Managing Operations › Automatic Failover and the BES Subsystem › How Automatic Failover Works

How Automatic Failover Works

CA Tape Encryption failover processing is summarized as follows:

• CA Tape Encryption provides system intercepts to monitor tape activity during open, close and end-of-volume processing.

  During tape file open for output processing these routines examine the DFSMS data classes assigned. When encryption is requested, they trigger the encryption routines. Similarly, during read processing these routines identify whether a tape is encrypted. If so, they invoke the decryption routines.

  Note: These tape intercepts are independent of any single CA Tape Encryption task.

• During output processing the CA Tape Encryption system intercepts attempt to find the most appropriate task for processing the encryption request found in the data class assigned.

  If the data class description includes a specific task identifier, using the BESn= format, communication with that specific task is attempted.

  If the specified task is not up, the automatic failover logic searches for a task with compatible parameters that can service this encryption request. All BES tasks configured as failover tasks are examined in the numbered order of the task. The first BES task that matches all of the required attributes is selected.

  Note: For a list of parmlib attributes that must match for failover, see Parmlib Settings for Failover Tasks.

• If an encryption request is not directed to a specific task, the system intercepts query the CA Tape Encryption tasks in order, for example, BES1 followed by BES2 and so on, until they find an active task that includes the requested key in its database.

  If the requested key is not found in any BES database the encryption request fails.

• CA Tape Encryption system intercepts attempt to find the most appropriate task during read processing.

  The user header information on the encrypted tape includes information about the key used, the task that created it and more.

  The creating task is checked first. If it is available, this task is selected to process the decryption. If the creating task is not available, additional checks are made to see if an available task is configured for failover processing and if the task is running with the same CA Tape Encryption database and that the attributes are compatible.

  Note: For information, see Parmlib Settings for Failover Tasks.

• CA Tape Encryption is designed to recover from as many internal errors as possible to prevent the BES task from terminating abnormally.

  If an error is encountered that prevents the primary BES task from processing the encryption or decryption request, the failover tasks will take over and process the request.

• Typically, the primary BES task services all requests for encryption or decryption for keys defined in its database. Failover tasks do not perform any work unless the primary task terminates.