VERITAS Cluster Server Disaster Recovery Architectures Explained

Transcription

1 V ERITAS Solution Guide VERITAS Cluster Server Disaster Recovery Architectures Explained Authored by: Michelle M. Mol; Product Marketing Manager Jim Senicka; Technical Product Manager Revised for VERITAS Version 4.0 6/17/2004 1

2 Introduction... 3 Understanding Basic Disaster Recovery Terms... 3 Recovery Point Objective (RPO)... 3 Recovery Time Objective (RTO)... 3 Planned Downtime... 4 Unplanned Downtime... 4 Disaster Recovery Architectures for VERITAS Cluster Server... 4 What Solution Is Best For My Envrionment?... 5 Cluster Architecture Solution Offerings... 5 Local Cluster... 5 Customer Scenario... 7 Metropolitan Area Disaster Recovery with Remote Mirroring... 8 Customer Scenario Metropolitan Area Disaster Recovery with Replication Customer Scenario Wide Area (Global) Disaster Recovery Customer Scenario Conclusion

3 INTRODUCTION Many organizations have requirements for implementing a high availability architecture as well as a disaster recovery/business continuity solution for their mission critical applications and databases. Achieving these requirements while also managing a constrained budget is possible if existing hardware and infrastructure can be leveraged. Traditional approaches to disaster recovery involve a variety of methods, from standard tape-based data recovery to synchronous, wide-area data replication. For organizations without the infrastructure to support a wide-area replication solution, there are other approaches to achieving rapid recovery of applications and databases while still protecting against site failure that is discussed in this article. VERITAS supports several clustering architectures to meet many data center requirements. The purpose of this article is to thoroughly explain data center architectures and to provide detailed information involved with deploying each of the architectures. UNDERSTANDING BASIC DISASTER RECOVERY TERMS One key concept to understand is your recovery point objective (RPO) and your recovery time objective (RTO). In the event of a fault or disaster, it is important to have a clear understanding of the time required to come back online, as well as how current the data will be after recovery. It may be that not all applications and databases require the same levels of availability. Below are brief descriptions for RPO and RTO: RECOVERY POINT OBJECTIVE (RPO) How much data loss can you afford after a fault or disaster? What amount of data loss is acceptable? Recovery point objective is the point at which data must be restored. Organizations should have a Recovery Point Objective (per application) and a Recovery Time Objective that must be satisfied. Most people tend to focus on the RTO or how much downtime is acceptable. However, it is just as important to consider how much data loss an organization can tolerate. Data is important and data loss (even just a few minutes, hours or days) can have far reaching negative business impacts. Most companies today rely primarily on tape backup and restore as the centerpiece of their DR plan. Although tape backup is important and the foundation to any comprehensive disaster recovery plan, this usually means at least a day of lost data and a few days of downtime after a disaster due to the amount of time to recover from tape. This may meet some business needs, but if not, technologies to reduce the time is takes to recover data must be implemented. RECOVERY TIME OBJECTIVE (RTO) The recovery time objective is the time in which data accessibility must be restored. For example, if a customer states that it takes 45 minutes to bring applications on line, and the maximum acceptable outage duration is 1 hour, then the Mandatory Decision Point is within 15 minutes of the actual disaster. The Mandatory Decision Point is explained as follows: Clock starts once the disruption occurs. How long are end users impacted? Business Requirement: Need applications online in 1 hour. Problem: clock starts upon disaster declaration 1. 1 hour is maximum acceptable outage 2. Time of fault detection eats into IT recovery time 3

