SAFE for PIs and Project Managers
This section covers the use of SAFE to:
- Manage project users on different systems and services
- Manage project resources on different systems and services
Principal Investigators (grant holders) can manage their allocations via SAFE.
Important
Not all management options are available for all systems. We try to note which functionality is available for individual systems in the sections below.
Getting Started
How to activate your new allocation
After your application for access to a service has been approved by the relevant funding body, your new allocation will need to be activated. How this happens depends on the service you are accessing and the funding call that awarded the resource. Please refer to the specific call, funder and service documentation on how your allocation will be activated.
If you have any questions about activating your allocation, please contact the relevant service desk for the service you are using.
Your allocation has been set up as a project on the service. Your first steps.
Here are some of the things you should consider doing; not all of them will be needed for every project.
- Change your own SAFE password
- Set up an account on service machines for yourself
- Make sure other project users get registered
- Designate one or more users as managers of your project
- Decide whether you need project groups within your project, in order to administer time and other resources
How to get your own account on service machines
If you are not going to work on the machine yourself, you do not need to do this. You can administer your project through SAFE alone. But if you want a service machine account follow the usual account setup process.
You will get an acknowledgement screen, from which you can return to your main page. As a PI, your account request will be auto-approved.
How to check project alerts
Login to SAFE. Then:
- Go to the Menu Projects and select the project you wish to check
Note
if there are account approvals waiting, the project name will be highlighted in this list and clicking on the highlight will take you straight to that page.
- This will display a page with a variety of options for managing your project.
- Project alerts and warning are highlighted in Amber and Red
- To request emails for alerts, or to change the frequency of the emails
- Click Update
- Beside "Frequency of Alerts" select the required frequency
- If the emails should go to someone other than the PI, enter the email address(es) into the 'Recipients for alerts' box. If the PI still wishes to receive alerts their email must be included in this box.
- Click Update to save the changes.
Do not forget the Update step, or nothing will happen.
Managing your allocated resources
What is "period allocation"
A period allocation is an amount of compute time which has been allocated for a project to use within the specified time period. Period allocations are valid for a specific resource pool (machine) and have definitive start and end dates, which usually coincide with the dates of your grant or project award. When the end date of the period allocation passes, any leftover compute time will automatically expire.
You can view and manage your period allocation via SAFE.
Login to SAFE. Then:
- Go to the Menu Projects and select the project you wish to work with
- This will display a screen with a variety of options for managing the project.
- Scroll down to Time Budgets and Click on Manage Group Time Allocations
- Click on the small arrow beside How to Manage Your Budgets for detailed instructions.
You will then see the details of your current live allocation.
Important
Please check the dates by Allocation Period to make sure you are looking at the correct one.
You can skip between the period allocations by clicking on the "Next period>>>" and "<<< Previous period" buttons at the bottom of the page.
- Resource Pool (machine)
- Allocation
- Dates It is possible to have multiple successive period allocations, but they can never overlap if they are for the same resource pool. Before carrying out any project management tasks please check the dates and make sure you are managing the correct allocation. You can skip between the period allocations by clicking on the "Next period>>>" and "<<< Previous period" buttons at the bottom of the page.
You can manage the allocation by setting up project groups and allocating compute time to project groups if the project group functionality is available on the machine you have the allocation on. Project management tasks for the period allocation can be carried out at any time, but the allocation will be active, i.e. usable, only between the specified dates. Thus, you can set up project groups in advance.
How can I set up project groups within my project?
Project groups can be used to administer time and other resources within your project. There is always one group which contains all project members but you can create additional groups if you wish and the functionality is supported on the machine you are using.
The following machines currently support the use of project groups: - ARCHER2 - Cirrus - DiRAC Extreme Scaling (Tursa)
Login to SAFE Then:
-
Go to the Menu Projects and select the project you wish to create the group
-
This will display a screen with a variety of options for managing the project.
- Click the small arrow beside Project Groups to expand this section
- Click on the first entry (which will match the project ID)
- Click Add new sub-group at the bottom of the section
- This will take you to the screen for creating new project groups.
