Hyperconverged Infrastructure Data Protection Isn t a Snap

Transcription

1 Hyperconverged Infrastructure Data Protection Isn t a Snap

2 CONTENTS From Virtualized to Hyperconverged Hyperconvergence for What?... 3 Hyperconvergence = New Threats: Understand Data Protection and the Implications in an HCI.. 4 Understand Data Protection Basics to Understand its Role for HCI Projects... 2 Hyperconverged Data Protection... 5 Array-Based Snapshots Are Not Backups... 5 Hypervisor Snapshots... 6 Where Snapshots Fall Short... 7 Choosing the Right Approach for HCIs... 8 Quantum and Veeam: Data Protection for Hyperconverged Environments Hyperconverged Infrastructure Data Protection Isn t a Snap

3 FROM VIRTUALIZED TO HYPERCONVERGED Simplification and cost reduction have always been the holy grail of IT managers. Beginning in the 1960s, IT managers used virtualization as a method of logically dividing the system resources provided by a mainframe computer between applications. The next wave of virtualization resurgence in 2005 was based on x86 machines its objectives were to do more with less and make IT administrators lives easier. Lately, this do-more-with-less approach called hyperconvergence is expanding out of the server scope to reach not only the compute layer, but also data storage devices and networking equipment. The concept is simple include storage, compute, and networking in one box. A single preconfigured appliance greatly simplifies management and maintenance. Over the last year, we ve seen even more convergence in the hyperconverged infrastructure (HCI). HCI solutions include the converged layer components storage, compute, and networking as well as a hypervisor (as used in virtual environments), all managed through a single interface. It s an IT stack in a box. This software-centric architecture represents the current ultimate simplification. A vendor provides a preconfigured solution with hardware and software in a single system minimizing compatibility issues and simplifying management. The system is designed and must be managed and used as a single system it can t be broken down into separate components. In parallel with HCI development, vendors have created the next level of abstraction software-defined data centers (SDDCs). With SDDCs, all of the elements in an IT stack are fully virtualized and delivered as a service. Some vendors define their solutions as software-defined hyperconverged appliances. To simplify the discussion in this paper, we ll consider SDDC and HCI to be in the same category. Hyperconvergence for What? For smaller companies with relatively few virtual machines (VMs), an HCI solution may be the only architecture their data center needs, providing the ultimate simplification. However, the larger the environment, the more complex the storage and network design can be. Typical HCI workloads are VMs, virtual desktop infrastructures (VDIs), and disaster recovery (DR) sites. Some critical applications can also be hosted on an HCI, but designing an HCI to meet performance service-level agreements (SLAs) might be challenging compared to designing a more traditional infrastructure. Simplification can create complexity especially when HCI and existing independent IT components are deployed in the same environment. Hyperconverged Infrastructure Data Protection Isn t a Snap 3

