KB318755: How to configure work fences in MicroStrategy Secure Enterprise

Starting with Strategy Secure Enterprise 10.4, using work fences, administrators can reserve specific nodes for use by certain users or certain workloads during normal operations. Refer to the following Strategy Knowledge Base document for additional information
KB318757: New feature in Strategy 10.x Secure Enterprise Platform: Work fences
 
Using Strategy Command Manager, users can create, modify, list, and delete fences without restarting the clustered Strategy Intelligence Servers.
 

Prerequisites:

• Properly configured Strategy Intelligence Server cluster and all nodes in the cluster using the same server definition.
• User configuring fences can login to Strategy Command Manager as a user that has the "Configure server basic" privilege, which is a default privilege for the Server Resource Settings Administrators group.

 

How to configure fences:

 
Create Fence Statement
Create a User Fence or Workload Fence.

CREATE ( (USERFENCE name (USERS user_name1[, ..user_nameN] | USERGROUPS group_name1[,.. group_name2])) 
| (WORKLOADFENCE name) )(NODES instance_name1[,..instance_name2]) 
[PROJECTS project_name1[,..project_name2] [PRECEDENCE positive_integer];

 
where:
• name is the name of the fence
• user_name1..N is a comma separated list of user names to include in the fence.
• group_name1..N is a comma separated list of user groups to include in the fence.
• instance_name1..N is a comma separated list of nodes to include in the fence.
• project_name1..N is a comma separated list of projects to include in the fence.
• positive_integer is the order of precedence for the fence when multiple fences exist.
 
The highest PRECEDENCE value is 1. This will be the first fence in the fence list. An invalid or out-of-index value will add the specified fence to the end of the fence list. When PRECEDENCE is not specified in the command, the fence will be added to the end of the list.
When PROJECT is not specified in the command, the fence will apply to all the projects.
A User Fence must specify USERS or USERGROUP, while a Workload Fence does not.
 

Examples

CREATE USERFENCE "fence1" USERS "ADMINISTRATOR" NODES "node1", "node2" PROJECTS "Strategy Tutorial" PRECEDENCE 1;

CREATE USERFENCE "fence2" USERGROUPS "Web USERS", "Customers" NODES "node3", "node4" PRECEDENCE 2;

CREATE WORKLOADFENCE "fence3" NODES "node5" PROJECTS "Strategy Tutorial" PRECEDENCE 3;

  
Alter Fence Statement
Modify an existing User Fence or Workload Fence.

ALTER ( (USERFENCE name [USERS user_name1[,..user_name2] | 
USERGROUPS group_name1[,..group_name2]] ) | (WORKLOADFENCE name) ) 
[NODES instance_name1[,..instance_name2]] [PROJECTS project_name1[,..project_name2]] [PRECEDENCE positive_integer];

 
where:
• name is the name of the fence you want to modify.
• user_name1..N is a comma separated list of user names to include in the fence.
• group_name1..N is a comma separated list of user groups to include in the fence.
• instance_name1..N is a comma separated list of nodes to include in the fence.
• project_name1..N is a comma separated list of projects to include in the fence.
• positive_integer is the order of precedence for the fence when multiple fences exist.
 
The highest PRECEDENCE value is 1. This will be the first fence in the fence list. An invalid or out-of-index value will add the specified fence to the end of the fence list. When PRECEDENCE is not specified in the command, the fence will be added to the end of the list.
When PROJECT is not specified in the command, the fence will apply to all the projects.
A User Fence must specify USERS or USERGROUP, while a Workload Fence does not.
 

Examples

ALTER USERFENCE "fence1" USERS "ADMINISTRATOR" NODES "node1", "node2" PROJECTS "Strategy Tutorial" PRECEDENCE 1;

ALTER USERFENCE "fence2" USERGROUPS "Web USERS", "Customers" NODES "node3", "node4" PRECEDENCE 2;

ALTER WORKLOADFENCE "fence3" NODES "node5" PROJECTS "Strategy Tutorial" PRECEDENCE 3;

 
List Fences Statements
List all fences or all properties of a specific fence.
 

LIST [ALL] PROPERTIES FOR FENCE name;

LIST [ALL] FENCES;

 
Where, name is the name of the fence.
 

Examples

LIST ALL PROPERTIES FOR FENCE "fence2";

LIST ALL FENCES;

 
Explanation of the result:
 

LIST [ALL] PROPERTIES FOR FENCE name;

• NAME: The name of the fence, returned as a string.
• TYPE: The type of the fence, returned as a string.
• USER_RESULTSET: A ResultSet containing a list of users or user groups inside the fence and related details.
     ▫ NAME: The name of the user / user group, returned as a string.
     ▫ IS_GROUP: Specifies if the NAME is a user group, returned as a Boolean value.
• FENCE_NODE_RESULTSET: A ResultSet containing a list of nodes included in the fence.
     ▫ NAME: The name of the node, returned as a String.
• PROJECTS: A ResultSet containing a list of projects included in the fence.
     ▫ NAME: The name of the project, returned as a String.
• FENCE_PRECEDENCE: The order of the fence in the fence list, returned as a integer.
LIST [ALL] FENCES;
• NAME: The name of the fence, returned as a string.
• TYPE: The type of the fence, returned as a string.
 
Delete Fence Statement
 

DELETE FENCE name;

Where,  name is the name of the fence you want to delete.
 

Example

DELETE FENCE "fence2";

 
 
NOTE:
Script outlines are provided in Strategy Command Manager to assist with configuring fences in the Fence_Outlines folder.
For more information about these commands, see Fence Management in Command Manager Help.