for OpenPages and Cognos BIcomponents

Table 67: Example directory locations for OpenPages and Cognos BI components

Installation directory Location on Windows operating system

OpenPages

(OP_HOME)

C:\OpenPages

Fujitsu Interstage BPM

(Workflow_HOME)

C:\Fujitsu\InterstageBPM

OpenPages CommandCenter

(CC_HOME)

C:\OpenPages\CommandCenter

Cognos BI

(Cognos_HOME)

C:\IBM\cognos\c10_64

9. Review the TEMP or TMP directories for temporary installation files that might exist.

The location of temporary directories varies. The location depends on the environmental variables thatare set during the installation process.

For Windows operating systems, common temporary directory locations include

• C:\temp• C:\Users\<user_name>\AppData\Local\Temp


Issues when importing databasesWhen you import the IBM OpenPages GRC Platform or workflow database during upgrade or migration,you may see an error as a result of the default data file size.

If an error occurs, increase the default data file size as follows.

1. On a computer that has SQL*Plus, log on as a user, such as SYSTEM, who has database administrationpermissions.

2. Run the following SQL statements:

ALTER TABLESPACE INDX ADD DATAFILE 'C:\app\Administrator\oradata\OP\INDX02.DBF' SIZE 128 M AUTOEXTEND ON NEXT 128 M MAXSIZE 34359721984;

Alter database datafile 'C:\app\Administrator\oradata\OP\AURORA.DBF' resize 2000m;

Cognos content store import failsIf you use the database export and import option for the IBM Cognos content store migration, the importmight fail if the table space name differs in the target environment.

To resolve this issue, you must update the table space name in the target environment:

1. Check the table space name in the target environment.

a. Log on as an OpenPages user.b. Run the following command:

select tablespace_name from user_tablespaces;

2. Update the table space name.

a. Log on as SYSTEM using sqlplus.b. Run the following scripts:

alter tablespace crn RENAME TO cognos;

3. Go the /OP_version_Configuration/Database/ORACLE/INSTALL_SCRIPTS directory, and runthe following scripts:

sqlplus cognos_user/cognos_password@Alias @sql-wrapper AuroraDbDelete.sql auroradbdeletecognos.log

impdp system_user/system_password@Aliasfull=Y file=filename.dmp log=filename.logdirectory=OP_DATAPUMP_DIRECTORYfromuser=cognos_user touser=cognos_user EXCLUDE=INDEX

Admin user name not set to OpenPagesAdministratorDuring migration to IBM OpenPages GRC Platform version 7.1, if the OpenPages admin user name is notset to OpenPagesAdministrator, you must update the following database scripts before executing them toavoid errors.

In the OP601X_TO_OP6100/dbu-20-20-30-opx-data-changes.sql script, update line 495 as follows:

l_actor_author_name I18N_AUDIT_TRAIL.CREATED_BY_NAME%type := '&&opx_op_admin_name';

In the OP610X_TO_OP6200/dbu-20-20-01-opx-patches-and-updates script, update line 407 as follows:

l_actor_author_name I18N_AUDIT_TRAIL.CREATED_BY_NAME%type := '&&opx_op_admin_name';


High CPU use with Windows 2012 R2 serversYou might experience high CPU use if the User Access Logging service is set to automatic in WindowsServer 2012 or if you enabled the ProgramData Updater that is used by Microsoft Customer ExperienceImprovement Program.

To change the User Access Logging service to manual, follow these steps:

• Log in to Windows 2012 Server.• In the services console, stop the User Access Logging Service.• Change the Startup Type to Manual.

To disable the ProgramData Updater, follow these steps:

• Open Administrative Tools.• Expand Computer Management.• Select Application Experience and ProgramData Updater.• Right-click, then click Disable.

Updating the Oracle client path on the reporting serverOn a Linux or AIX OS that uses an Oracle database, if you change the Oracle client location after youinstall Cognos Business Intelligence and IBM OpenPages GRC Platform, then you must update the Oracleclient path on the reporting server. To update the Oracle client path, edit the PATH and LD_LIBRARY_PATHor LIBPATH environment variables in the BMTScriptPlayer.sh file.

Procedure

1. On the reporting server, navigate to the Cognos_installation_location/bin folder, and openthe BMTScriptPlayer.sh file.

2. Update the Oracle client path in the environment variables:

• For Linux, update the PATH and LD_LIBRARY_PATH variables.• For AIX, update the PATH and LIBPATH variables.

3. After you update the BMTScriptPlayer.sh file, verify that you can generate the OpenPagesFramework.

Issues when you use IBM Installation Manager on LinuxWhen you use the IBM Installation Manager on the Linux operating system to install IBM OpenPages GRCPlatform, then an error message might be displayed.

Add the following line to the IBMIM.ini file, which you can find in <installation location>/eclipse: -Dorg.eclipse.swt.internal.gtk.cairoGraphics=false. Save the file and restartIBM Installation Manager.

Error on the approval app home page: The requested operation could not be completedAfter you restart the OpenPages servers, you might see The requested operation could not becompleted. on the home page of the approval app.

After you restart the OpenPages servers, you must load the approval app configuration. For moreinformation, see “Loading the approval app configuration” on page 204.