4 3. Even in a local failure, there s some time needed to actually detect the fault. 4. This determines the Mandatory Decision Point to be 15 minutes PLANNED DOWNTIME If an application, database or server requires upgrades or maintenance, clustering is essential to maintain high availability to the users during these periods. UNPLANNED DOWNTIME In the event of an application, database or server fault, the services running on the server are failed over to another server to avoid long periods of downtime and maintain a quick recovery time objective. DISASTER RECOVERY ARCHITECTURES FOR VERITAS CLUSTER SERVER VERITAS recognizes that not all data centers are alike. Building an infrastructure for high availability at a local site may meet many availability requirements of business while other requirements may involve greater protection that spans across multiple locations. By using VERITAS Cluster Server as a stand-alone solution or in combination with other VERITAS products, availability can be achieved in almost any open system environment. VERITAS can meet data center architecture requirements for most companies by providing and supporting several cluster architectures: Local high availability with shared data Metropolitan area cluster Wide area clustering (Global Clustering) for disaster recovery VERITAS can provide high availability (HA) and disaster recovery (DR) for any enterprise requirement, be it single site local HA, to DR scenarios including short haul metropolitan area network (MAN) and full wide area network (WAN) support. Regardless of data center infrastructure and availability of SAN and network connections, VERITAS has a proven HA and DR architecture, all built around its high availability and storage management products. 4

5 WHAT SOLUTION IS BEST FOR MY ENVIRONMENT? The differences between local clustering and wide area disaster recovery is relatively clear: local clustering protects against hardware and software failures within the data center, and wide area disaster recovery using replication protects against far reaching disasters covering large regions. It is the intermediate distance between high availability/disaster recovery solutions that combine clustering with either mirroring or replication into a single cluster that raise the most interest when protecting mission critical applications and databases with minimal cost. Can a high availability cluster also provide disaster recovery capability? One of the primary shifts that drive questions such as this is the concept of how far away is far enough? Traditional thinking has been that a disaster recovery center must be hundreds or even thousands of miles away to provide complete protection. The bottom line is that more organization s and data requirements need online data protection, with a RPO and a RTO of nearly zero. This means customers are looking to provide disaster recovery capabilities similar to a simply deployed local high availability clustering solution, but spanning multiple sites, without enormous cost. Customers are now realizing that shorter distances, in the range of kilometers can provide disaster recovery protection against most credible threats, such as fire, flood, power, etc. For those threats that affect more than an entire metropolitan area, either traditional tape backup and offsite vaulting will suffice, or to meet a RPO and a RTO, the organization will deploy Wide Area Clustering, which spans beyond a metropolitan area. In the following section this paper will detail the VERITAS offerings in high availability clustering from a local data center to metropolitan area and finally, to a wide area. The objective of this paper is to demonstrate that VERITAS can provide a seamless high availability and disaster recovery solution, based on current infrastructure, to meet an organization s RPO and RTO requirements. CLUSTER ARCHITECTURE SOLUTION OFFERINGS 1 LOCAL CLUSTER Definition A single VCS cluster consists of multiple systems connected in various combinations to shared storage devices. VERITAS Cluster Server monitors and controls applications and databases, and can failover or restart applications and databases in response to a variety of hardware or software faults. A cluster is defined as sets of systems connected with a redundant network interconnect. This solution provides local recovery of UNIX and Windows servers in the event of application, OS, or hardware failure at a single site. It also minimizes planned and unplanned application downtime. Local clustering, also known as shared-storage clusters, are the most prevalent for providing HA through application and database failover. Environment Single cluster; one or more subnets; up to 32 servers supporting any cluster configuration. A redundant server, network and storage architecture for application and data availability through the linking of multiple servers with shared storage Systems are linked with a private network interconnect, usually Ethernet, which they use to communicate the status of systems and software and hardware resources VCS uses a fast proprietary protocol, GAB/LLT, to communicate status 5

