Kisco Systems

IBM i Security Tips

Home : Blog : Are Your Backups Complete?

Are Your Backups Complete?

By Rich Loeber

No security plan is complete without addressing the issue of safe and complete backups. When the AS/400 was first announced, the process was fairly simple and straight forward. All you needed to do was save all the libraries on your system, save OS/400 in a way it could be reloaded and then make arrangements to backup your security and configuration settings.

As the AS/400 has morphed into the IBM i, things have gotten more complex. Additional items needed to be saved and new command structures needed to be learned. With today's systems, it is not as simple as the original plan, but the tools are all there. If you haven't reviewed your backup plan recently, it would be a good idea to dust it off to make sure that everything you need is being saved on your system.

A backup plan generally has two objectives. First, to be able to recover the entire machine in the event of a catastrophic loss of your processor. This recovery can be either on your own machine, following repair, or at an off-site location. The second objective is to be able to recover an individual object in the event of accidental or purposeful object loss. Your backup plan needs to support both of these objectives.

To get a complete backup of your system today, your backup plan has to provide for the following components of your system:

1. The IBM i operating system
2. Your machine configuration
3. Your systems security settings
4. All native IBM i libraries
5. All shared folder files
6. All files in your Integrated File System (IFS)

The more recent additions to this list are these last two and this is where I want to concentrate efforts for this article. If you've been around the IBM i for a while, you're probably already quite familiar with items 1 through 4. If not, feel free to shoot me an Email and I can help you out off-line.

It could be argued that numbers 5 and 6 on this list are both part of the IFS, but the IBM i provides some commands specifically designed for the shared folder system, so you can consider it separately if you want to.

You can save just the Shared Folder files (also known as the QDLS file system in the IFS) using the IBM i command SAVDLO. To save all files in the Shared Folder system, you can use the following command:


Note, this command will produce an audit report of what was saved which you can print and keep with the backup or just hold in an output queue. This report tends to be quite lengthy on most systems. When you run this command, all document library objects on your system will be saved along with all folders and files in the entire Shared Folder system. The SAVACT(*YES) parameter helps to make sure that the backup is complete by saving objects that may be in use. If you run your backup in a restricted state, this parameter will not be necessary.

To save the files in your Integrated File System, you will need to use the IBM i SAV command. This command can actually be used to save your entire system, but its use for native IBM i objects can be confusing so most shops limit its use to the IFS objects. To save all files in your IFS, use the following command:

OBJ(('/*') ('/QSYS.LIB' *OMIT) ('/QDLS' *OMIT))

Note that the output device naming method is quite different from standard IBM i command formats. Also, if you are using the plan outlined above, you want to make sure that you don't save objects again that have already been saved at points 1, 4 and 5. The OBJ parameter controls this function. In this SAV command, the OBJ parm contains three elements. The first element specifies that everything is to be saved. The next two sub parameters modify this by specifying that the QSYS file system and the QDLS file system be omitted from the backup. By leaving these out, you will end up saving just the IFS objects you need.

If some of this appears strange to you, then it means you need to dust off your backup plan and bring it up to date. Today would probably be a good day to do that.

If you have any questions about this topic, you can reach me at rich at I'll give it my best shot. All email messages will be answered.