4 Hyperconvergence = New Threats: Understand Data Protection and the Implications in an HCI Data protection is the process of safeguarding important information from corruption and/or loss. The term data protection is used to describe both operational backup of data as well as protection against localized disasters and online threats like ransomware. Companies need to protect against hardware failure, data corruption, and facility outages; security breaches and viruses; and data loss due to unhappy employees or human error. These are just a few of the reasons to implement a formal data protection policy. Data protection is not an option, it s an insurance policy. There are numerous data protection technologies available such as snapshots, WAN optimization applied to replication, backup deduplication and compression appliances, continuous data protection, copy data management, and many more. In today s environment, a traditional backup approach is constantly challenged by many threats. As data center technology evolves, from virtualization to HCI, other data protection methods can also be used in conjunction with or replacing backups. As waves of IT solutions come and go, some old rules still apply. The backup rule is timeless. This strategy helps you overcome nearly any failure scenario. Despite the rule s simplicity or perhaps because of it, many IT managers continue to ignore it and lose their data because they were unprepared for a disaster. A robust data protection strategy should use the rule. Following the rule is even more critical for highly consolidated virtual environments and HCIs due to the consolidation nature of the data. Here are the basics of a rule (or strategy): Keep three (3) different copies of your data. In addition to your primary data storage, you should also have at least two (2) backup copies. Keep data on two (2) different media types such as disk and tape. Storing copies on two different media ensures that a failure of any one device will not affect the recoverability on another. If possible, store copies in a different physical location than the original. Using a different medium is required because a common failure is likely to affect all devices. Keep one (1) copy off-site. This is the most important part of the rule. Keeping a copy off-site protects data against fires or a natural disaster that can take out both your primary data and all your backup copies at once. This off-site copy can be stored in the cloud, but it s better to use an offline media (such as tape). Offline storage offers a number of benefits from an availability perspective. Whether it s the latest malware risk or possibly some physical issue (like an extreme power problem that damages everything), there is a use case for tape storage in today s modern world. Besides, the portability and acquisition cost of tape can t be beat. Not following the rule can put you out of business. This happened to a code-hosting and software collaboration provider that was forced out of business by an attacker who deleted the company s data and backups after gaining root access. Primary data and backups copies were stored in the same infrastructure, failing to be on two different media and in two different locations. The company also did not have an offline copy, which would have been a lifesaver in this situation. Even if copies of data are stored on a geospread architecture, as long as they re on one console, it doesn t count as off-site. Data remains vulnerable to any type of administrator identity attack, which is more likely to be carried out by an ex-employee than a hacker. 4 Hyperconverged Infrastructure Data Protection Isn t a Snap

5 There is incredible versatility in how the rule can be implemented since it doesn t specify any specific technology. For instance, backups on tape are one way to get data off-site and on different media. Replicated virtual machines are another way to address different media types such as a storage system. Even putting backups in a service provider cloud can be a way to easily address the off-site requirement. In any situation, you can use the rule to meet any availability requirement for the advanced data center. HYPERCONVERGED DATA PROTECTION HCI brings nondisruptive scaling, reduced complexity, and other benefits, but it requires a stronger data-protection strategy because hyperconvergence brings new vulnerabilities. A root compromise anywhere provides complete and unfettered access to everything in that system the entire IT stack. There is no separation of application interfaces and configurations, and all services share the same security characteristics and profile. This means if there is a single root compromise, an intruder can access all application interfaces, all networking functions, and all the databases and storage for all systems. Using a single vendor increases the chance of a zero-day attack a hole in software that is unknown to the vendor, and therefore, no vendor fix or patch is available for it leaving the HCI vulnerable to a single attacker. What about ransomware attacks like Locky or Cryptolocker? Ransomware is a type of malware that prevents or limits users (or administrators) from accessing their system, either by locking system access or by locking files. Today s ransomware encrypts files and uses new infection routines that enable them to spread across networks and servers. Hyperconverged systems are a perfect target one unique system to encrypt with a built-in replication to spread the malware. Simply put, putting all your eggs in the same basket induces a vulnerability. In Australia, a faulty software update deployed by a local telco left tens of thousands of DSL broadband customers without internet access. Consolidation offers great benefits, but can also introduce new risks a faulty software update on an HCI can cause a major outage to your users. Array-Based Snapshots Are Not Backups Some HCI vendors make a categorical statement that you do not need any other product to build a complete infrastructure. That means no backup software, no deduplication appliances, no DR products, nothing additional it s all included. The caveat they fail to mention is that the built-in data protection technology is often based on snapshots. Array-based snapshots, also known as storage snapshots, are widely used to quickly create point-in-time virtual copies of data. But storage snapshots, unless copied to secondary media do not protect against media failures. Snapshots are not sufficient as a backup because if the volume is inaccessible, so is the snapshot. Imagine deleting or removing access to your storage during a routine upgrade the snapshots are worthless because they are stored on the same inaccessible storage. Hyperconverged Infrastructure Data Protection Isn t a Snap 5