6 Each system in the cluster can access application data as necessary on shared storage There is no replication or mirroring of data to other data centers, as opposed to a stretch cluster (mirroring/raid inside a single array is used to provide disk protection) A SAN facilitates larger clusters (> 2 nodes), and is typically present in all clusters, i.e., switches or hubs are used All cluster components servers, SAN infrastructure, storage are co-located on a single site All servers in the cluster are in a single location (single data center) Advantages Applications recover using data on shared storage (zero data loss) Minimal downtime for applications and databases (automated failover) Optimal for server consolidation (N+1 failover scenarios) Quick recovery time objective to meet stringent service level agreements and high availability Disadvantages Data center or site can be a single point of failure in a disaster Failover Behavior In the event of an application, database, or server fault, VCS will bring down the faulted application or database in dependency order and bring up those services on another server in the cluster in dependency order. All servers are local (within the same data center) and are sharing storage. Since the servers are accessing the same storage, the data that the faulted server was accessing is available to the server that restored the services. When to consider Local Clustering 1. Do you have specific applications and databases that require high availability unable to have long periods of downtime? 2. Are you frustrated with long application or database outages? 3. Would you like to avoid application or database downtime during planned outages? 4. Are you unable to meet your recovery time objective upon an application, database or server fault? In today s SAN based architectures, and the capability of VERITAS Cluster Server to provide N+1 (N amount of active servers with 1 standby server) and N-to-N clustering (all servers are actively running services), it makes greater sense to cluster nearly all applications and databases. With common clusters being deployed today with one spare server per 8 or more servers commonly running applications and databases, clustering reduces the amount of planned and unplanned downtime. The amount of time it takes for an IT administrator to detect a fault, and then take appropriate action can mean hours of downtime. Users are left unable to access data if either or both of the application or database are down. VERITAS products for this solution VERITAS Storage Foundation High Availability (VERITAS File System, Volume Manager, and Cluster Server) RPO/RTO Facts Recovery Point Objective: At what point can the data be restored? In this configuration, the cluster is using shared storage and therefore, upon a failure, the other servers in the cluster will always have access to the identical data. Recovery Time Objective: Clustering reduces the recovery time objective because it takes the human intervention of first detecting a fault, and then taking the appropriate action of bringing the application down and brining it up on another server. Automating this process ensures that in the event of a fault, the moment an application or database to another server is quick and accurate. 6

7 Cost Comparison The cost of implementing a local HA solution involving any clustering technology can increase cost in that the IT Administrator will have to learn a new technology and afford another server to failover to. In general though, the cost of downtime can far outweigh the cost of implementing a new technology that can significantly reduce both planned and unplanned downtime. Once again, rather than the traditional thinking of 1 server + 1 spare server, which is the way first generation HA software required, VCS can provide much lower cost through the use of N+1 clustering. For example, in a 1-to-1 cluster (one active and one passive), cost of redundancy is 100% at the server level. If an 8+1 cluster is deployed, cost of redundancy is reduced to 12.5%. CUSTOMER SCENARIO ICON Clinical ICON Clinical is the leader in providing the pharmaceutical and biotechnology industries with exceptional clinical research and biometric services worldwide. These services include: Provides Clinical Trial support for all phases of drug delivery Documents all patent/doctor/drug information for the trial with their custom application system. Patients involved in the trial disclose information such as symptoms and daily health either through the ICON Clinical phone system or web interface. This information is a critical component for passing Phase 3 Clinical Trials. Data center Information Data center supports 23 offices, 14 countries on 5 continents, with over 1500 employees. Revenue Information Net revenues increased 36% on a year-to-date basis. $67 million of net new business awarded to ICON during Q2FY03. Problem Statement Need to achieve 99.9% system availability for Microsoft SQL 2000 database and custom application. Deliver 24x7 service to doctors and patients involved in the clinical trials. Required a solution that would provide high availability and disaster recovery for hardware and software already in place. Description of Local HA Environment Operating System: Windows 2000 Server Servers: Compaq and Sun Storage: Hitachi Applications: Microsoft Exchange 2000, SQL 7, SQL 2000, Citrix, Custom Applications Total Storage: 300 GB VERITAS Products NetBackup Volume Manager Cluster Server Volume Replicator Global Cluster Manager Success Clustering exceeded their expectations: Required a local high availability and disaster recovery solution in the event of an application or server outage. Met their 99.9% system availability requirements both at their local and disaster recovery site Needed a solution that could use their current hardware and software investment Standard Edition of the application and low-end Windows servers Easy to deploy and manage with GUI interface 7

