OLCF Policy Guides

OLCF Acknowledgement

Users should acknowledge the OLCF in all publications and presentations that speak to work performed on OLCF resources:

This research used resources of the Oak Ridge Leadership Computing Facility at the Oak Ridge National Laboratory, which is supported by the Office of Science of the U.S. Department of Energy under Contract No. DE-AC05-00OR22725.

Computing Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to and use of OLCF computational resources:

  • Principal Investigators (Non-Profit)
  • Principal Investigators (Industry)
  • All Users

Title: Computing Policy Version: 12.10

Computer Use

Computers, software, and communications systems provided by the OLCF are to be used for work associated with and within the scope of the approved project. The use of OLCF resources for personal or non-work-related activities is prohibited. All computers, networks, E-mail, and storage systems are property of the United States Government. Any misuse or unauthorized access is prohibited, and is subject to criminal and civil penalties. OLCF systems are provided to our users without any warranty. OLCF will not be held liable in the event of any system failure or data loss or corruption for any reason including, but not limited to: negligence, malicious action, accidental loss, software errors, hardware failures, network losses, or inadequate configuration of any computing resource or ancillary system.

Data Use

Prohibited Data

The OLCF computer systems are operated as research systems and only contain data related to scientific research and do not contain personally identifiable information (data that falls under the Privacy Act of 1974 5U.S.C. 552a). Use of OLCF resources to store, manipulate, or remotely access any national security information is strictly prohibited. This includes, but is not limited to: classified information, unclassified controlled nuclear information (UCNI), naval nuclear propulsion information (NNPI), the design or development of nuclear, biological, or chemical weapons or any weapons of mass destruction. Authors/generators/owners of information are responsible for its correct categorization as sensitive or non-sensitive. Owners of sensitive information are responsible for its secure handling, transmission, processing, storage, and disposal on OLCF systems. Principal investigators, users, or project delegates that use OLCF resources, or are responsible for overseeing projects that use OLCF resources, are strictly responsible for knowing whether their project generates any of these prohibited data types or information that falls under Export Control. For questions, contact help@nccs.gov.

Confidentiality, Integrity, and Availability

The OLCF systems provide protections to maintain the confidentiality, integrity, and availability of user data. Measures include the availability of file permissions, archival systems with access control lists, and parity and CRC checks on data paths and files. It is the user’s responsibility to set access controls appropriately for the data. In the event of system failure or malicious actions, the OLCF makes no guarantee against loss of data or that a user’s data can be accessed, changed, or deleted by another individual. It is the user’s responsibility to insure the appropriate level of backup and integrity checks on critical data and programs.

Data Modification/Destruction

Users are prohibited from taking unauthorized actions to intentionally modify or delete information or programs.

Data Retention

The OLCF reserves the right to remove any data at any time and/or transfer data to other users working on the same or similar project once a user account is deleted or a person no longer has a business association with the OLCF. After a sensitive project has ended or has been terminated, all data related to the project must be purged from all OLCF computing resources within 30 days.

Software Use

All software used on OLCF computers must be appropriately acquired and used according to the appropriate software license agreement. Possession, use, or transmission of illegally obtained software is prohibited. Likewise, users shall not copy, store, or transfer copyrighted software, except as permitted by the owner of the copyright. Only export-controlled codes approved by the Export Control Office may be run by parties with sensitive data agreements.

Malicious Software

Users must not intentionally introduce or use malicious software such as computer viruses, Trojan horses, or worms.

Reconstruction of Information or Software

Users are not allowed to reconstruct information or software for which they are not authorized. This includes but is not limited to any reverse engineering of copyrighted software or firmware present on OLCF computing resources.

User Accountability

Users are accountable for their actions and may be held accountable to applicable administrative or legal sanctions.