IBM WebSphere profile errors or SOAP port conflicts after you change an applicationserver host name

You might encounter SOAP port conflict errors or errors about the need to create new application serverprofiles.

These errors can occur in the following circumstances:


• When you upgraded IBM OpenPages GRC Platform or applied a fix pack, you changed the applicationserver host names. The host names that you used are different from the host names that were used inyour most recent installation, upgrade, or fix pack update.

• When you upgraded IBM OpenPages GRC Platform or applied a fix pack, you recreated the topologybecause you did not have the topology.xml file from your most recent installation, upgrade, or fixpack update.

The errors can occur, for example, if you changed the host name from a fully qualified domain name(FQDN) to a short name.

You might see these errors in one or more of the OpenPages Administrative Console session.log files.You might also see these errors in the SystemOut.log files that are associated with the affected IBMWebSphere profiles. Make a note of the affected profiles.

You have two options for resolving the errors.

• Option 1: Restore the application server host names that you changed• Option 2: Remove the affected IBM WebSphere profiles

Option 1: Restoring the application server host names that you changed

You can restore the host names by either manually editing the topology.xml file (be sure to create abackup copy first) or by using the OpenPages Administrative Console.

Follow these steps to restore the host names by using the OpenPages Administrative Console.

1. Click the Welcome tab.2. Edit the field where the application server host name was changed.3. Ensure that the hosts file on the computer where you are running the administrative console is in

synch with the host names that you are using.4. Restart the OpenPages Administrative Console.5. Click the Deployment tab.6. Click Calculate Next Steps and review the next step that is displayed.7. Click Execute All Remaining Steps.

Option 2: Remove the affected IBM WebSphere profiles

If the issue persists after you do the steps in Option 1, or if you cannot restore the original host names,use the IBM WebSphere manageprofile command to remove the affected profiles.

The following commands are for Microsoft Windows application servers. Use the Linux/AIX equivalent ofeach command if your application server is either Linux or AIX:

Replace <nodename> with the name of the profile that you are removing.

Replace <WAS_Home> with the home directory of the WebSphere deployment.

Replace <OP_Home> with the home directory of the OpenPages application server.

1. Stop the OpenPages application servers.

cd <OP_Home>\binStopAllServers.cmd

2. List all of the profiles in the cell.

cd <WAS_Home>\AppServer\binmanageprofiles.bat -listProfiles

The command output looks like this example:

[OpenPagesDmgr, <nodename>-OPNode1, IBPMDmgr, <nodename>-IBPMNode1]


3. Remove the affected profiles.

Start with the IBPM profiles, if they are affected:

manageprofiles.bat -delete -profileName <nodename>-IBPMNode1

Remove the IBPM Dmgr profile, if it is affected:

manageprofiles.bat -delete -profileName IBPMDmgr

Remove the profile for the OpenPages node agent, if it is affected:

manageprofiles.bat -delete -profileName <nodename>-OPNode1

Remove the OpenPages Dmgr profile.

manageprofiles.bat -delete -profileName OpenPagesDmgr

4. Get the list of profiles.

manageprofiles.bat -listProfiles

Verify that the command output no longer contains the profiles that you removed.5. Go to the profiles directory. If the subdirectories for the profiles that you removed still exist, delete

them.

Note: Do not remove the profiles directory.6. Restart the OpenPages application servers to free up any affected ports.7. Start the OpenPages Administrative Console.8. Click the Deployment tab.9. Click Calculate Next Steps and review the next step that is displayed.

10. Click Execute All Remaining Steps.

Troubleshooting IBM OpenPages GRC Platform solutionsSolve common problems that might occur when you install or remove the IBM OpenPages GRC Platformsolutions.

ObjectManager loader failed message during the installationIf a reporting schema exists, and you do not drop it before you install the IBM OpenPages GRC Platformsolutions, an error occurs similar to this one:ObjectManager loader failed. Please review the logs for moreinformation and load the schema files manually.

About this taskTo resolve the issue, you must drop the reporting schema. For more information, see “Dropping the DB2reporting schema” on page 102.

Importing the solutions deployment packageAfter you install IBM OpenPages GRC Platform solutions, if you do not see the reports and packages inIBM Cognos Connection, you can import them manually.

For more information about importing content, see the IBM Cognos Business Intelligence Administrationand Security Guide.


Procedure

1. On the reporting server, access IBM Cognos Business Intelligence by typing the following URL:

cognos_server:port/ibmcognos2. Click Administer IBM Cognos content.3. In IBM Cognos Administration, click the Configuration tab and click Content Administration.

Tip: To access this area in IBM Cognos Administration, you must have the required permissions forthe Administration secured feature.

4. On the toolbar, click New Import.5. From the Deployment archive list, select OpenPages_Solutions_v6 and click Next.6. Type a unique name, an optional description, and a screen tip for the deployment archive, select the

folder where you want to save it, and then click Next.7. In the Public folders content box, select the OpenPages_Reports_v6 folder and click Next.8. On the Specify the general options page, accept the default options and click Next.9. On the Review the summary page, review the settings and click Next.

10. On the Select an action page, click Finish.11. On the Run with options page, click Run and then, on the IBM Cognos software page, click OK.12. To view the imported packages and reports, click the Home icon, and select the folder where you

imported them.13. To import each deployment file for the solutions that you plan to use, click Launch > IBM Cognos

Administration, and repeat steps 3-11.