8 2 METROPOLITAN AREA DISASTER RECOVERY WITH REMOTE MIRRORING Note: A separate whitepaper detailing Metro DR configurations can be found on the VERITAS website. Definition Metropolitan Area Disaster Recovery with Remote Mirroring (also known as a campus cluster or stretched cluster) is a single cluster that stretches over two sites using fiber channel connectivity (typically using DWDM or CWDM technology). The fibre channel connectivity provides SAN connections for data mirroring and network connections for cluster communication. This architecture provides continuous availability for expanding data centers faced with limited space for growth. If fibre is not available but IP is, please refer to Metropolitan Area Disaster Recovery with Replication. Environment Single cluster stretched over multiple buildings, data centers, or sites connected via dedicated fibre channel. The public network should span sites and there should be a single subnet. Up to 32 nodes distributed freely among buildings, data centers or sites. Local storage is mirrored between cluster nodes at each location. Data is synchronously mirrored between both sites (no data loss) Distance between sites depends on storage networking infrastructure. The VERITAS performance lab tested VERITAS Volume Manager mirroring at distances from 0-80km using CWDM and found 2-6% performance loss versus local, non-mirrored storage. The test results are posted on VAN ( Advantages Metro DR with Remote Mirroring provides local high availability within each site as well as protection against site failure Cost effective, simple solution no need for replication (zero data loss due to remote mirroring which is synchronously copying data to both sites) Fast mirroring is at the host level so the server is writing data to both sites simultaneously. Minimal downtime for applications and databases (automatic or manual failover) Leverage existing SAN infrastructure make use of your fibre channel connectivity investment Looks and acts like a locally deployed cluster environment no specialized configuration necessary Protects against weather related outages and local power grid failure as a single point of failure Allows for data center expansion creates a single, logical grouping of servers, storage and applications across sites Allows failover across multiple networks Disadvantages Cost Requires Fiber Channel SAN infrastructure Distance limitations based on storage - ability to mirror storage with adequate performance Failover Behavior Example: If 3 servers are located in Building A and another 2 servers are located in Building B, upon a failover of one server in Building A, VCS will attempt to failover the application to another server in Building A. If Building A is down, all services will be failed over to Building B. The data is already at Building B since Volume Manager is using remote mirroring to get the data to another site. 8

9 When to consider Metro DR with Remote Mirroring 1. Do you have Fibre Channel SAN? 2. What is the distance between the two sites? Are the sites approximately 80km apart? 3. Would you like to maximize your million-dollar investment in fiber by providing a level of disaster recovery? By using VERITAS Volume Manager, FlashSnap and VERITAS Cluster Server, a level of disaster recovery can be achieved without spending more money on additional software or hardware. The technology to provide mirroring between two sites is already inherent in VERITAS Volume Manager. While data is protected with a synchronous copy at the remote site, applications and databases are kept highly available with VERITAS Cluster Server. The combination of VERITAS Volume Manager and VERITAS Cluster Server can provide data and application availability not only in the local data center but provide a level of disaster recovery protection in the event of a building or site power outage, fire, or flood. VERITAS products for this solution The same products that provide Local Clustering: VERITAS Storage Foundation High Availability (Volume Manager, VERITAS File System, and Cluster Server) o Recommended: VERITAS FlashSnap VERITAS FlashSnap provides a suite of snapshot technologies to match a wide variety of customers point-in-time copy needs. In the Metro DR with Remote Mirror architecture, FlashSnap provides for rapid recovery of volume mirrors between sites after a building or array outage. FlashSnap tracks all writes to storage whenever all volume mirrors are not present to speed up volume resynchronization. FlashSnap can also be used to enable off host processing by providing a point in time copy that can be imported on other nodes in the cluster. For example, while running database application in one building, a reporting instance could be used on the failover node. RTO/RPO Facts R ecovery Point Objective: At what point can the data be restored in a Metro DR with Remote Mirror configuration? The data is synchronously mirrored between the two sites using VERITAS Volume Manager and therefore, upon a site failure at the primary location, the exact copy of the data can be found at the secondary site. VERITAS recommends the secondary site should be no more than 80 kilometers away due to application performance considerations. Recovery Time Objective: At what point can the application or database be back online? What make this architecture so appealing are the quick recovery times and the level of protection against local disasters that it provides. In the event of a local disaster (building fire, flood, etc.), all of the services such as the applications, databases, and data are failed over from that site to the other building that is not affected by the disaster. If a customer deploys local clustering, and experienced a building disaster, the recovery time objective could be from seconds/minutes when deploying this architecture, to days/weeks when only deploying a local cluster. Consider the time necessary to deploy new servers, upload the services and mount the data coupled with the expense of idle users and lost productivity. Clearly there is an advantage to deploying this architecture if the infrastructure is in place. Cost Comparison Implementing this solution can maximize the investment made toward the networking infrastructure while providing a level of disaster recovery. The cost of recovering from a local disaster can be disastrous, even resulting in lost business due to the amount of time it would take to set up the configuration at another site. Since this architecture involves deploying VERITAS Cluster Server and VERITAS Volume Manager, it is relatively inexpensive, lightweight disaster recovery solution that meets most disaster recovery needs. 9