6 In addition, there are different snapshot variants to consider: Copy-on-write snapshots make an initial snapshot that further updates as the data is changed. But if one iteration is corrupted or unavailable, then the restoration might be impossible to perform and the uncorrupted data is lost. Clone/split-error snapshots create reference pointers to the entire contents of a mirrored set of drives, file system, or logical unit number (LUN) every time a snapshot is made. When a clone is created, this can negatively impact production performance as it can access primary data at the same time as the host. Not the best choice for HCIs. Continuous data protection (CDP) is another method to create snapshots that tracks and stores all updates to data as those updates occur. But CDP requires additional storage in order to keep every changed block copy, and more performance to store it. In a hyperconverged solution, it means adding the full stack of compute, networking, and so on, when only storage is required to protect primary data. Array-based snapshots typically occur very quickly. The number of supported snapshots varies by platform, with some suppliers providing support for hundreds or thousands of snapshots per system. Most suppliers offer advanced scheduling to automate the snapshot process. Remember also that snapshots on the array are based on a LUN or volume. This means that array-based snapshots may contain many VMs, making it difficult to build schedules around protecting individual VMs. This is expected to change with the introduction of Virtual Volumes (vvols), but it s still a complex job. (For information on VMware vvols, read this article.) So what if we want to back up only two VMs? Do we need to acquiesce to all of them? What if we want to protect some VMs in different backup groups with different backup policies? A dedicated backup software solution, such as Veeam, is recommended to overcome these limitations and provide additional data protection capabilities. Hypervisor Snapshots Hypervisor-based snapshots, on the other hand, operate at the VM level, allowing a snapshot policy to be applied to each VM individually. With the advent of virtualization, the hypervisor now provides an alternative location from which to execute the snapshot process. VMs are simply files (VMDKs in the case of VMware vsphere and VHD files on Microsoft Hyper-V), which means creating and managing snapshots is a case of manipulating these image files. When a VM has an active snapshot, its virtual disk I/O is not performed on the VM s actual virtual disk, but instead they are kept unchanged, and whatever changes in the VM is written to different physical files. This type of snapshot has three side effects: Disk I/O for the VM is much slower since when a snapshot is created, it produces an additional delta file. Each successive snapshot produces an additional file. When a disk operation is performed within the guest, the disk I/O is recreated by parsing each snapshot delta file in the chain. This produces additional disk overhead on the host because more than one file must be opened and processed to recreate the I/O data for the guest operating system. The delta files keep growing over time, consuming disk space. When the snapshots are removed, the delta files have to be merged back to the main virtual disk. This is slow and time-consuming. 6 Hyperconverged Infrastructure Data Protection Isn t a Snap

7 Best practices for virtual machine snapshots can be found in the VMware Knowledge Base, including: A snapshot file is only a change log of the original virtual disk and should not be retained as a backup. Do not use single snapshot for more than hours. Where Snapshots Fall Short As previously mentioned, the major problem with snapshots is that they are usually kept on the same physical volume as the running VM. Obviously this means that if data loss occurs because of a problem with a volume or system, or a failed upgrade, the snapshot will disappear or be corrupted along with the original VM. Furthermore, snapshots are not distinct copies taken at regular intervals; they are generally deltas. New data is incrementally stored, rather than completely replicating the whole image. So what happens if the original storage volume had become corrupted at some point in time? If the parent volume is corrupted, then it becomes impossible to restore at any point in time along the snapshot tree. The same risk applies to virtual snapshots that are often dependent on the original disk image for information. If that image is damaged, the snapshots become worthless. For instance, a command can be run that accidentally removes critical data. For an example of this, view the video How Toy Story 2 Almost Got Deleted. A snapshot can help protect files, but it s not a replacement for a full backup strategy with multiple copies of a system and/or files in a physically separate location. If ransomware starts encrypting your data or malware hits your drives, the snapshot will be affected as part of its imaging data. Compliance is another area where snapshots fall short. They are not designed for long-term retention a common requirement for governance, audits, and compliance. Also, some vendors support a very limited number of snapshots. As previously mentioned, hypervisor vendors do not recommend keeping more than two or three snapshots, and array-based snapshots also have some limitations. For example, a limit of 255 array-based snapshots means less than 37 weeks of retention (assuming one snapshot per day), unless you are using different retentions for hourly/ daily/weekly/monthly snapshots to increase retention but it still can t achieve years or decades of retention. Snapshots do not replace backup, but they can be used to enhance a data protection strategy if you use them at the right time and for the right tasks. Some technologies in an HCI integrate VM-centric backups and DR features to improve availability. Others support snapshots and replication, and provide a common engine across multiple systems. As a result, management is consolidated into a single interface. This covers only some aspects of the strategy, perhaps supporting different media or offline media only, and so on. A dedicated data protection solution, such as Veeam, can increase the level of protection especially when the strategy is used to overcome nearly any failure scenario. Hyperconverged Infrastructure Data Protection Isn t a Snap 7