Table 68: Description of deployment files

Solution name File name

Financial Control Management(FCM)

OPENPAGES_FCM

Internal Audit Management(IAM)

OPENPAGES_IAM

Operational Risk Management(ORM)

OPENPAGES_ORM

IT Governance Management(ITG)

OPENPAGES_ITG

Policy and ComplianceManagement (PCM)

OPENPAGES_PCM

Results

You can now use the OpenPages package to create and run the OpenPages reports in IBM CognosBusiness Intelligence.

Reporting Framework generation fails with CAMCryptoBC errorDuring installation, Reporting Framework generation might fail with a CAMCryptoBC error.

About this task

A CAMCryptoBC error occurs if the bcprov-jdk14-145.jar file that is provided with IBM OpenPagesGRC Platform is missing from the Java location that is used by the IBM Cognos server or if theBouncyCastleProvider is not registered in the JRE master security provider file, java.security.


The following circumstances can cause the error:

• During the OpenPages upgrade process, the Java that is used for the Cognos server was changed fromversion 1.6 to version 1.7.

• During the Cognos fix pack installation process, the Java that is used for the Cognos server was updatedor overwritten.

• The Java used for the Cognos server was updated.

In some instances, IBM WebSphere Java is shared between WebSphere and Cognos, usually in an IBMtest environment in which everything is in the same system and users use the WebSphere SDK forApplication, Reporting, and Search. In that case, the bcprov-jdk14-145.jar file is backed up andrestored after the WebSphere Java upgrade by using the procedure in the WebSphere Profileconfiguration.

If the Cognos server uses its own Java, you must complete the same procedure to back up and restorethe bcprov-jdk14-145.jar file in the Java location on the Cognos server. You must also make surethat the BouncyCastleProvider is registered in the JRE master security provider file,java.security.

Procedure

1. Back up the bcprov-jdk14-145.jar file from the Java extension library that is used for the Cognosserver.

Whenever you upgrade the JRE that you are using for running Cognos, you must back up the bcprov-jdk14-145.jar file and restore it after you upgrade the JRE. The JRE location varies depending onwhich JRE you are using.

• If you are using the JRE installed with Cognos, the bcprov-jdk14-145.jar file is located in the<IBM Cognos Installation location>/c10_64/bin64/jre/7.0/lib/ext directory.

• If you are using the JRE installed with WebSphere for running Cognos, the bcprov-jdk14-145.jar file is located in the <IBM WebSphere Installation location>/java_1.7.1_64/jre/lib/ext directory.

• If you are using a JRE installed in another location for running Cognos, back up the bcprov-jdk14-145.jar file in the JRE's lib/ext directory.

2. After you install or upgrade to Java 1.7.3, restore the bcprov-jdk14-145.jar file.

• If you are using the JRE installed with Cognos, do the following steps:

– Restore the bcprov-jdk14-145.jar file to the <IBM Cognos Installation location>/c10_64/bin64/jre/7.0/lib/ext directory.

– Register the BouncyCastleProvider in the JRE master security provider file, if it is not alreadyregistered.

To register the provider, add the following line to the java.security file that is stored in the<IBM Cognos Installation location>/c10_64/bin64/jre/7.0/lib/securitydirectory.

security.provider.<sequence number>= org.bouncycastle145.jce.provider.BouncyCastleProvider

• If you are using the JRE installed with WebSphere for running Cognos, do the following steps:

– Restore the bcprov-jdk14-145.jar file to the <IBM WebSphere Installationlocation>/java_1.7.1_64/jre/lib/ext directory.

– Register the BouncyCastleProvider in the JRE master security provider file, if it is not alreadyregistered.


To register the provider, add the following line to the java.security file that is stored in the<IBM WebSphere Installation location>/java_1.7.1_64/jre/lib/securitydirectory.


• If you are using a JRE installed in another location for running Cognos, do the following steps:

Replace <JAVA_LOCATION> with the directory where the JRE is installed.

– Restore the bcprov-jdk14-145.jar file to the <JAVA_LOCATION>/lib/ext directory.– Register the BouncyCastleProvider in the JRE master security provider file, if it is not already

registered.

To register the provider, add the following line to the java.security file that is stored in the<JAVA_LOCATION>/lib/security directory.




Notices

This information was developed for products and services offered worldwide.

This material may be available from IBM in other languages. However, you may be required to own a copyof the product or product version in that language in order to access it.

IBM may not offer the products, services, or features discussed in this document in other countries.Consult your local IBM representative for information on the products and services currently available inyour area. Any reference to an IBM product, program, or service is not intended to state or imply that onlythat IBM product, program, or service may be used. Any functionally equivalent product, program, orservice that does not infringe any IBM intellectual property right may be used instead. However, it is theuser's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.This document may describe products, services, or features that are not included in the Program orlicense entitlement that you have purchased.