10 CUSTOMER SCENARIO A premier medical center in Rochester, MN This premiere medical facility has four large hospitals in three states that focus primarily on patient care, research, education (medical school, graduate and post graduate) and health systems (numerous clinics and smaller hospita ls in five states). Problem Statement Meeting Service Level Agreements Our systems are highly critical 24 x 7 x 365 Any downtime affects patient care Meet Recovery Point and Recovery Time Objectives of 10 minutes Description of Metro DR with Remote Mirror Cluster Environment Running this configuration since data centers on campus 7 x 24 x 365 uptime Survive the loss of a data center and maintain operations of all critical (patient care) systems within 10 minutes Failover without human intervention Faster notification of a failover occurre nce Maximize Return On Investment (ROI) for the servers being used Supported Applications Electronic Medical Record Patient and Surgical Scheduling Radiology Information Systems Radiology Digital Image Archive Lab results Materials Management/Purchasing Secure patient/doctor Institutional backups Distance 4 data centers on campus separated by varying distances at a maximum distance of 3.5 km to the shortest distance of.5 km. VERITAS Products Volume Manager Cluster Server NetBackup Success Utilizing Cluster Server and the remote mirroring features bundled in VERITAS Volume Manager; the customer was able to achieve local high availability as well as a level of disaster recovery without added costs. The customer had already invested in a fiber infrastructure for other reasons outside the scope of the data center needs and maximized that networking investment by deploying a level of disaster recovery. 10

11 METROPOLITAN AREA DISASTER RECOVERY WITH REPLICATION 3 Alternative to Metropolitan Area Disaster REcovery with Remote Miorriring Definition Metropolitan Area Disaster Recovery with Replication is similar to the previous architecture (Metropolitan Area DR with Remote Mirroring) however it doesn t require an extended SAN for mirroring data. Rather than synchronous data writes at both sites using remote mirroring, data is replicated synchronously using VERITAS Volume Replicator over IP, or the customer s choice of using 3 rd party hardware replication solutions. This architecture requires dedicated communication links between sites for cluster communication. A question associated with Metro DR with Replication architecture is when to look at this solution over the Metro DR with Remote Mirroring solution. The general rule is this: if a you do not have a SAN nor want to invest in a SAN, but you can run private Ethernet networks for VERITAS Cluster Server heartbeating while providing synchronous replication, then a Metro DR with Replication architecture is applicable. In most cases, if a SAN is present, a Metro DR with Remote Mirroring architecture is by far the better choice, as there is no cost for additional replication requirements beyond volume mirroring found in VERITAS Storage Foundation. Additionally, keep in mind that performance will be enhanced when mirroring rather than synchronous replication over IP in all cases. Environment Advantages Disadvantages Single cluster stretched over multiple buildings, data centers, or sites connected via Ethernet (IP). The public network should span sites and there should be a single subnet. (If multiple subnets are required, please refer to Wide Area Disaster Recovery using VERITAS Global Cluster Option.) Up to 32 servers distributed freely among buildings Local storage is replicated between cluster nodes at each location synchronously. Asynchronous replication is not an option due to automatic cluster failover. Data must be consistent at both sites to have auto failover. Can use IP rather than SAN (with VERITAS Volume Replicator or 3 rd party hardware replication technology such as EMC SRDF) Cost doesn t require SAN infrastructure (fiber) Protection against local disasters Leverage existing Ethernet infrastructure Replicate synchronously and avoid data loss upon a site failure. More complex solution (direction of replication and currency of data must be considered in all failure scenarios) Potential application performance hit if using synchronous replication over a large distance Synchronous replication only Failover Behavior Example: If 1 server is located in Building A and another server is located in Building B, upon a failover of one server in Building A, VCS will failover the application to the other server in Building B. Data is being replicated using VVR over IP, or hardware replication using its native protocol. In all cases, the replication is expected to be synchronous. 11

