AUTOMATED QUOTA MANAGEMENT AND FILE SCREENING

Size: px

Start display at page:

Download "AUTOMATED QUOTA MANAGEMENT AND FILE SCREENING"

Cameron Gray
6 years ago
Views:

1 StorageCentral: Architecture Overview AUTOMATED QUOTA MANAGEMENT AND FILE SCREENING For Windows Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other VERITAS 1 product names and slogans are trademarks or registered trademarks of VERITAS Software Corporation in the US and/or other countries. Other product names and/or slogans mentioned herein may be trademarks or registered trademarks of their respective companies. Specifications and product offerings subject to change without notice. Printed in USA and the EU. April 2004.

2 TABLE OF CONTENTS TABLE OF CONTENTS...2 architecture overview...3 Agents...3 Collectors...3 Management Console...4 Managed objects...4 Policies...4 Policy management and propagation...5 Computer policies...5 Allocation Design Overview...6 Allocation (Quota Management) Flow:...6 Allocation Functional Overview...6 File Groups...6 Policies and Managed Objects...7 Reporting...8 Report definitions...8 Report sets...8 Running reports...8 Scheduling Reports with Collectors...8 Active HTML reports...9 Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 2

ARCHITECTURE OVERVIEW VERITAS StorageCentral uses a distributed architecture that scales throughout enterprises small and large with a minimal impact on existing resources.

3 ARCHITECTURE OVERVIEW VERITAS StorageCentral uses a distributed architecture that scales throughout enterprises small and large with a minimal impact on existing resources. The three basic components of this architecture are agents, collectors, and consoles. AGENTS Agents are small software components that provide the core functionality of StorageCentral. Agents are installed and executed on any Windows 2003, Windows 2000, or Windows NT 4 server for StorageCentral quota management or file screening. Agents run as a background service and are managed from a StorageCentral console. Agents are the primary workhorses of the StorageCentral product. However, Agents do not contain a user interface of any kind. Instead, they run entirely in the background, accepting instructions from the StorageCentral management console. COLLECTORS The reporting function that comes with StorageCentral may be used to report on large numbers of files in a production environment. The process of gathering and processing the file information can be time-consuming if a significantly large number of files are being reported on. In some situations the StorageCentral collector may require a dedicate system for a report execution. The StorageCentral collector can be installed on a standalone system or on a management workstation, allowing offloaded report processing. Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 3

MANAGEMENT CONSOLE The StorageCentral management console controls all operational aspects of StorageCentral. The console is a snap-in to the Microsoft Management Console.

4 MANAGEMENT CONSOLE The StorageCentral management console controls all operational aspects of StorageCentral. The console is a snap-in to the Microsoft Management Console. Customers can deploy one or more management consoles to manage and monitor deployed StorageCentral agents and report collectors. MANAGED OBJECTS A managed object is the basic unit of management for StorageCentral. Managed objects may be a file, folder, share, or partition. With Active Directory Edition, Organization Units (OUs), sites, and domains can also be managed objects. Managed objects have a space allocation or a file screening policy associations. StorageCentral applies policies to managed objects. For example, a policy prevents MP3 files from being saved. A StorageCentral management console can be used to associate that policy to a folder. The folder is now a StorageCentral managed object. StorageCentral will prevent MP3 files from being saved to that folder. POLICIES Policies can contain both space allocation (quota management) and file screening properties, and implement storage management policies. By themselves, policies have no effect. When applied to eligible file, folder, share, or partition, policies define managed objects. Policies can act as templates, applying the same business practices to multiple managed objects. Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 4

5 POLICY MANAGEMENT AND PROPAGATION When a policy is applied to a managed object, the properties are copied to the managed object. If the policy is changed in the future, StorageCentral by default copies changes to associated managed objects. A StorageCentral policy can be configured not to automatically propagate policy changes. In some cases, folders and/or users can be disassociated from a policy and will continue to exist as StorageCentral managed objects, via the management console interface. COMPUTER POLICIES Computer policies are available with StorageCentral Active Directory Edition and apply only to servers. Computer policies specify the systems that the policy will apply to, the folders on each system that the policy will apply to, and actions such as auto detecting disks, folders, and folder policies. Computer policies specify server-wide policies and apply them with a single policy. Computer policies consistently apply policies to new systems. By applying the computer policy to an Active Directory Organizational Unit, StorageCentral ensures that any system defined to that Organizational Unit will automatically receive the correct policies. Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 5