IBM may have patents or pending patent applications covering subject matter described in this document.The furnishing of this document does not grant you any license to these patents. You can send licenseinquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual PropertyDepartment in your country or send inquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

The following paragraph does not apply to the United Kingdom or any other country where suchprovisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATIONPROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS ORIMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT,MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer ofexpress or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodicallymade to the information herein; these changes will be incorporated in new editions of the publication.IBM may make improvements and/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not inany manner serve as an endorsement of those Web sites. The materials at those Web sites are not part ofthe materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate withoutincurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) theexchange of information between independently created programs and other programs (including thisone) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM CorporationLocation Code FT0550 King StreetLittleton, MA01460-1250U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases,payment of a fee.

The licensed program described in this document and all licensed material available for it are provided byIBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or anyequivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, theresults obtained in other operating environments may vary significantly. Some measurements may havebeen made on development-level systems and there is no guarantee that these measurements will be thesame on generally available systems. Furthermore, some measurements may have been estimatedthrough extrapolation. Actual results may vary. Users of this document should verify the applicable datafor their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, theirpublished announcements or other publicly available sources. IBM has not tested those products andcannot confirm the accuracy of performance, compatibility or any other claims related to non-IBMproducts. Questions on the capabilities of non-IBM products should be addressed to the suppliers ofthose products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal withoutnotice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business operations. To illustratethem as completely as possible, the examples include the names of individuals, companies, brands, andproducts. All of these names are fictitious and any similarity to the names and addresses used by anactual business enterprise is entirely coincidental.

If you are viewing this information softcopy, the photographs and color illustrations may not appear.

This Software Offering does not use cookies or other technologies to collect personally identifiableinformation.

Copyright

Licensed Materials - Property of IBM Corporation.© Copyright IBM Corporation, 2003, 2018.

US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP ScheduleContract with IBM Corp.

This information contains sample application programs in source language, which illustrate programmingtechniques on various operating platforms. You may copy, modify, and distribute these sample programsin any form without payment to IBM, for the purposes of developing, using, marketing or distributingapplication programs conforming to the application programming interface for the operating platform forwhich the sample programs are written.

These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guaranteeor imply reliability, serviceability, or function of these programs. You may copy, modify, and distributethese sample programs in any form without payment to IBM for the purposes of developing, using,marketing, or distributing application programs conforming to IBM's application programming interfaces.

388 Notices

Trademarks

IBM, the IBM logo and ibm.com are trademarks or registered trademarks of International BusinessMachines Corp., registered in many jurisdictions worldwide.

The following terms are trademarks or registered trademarks of other companies:

• Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks ortrademarks of Adobe Systems Incorporated in the United States, and/or other countries.

• Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in theUnited States, other countries, or both.

• Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.• UNIX is a registered trademark of The Open Group in the United States and other countries.• Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or

its affiliates.

Other product and service names might be trademarks of IBM or other companies. A current list of IBMtrademarks is available on the Web at " Copyright and trademark information " at www.ibm.com/legal/copytrade.shtml.

Notices 389

http://www.ibm.com/legal/copytrade.shtml


Index

Aadditional tasks

Fix Pack 7.2.0.2 256Fix Pack 7.2.0.3 275Fix Pack 7.2.0.4 295Fix Pack 7.2.0.5 and later 318

Administrative Consolebacking up 173launching deployment tool for Fix Pack 7.2.0.2 251launching deployment tool for Fix Pack 7.2.0.3 268launching deployment tool for Fix Pack 7.2.0.4 288launching deployment tool for Fix Pack 7.2.0.5 and later308restoring 173updating for Fix Pack 7.2.0.2 248updating for Fix Pack 7.2.0.3 265updating for Fix Pack 7.2.0.4 285updating for Fix Pack 7.2.0.5 and later 305

administratorSuper Administrator 20

AIXscripts 203

AL32UTF8 character set 67Apache Web Server

configuring 85application readiness 203application server

configuring single sign-on 235default port 29paging file size and 181post-installation tasks 179scaling 217server topology 8software prerequisites 13

application serversprerequisite software 14prerequisite tasks for Oracle database 74upgrading 115, 142user permissions for DB2 databases 35user permissions for Oracle database 74

approval appcertification questions 344configuring the JSON file 340customizing the JSON file 346data types 330excluding specific object types 332, 334field types 330fields 331loading profile 338

architectureplatform 7

Attestation Creation Reportfixing for Fix Pack 7.2.0.2 255fixing for Fix Pack 7.2.0.3 271fixing for Fix Pack 7.2.0.4 291fixing for Fix Pack 7.2.0.5 311

Bbackup

files 99system 100

backupsCommandCenter utilities for Fix Pack 7.2.0.2 244CommandCenter utilities for Fix Pack 7.2.0.3 261CommandCenter utilities for Fix Pack 7.2.0.4 280CommandCenter utilities for Fix Pack 7.2.0.5 and later301directories for Fix Pack 7.2.0.2 245, 262directories for Fix Pack 7.2.0.4 281directories for Fix Pack 7.2.0.5 and later 302Dojo toolkit for Fix Pack 7.2.0.2 245Dojo toolkits for Fix Pack 7.2.0.3 262Dojo toolkits for Fix Pack 7.2.0.4 281Dojo toolkits for Fix Pack 7.2.0.5 and later 301files for Fix Pack 7.2.0.2 245, 262files for Fix Pack 7.2.0.4 281files for Fix Pack 7.2.0.5 and later 302OpenPages utilities for Fix Pack 7.2.0.2 244OpenPages utilities for Fix Pack 7.2.0.3 261OpenPages utilities for Fix Pack 7.2.0.4 280OpenPages utilities for Fix Pack 7.2.0.5 and later 301overview for Fix Pack 7.2.0.2 244overview for Fix Pack 7.2.0.3 261overview for Fix Pack 7.2.0.4 280overview for Fix Pack 7.2.0.5 and later 300solutions helpers for Fix Pack 7.2.0.2 245solutions helpers for Fix Pack 7.2.0.3 262solutions helpers for Fix Pack 7.2.0.4 281solutions helpers for Fix Pack 7.2.0.5 and later 301