12 When to consider Replicated Data Cluster Do you have a need for Disaster Recovery but don t have a site 100+ miles away? Do you have another site connected by an Ethernet connection? Metro DR with Replication is similar to Metro DR with Remote Mirroring but replication of data is over IP rather than over fibre channel SAN. The cost savings is that an organization doesn t require a fibre channel SAN infrastructure for this solution. VERITAS products for this solution VERITAS Storage Foundation High Availability (VERITAS File System, Volume Manager, and Cluster Server) o Recommended: VERITAS FlashSnap In the Metro DR with Replication environment, FlashSnap is used to provide the same off host processing capabilities as that available in the previous architecture environments. The user can take a point-in-time copy of critical data and import on the secondary site of the cluster for reporting or any off host processing need. VERITAS Volume Replicator RTO/RPO Facts Recovery Point Objective: At what point can the data be restored in a replicated data cluster configuration? The data is synchronously replicated between the two sites using VERITAS Volume Replicator or a 3 rd party hardware replication technology and therefore, upon a site failure at the primary location, the data at the secondary site is an exact duplicate. Recovery Time Objective: At what point can the application or database be back online? What make this architecture so appealing are the quick recovery times and the level of protection against local disasters that it provides. In the event of a local disaster (one building fire, flood, etc.), all of the services such as the applications, databases, and data are failed over from that site to the other building that is not experiencing the disaster. If a customer deploys local clustering, and experienced a building disaster, the recovery time objective could be from seconds/minutes when deploying a Metro DR with Remote Mirroring cluster, to days/weeks when only deploying a local cluster. Consider the time necessary to deploy new servers, upload the services and mount the data coupled with the expense of idle users and loss productivity. Clearly there is an advantage to deploying this architecture if the infrastructure is in place. Cost Comparison Either an organization will have fibre channel SAN or IP (Ethernet). The cost of implementing fibre channel SAN to achieve a Metro DR with Remote Mirror architecture far outweighs an immediate cost and return of investment of purchasing a replication technology that can replicate data over IP. The bottom line is that metropolitan area disaster recovery can still be permitted if Ethernet is the only connection between two sites. CUSTOMER SCENARIO A Large Manufacturing Company Company manufactures specialized equipment for the oil industry. Their manufacturing plant is located in Arizona and runs 24/7. Both the manufacturing data and applications can t afford long periods of planned and unplanned downtime. Two sites: Phoenix, Arizona and Scottsdale, Arizona Problem Statement The company manages a large amount of data that not only provides specifications to manufacture specialized equipment for large oil companies. The company wanted to minimize risk of having downtime due to data loss manufacturing specification management system is required to be up and running throughout the day. The facility runs continuously. The company wanted to minimize risk of having downtime to their application which accesses inventory data. Description of Replicated Data Cluster Environment Number of servers in the cluster: 2 nodes; 12

13 Data centers have 20+ servers (2 data centers; one data center at each site)2 Replicated Data Clusters deployed o 5 servers (3 at one site and 2 at the other site) Servers: Compaq 100 Storage: EMC Symmetrix Applications: Microsoft SQL, Custom Application Distance ~10 Km VERITAS Products Cluster Server Cluster Server agent for Microsoft SQL 3 rd Party Products EMC Symmetrix array for replicating data between Phoenix and Scottsdale Success Company was able to achieve a level of disaster recovery over their IP infrastructure for a specific application. Since the two sites were relatively close together, this architecture enabled the customer to utilize their current infrastructure and hardware investments made with EMC SRDF to provide replication between both sites. 13