Monitoring and Privacy

Users are advised that there is no expectation of privacy of your activities on any system that is owned by, leased or operated by UT-Battelle on behalf of the U.S. Department of Energy (DOE). The Company retains the right to monitor all activities on these systems, to access any computer files or electronic mail messages, and to disclose all or part of information gained to authorized individuals or investigative agencies, all without prior notice to, or consent from, any user, sender, or addressee. This access to information or a system by an authorized individual or investigative agency is in effect during the period of your access to information on a DOE computer and for a period of three years thereafter. OLCF personnel and users are required to address, safeguard against, and report misuse, abuse and criminal activities. Misuse of OLCF resources can lead to temporary or permanent disabling of accounts, loss of DOE allocations, and administrative or legal actions. Users who have not accessed a OLCF computing resource in at least 6 months will be disabled. They will need to reapply to regain access to their account. All users must reapply annually.

Authentication and Authorization

All users are required to use a one-time password for authentication. Tokens will be distributed to OLCF users. Users will be required to create a Personal Identification Number (PIN). This is used in conjunction with a generated token code as part of a two-factor authentication implementation. Accounts on the OLCF machines are for the exclusive use of the individual user named in the account application. Users should not share accounts or tokens with anyone. If evidence is found that more than one person is using an account, that account will be disabled immediately. Users are not to attempt to receive unintended messages or access information by some unauthorized means, such as imitating another system, impersonating another user or other person, misuse of legal user credentials (usernames, tokens, etc.), or by causing some system component to function incorrectly. Users are prohibited from changing or circumventing access controls to allow themselves or others to perform actions outside their authorized privileges. Users must notify the OLCF immediately when they become aware that any of the accounts used to access OLCF have been compromised. Users should inform the OLCF promptly of any changes in their contact information (E-mail, phone, affiliation, etc.) Updates should be sent to accounts@ccs.ornl.gov.

Foreign National Access

Applicants who appear on a restricted foreign country listing in section 15 CFR 740.7 License Exceptions for Computers are denied access based on US Foreign Policy. The countries cited are Cuba, Iran, North Korea, Sudan, and Syria. Additionally, no work may be performed on OLCF computers on behalf of foreign nationals from these countries.

Denial of Service

Users may not deliberately interfere with other users accessing system resources.

Data Management Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to or use of OLCF computational resources:

  • Principal Investigators (Non-Profit)
  • Principal Investigators (Industry)
  • All Users

Title: Data Management Policy Version: 14.01

Introduction

The OLCF provides a comprehensive suite of hardware and software resources for the creation, manipulation, and retention of scientific data. This document comprises guidelines for acceptable use of those resources. It is an official policy of the OLCF, and as such, must be agreed to by relevant parties as a condition of access to and use of OLCF computational resources.

Data Storage Resources

The OLCF provides an array of data storage platforms, each designed with a particular purpose in mind. Storage areas are broadly divided into two categories: those intended for user data and those intended for project data. Within each of the two categories, we provide different sub-areas, each with an intended purpose:

Purpose Storage Area Path
Long-term data for routine access that is unrelated to a project User Home $HOME
Long-term data for archival access that is unrelated to a project User Archive /home/$USER
Long-term project data for routine access that’s shared with other project members Project Home /ccs/proj/[projid]
Short-term project data for fast, batch-job access that you don’t want to share Member Work $MEMBERWORK/[projid]
Short-term project data for fast, batch-job access that’s shared with other project members Project Work $PROJWORK/[projid]
Short-term project data for fast, batch-job access that’s shared with those outside your project World Work $WORLDWORK/[projid]
Long-term project data for archival access that’s shared with other project members Project Archive /proj/[projid]

User Home

Home directories for each user are NFS-mounted on all OLCF systems and are intended to store long-term, frequently-accessed user data. User Home areas are backed up on a daily basis. This file system does not generally provide the input/output (I/O) performance required by most compute jobs, and is not available to compute jobs on most systems. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

User Archive

The High Performance Storage System (HPSS) is the tape-archive storage system at the OLCF and is the storage technology that supports the User Archive areas. HPSS is intended for data that do not require day-to-day access. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

Project Home

Project Home directories are NFS-mounted on selected OLCF systems and are intended to store long-term, frequently-accessed data that is needed by all collaborating members of a project. Project Home areas are backed up on a daily basis. This file system does not generally provide the input/output (I/O) performance required by most compute jobs, and is not available to compute jobs on most systems. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