Fill in a suffix to your project code in the box: for example, if your project code is t01, you might chose t01-a. Project group names cannot be more than eight characters in total.
-
If this group is to be used for guest budget users, tick "Guest Budget"
A guest budget is a budget in one project which is set up to permit access requests from users in a different project. -
Click Create
How can I delete a project group?
You can only delete a project group if it has no resources or members. You must remove all its members and all its time. Also, if it has disk quotas set, it cannot be deleted; they will have to be removed first.
Then:
- Go to the Menu Projects and select the project you wish to delete the sub-group from.
- Scroll down to project groups and click on the small arrow beside Project Groups to expand and display all the groups in the project.
- Select the project sub-group you want to delete.
- Scroll to the bottom of the page and click Delete. This will ask for confirmation that you wish to delete the sub-group. Click Yes.
Deleting a group involves removing its various directories - depending on how much data is in the directories, this may take some time.
How can I administer time within my project?
Compute Time is held in budgets. Every project group has its own budget. There are always at least two project groups in your project:
-
The general group, which has the same code as the project itself. Every member of the project is a member of this group, so the time in its budget is available to them all.
-
The reserve project group, which has a name of form t01-reserve. It has no members, so no one can use the time in its budget. This budget can be used to hold time which the PI or project manager wishes to hold in reserve for later use.
Initially, all your time is in the general group's budget. If you are happy with all your users using the same budget, you can leave things as they are.
If you wish to divide the time up between groups, you can create a project group for each group. In this case you will probably want to move all the time out the general group, since this can be used by everyone.
You may wish to give time just to a single user. This is a special case of a project group: one with only one member.
The reserve budget is provided so that if you wish you can control the use of time by your project members: you can keep most of the time in your reserve budget, and move it to the other budgets as required. We recommend that you should do this, even if you don't need to create other project groups.
How can I move time between budgets?
Login to SAFE, and then:
-
Go to the Menu Projects and select the project you wish to work with. This displays a panel with information for the project.
-
Scroll down to Time Budgets
- Click Manage Group Time Allocations
- Click the small arrow beside "How to Manage your Budgets" to expand the instructions.
- Click the Move From and Move To buttons of the project groups you want to change
- Enter the amount of compute time you wish to move in the box
- Click the Move button
- Click the Submit Budget Allocation Changes button.
Do not forget the Submit step, or nothing will happen.
Hint
If you need to make a large number of simultaneous changes the MultiMove button will open a different form that allows you to specify the amount you want each budget to change.
How can I allocate time to a single user?
As all the time in a project group is shared by all its members, the only way to reserve some time for a single user is to create a project group for that user alone.
- Create a new project group for the user. For example, if we are in project t01 and the user is fred, you might call the new project group t01-fred
- Add the user to the new project group
- Move the time you wish the user to have into the new project group
Remember that time in the general group's budget is accessible to all, so you will probably want to move all of the project's time away from there.
How can I administer disk space?
Start by reading the discussion of the administration of time, as the administration of disk space is related to this, and is also done using project groups. The two project groups which exist in each project can also be used for administering space.
- The general group, which has the same code as the project itself, includes every member of the project. The disk quotas of this project group can therefore be used by them all.
- The reserve project group, which has a name of form t01-reserve, has no members, so no one can use the disk space which is in its quotas. You can use these quotas to hold space which you want to hold in reserve for later.
Different file systems are administered separately. A project may have access to multiple file systems on multiple different service machines. Within the disk space allocated on a particular file system every portion of space must belong to one or other of the project group quotas. Thus, to start with, all the quota allocated to a project on a file system is either in the general quota or the reserve quota for that file system. Space never belongs to more than one group quota. [The reserve quota is not a real quota, in fact. It has no existence on the service machine - just in the database.]
Note
You cannot move disk space on one file system to another file system - you can only allocate file space on a file system to group quotas on te same file system.
Beyond the general and reserve quotas, you can also have quotas for the project groups which you create. But this is not compulsory. If you qre thinking about using project group quotas, you need to be aware that they are implemented using Unix groups, which are only just adequate for the task.
