Safe Harbor Statement

Transcription

1

2 Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle. 2

3 Oracle Exadata: Maximum Availability Best Practices and New Recommendations Technical Presentation René Kundersma Consulting Member of Technical Staff; Oracle Exadata Development Oracle Server Technologies Copyright 2016, Oracle and/or its affiliates. All rights reserved.

4 Program Agenda MAA Exadata Overview New MAA Exadata High Availability Features You Get Automatically New MAA Exadata Best Practices For You To Implement* * Cloud Customers, don t worry we are already doing this for you 4

5 MAA Exadata Overview First Let s Review 5

6 Exadata Database Machine Performance, Availability and Security Best Platform for Oracle Databases on-premises and in the Cloud Enabled by: Single-vendor accountability Exclusive focus on databases Deep h/w and s/w integration Revolutionary approach to storage 6

7 Proven at Thousands of Critical Deployments since 2008 OLTP Analytics Data Warehousing Mixed Workloads Petabyte Warehouses Online Financial Trading Business Applications SAP, Oracle, Siebel, PSFT, Massive DB Consolidation Public SaaS Clouds Oracle Fusion Apps, Salesforce, SAS, 4 OF THE TOP 5 BANKS, TELCOS, RETAILERS RUN EXADATA 7

8 Exadata Database Machine Family Same Product Same Price Oracle Owned Oracle Managed Exadata Cloud Service Oracle Public Cloud Exadata Cloud Machine Cloud at Customer Private Cloud Oracle-Managed Subscription Customer Data Center 8

9 Exadata X7 Hardware (changes in red) Scale-Out 2-Socket Database Servers 20% to 40% faster CPUs latest 24 core Intel Skylake 150% faster Ethernet 25 GigE client connectivity 50% more DRAM capacity and throughput Ultra-Fast Unified InfiniBand Internal Fabric Scale-Out Intelligent 2-Socket Storage Servers Intel 10 core Skylake CPUs offload database processing 25% higher capacity 10TB Helium Disk Drives 100% higher capacity 6.4 TB Hot swappable NVMe Flash Database Server High-Capacity (HC) Storage Extreme Flash (EF) Storage 9

10 Exadata X7-2 and X7-8 Performance Improvements vs X6 350 GB/sec IO Throughput 17% more 5.97 Million OLTP Read IOPs 50% more IOPs under 250usec = 3.5M 40% CPU improvement for Analytics 20% CPU improvement for OLTP 40% on X7-8 Dramatically faster than leading all-flash arrays in every metric Each Rack Has Up to: 1.7 PB Disk 720 TB NVMe Flash 10

11 X7 Do-Not-Service LED Data Center tech gets easy to use visual to prevent servicing that might cause an outage. Leverages ASMDeactivationOutcome cell attribute which is storage partner aware 11

12 X7 M.2 Fast Failure Protection and Online Replacement Two M.2 drives house operating system and cell software. Storage server hard disks and flash drives contain application data only. M.2 drives protected with Intel RSTe RAID Chassis can be opened and M.2 drive replaced online while the storage server continues to service the application USB Drive 12

13 X7 Online Flash Replacement Hot-Plug Chassis can be opened and the flash drives can be replaced online while the storage server continues to service the application. For a failed drive, replace when ready For an online drive, just tell us so we can properly prepare it. Example: CellCLI> alter physicaldisk FLASH_2_2 drop for replacement; 13

14 Exadata: Built-in Hardware Fault-Tolerance Redundant Database Servers Active-Active highly available clustered servers Hot-swappable power supplies and fans Redundant power distribution units Redundant Network Redundant 40Gb/s IB connections and switches Client access using HA bonded networks Redundant Storage Grid Data mirrored across storage servers Redundant, non-blocking I/O paths

15 Cost of Downtime Gartner: Cost of $336K - $540K per hr or $11M - $100M per Year IDC: $100k - $500k per hr with critical failures up to $1M/hr with average cost of unplanned downtime between $1.25B - $2.5B per year In addition, Company reputation & Customer Loyalty best-practice-metrics-quantified.pdf