Member Work

Project members get an individual Member Work directory for each associated project; these reside in the center-wide, high-capacity Lustre® file system on large, fast disk areas intended for global (parallel) access to temporary/scratch storage. Member Work directories are provided commonly across all systems. Because of the scratch nature of the file system, it is not backed up and files are automatically purged on a regular basis. Files should not be retained in this file system for long, but rather should be migrated to Project Home or Project Archive space as soon as the files are not actively being used. If a file system associated with your Member Work directory is nearing capacity, the OLCF may contact you to request that you reduce the size of your Member Work directory. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

Project Work

Individual Project Work directories reside in the center-wide, high-capacity Lustre file system on large, fast disk areas intended for global (parallel) access to temporary/scratch storage. Project Work directories are provided commonly across most systems. Because of the scratch nature of the file system, it is not backed up. If a file system associated with Project Work storage is nearing capacity, the OLCF may contact the PI of the project to request that he or she reduce the size of the Project Work directory. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

World Work

Each project has a World Work directory that resides in the center-wide, high-capacity Lustre file system on large, fast disk areas intended for global (parallel) access to temporary/scratch storage. World Work directories are provided commonly across most systems. Because of the scratch nature of the file system, it is not backed up. If a file system associated with World Work storage is nearing capacity, the OLCF may contact the PI of the project to request that he or she reduce the size of the World Work directory. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

Project Archive

The High Performance Storage System (HPSS) is the tape-archive storage system at the OLCF and is the storage technology that supports the User Archive areas. HPSS is intended for data that do not require day-to-day access. Project Archive areas are shared between all users of the project. Users should not store data unrelated to OLCF projects on HPSS. Project members should also periodically review files and remove unneeded ones. See the section “Data Retention, Purge, & Quota Summary” for more details on applicable quotas, backups, purge, and retention timeframes.

Local Scratch Storage

A large, fast disk area intended for parallel access to temporary storage in the form of scratch directories may be provided on a limited number of systems. This area is local to a specific system. This directory is, for example, intended to hold output generated by a user’s job. Because of the scratch nature of the file system, it is not backed up and files are automatically purged on a regular basis. Files should not be retained in this file system and should be migrated to archival storage as soon as the files are not actively being used. Quotas may be instituted on a machine-by-machine basis if deemed necessary.

Data Retention, Purge, & Quotas

Summary

The following table details quota, backup, purge, and retention information for each user-centric and project-centric storage area available at the OLCF.

User-Centric Storage Areas

Area Path Type Permissions Quota Backups Purged Retention
User Home $HOME NFS User-controlled 50 GB Yes No 90 days
User Archive /home/user HPSS User-controlled 2TB [1] No No 90 days

Project-Centric Storage Areas

Area Path Type Permissions Quota Backups Purged Retention
Project Home /ccs/proj/[projid] NFS 770 50 GB Yes No 90 days
Member Work $MEMBERWORK/[projid] Lustre 700 [2] 10TB No 14 days [4]
Project Work $PROJWORK/projid] Lustre 770 100TB No 90 days [4]
World Work $WORLDWORK/[projid] Lustre 775 10TB No 90 days [4]
Project Archive /proj/[projid] HPSS 770 100TB [3] No No 90 days
Area - The general name of storage area.
Path - The path (symlink) to the storage area’s directory.
Type - The underlying software technology supporting the storage area.
Permissions - UNIX Permissions enforced on the storage area’s top-level directory.
Quota - The limits placed on total number of bytes and/or files in the storage area.
Backups - States if the data is automatically duplicated for disaster recovery purposes.
Purged - Period of time, post-file-access, after which a file will be marked as eligible for permanent deletion.
Retention - Period of time, post-account-deactivation or post-project-end, after which data will be marked as eligible for permanent deletion.
Important! Files within “Work” directories (i.e., Member Work, Project Work, World Work) are not backed up and are purged on a regular basis according to the timeframes listed above.