Let us use an ARCHER2 work file system as an example (a2fs-work1
, your project may have access to a different file system). Suppose you are project t01. To start with, one Unix group will be assigned to this project. The directories for all users will be in directory /work/t01/t01/
— this is where the general group is held. User john, for example, will have directory /work/t01/t01/john/
as his work directory. Any file created in any of the directories under /work/t01/t01/
will belong to the Unix group for project t01.
If you create a project group t01-a with no quota on ARCHER2 work, this will not change. On the "Group quotas" SAFE page you will see the new project group and under "Usage" and "Quota" you will see "Locked" — as the group has no quota, it cannot be populated. But the moment you give a quota to this project group on ARCHER2 work, a Unix group will be assigned to it and a directory will be created for it: /work/t01/t01-a/
If user john is a member of this project group, he will have a directory /work/t01/t01-a/john/
. Any files he creates under that directory will belong to t01-a and will be counted against its quota.
Of course, john is still a member of the general project group, so he can still create files there. If he belongs to other project groups which have quotas, he will have directories for these as well. He can only create files in the project groups he is a member of, since he cannot access the directories of the other groups. It is up to him to make sure that he creates his files in the right places, so that they get charged to the right project groups.
You should also note that once you have instituted project group quotas, there is no easy way back. Removing them and reassigning all the files to other groups is a complex job and will require special arrangement with the service team — send a request to the appropriate Service Desk.
Most projects, in fact, use their project groups only for administering time, and allow their users to have access to all their space. You could, if you wish, make use of user quotas (if they are supported on the file system you have access to) to stop individual users from taking too much space.
Note
The above points do not apply to the reserve quotas, since they do not exist on the service machine. They are just a book-keeping fiction, and using them is cost free. We recommend this to any project which is concerned about running out of space.
How can I create a quota for a project group, or move space between quotas?
First, read the discussion of space administration. If you are still determined to use project group quotas, this is how.
Login to SAFE Then:
- Go to the Menu Projects and select the project you wish to work on. This will display a panel with the project information.
- Scroll down and click the small arrow beside "Disk Quotas" to expand the section.
- In the Group Quotas section, click on button beside the File System you wish to work on.
- You will now see a list of your project groups, including the general and reserve groups. Project groups which have no quota will show the note No quota set
- Click the small arrow beside "Instructions..." to display detailed instructions.
- Click the Move From and Move To buttons of the groups you want to change
- Fill in the number of Gb to move in the box
- Click Move
- Repeat until you have entered all the moves you wish to make
- Click Submit and the move instructions will then be carried out.
Do not forget the final Submit step, or nothing will happen. The act of moving quota space to a project group which has no quota set converts that project group to one with a group quota, administered by a Unix group, as discussed earlier.
Quota changes are actually carried out by a human being. Once this has been done, you will receive an email informing you. If you ask for the quota to be reduced below the current size of the files in the project group, the human will reject your request, and you will get an email saying this.
How can I set a quota for an individual user?
User quota control is not available on all machines. Current machines that support this are:
- ARCHER2
- Cirrus
- DiRAC Extreme Scaling (Tursa)
User disk quotas are completely separate from project group quotas. A user quota simply places a limit on the amount of space which a particular user can occupy in workspace or homespace. There's nothing to stop you setting user quotas which add up to more (or less) than the total space. To set a quota for a user or users:
Login to SAFE Then:
- Go to the Menu Projects managed and select the project you wish to work on. This will display a panel with the project information.
- Scroll down to Disk Quotas
- In the User Quotas section, click Home or Work
- You will see a list of users. Enter a value for each of the users whose quota you wish to change
- Click Submit Changes
Once again, these quota changes are carried out by a human. Once they have finished, you will receive an email.
As with group quotas on the work file-system you can only be absolutely sure of writing data when you are more than 7Gb below your quota limit.
Managing Project Users
How can project users get registered?
You must not apply for machine accounts on behalf of other users, or let others use accounts that belong to you. Account sharing is strictly forbidden.
Every user must register on SAFE and then apply for their own machine account.