bcprov-jdk14-145.jar 383

CCAMCryptoBC error

fixing 383cataloging

OpenPages database 52certificates

secondary OpenPages CommandCenter 232certification

approval app 344client systems

prerequisites 13clustered environment

configuring 217horizontal 11load balancing and 229vertical 11

Cognosservices 213

Cognos Business Intelligenceinstalling 80reporting server 8

391

command blockcreating for OpenPages data sources 175

CommandCenterbackup utilities for Fix Pack 7.2.0.2 244backup utilities for Fix Pack 7.2.0.3 261backup utilities for Fix Pack 7.2.0.4 280backup utilities for Fix Pack 7.2.0.5 and later 301creating installation directory 94framework generator 8host settings 233port settings 233post-installation tasks 173reporting server 8scaling 217uninstalling 323, 325

commandsWindows 202

concurrency conflict 180configuration data

manually loading after installation 372manually loading after upgrade 373

configuration filessaving custom settings 114upgrading custom changes 130

configuring single signon 235content store

configuring a connection 86configuring a connection to DB2 database 88manually creating tablespace and user 365

content store databaseoverview 8

creatingdatabase schema 69tablespaces and users 42, 70

custom configuration changesrestoring after upgrade 130

custom query subjectsupgrading 126

DData Execution Prevention (DEP)

enabling 22database

cataloging 52database client

64-bit installations 74database components

creating 42, 70creating manually before installation 44

database instancecreate 67installing 67

database listenerinstalling 66

database schemamanually creating 69upgrading manually 104, 136, 140, 148, 150, 156, 158upgrading manually with DB2 107, 152, 160

database schemascustom installations 77

database serverapplying Fix Pack 7.2.0.2 for DB2 249applying Fix Pack 7.2.0.2 for Oracle 250

database server (continued)applying Fix Pack 7.2.0.3 for DB2 266applying Fix Pack 7.2.0.3 for Oracle 267applying Fix Pack 7.2.0.4 for DB2 286applying Fix Pack 7.2.0.4 for Oracle 285applying Fix Pack 7.2.0.5 and later for DB2 307applying Fix Pack 7.2.0.5 and later for Oracle 306creating a database instance 67default port 29dependencies 64installing 63instance, installing 67listener, installing 66net service name, adding 68OpenPages repository 8prerequisites 13server topology 8standard objects 64using scripts to update for Fix Pack 7.2.0.2 249using scripts to update for Fix Pack 7.2.0.4 285using scripts to update for Fix Pack 7.2.0.5 and later306

database server connectionstesting 73, 170

database serverusing scripts to update for Fix Pack 7.2.0.23266database users

upgrading manually 104, 136, 140, 148, 150, 156, 158upgrading manually with DB2 107, 152, 160

DB2applying Fix Pack 7.2.0.2 for OpenPages database 249applying Fix Pack 7.2.0.3 for OpenPages database 266applying Fix Pack 7.2.0.4 for OpenPages database 286applying Fix Pack 7.2.0.5 and later for OpenPagesdatabase 307database backup for Fix Pack 7.2.0.2 244database backup for Fix Pack 7.2.0.3 261database backup for Fix Pack 7.2.0.4 280database backup for Fix Pack 7.2.0.5 and later 301dropping reporting schema for Fix Pack 7.2.0.2 247dropping reporting schema for Fix Pack 7.2.0.3 264dropping reporting schema for Fix Pack 7.2.0.4 283dropping reporting schema for Fix Pack 7.2.0.5 and later304re-creating reporting schema for Fix Pack 7.2.0.2 255re-creating reporting schema for Fix Pack 7.2.0.3 274re-creating reporting schema for Fix Pack 7.2.0.4 294re-creating reporting schema for Fix Pack 7.2.0.5 andlater 317

default definition valuesverifying 42, 44, 70

directoriescreating for application server installations 26

documentationrelated information xiii

Dojo toolkitbacking up for Fix Pack 7.2.0.2 245restoring for Fix Pack 7.2.0.2 253restoring for Fix Pack 7.2.0.3 270restoring for Fix Pack 7.2.0.4 290restoring for Fix Pack 7.2.0.5 and later 310

Dojo toolkitsbacking up for Fix Pack 7.2.0.3 262backing up for Fix Pack 7.2.0.4 281