Footnotes

[1]In addition, there is a quota/limit of 2,000 files on this directory.
[2]Permissions on Member Work directories can be controlled to an extent by project members. By default, only the project member has any accesses, but accesses can be granted to other project members by setting group permissions accordingly on the Member Work directory. The parent directory of the Member Work directory prevents accesses by “UNIX-others” and cannot be changed (security measures).
[3]In addition, there is a quota/limit of 100,000 files on this directory.
[4](1, 2, 3) Retention is not applicable as files will follow purge cycle.

Data Retention Overview

By default, there is no lifetime retention for any data on OLCF resources. The OLCF specifies a limited post-deactivation timeframe during which user and project data will be retained. When the retention timeframe expires, the OLCF retains the right to delete data. If you have data retention needs outside of the default policy, please notify the OLCF.

User Data Retention

The user data retention policy exists to reclaim storage space after a user account is deactivated, e.g., after the user’s involvement on all OLCF projects concludes. By default, the OLCF will retain data in user-centric storage areas only for a designated amount of time after the user’s account is deactivated. During this time, a user can request a temporary user account extension for data access. See the section “Data Retention, Purge, & Quota Summary” for details on retention timeframes for each user-centric storage area.

Project Data Retention

The project data retention policy exists to reclaim storage space after a project ends. By default, the OLCF will retain data in project-centric storage areas only for a designated amount of time after the project end date. During this time, a project member can request a temporary user account extension for data access. See the section “Data Retention, Purge, & Quota Summary” for details on purge and retention timeframes for each project-centric storage area.

Sensitive Project Data Retention

For sensitive projects only, all data related to the project must be purged from all OLCF computing resources within 30 days of the project’s end or termination date.

Data Purges

Data purge mechanisms are enabled on some OLCF file system directories in order to maintain sufficient disk space availability for job execution. Files in these scratch areas are automatically purged on a regular purge timeframe. If a file system with an active purge policy is nearing capacity, the OLCF may contact you to request that you reduce the size of a directory within that file system, even if the purge timeframe has not been exceeded. See the section “Data Retention, Purge, & Quota Summary” for details on purge timeframes for each storage area, if applicable.

Storage Space Quotas

Each user-centric and project-centric storage area has an associated quota, which could be a hard (systematically-enforceable) quota or a soft (policy-enforceable) quota. Storage usage will be monitored continually. When a user or project exceeds a soft quota for a storage area, the user or project PI will be contacted and will be asked if at all possible to purge data from the offending area. See the section “Data Retention, Purge, & Quota Summary” for details on quotas for each storage area.

Data Prohibitions & Safeguards

Prohibited Data

The OLCF computer systems are operated as research systems and only contain data related to scientific research and do not contain personally identifiable information (data that falls under the Privacy Act of 1974 5U.S.C. 552a). Use of OLCF resources to store, manipulate, or remotely access any national security information is strictly prohibited. This includes, but is not limited to: classified information, unclassified controlled nuclear information (UCNI), naval nuclear propulsion information (NNPI), the design or development of nuclear, biological, or chemical weapons or any weapons of mass destruction. Authors/generators/owners of information are responsible for its correct categorization as sensitive or non-sensitive. Owners of sensitive information are responsible for its secure handling, transmission, processing, storage, and disposal on OLCF systems. Principal investigators, users, or project delegates that use OLCF resources, or are responsible for overseeing projects that use OLCF resources, are strictly responsible for knowing whether their project generates any of these prohibited data types or information that falls under Export Control. For questions, contact help@olcf.ornl.gov.

Unauthorized Data Modification

Users are prohibited from taking unauthorized actions to intentionally modify or delete information or programs.

Data Confidentiality, Integrity, & Availability

The OLCF systems provide protections to maintain the confidentiality, integrity, and availability of user data. Measures include: the availability of file permissions, archival systems with access control lists, and parity/CRC checks on data paths/files. It is the user’s responsibility to set access controls appropriately for data. In the event of system failure or malicious actions, the OLCF makes no guarantee against loss of data nor makes a guarantee that a user’s data could not be potentially accessed, changed, or deleted by another individual. It is the user’s responsibility to insure the appropriate level of backup and integrity checks on critical data and programs.

