content_image/972082.jpg
By default, IBM Spectrum Virtualize and Storwize has the SPECTRUM_VIRT  pre-defined in the encryption configuration wizard, and SPECTRUM_VIRT  contains all of the keys for the managed IBM FlashSystem 9100 systems. However, It is possible to use different device groups as long as they are GPFS device family based. For example, one device group for each environment (Production or DR). Each device group maintains its own key database, and this approach allows more granular key management. 

## Clone servers configuration management 

The minimum replication interval on IBM Security Key Lifecycle Manager is one hour, as shown in Figure 4-9 on page 91. It is more practical to perform backup and restore or manual replication for the initial configuration to speed up the configuration synchronization. 

Also, the rekey process creates a new configuration on the IBM Security Key Lifecycle Manager server, and it is important not to wait for the next replication window but to manually synchronize the configuration to the additional key servers (clones), otherwise, an error message will be generated by the IBM FlashSystem 9100 system indicating the key is missing on the clones. 

Figure 4-9 shows the replication interval. 

<img src='content_image/972082.jpg'>

Example 4-6 shows an example of manually triggered replication. 

/opt/IBM/WebSphere/AppServer/bin/wsadmin.sh -username SKLMAdmin -password <password> -lang jython -c "print AdminTask.tklmReplicationNow()" 

