Modern Linux server environments running container orchestrators (Kubernetes, OpenShift, Docker, Podman) dynamically generate and tear down ephemeral virtual filesystems (e.g., overlay2, fuse-overlayfs, tmpfs) under predictable runtime directories.
Current BA Client auto-discovery (DOMAIN ALL-LOCAL) treats every active container mount point as an independent, top-level Filespace on the IBM Storage Protect Server.
This causes severe operational bottlenecks:
DB2 Database Overhead & Bloat: A Filespace is a top-level object in the DB2 schema (NODES -> FILESPACES -> DIRECTORIES -> FILES). Generating 50–100 new transient filespaces daily results in thousands of obsolete database rows every month, leading to index fragmentation, slow expiration processing, and heavy DB2 memory/CPU consumption.
Replication Bottlenecks: Every dynamic filespace created on the primary server is added to the server replication queue, consuming network bandwidth and database resources on secondary/DR servers.
Inadequacy of EXCLUDE.DIR: While EXCLUDE.DIR prevents file-level traversal, it evaluates paths after the mount point has already been registered as a Filespace object on the TSM server.
Manual Operational Burden: Backup administrators must continuously write and maintain custom DELETE FILESPACE scripts to clean up orphaned database entries across hundreds of container nodes.
Providing native domain-level path exclusion eliminates database bloat at the source, significantly lowering the total cost of ownership (TCO) for enterprise IBM Storage Protect deployments.
2. Who would benefit from it?
Backup & Storage Administrators: Eliminates time spent manually cleaning up thousands of dead filespaces, managing DB2 database growth, and troubleshooting failed replication jobs caused by metadata congestion.
Database & TSM Server System Engineers: Prevents severe performance degradation of the DB2 database engine, keeping expiration, inventory processing, and daily administrative maintenance within expected time windows.
DevOps & Infrastructure Teams: Allows teams to deploy and scale containerized applications (Kubernetes/Podman) freely without triggering backup alerts or degrading backup server performance.
Enterprise Customers: Reduces network, storage, and database compute requirements across multi-site replicated environments.
3. How should it work?
Functional Specification
The IBM Storage Protect BA Client should be enhanced to evaluate filesystem paths during the initial domain discovery phase before sending filespace definitions to the server.
Option A: Wildcard/Path Pattern Support in DOMAIN (Client Configuration)
Extend the existing DOMAIN option in dsm.sys to support sub-path pattern exclusions using standard syntax (e.g., minus - operator with wildcard paths):
* Exclude all dynamically mounted filesystems beneath specified container runtime paths
DOMAIN ALL-LOCAL -/var/lib/docker/overlay2/* -/var/lib/containers/* -/var/lib/kubelet/pods/*
Behavior: When the BA Client scans /proc/mounts or system mount points during a DOMAIN ALL-LOCAL backup, any mount point whose mount path matches an excluded domain pattern is completely skipped. No FILESPACE record is created or updated on the Storage Protect Server.
Granularity: Standard files on host filesystems (e.g., /var/log or non-container data under /var) remain fully protected under the primary domain rule (/var).
Option B: Dedicated EXCLUDE.DOMAIN / DOMAIN.EXCLUDE Command
Introduce a dedicated directive in dsm.opt / dsm.sys designed specifically for mount-level filtering:
EXCLUDE.DOMAIN /var/lib/docker/overlay2/*
EXCLUDE.DOMAIN /var/lib/containers/storage/*
Execution Order:
Step 1 (Domain Filtering): BA Client scans system mounts and filters out paths matching EXCLUDE.DOMAIN.
Step 2 (Filespace Registration): Remaining valid filesystems are registered with the server.
Step 3 (Directory Traversal): Standard EXCLUDE.DIR and EXCLUDE rules are applied to the remaining data.
Option C: Default Container Filesystem Auto-Suppression via SKIPFILESYS
Enhance the client's SKIPFILESYS directive on Linux to automatically detect and ignore virtual container overlay filesystems (overlay, overlay2, fuse-overlayfs, shm) by default unless explicitly overriden in dsm.sys.