In order to request an account, a potential user just needs to know the project machine and code.
- Give the users the project code and any advice on what username they should request in your project if you wish.
- Every user should then register on SAFE and then apply for their own machine account
or you can send an Invite to a new user:
Invite users
The normal procedure for generating a machine account is for the account owner to apply for an account and have it approved by a project manager, as described above.
It is also possible for project managers to pre-approve an account and send an invitation to the potential project member.
To do this the project manager uses the Invite member button from the project administration page. The project manager must provide an Email address for the prospective project member together with the machine the account is for, a suggested username for the account and a text message to send with the invite. This will send an email to the provided address with a link. If the recipient wants to accept the account they need to log into the safe (creating a SAFE account if they do not already have one) and click on the link in the email.
After sending the invitation the SAFE will offer an opportunity add the new account to additional project groups.
The account is not actually created until the account owner accepts the account so they will be able to change the suggested username if they wish.
How to approve user sign up requests
If you notice that the Menu Projects managed is highlighted, then this indicates that there is a request for project membership awaiting approval.
You can also set up to receive email alerts whenever a signup request is waiting.
You have to accept (or reject) each user's request.
Login to SAFE Then:
- Go to the Menu Projects and click on the highlighted project and you will see the details of the user who has applied.
- Click on the Full name (with email) link to see full details of the person requesting the account.
- Click on the User name link to see details of the requested account.
- Click the "Accept/Reject" button next to the user to see basic details about the person, including their Nationality, Institution and Department
- Click on either the "Reject" or "Approve" button to reject or accept them.
If you now accept the user, they will get an account. This is the last chance to stop someone who should not be there! Take a few seconds to check the user's details, especially their email address, to make sure that they are who they say they are. Please check their nationality as well: it's your responsibility to make sure this is right.
When you accept a user, the systems team is automatically requested to create the account on the service machine. When this has been done, the user is emailed; allow a working day for this. The user can then login to SAFE and pick up their password on the service machine.
When you click Accept you will then be taken to a list of all the Project Groups in your project, so you can easily add the new user to the group(s) they will be using. Simply tick the box against any groups they should be a member of, and then click "OK".
How can I designate a user as a project manager?
A project manager can do everything in a project that a PI can do, except designate another project manager. You can designate as many project managers as you wish.
- Make sure the user has an account in your project.
- Login to SAFE
- Go to the Menu Projects and select the project you wish to appoint a project manager for. This will display a screen with a variety of options for managing the project.
- Scroll down to "Manage members"
- Click Add project manager
- A drop down list will be displayed which contains all the users within the project. Select the user you wish to make a manager and click Add
If you later wish to remove a project manager, click Remove project manager, select the project manager and then click Remove.
You may want to enable a project user to perform some, but not all, of the project manager roles.
The options available are
- Approve Users
- Make Sub Groups
- Move Budget
- Move Group Quota
You can enable these using the "Set member permissions" button
How can I designate a user as a project sub-group manager?
A project sub-group manager can only move time and disk quota between the groups they manage. They can also create new sub-groups underneath these groups. (If you manage a parent group you automatically manage all its children). Sub-group managers can also accept new people into the project and run reports on the project.
- Make sure the user has an account in your project.
- Login to SAFE.
- Go to the Menu Projects and select the project you wish to appoint a project sub-group manager for.
- Scroll down to project groups and click on the small arrow beside Project Groups to expand and display all the groups in the project.
- Select the project-subgroup that you wish to assign a sub-group manager for.
- Scroll to the bottom of the page and Click on Add Manager.
- You will now have a drop down list of all the users who are sub-group members but not currently managers. Select the new manager from this list and click Add and then confirm the change.
To add users to the new project group, see the next question. A user can belong to more than one project group.
How can I add users to an existing project group?
Login to SAFE. Then:
- Go to the Menu Projects and select the project you wish to are work on.
- Scroll down to project groups and click on the small arrow beside Project Groups to expand and display all the groups in the project.
- Select the project-subgroup that you wish add or remove users to or from.