Administrator Access to Data

OLCF resources are federal computer systems, and as such, users should have no explicit or implicit expectation of privacy. OLCF employees and authorized vendor personnel with “root” privileges have access to all data on OLCF systems. Such employees can also login to OLCF systems as other users. As a general rule, OLCF employees will not discuss your data with any unauthorized entities nor grant access to data files to any person other than the UNIX “owner” of the data file, except in the following situations:

  • When the owner of the data requests a change of ownership for any reason, e.g., the owner is leaving the project and grants the PI ownership of the data.
  • In situations of suspected abuse/misuse computational resources, criminal activity, or cyber-security violations.

Note that the above applies even to project PIs. In general, the OLCF will not overwrite existing UNIX permissions on data files owned by project members for the purpose of granting access to the project PI. Project PIs should work closely with project members throughout the duration of the project to ensure UNIX permissions are set appropriately.

Software

Software Licensing

All software used on OLCF computers must be appropriately acquired and used according to the appropriate software license agreement. Possession, use, or transmission of illegally obtained software is prohibited. Likewise, users shall not copy, store, or transfer copyrighted software, except as permitted by the owner of the copyright. Only export-controlled codes approved by the Export Control Office may be run by parties with sensitive data agreements.

Malicious Software

Users must not intentionally introduce or use malicious software, including but not limited to, computer viruses, Trojan horses, or computer worms.

Reconstruction of Information or Software

Users are not permitted to reconstruct information or software for which they are not authorized. This includes but is not limited to any reverse engineering of copyrighted software or firmware present on OLCF computing resources.

Security Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to or use of OLCF computational resources:

  • Principal Investigators (Non-Profit)
  • Principal Investigators (Industry)
  • All Users

Title:Security Policy Version: 12.10

The Oak Ridge Leadership Computing Facility (OLCF) computing resources are provided to users for research purposes. All users must agree to abide by all security measures described in this document. Failure to comply with security procedures will result in termination of access to OLCF computing resources and possible legal actions.

Scope

The requirements outlined in this document apply to all individuals who have an OLCF account. It is your responsibility to ensure that all individuals have the proper need-to-know before allowing them access to the information on OLCF computing resources. This document will outline the main security concerns.

Personal Use

OLCF computing resources are for business use only. Installation or use of software for personal use is not allowed. Incidents of abuse will result in account termination. Inappropriate uses include, but are not limited to:

  • Sexually oriented information
  • Downloading, copying, or distributing copyrighted materials without prior permission from the owner
  • Downloading or storing large files or utilizing streaming media for personal use (e.g., music files, graphic files, internet radio, video streams, etc.)
  • Advertising, soliciting, or selling

Accessing OLCF Computational Resources

Access to systems is provided via Secure Shell version 2 (sshv2). You will need to ensure that your ssh client supports keyboard-interactive authentication. The method of setting up this authentication varies from client to client, so you may need to contact your local administrator for assistance. Most new implementations support this authentication type, and many ssh clients are available on the web. Login sessions will be automatically terminated after a period of inactivity. When you apply for an account, you will be mailed an RSA SecurID token. You will also be sent a request to complete identity verification. When your account is approved, your RSA SecurID token will also be enabled. Please refer to our Systems for more information on host access. DO NOT share your PIN or RSA SecurID token with anyone. Sharing of accounts will result in termination. If your SecurID token is stolen or misplaced, contact the OLCF immediately and report the missing token. Upon termination of your account access, return the token to the OLCF in person or via mail.

Data Management

The OLCF uses a standard file system structure to assist users with data organization on OLCF systems. Complete details about all file systems available to OLCF users can be found in the Data Management Policy section.

Sensitive Data

Additional file systems and file protections may be employed for sensitive data. If you are a user on a project producing sensitive data, further instructions will be given by the OLCF. The following guidelines apply to sensitive data:

  • Only store sensitive data in designated locations. Do not store sensitive data in your User Home directory.
  • Never allow access to your sensitive data to anyone outside of your group.
  • Transfer of sensitive data must be through the use encrypted methods (scp, sftp, etc).
  • All sensitive data must be removed from all OLCF resources when your project has concluded.