16 Exadata Addressing High Availability Challenges Protection from Planned & Unplanned Outages Type of Outage High Availability Challenges Protection using Exadata Planned Outages Unplanned Outages Disruptive Schema Changes due to application changes to meet ever-changing business requirements Downtime required for lifecycle management like periodic upgrades of firmware & software, data migration Data Corruptions due to hardware/software faults, media issues Application Brownouts due to server, instance storage failures or due to planned maintenance Disaster Recovery (DR) Challenges where the DR site is not keeping up with Production Schema Changes impacts are greatly reduced with faster changes, index and object rebuilds and reorganizations Downtime required for lifecycle management is mitigated using fast online upgrades, patching automation, standby first patching, zero downtime migration Data Corruptions are prevented or the potential downtime is reduced dramatically with additional corruption prevention, detection and auto-repair Application Brownout reduced to sub-second with fastest instance recovery. Disaster Recovery (DR) Challenges are mitigated with fastest redo apply resulting in low Recovery Time Objective 16

17 Exadata Maximum Availability Architecture (MAA) Blueprint for HA That Handles All Failures. MAA Best Practices Baked In Automatically Within Exadata Within a Site Across Sites Redundant Hardware Local standby for HA Failover Remote standby for Disaster Recovery Servers, Disks, Flash, Network, Power Redundant Software Active clusters, Disk/flash mirroring DATABASE IN-MEMORY Redo-based change replication with data consistency checking LAN DATABASE IN-MEMORY Redundant Systems Redundant Databases WAN DATABASE IN-MEMORY Redundant Systems Redundant Databases Online updates, reconfiguration, expansion Fastest RAC Instance and Node Failure Recovery Fastest Backup - RMAN Offload to Storage Deep ASM Mirroring Integration Fastest Data Guard Redo Apply Complete Failure Testing with Lowest Brownouts 17

18 MAA Reference Architectures Recovery Time & Recovery Point Objectives BRONZE Dev, Test, Prod Zero Backup Data and Loss Backup Recovery to the Cloud Use Case SILVER Prod/Departmental Bronze + Zero Downtime RAC High Availability GOLD Business Critical PLATINUM Mission Critical Gold + Silver + Zero Downtime Zero Data Loss Golden Maintenance Gate Cloud / Migration Svc. Zero DR to Data the Loss Cloud Use Case HA and DR 18

19 Planned Maintenance Unplanned Outages Unplanned Outages and Planned Maintenance Bronze - Single Instance Database on Exadata Events Downtime (RTO) Data Loss Potential (RPO) Database instance failure Minutes Zero Recoverable server failure Minutes to hours Zero Data corruptions, unrecoverable server failure, database or site failures Hours to days Online file move, reorganization/redefinition, and certain patches Zero Zero Hardware or operating system maintenance and database patches, patch set updates and bundle patches Minutes to hours Database upgrades: patch sets and full database releases Minutes to hours Zero Since Last Backup (or) Near Zero with Recovery Appliance Zero Platform migrations Hours to a day Zero Application upgrades that modify back-end database objects Hours to days Zero 19

20 Planned Maintenance Unplanned Outages Unplanned Outages and Planned Maintenance Silver High Availability with Fast Failover Events Downtime (RTO) Data Loss Potential (RPO) Database instance failure Seconds Zero Recoverable server failure Seconds Zero Data corruptions, database unable to restart, site failure Minutes to Hours Since Last Backup (or) Near Zero with Recovery Appliance Online file move, reorganization/redefinition, and patching Zero Zero Hardware or operating system maintenance and database patches, patch set updates and bundle patches Database upgrades: patch sets and full database releases Minutes to Hours Zero Platform migrations Hours to days Zero Zero Zero App upgrades that modify back-end database objects Hours to days Zero 20

21 Planned Maintenance Unplanned Outages Unplanned Outages and Planned Maintenance Gold Comprehensive HA and Data Protection Events Downtime Data Loss Potential Database instance failure Seconds Zero Recoverable server failure Seconds Zero Data corruptions, database unable to restart, site failure Seconds to minutes Zero to seconds Online file move, reorganization/redefinition, and patching Zero Zero Hardware or operating system maintenance and database patches, patch set updates and bundle patches Zero Zero Database upgrades: patch sets, full database releases Seconds to minutes Zero Platform migrations Seconds to minutes Zero Application upgrades that modify database objects Hours Zero 21