392

Dojo toolkits (continued)backing up for Fix Pack 7.2.0.5 and later 301

domainsupdating 124

Eenvironment variables

reporting server on AIX or Linux operating systems 91reporting server on Windows operating system 90setting 76

error messagesOP-03620 376

exportOpenPages data 102

exportinglog files 363

Ffile descriptor limits

setting on AIX operating systems 26, 31setting on Linux operating systems 27, 31

file path too longextraction errors 377

Fix Centralgetting fixes 362

Fix Pack 7.2.0.2additional tasks 256backing up solutions helpers and Dojo toolkit 245backups 245, 262backups for existing environments 244fixing Attestation Creation Report 255installation log files 253installation process overview 243installation tasks 247loading application and object strings using loader file254, 273loading out-of-box solutions reports 254loading XML file for RCM solution 253OpenPages backup and CommandCenter backuputilities 244postinstallation tasks 253preinstallation tasks 244preparing for installation 247re-creating global search index 256re-creating reporting schema 255restoring solutions helpers and Dojo toolkit 253running installation 251silent installation 256uninstalling 257updating OpenPages Administrative Console 248

Fix Pack 7.2.0.3additional tasks 275backing up solutions helpers and Dojo toolkit 262backups for existing environments 261fixing Attestation Creation Report 271installation log files 270installation process overview 260installation tasks 264loading out-of-box solutions reports 271loading XML file for RCM solution 272

Fix Pack 7.2.0.3 (continued)OpenPages backup and CommandCenter backuputilities 261postinstallation tasks 270preinstallation tasks 261preparing for installation 264re-creating global search index 274re-creating reporting schema 274restoring solutions helpers and Dojo toolkit 270running installation 268silent installation 275uninstalling 276updating OpenPages Administrative Console 265

Fix Pack 7.2.0.4additional tasks 295backing up helpers and Dojo toolkits 281backups 281backups for existing environments 280fixing Attestation Creation Report 291installation log files 289installation process overview 279installation tasks 283loading application and object strings using loader file293loading out-of-box solutions reports 291loading XML file for RCM solution 292OpenPages backup and CommandCenter backuputilities 280postinstallation tasks 290preinstallation tasks 280preparing for installation 283re-creating global search index 295re-creating reporting schema 294restoring solutions helpers and Dojo toolkit 290running installation 288silent installation 296uninstalling 296updating OpenPages Administrative Console 285

Fix Pack 7.2.0.5fixing Attestation Creation Report 311installation log files 310loading application and object strings using loader file314postinstallation tasks 310

Fix Pack 7.2.0.5 and lateradditional tasks 318backing up helpers and Dojo toolkits 301backups 302backups for existing environments 300installation process overview 299installation tasks 304loading out-of-box solutions reports 311loading XML file for RCM solution 312OpenPages backup and CommandCenter backuputilities 301preinstallation tasks 300preparing for installation 304re-creating global search index 317re-creating reporting schema 317restoring solutions helpers and Dojo toolkit 310running installation 308silent installation 318uninstalling 319updating OpenPages Administrative Console 305

393

Fix Pack 7.2.0.6 and laterloading application and object strings using loader file315

Framework Model Generatorstarting and stopping on Windows 214

Framework Model Generator servicestarting and stopping on AIX 214starting and stopping on Linux 214

Fujitsu Interstage BPMworkflow server 8

Gglobal search index


groupscreating for Linux installations 63

Hhorizontal cluster 11horizontal scaling 217host names

updating 124

IIBM Cognos BI

upgrading 109IBM Cognos service

starting and stopping 213starting and stopping on AIX 214starting and stopping on Linux 214starting and stopping on Windows 213

IBM Customer Centertroubleshooting resources 362

IBM HTTP Serverconfiguring 85

IBM Installation Manager, See IIMIIM

launching to update the OpenPages AdministrativeConsole for fix page 7.2.0.2 248launching to update the OpenPages AdministrativeConsole for fix page 7.2.0.3 265launching to update the OpenPages AdministrativeConsole for fix page 7.2.0.4 285launching to update the OpenPages AdministrativeConsole for fix page 7.2.0.5 and later 305

IIS web serverconfiguring 84

imagesupgrading 126

importingreports and packages 382

installationdefault ports 29setting environment variables for Oracle databasesoftware 76

installation pathsrestrictions 23

installation taskslaunching Administrative Console deployment tool forFix Pack 7.2.0.2 251launching Administrative Console deployment tool forFix Pack 7.2.0.3 268launching Administrative Console deployment tool forFix Pack 7.2.0.4 288launching Administrative Console deployment tool forFix Pack 7.2.0.5 and later 308overview for Fix Pack 7.2.0.2 247overview for Fix Pack 7.2.0.3 264overview for Fix Pack 7.2.0.4 283overview for Fix Pack 7.2.0.5 and later 304preparing for Fix Pack 7.2.0.2 247preparing for Fix Pack 7.2.0.3 264preparing for Fix Pack 7.2.0.4 283preparing for Fix Pack 7.2.0.5 and later 304process overview for Fix Pack 7.2.0.2 243process overview for Fix Pack 7.2.0.3 260process overview for Fix Pack 7.2.0.4 279process overview for Fix Pack 7.2.0.5 and later 299running OpenPages fix pack installation for Fix Pack7.2.0.2 251running OpenPages fix pack installation for Fix Pack7.2.0.3 268running OpenPages fix pack installation for Fix Pack7.2.0.4 288running OpenPages fix pack installation for Fix Pack7.2.0.5 and later 308updating OpenPages Administrative Console for Fix Pack7.2.0.2 248updating OpenPages Administrative Console for Fix Pack7.2.0.3 265updating OpenPages Administrative Console for Fix Pack7.2.0.4 285updating OpenPages Administrative Console for Fix Pack7.2.0.5 and later 305using scripts to update database server for Fix Pack7.2.0.2 249using scripts to update database server for Fix Pack7.2.0.3 266using scripts to update database server for Fix Pack7.2.0.4 285using scripts to update database server for Fix Pack7.2.0.5 and later 306