Data Transfer

The OLCF offers two dedicated data transfer nodes to users. The nodes have been tuned specifically for wide area data transfers, and also perform well on the local area. There are also several utilities that the OLCF recommends for data transfer. Please refer to our Systems for information about the DTNs and available utilities.

INCITE Allocation Under-utilization Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to and use of OLCF computational resources:

  • INCITE Principal Investigators

Title: INCITE Allocation Under-utilization Policy Version: 12.10

The OLCF has a pull-back policy for under-utilization of INCITE allocations. Under-utilized INCITE project allocations will have core-hours removed from their outstanding core-hour project balance at specific times during the INCITE calendar year. The following table summarizes the current under-utilization policy:

Date Utilization to-Date Forfeited Amount
May 1 < 10% Up to 30% of remaining allocation
< 15% Up to 15% of remaining allocation
September 1 < 10% Up to 75% of remaining allocation
< 33% Up to 50% of remaining allocation
< 50% Up to 33% of remaining allocation

For example, a 1,000,000 core-hour INCITE project that has utilized only 50,000 core-hours (5% of the allocation) on May 1st would forfeit (0.30 * 950,000) = 285,000 core-hours from their remaining allocation.

Project Reporting Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to and use of OLCF computational resources:

  • Principal Investigators (Non-Profit)
  • Principal Investigators (Industry)

Title: Project Reporting Policy Version: 12.10

Principal Investigators of current OLCF projects must submit a quarterly progress report. The quarterly reports are essential as the OLCF must diligently track the use of the center’s resources. In keeping with this, the OLCF (and DOE Leadership Computing Facilities in general) imposes the following penalties for late submission:

Timeframe Penalty
1 Month Late Job submissions against offending project will be suspended.
3 Months Late Login privileges will be suspended for all OLCF resources for all users associated with offending project.

Non-proprietary Institutional User Agreement Policy

Note

This details an official policy of the OLCF, and must be agreed to by the following persons as a condition of access to and use of OLCF computational resources:

  • Principal Investigators (Non-Profit)
  • All Users

Title: Non-proprietary Institutional User Agreement Policy Version: 12.10

Users of DOE-designated User Facilities must understand and agree to the following Institutional User Agreement clause: I understand that my institution has entered into a User Agreement with UT-Battelle, the management and operating contractor for the U.S. Department of Energy’s (DOE) Oak Ridge National Laboratory (ORNL), that governs my research ORNL’s DOE-designated User Facilities. I have read and understand my obligations under that Agreement, including the provisions summarized below. You may check with your institution or contact accounts@ccs.ornl.gov if you require a copy of your User Agreement.

Access

I understand that my access is limited to certain designated areas and/or systems, and my access may be revoked if I pose a security, safety, or operational risk.

Rules and Regulations

I will follow the applicable ORNL rules, regulations and requirements, including those requirements of the ORNL User Facility. I will follow the requirements set forth in training if assigned to me by the ORNL User Facility.

Safety and Health

I will take all reasonable precautions to protect the safety and health of others and comply with all applicable safety and health requirements.

Intent to Publish

I will use best efforts to publish the results from my use of the ORNL User Facility in an open scientific journal or significant industry technical journal or conference proceedings. I will acknowledge use of the ORNL User Facility in the publication and notify the ORNL User Facility of any publications that result from my use of the facility.

Export Control

I will comply with all U.S. Export Control laws and regulations and be responsible for the appropriate handling and transfer of any export controlled information, which may require advance U.S. Government authorization.

Intellectual Property

I will disclose any invention conceived as a part of the work at a ORNL User Facility and will protect the invention until a patent application can be filed. I understand that my institution may elect title to the invention and the U.S. Government retains rights to the invention.

Special Requests and Policy Exemptions

To request policy exemptions, please submit the appropriate webform available on the Documents and Forms page. Special request forms allow a user to:

  • Request Software installations
  • Request relaxed queue limits for a job
  • Request a system reservation
  • Request a disk quota increase
  • Request a User Work area purge exemption

Special requests are reviewed weekly by the OLCF Resource Utilization Council. Please contact help@olcf.ornl.gov for more information.