22 Planned Maintenance Unplanned Outages Unplanned Outages and Planned Maintenance Platinum Zero Outage for Platinum Ready Applications Events Downtime Data Loss Potential Database instance failure Zero Zero Recoverable server failure Zero Zero Data corruption, database unable to restart, site failure Zero Zero Online file move, reorganization/redefinition, patching Zero Zero Hardware or operating system maintenance and database patches, patch set updates and bundle patches Zero Zero Database upgrades: patch sets, full database releases Zero Zero Platform migrations Zero Zero Application upgrades that modify database objects Zero Zero 22

23 Oracle Maximum Availability Architecture (MAA) Production Site RAC / RAC One Scalability Server HA Flashback Human error correction Application Continuity Application HA ASM Local storage protection Edition-based Redefinition, Online Redefinition, Data Guard, GoldenGate Minimal downtime maintenance, upgrades, migrations Enterprise Manager Cloud Control Site Guard, Coordinated Site Failover Global Data Services Service Failover / Load Balancing Sharding Horizontal Partitioning, Scalability, Shared Nothing architecture Active Standby Site Active Data Guard Data Protection, DR Query Offload GoldenGate Active-active replication Heterogeneous RMAN, Oracle Secure Backup, Zero Data Loss Recovery Appliance Backup to disk, tape or cloud 23

24 Exadata: Management Health Check using EXAchk Utility EXAchk provides configuration specific, up-to-date health check across the entire stack Covers Exadata, Database, Grid Infrastructure, ASM critical issues Provides MAA scorecard with MAA configuration gaps and guidance to mitigate Automated periodic scheduled runs with notifications Continuous evolution of configuration checks EXAchk helps with saving a lot of time and money due to proactive health verification which dramatically reduces downtime Currently has over 1000 checks per target Note: Automated Exachk Healthcheck MOS

25 Development Backed Best Practices Continuous Improvement, Always a Priority Idea Weekly Expert Review / Testing Publication MOS Note Default Exadata deployment Engineered System with Best Practices Exadata Health Check (Exachk) You are here But you are also here! 25

26 Continuous Improvement and Regular Real World Checkups High Priority Inside Oracle Development Weekly meeting to process Best Practices and Critical Issues flows right into exachk 26

27 New MAA Exadata High Availability Features You Get Automatically Important Features We Have Developed For You This Past Year 27

28 Fault Tolerant Availability Exadata and SuperCluster both achieve AL4 fault tolerance in a Maximum Availability Architecture* configuration *Gold or Platinum reference architecture FIVE NINES 5X % A New Gold Standard Only other AL4 Systems IBM - z Systems HPE - Integrity NonStop & Superdome Fujitsu GS & BS2000 NEC FT Server/320 Series Stratus ftserver & V Series Unisys Dorado 28

29 Exadata Marquee/New HA Features Reduced HA Brownout Fast Node Death Detection on Database Nodes and Cells Example of Database node power failure with an OLTP workload and CSS misscount=60 29

30 Application Brownout in a Typical Configuration Storage Controller Proprietary Protocol Timeouts SAN/LAN Clusterware Timeout Storage Controller SCSI Timeout Each layer of the application stack has its own failure detection method Vendors try to obfuscate these details by quoting client side failure numbers In most cases the fault detection times are additive For example if storage controller crashes it will take 2 SCSI timeouts for the database server to detect such a failure 30

31 Seconds Exadata: Unique Brownout Reduction Features Instant Failure Detection Maximum Application Uptime If a server disappears from both InfiniBand switches, declare it dead in less than two seconds No waiting for long heartbeat timeouts NVMe Flash Reduces application brownouts from 30+ seconds to < 2 seconds Active/Active IB configuration provides: Extreme throughput - 40 Gb/s QDR Extreme availability - RDS failover in 1-2 seconds with minimum application impact Application Brownout 0,8 Exadata 300 3rd Party Storage 31

32 Failed Storage Here lies disk drive in slot 11 who lived a long life and served its purpose 32

33 Sick Component Handling Disks

34 Exadata: Data Protection Corruption Detection, Prevention & Repair If an application update in the database encounters corruption Database reads from the ASM mirror Repairs the corruption using the good copy This repair happens without impacting other database processes and application When a network packet in the I/O path between DB server and storage node is corrupted Storage cell prevents the write ASM retries by re-sending the packet Application never encounters corruptions Automatic disk inspection and repair when disks are idle Hardware Assisted Resilient Data (HARD) compliant checks 34

