Allowing Data Access

The Snapshot Agent needs to be able to access the directories containing your ISAM data files, and as it runs under the context of a restricted service account, it almost certainly will not be able to do so. The best way to provide access is using file system access control lists to explicitly provide the necessary read-only access.

For example, if your application's data files are in the directory /app/data and the Snapshot Agent has been configured to run in the service account my-service you will need to provide execute access at the parent directory level:

sudo setfacl -m u:my-service:--x /app

And both read and execute permissions to the directory containing the data files:

sudo setfacl -R -m u:my-service:rX /app/data

In the workshop environment the system-of-record data files are located in the directory /home/admin/data and the services that will need to access the data will be running in a service account sip-service.

Execute these commands to set the necessary permissions

Provide execute access to the parent directory:

sudo setfacl -m u:sip-service:--x /home/admin

And Provide read and execute access to the data directory

sudo setfacl -R -m u:sip-service:rX /home/admin/data