8 CHOOSING THE RIGHT APPROACH FOR HCIs The best solution for HCIs is to adopt a strategy and combine different technologies. Shortterm snapshots or CDP are great for dealing with user errors or some data corruption scenarios. Snapshots are also the fastest way to restore data. Backup tools, in particular those designed to safeguard virtual environments, are the best solution to protect against hardware failures, site disasters, and virus/ransomware attacks if combined with offline media such as tape. Backups are better for mid-term and long-term data retention. Adding a deduplication appliance can help to reduce the amount of storage required for data protection and the bandwidth required for replication. Deduplication is a must-have if there is a requirement for multiple backup copies in geographically dispersed locations. Why multiple copies? Why long-term retention? Suppose you are hosting virtual desktops on your brand new HCI. Some of your users take a long-term leave of absence, and you routinely remove unused accounts after a few months. This happened to a government agency in the UK and the agency was saved by its backups. Quantum and Veeam: Data Protection for Hyperconverged Environments If you want to avoid putting all your eggs in the same basket, but also don t want too many baskets, Veeam and Quantum offer the best solution to protect HCIs. Data is stored in three different places as shown below, with protection policies managed by Veeam software. ON-SITE Copy 2 OFF-SITE APP OS APP OS APP OS QXS Hybrid Storage -or- Virtualized, Converged, Hyperconverged Environment Veeam Backup Server DXi Dedupe Disk 2 Media Types Cloud 1 Off-Site Copy Off-line Copy 1 Copy 3 Scalar Tape Library Tape Veeam and Quantum are applying hyperconvergence principles to secondary storage and backup solutions. Quantum offers a complete backup solution to implement a best practice approach for data protection: Quantum QXS delivers fast block storage array Quantum DXi provides patented variable-length deduplication Quantum Q-Cloud Protect stores a copy off-site in the cloud Quantum Scalar stores offline/off-site copies on tape. Veeam Backup & Replication manages all backup policies and data movement. 8 Hyperconverged Infrastructure Data Protection Isn t a Snap

9 Hyperconvergence provides great benefits, but it brings new vulnerabilities. Separating production and data protection can be a pragmatic way to mitigate risk and costs. Don t keep your backups or snapshots on the same physical volume or hardware as your production virtual servers. If you have a data loss due to hardware failure, human error, failed upgrades, or any other threat you ll lose everything. For more details on the Quantum and Veeam solution, read this technical brief (Veeam and Quantum Tech Brief TB00043). Hyperconverged Infrastructure Data Protection Isn t a Snap 9

10 ABOUT QUANTUM Quantum is a leading expert in scale-out storage, archive and data protection, providing solutions for capturing, sharing and preserving digital assets over the entire data lifecycle. From small businesses to major enterprises, more than 100,000 customers have trusted Quantum to address their most demanding data workflow challenges. Quantum s end-to-end, tiered storage foundation enables customers to maximize the value of their data by making it accessible whenever and wherever needed, retaining it indefinitely and reducing total cost and complexity. See how at Quantum Corporation. All rights reserved. Quantum, the Quantum logo, Artico and StorNext are either registered trademarks or trademarks of Quantum Corporation and its affiliates in the United States and/or other countries. All other trademarks are the property of their respective owners. WP00219A-v01 Sept 2016 Hyperconverged Infrastructure Data Protection Isn t a Snap 10