installing64-bit Oracle database client 74troubleshooting 368

installing application serversproperty settings for application servers that use DB2databases 165

installing solutionsapplication servers 171

JJSON file

configuring for approval app 340customizing for approval app 346

Kknowledge bases

394

knowledge bases (continued)masthead search 362

LLDAP

disable 185legacy reporting framework

enabling 125Lifecycles on Incidents

loading XML trigger file for 271, 291, 312Linux

scripts 203Linux installations

creating database server users 63listener

installing 66load balancing

configurations 11raising the Oracle connection limit 217

load-balancingabout 229reporting server configuration 229

loader fileloading application and object strings for Fix Pack7.2.0.2 with 254, 273loading application and object strings for Fix Pack7.2.0.4 with 293loading application and object strings for Fix Pack7.2.0.5 314loading application and object strings for Fix Pack7.2.0.6 and later 315

location for solutions installation 171log files

directory location 363installation for Fix Pack 7.2.0.2 253installation for Fix Pack 7.2.0.3 270installation for Fix Pack 7.2.0.4 289installation for Fix Pack 7.2.0.5 310silent installations 363troubleshooting 363

MMicrosoft Internet Information Services, See IISmigrating

overview 135multiple users 180

Nnet service name

instanceadding 68

new features in version 7.2.0 1, 2new features in version 7.3.0 1

OObject Manage

disabling object force update 115opadminconsole, See Administrative ConsoleOPAdminConsole, See Administrative Console

OPAdminWLS 208–210OpenPages Administrative Console, See AdministrativeConsoleOpenPages database

Oracle compatibility mode 37Oracle

applying Fix Pack 7.2.0.2 for OpenPages database 250applying Fix Pack 7.2.0.3 for OpenPages database 267applying Fix Pack 7.2.0.4 for OpenPages database 285applying Fix Pack 7.2.0.5 and later for OpenPagesdatabase 306database backup for Fix Pack 7.2.0.2 244database backup for Fix Pack 7.2.0.3 261database backup for Fix Pack 7.2.0.4 280database backup for Fix Pack 7.2.0.5 and later 301

Oracle Admin Clientinstalling on OpenPages application servers 74

Oracle client pathupdating on report server 380

Oracle compatibility modeOpenPages database 37

Oracle database instancestarting 73

Oracle database serverinstalling 63

Oracle standard objects 64ORACLE_HOME

setting 76out-of-box solutions reports

loading for Fix Pack 7.2.0.2 254loading for Fix Pack 7.2.0.3 271loading for Fix Pack 7.2.0.4 291loading for Fix Pack 7.2.0.5 and later 311

Ppackages

importing 382paging file size

increasing on application server 181increasing on reporting server 181

PATH variableadding ORACLE_HOME 76modifying for installations that use Oracle 76

permissionsusers and groups for Oracle database on applicationservers 21

platformarchitecture 7

portsdefault 29fixed 29

post-installationCommandCenter tasks 173

post-installation tasksapplication server 179

postinstallation tasksoverview for Fix Pack 7.2.0.2 253overview for Fix Pack 7.2.0.3 270overview for Fix Pack 7.2.0.4 290overview for Fix Pack 7.2.0.5 310re-creating reporting schema for Fix Pack 7.2.0.2 255re-creating reporting schema for Fix Pack 7.2.0.3 274re-creating reporting schema for Fix Pack 7.2.0.4 294

395

postinstallation tasks (continued)re-creating reporting schema for Fix Pack 7.2.0.5 andlater 317restoring Dojo toolkit for Fix Pack 7.2.0.2 253restoring Dojo toolkit for Fix Pack 7.2.0.3 270restoring Dojo toolkit for Fix Pack 7.2.0.4 290restoring Dojo toolkit for Fix Pack 7.2.0.5 and later 310restoring solutions helpers for Fix Pack 7.2.0.2 253restoring solutions helpers for Fix Pack 7.2.0.3 270restoring solutions helpers for Fix Pack 7.2.0.4 290restoring solutions helpers for Fix Pack 7.2.0.5 and later310

preinstallation tasksbackups for Fix Pack 7.2.0.2 244backups for Fix Pack 7.2.0.3 261backups for Fix Pack 7.2.0.4 280backups for Fix Pack 7.2.0.5 and later 300overview for Fix Pack 7.2.0.2 244overview for Fix Pack 7.2.0.3 261overview for Fix Pack 7.2.0.4 280overview for Fix Pack 7.2.0.5 and later 300

prerequisite softwareapplication servers 14database server 63

prerequisitesclient systems 13preparing the system 170software 13system setup 98

Problem Management Recordsservice requests, See Problem Management Records

profileWebSphere Application Server 24, 111

RRCM solution

loading XML file for Fix Pack 7.2.0.2 253loading XML file for Fix Pack 7.2.0.3 272loading XML file for Fix Pack 7.2.0.4 292loading XML file for Fix Pack 7.2.0.5 and later 312