14 4 WIDE AREA (GLOBAL) DISASTER RECOVERY Cluster A Cluster B Definition Wide Area Disaster Recovery provides the most protection for data and applications in the event of a disaster. The architecture requires deployment of two or more data centers with two or more subnets. In the event of a site outage, all of the services and data are moved to the secondary hot site, which then becomes available to users. This architecture involves precision when determining secondary sites. For instance, the location of the secondary site shouldn t be on the same fault line as the primary site, or it shouldn t be near airports or on same power grids, and should be far enough away to avoid weather patterns that could affect both locations. There are several companies, including VERITAS that provides consulting services for deploying disaster recovery best practices. Wide Area Disaster Recovery will typically be deployed based on government regulations or service level agreements that the company is forced to comply with. However, there are several companies that have office locations in other parts of the world that they could take advantage of for deploying such architecture. By definition, Wide Area Disaster Recovery is typically deployed when IP is available and the customer has a need for distance greater than 100km. The secondary site is a hot site, which has servers and storage available in the case of the primary site failing over. Connection between the sites is typically over IP. Environment A local cluster deployed at primary site & another local cluster deployed at secondary site(s) two clusters minimum o Two or more subnets o Two or more clusters o Two or more sites Data is replicated between clusters at each location. VERITAS allows up to 32 nodes per cluster and up to 64 clusters per site. Advantages All advantages of local clustering Unlimited data replication distance in asynchronous mode Protection against disasters local to a building, data center, or geographic area Supports any distance using IP for cluster-to-cluster communication Application failover is automatic locally, with a manual one click recovery to a remote site Support for VERITAS Volume Replicator and 3 rd party replication solutions Disadvantages Cost of network infrastructure, servers and storage at remote site(s) Potential data loss if failure occurs while running in asynchronous mode 14

15 Failover Behavior Example: If a server or application fails locally, VERITAS Cluster Server will attempt to fail over the services to another server in the same cluster. Upon receiving no response from the clusters within the local site, VERITAS Global Cluster Option, which is found within VERITAS Cluster Server, will then fail over all services from the local site to the secondary/remote site. VERITAS Cluster Server Global Cluster Option manages the failover between sites and all replication commands needed to view replication status and switch replication roles between primary and secondary site When to consider Wide Area Disaster Recovery 1. Do you have a remote office data center that can be utilized as a secondary disaster recovery site? 2. Are you faced with regulatory requirements that mandate you to have a secondary remote office disaster recovery solution? 3. Do you have specific mission critical applications and/or data that you need protected and the solution you have in place today is at risk due to natural disasters (i.e. weather, earthquakes, etc.)? There may be a requirement to implement a secondary data center 80 + kilometers away from the primary site to protect against local and metropolitan area disasters. This is a costly architecture in that the organization has to purchase hardware and software as well as a networking infrastructure to support this (this would be a HOT site). Although most disasters are localized, implementing a secondary site may be a requirement based on regulatory/government constraints, service level agreements, the nature of their business (i.e. banking or web hosting services) or the location of their primary site. If their primary data center is in a location that is prone to severe weather patterns, then it may be in the customers best interested to protect against natural disasters such as tornadoes or hurricanes and implement by deploying a secondary site outside the primary site weather zone. VERITAS products for this solution VERITAS Foundation Suite/High Availability (VERITAS File System, Volume Manager, and Cluster Server) o Recommended: VERITAS FlashSnap VERITAS Volume Replicator VERITAS Global Cluster Option (option found in VERITAS Cluster Server) VERITAS CommandCentral Availability (manage and report on global clusters) RTO/RPO Facts Recovery Point Objective: Data can either by replicated periodically, asynchronously or synchronously between the two sites using VERITAS Volume Replicator, EMC SRDF or Hitachi TrueCopy and therefore, upon a site failure at the primary location, the data is usable at the secondary site. How current the data is, or how much data will be lost during a true disaster is dependent on the mode of replication used. If the replication is synchronous, then there will be zero data loss. With periodic or asynchronous replication, there will be some amount of data lost. The amount of data depends on the replication configuration. VERITAS Volume Replicator ensures consistency with no distance limitations/requirements between the primary and secondary site. Other technologies may have limitations that need to be investigated by the customer to decide whether those limitations are acceptable. Recovery Time Objective: At what point can the application or database be back online? In the event of a site disaster, all of the services such as the applications, databases, and data are failed over from that site to the other site that is not experiencing the disaster. If a customer deploys a wide area disaster recovery architecture, recovery time can be as little as seconds or minutes, to hours depending on, among other things, the processes in place, the readiness of the IT staff to act on those processes, and the amount of data that needs to be mounted at the secondary site. Without Wide Area Cluster technology, the downtime cost is considerable given the time necessary to deploy new servers, upload the services and mount the data as well as the expense of idle users and lost productivity. Clearly there is an advantage to deploying Wide Area Disaster Recovery. Cost Comparison 15