There are 3 possible operations
- Add/Remove members lists all members of the project allowing you to add and remove accounts from the project group in a single operation.
However for a very large project this can become unwieldy so separate add/remove operations are also available.
-
Add accounts only lists accounts that can be added to the group allowing multiple accounts to be added.
-
Remove accounts only lists accounts already belonging to the project allowing multiple accounts to be removed.
Hint
There is also the option to add/remove groups to a user account. This can be found on the individual user account pages linked from the Usernames in the Project accounts page. This route is most useful if you want to add or remove a single account to/from multiple groups.
To see which members have access to the project group, select project sub-group and click List Members.
If the project group is using disk quotas, this operation is carried out by a human, so there may be a short delay. Otherwise, it happens at once.
A user can belong to more than one project group.
How can I remove a user (or users) from my project?
Please check the policy on on end of life procedures for user accounts on the system you are using.
If you wish to remove a user from your project, you can email the appropriate Service Desk for the system giving the username of the user to be deleted. Service desk staff will arrange for the account to be deleted, in line with the policy.
You can remove an account from your project in SAFE by selecting the project from your Projects list and then under "Manage members" choose "Remove account". Removing an account also immediately removes all associated data permanently, so must be done with great caution.
Warning
When you remove a user from the project or from a project group, this removal will not be processed on the machine while the user still has jobs in the queue (pending or running). Once they no longer have work in the queue, the removal will be processed.
In the event that you wish to prevent the user from running jobs immediately, please contact the service desk who can arrange for queued and running jobs to be removed from the queue.
How can I send a mailing to all users in my project
Login to SAFE Then:
- Go to the Menu Projects and select the project you wish to work on. This will display a screen with a variety of options for managing the project.
- Scroll down to Project mailings click on View
- You will see a list of all of the previous project mailings, and the option to compose a new one.
- Select Compose
- To change the mailing or content, you can use the Edit Subject and Edit buttons. Once you have changed the text select Update.
- To send the mail click Send. There is an option to Start Over - this will wipe the content of the email. The Abort option will take you out of the mailing page completely.
Tracking your Project Usage
How to check the current state of your project's time and space
Login to SAFE Then:
- Go to the Menu Projects and select the project you wish to work on.
- Under Project groups you can see the current state of each project group's budgets. If it uses disk quotas, you will see these, together with how much of is in use.
If a project group's use of a quota is getting close to the maximum, it is highlighted.
The budget values displayed are updated every morning, and the values shown for disk use are updated four times a day. For this reason, these values may not all be completely up-to-date. If there is a lot of activity in your project, the numbers shown could be significantly different from the current ones.
How to track what my project's users and project groups are doing
This can be done using the Report Generator
Login to SAFE Then:
- Go to the Menu Service information and select Reports
- Choose the "Project Report" report
- Select the start and end dates of the period you are interested in
- Click the button to select a report format: Preview, HTML, PDF or CSV (comma-separated values — good for input to Excel, etc.)
- If you initially selected Preview and would now like this report in one of the other formats, you can now click the format you wish and the same report parameters will be used to generate the report.
How to request automatic project reports
Login to SAFE Then:
- Go to the Menu Projects and select the project you wish to work on. This will display a screen with a variety of options for managing the project.
- Click on Update
- Enter the email addresses which the reports should be sent to in Recipients for automatic reports.
- Set the Frequency of Automatic Reports to the preferred frequency.
- Click Update to confirm the changes.
How to check how much space my project's users are occupying
Use the Reports menu item (see the earlier question), and select the "Project Disk Use" report. The Report Generator displays the history of disk use — to see the current use, make sure that the reporting period includes the present moment. The disk usage values known to the database are updated four times a day, so if there is a lot of activity in your project, the numbers shown could be significantly different from the current ones.
There is an unresolvable problem with this: if a user has an account which belongs to more than one project, the disk usage shown for that account will be the total that the account is using in all those projects combined.
How to request more resources (compute time and file system space)
If you need more file system space, contact the appropriate Service Desk.
If you need extra time, you should contact the funder for your project. The Service Desk cannot allocate time without authorisation from them.