Regulatory Compliance Management, See RCM solutionreporting framework

updating after solutions installation 171Reporting Framework

CAMCryptoBC error 383reporting schema

creating 174dropping 382dropping for Fix Pack 7.2.0.2 247dropping for Fix Pack 7.2.0.3 264dropping for Fix Pack 7.2.0.4 283dropping for Fix Pack 7.2.0.5 and later 304re-creating for Fix Pack 7.2.0.2 255re-creating for Fix Pack 7.2.0.3 274re-creating for Fix Pack 7.2.0.4 294re-creating for Fix Pack 7.2.0.5 and later 317updating after solutions installation 171

reporting serverconfiguring single signon 240default port 29environment variables on AIX or Linux operatingsystems 91environment variables on Windows operating system 90

reporting server (continued)load balancing 217load balancing and 229paging file size and 181prerequisites 13prerequisites tasks 90server topology 8software requirements 15

reportsgenerating the framework 174importing 382updating after migration 163updating the reporting framework 125

REST APIsecurity 370

restoringchanges to the application.xml file 131web.xml file 131

Sscaling the application 217schema

reporting 247, 255, 264, 274, 283, 294, 304, 317scripts

AIX and Linux 203using to update database server for Fix Pack 7.2.0.2 249using to update database server for Fix Pack 7.2.0.3 266using to update database server for Fix Pack 7.2.0.4 285using to update database server for Fix Pack 7.2.0.5 andlater 306

search indexFix Pack 7.2.0.2 256Fix Pack 7.2.0.3 274Fix Pack 7.2.0.4 295Fix Pack 7.2.0.5 and later 317

securityREST API 370securing access to the OpenPages CommandCenter 175

server topologyapplication server 8database server 8reporting server 8workflow server 8

serverstopology 9

service name, adding 68service requests

opening Problem Management Records (PMR) 362services

Cognos 213starting after upgrade 124starting and stopping Framework Model Generatorservice 214starting and stopping IBM Cognos service 213, 214verifying running 109

session directorylog files location 363

session timeout settingsconfiguration changes 114restoring configuration changes 131

sharing network storage 219silent installation

Fix Pack 7.2.0.2 256

396

silent installation (continued)Fix Pack 7.2.0.3 275Fix Pack 7.2.0.4 296Fix Pack 7.2.0.5 and later 318

silent installationslog files 363overview 359reusing property settings for similar deployments 365

single serverconfiguring for DB2 177configuring for Oracle databases 176

single signonconfiguring for logging out 239configuring OpenPages interface 235disabling 114, 240

softwareprerequisites 170requirements 13

software requirementsreporting server 15

solutions dataloading 126loading customized 128loading non-customized 126

solutions helpersbacking up for Fix Pack 7.2.0.2 245backing up for Fix Pack 7.2.0.3 262backing up for Fix Pack 7.2.0.4 281backing up for Fix Pack 7.2.0.5 and later 301restoring for Fix Pack 7.2.0.2 253restoring for Fix Pack 7.2.0.3 270restoring for Fix Pack 7.2.0.4 290restoring for Fix Pack 7.2.0.5 and later 310

SSO, See single sign-onstarting an OpenPages application 201starting and stopping

Framework Model Generator service 214IBM Cognos service 213, 214

starting OpenPagesautomatically 204

starting servicesafter upgrade 124

stopping OpenPages automatically 208stopping OpenPages manually 209Super Administrator 20Support Portal

overview 362system administration mode

disabling 115system setup

upgrade prerequisites 98

Ttablespaces

upgrading manually 104, 136, 140, 148, 150, 156, 158upgrading manually with DB2 107, 152, 160

tablespaces and userscreating 42, 70creating in DB2 databases 44creating manually 44

temporary foldersconfiguring for reports and notifications 172

testing

testing (continued)solutions installation 171

third-party softwarerequirements 13

topologyservers 9

troubleshootingAdministrative Console extraction errors 377Error 0x80010135 extracting files 377getting fixes 362IBM Customer Center 362installation issues and solutions 368reporting schema not instantiated error 376resources 361solutions installation problems 382Support Portal 362understanding symptoms of a problem 361using log files 363video documentation resources 361

Uuninstallation


uninstallingapplication 323, 325CommandCenter 323, 325

update-storage script 219upgrading

application servers 115, 142deployed images 126IBM Cognos BI 109overview 97preparing the system 111testing the installation 124verifying the installation 126

userscreating for Linux installations 63upgrading database schema 104, 136, 140, 148, 150,156, 158upgrading database schema with DB2 107, 152, 160

users and groupspermissions for Oracle database on application servers21

Vvertical cluster 11vertical scaling 217video documentation

YouTube 362virtualization

supported configurations 18

Wweb server

configuration options 83WebSphere Application Server

installation requirements 23

397

Windowscommands 202

workflow serverserver topology 8

XXML trigger file

for lifecycles on Incidents 271, 291, 312

398

IBM®

Date post:	22-Jul-2020
Category:	Documents
Upload:	others
View:	8 times
Download:	0 times

Installation and Deployment Guidepublic.dhe.ibm.com/software/data/cognos/... · IBM OpenPages GRC...

Documents