16 The cost of deploying Wide Area Disaster Recovery architecture is expensive and usually is deployed due to a government mandate or to meet regulatory requirements. Providing hardware, software and networking infrastructure at a remote site is a daunting task for most companies. Therefore, it is important to provide professional services to help with deployment. CUSTOMER SCENARIO BlueStar The Situation BlueStar Solutions is a leading provider of hosted enterprise-class applications such as ERP, financials, taxware, human resources, sales distribution, and other data-intensive and business-critical programs. Its customers demand guaranteed service levels for availability, performance, scalability, and support. With over 500 servers handling over 127 terabytes for multiple customers and varying applications, the management of data and storage has always been a challenge for BlueStar s technical staff. Customers don t buy equipment from us; they buy a service. And the service is what we get paid on. So it s in our best interest to evaluate and select the best technology out there to provide the best service back to the customer, says Bill Augustadt, Chief Architect and Technologist for BlueStar Solutions. Every time we sell a service that includes hosting and servers and applications, VERITAS is automatically plugged into the equation. The customer wants to know how we are going to provide the service levels that we guarantee in their contract, and by mentioning VERITAS they understand how we will provide availability, scalability, and recoverability. Customer Profile Summary Leading provider of enterprise application outsourcing for SAP environments o Host more than 50 customers, 35,000 users in 20 countries o Support more than 215 instances of SAP, completed 75 migrations/30 upgrades Headquarters in Cupertino, CA, USA Robust Service Level Agreements, customized for the needs of each customer Problem Statement Need to achieve 99.9% system availability across all instances Deliver consistency to customer base Needed to achieve a recovery time objective of 4 hours Needed to achieve a recovery point objective of 1 hour Description of Environment Operating System: Solaris Data centers in Phoenix, AZ and Dallas, TX Approximately 550 servers including Intel (Dell and IBM) and Unix (Solaris, Compaq, HP) Servers: Hitachi 9960 and Hitachi 7700 disk arrays Applications: Oracle, SAP, and other databases ranging from 200GB to three terabytes Over 127 terabytes total storage (raw) Network: OC-12 VERITAS Products VERITAS Foundation Suite VERITAS Volume Replicator VERITAS Global Cluster Manager (now called VERITAS Cluster Server Global Cluster Option) VERITAS Cluster Server VERITAS NetBackup Success BlueStar saved millions by replicating between dissimilar hardware and without any proprietary network infrastructures. VERITAS products have enabled BlueStar to solve a number of issues that were once slowing its corporate success. Data backup, for instance, was long a frustrating challenge. With the sheer volume of data, 16

17 plus the number and variety of servers and storage devices, how can it make sure that the libraries are compatible and can be shared across multiple platforms? VERITAS made that happen. CONCLUSION Best practices for disaster recovery start with tape backup and data redundancy using disk volume mirroring. Shared storage helps keep applications online when administrators deploy a scalable cluster infrastructure in conjunction with an automated disaster recovery plan that facilitates wide area data center migration. As business needs evolve, enterprises can add corresponding layers of availability, building upon a backup strategy that is already in place. By deploying products that enable high availability and disaster recovery, such as an integrated software suite from VERITAS, organizations can protect data and applications in their data center environment while deploying an IT architecture that best fits the requirements of the business. VERITAS Software Corporation Corporate Headquarters 350 Ellis Street Mountain View, CA or