35 Exadata: Data Protection Disk Sector / IO Error Detection, Prevention, and Repair Application never encounters the IO error Just in case the Administrator would like to know, we log the following: <Cell side> Begin scrubbing CellDisk:CD_06_cell06. Read Error on Cell Disk CD_06_cell06 (/dev/sdg) at device offset bytes with size bytes (errno: Input/output error [5]) Read Error on Grid Disk RECOC1_CD_06_cell06 at grid disk offset bytes with size bytes from disk scrub Read Error on Cell Disk CD_06_cell06 (/dev/sdg) at device offset bytes with size bytes (errno: Input/output error [5]) Read Error on Grid Disk RECOC1_CD_06_cell06 at grid disk offset bytes with size bytes from disk scrub Disk sector goes bad Exadata Scrubbing finds bad sector and ASM repairs it Broadcast: 1 events ASM REPAIR diskgroup of opcode 10 for diskgroup RECOC1 to: ClientHostName = dbnode1.domain.com, ClientPID = Broadcast: 1 events ASM REPAIR diskgroup of opcode 10 for diskgroup RECOC1 to: ClientHostName = dbnode1.domain.com, ClientPID = Finished scrubbing CellDisk:CD_06_cell06, scrubbed blocks (1MB): , found bad blocks:2

36 Exadata: Data Protection Resurrect drive Storage Failures When a drive is reported as failed, but not physically failed Automatic power cycle the drive to avoid false positive drive failure Works on both High Capacity Disks & Extreme Flash Cells When a drive predicatively fails, avoid flooding it with rebalance IO while maintaining its status in the diskgroup in case its needed Blue light indicating its safe to replace disk avoiding human errors 36

37 Optimized Software Updates We Feel The Need For Speed. Everything In Red Is Newly Available In the Past Year Single Tool To Update Full Exadata Stack Since September x Faster Storage Server Software Updates 2x Faster Database Node Software Updates Automatic Exadata Storage Servers That Update Themselves In Parallel With Application Online 37

38 New MAA Exadata Best Practices For You To Implement * Important Best Practices We Have Developed For You This Past Year * Cloud Customers, don t worry we are already doing this for you 38

39 MAA Exadata Best Practices Supporting Service Levels Since 2008 A special tribute to some best practices that are not technically new but never seem to get old: Use ASM high redundancy diskgroups Ensure adequate space exists to complete an ASM rebalance Enforce use of operating system hugepages for database SGA via use_large_pages=only Ensure Data Guard Failover and Switchover operational procedures exist that you can initiate without hesitation because you have tested them and you know they work For more information on older features and best practices, see MOS note , exachk reports, prior OOW MAA Exadata presentations, and the Exadata documentation. 39

40 Brownout and Blackout Reduction Brownouts and Blackouts have been reduced to low single digit seconds for the most common failure cases. The brownout associated with active/passive client access network port failure is now 60% lower after we thoroughly verified a reduction to the network downdelay parameter. It also prevents false positive VIP failover when using OVM. This best practice check is in exachk. Heatmap graph we use internally to assess brownouts and blackouts. Every millisecond counts! 40

41 Better Data Protection Eighth and Quarter Rack ASM High Redundancy Voting Device /Quorum Disk Best Practice Check ASM Power Limit Best Practice Check To Ensure a Rebalance Will Run But now we also check for an iscsi device based quorum disk that can house an additional vote device on each database node We already store vote devices on each of the three storage cells 41

42 Optimized Configuration and Management Simplification Reduces Management Costs 12.2 ASM/DB parameter and diskgroup attribute best practice checks Parallel Query parameter reduction best practice checks Multi Tenant non-default service configuration best practice check New Critical category / Tier 1 profile for exachk to ease consumption of most important best practice checks

43 Summary: High Availability Decisions Made Easier Protection From Unintuitive double storage failures Data loss and downtime Unexpected issues during planned maintenance Unexpected production workload profile Known critical issues Resource depletion that affects service levels Over-customization Use Exadata + MAA High redundancy or Normal redundancy with Data Guard For disasters: Data Guard, Golden Gate -> See For local failures requiring recovery: Test your restore/recovery strategy to ensure it works If you can negotiate the downtime within service levels, take it. If not, leverage rolling patch capabilities available at every tier Test environment similar to production, DBMS_WORKLOAD_REPLAY Run EXAchk monthly and when a new release is published Capacity Planning, Resource Management, Enterprise Manager, RAS for new customers Walk the Oracle line as much as you can, and you will gain the most bang for your buck from your engineered system 43

44