6 ALLOCATION DESIGN OVERVIEW Space allocation is physically implemented as a Windows service called QuotaAdvisor server. The service receives instructions from the StorageCentral management console. The service does not actually implement allocation policies; instead, it creates and manages policies for users. Policies are enforced by a patented filter driver (TruStor), file name QAFilter.sys stored in %systemroot%\system32\drivers\qafilter.sys. The filter driver is viewable via Device Manager and selecting the option to view hidden devices. ALLOCATION (QUOTA MANAGEMENT) FLOW: StorageCentral management console communicates with the QAServer service to create or modify space allocation settings. QAServer service communicates with the filter driver to create or modify allocations as instructed by the management console. In effect, the service acts as a front door to the filter. Filter driver monitors file I/O and adjusts space usage information accordingly. Allocation values and current usage are stored in a local data file, which resides in server memory. o o o o Filter drivers responds to the QAServer service to modify and display allocation information. The filter triggers QAServer to take alarm actions when allocation usage exceeds the configured alarm threshold. Allocation information is persistent, and is stored on each volume. This technique provides excellent scalability, and makes StorageCentral cluster-compatible. StorageCentral reads allocation information from the volume when Windows mounts the volume at system startup. The driver filter enforces allocation policy limits. QAServer performs actions as configured when triggered by the filter. Actions are stored in a local data file. ALLOCATION FUNCTIONAL OVERVIEW Space allocation is an object-based process. Administrators use the StorageCentral management console to define managed objects, which can be files, folders, logical drives, or file shares. With Active Directory Edition, managed objects can also represent Organizational Units (OUs), sites, or domains. Space allocation policies define quotas. Policies can define an active limitations, such as preventing users from storing more than 10MB. Policies are applied to managed objects, and become a governing force for how those managed objects behave. From a design standpoint, the StorageCentral components monitor managed objects; if anything happens to a file or folder that isn t part of a managed object, StorageCentral ignores it. File Groups StorageCentral comes with predefined file groups. Customers can modify predefined file groups and create new file groups. File groups provide an easy way to define a related set of files and/or file types. For example, a file group named graphic files 2 may include unauthorized file types of.gif and.jpg, while containing authorized file types.tif and.bmp. File groups can contain a list of authorized types, unauthorized types, or both. Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 6

7 Policies and Managed Objects File blocking is implemented through policies, just like disk space allocation. A policy can include both space allocation (quotas) and file blocking policies. Policies are applied to managed objects, and enforce file placement (or allocation) within managed objects. File blocking policies have properties. When file blocking policies are created, file groups are specified for the policy. And, file groups can include both authorized file types and unauthorized file types. File blocking policies can be active or passive. In passive mode, alarms are activated when the policy is violated but the file I/O is allowed to continue. Active policies stop files that violate the policy from being allocated in the managed object. File blocking policies by default use the file name extension to define the file type. File blocking policies can be configured to identify file type based on the content of the file. Users trying to bypass policy may try to rename their files for example, renaming an unauthorized JPG file with a DOC extension. By configuring the blocking policy to check file content, StorageCentral stops users and blocks unauthorized files even if they have been renamed. StorageCentral stores file type signatures in the system Registry. Some file types include multiple signatures (MP3, for example), reflecting the changing content types of those files. These signatures are used for content checking, when that option is selected in a policy. Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 7

8 REPORTING REPORT DEFINITIONS Report definitions are templates that determine what a report will look like, and what data the report will display. In this way, report definitions act as a starting point for report sets. Report definitions are batched together in to a report set. In report sets, definitions can be modified without modifying the original definition. Report definitions draw data from server file system, from the StorageCentral quota database, and the StorageCentral trend databases, enabling comprehensive customizable reporting capabilities. REPORT SETS A report set is a collection of built-in and custom report definitions. A report set batches one or more report definitions for preparation as part of a common pass of a file system. A report set can apply filters to the reports it contains. For example, a report set may filter on a specific folder \Users\ on a particular server. The report set will limit the report to data in the filtered object, enabling reports on specific servers or other managed objects. Report sets also define output format for the report data, such as an HTML file, a CSV file, and so on. RUNNING REPORTS Reports can be scheduled or run interactively. Report sets can be run interactively, StorageCentral processes the report on demand. Running interactive reports makes sense for reports with limited scope and retrieving less than 100,000 files. Interactive reports make sense when extracting from one StorageCentral database, since the data is easier to collect that information about files spread across multiple servers. Custom reports can be run without performing any configuration tasks, making it easy to use StorageCentral with an auditing requirement. Running a report is as easy as selecting a drive, file, or folder as the target of a report - without configuring any managed objects within StorageCentral. StorageCentral uses a process called RapidScan to create file reports. Rather than reading each file individually to determine its file type, size, last modification date, and other information, RapidScan retrieves the information from the file system s master file table. This design allows StorageCentral to quickly retrieve file information from a centralized location on each volume, imposing a minimum processor overhead. RapidScan is utilized when reports are executed at the volume level. Data collection in StorageCentral is distributed; report sets that reports on different servers spawn a process on each server to collect the necessary information. That information is reported back to the reporting computer for compilation, earlier described as the collector. SCHEDULING REPORTS WITH COLLECTORS Some reports can take a very long time to run, simply because they have to collect and format a lot of information. For example, generating a list of all BMP files located on 100 different file servers might take a while, especially if the servers contain a lot of BMP files. StorageCentral data collection and report generation runs at a low priority. Rather than tying up a management console for long reporting runs, schedule the report to run at a designated time (like overnight). Each computer has a separate agent to collect local data. StorageCentral uses a collector to Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 8

create and generate report. Designated systems with report collectors perform the time consuming function of sorting and generating reports.

9 create and generate report. Designated systems with report collectors perform the time consuming function of sorting and generating reports. ACTIVE HTML REPORTS One of the most useful features in StorageCentral is the interactive HTML report, which can be viewed in a Web browser. All StorageCentral reports can be generated in Active HTML format, making it easy to create a Webbased reporting solution. Reports in this format can easily be saved in a web portal that is available to all users for storage reporting. As shown below, Active HTML reports offer easy-to-read charts and graphs, as well as detail grids. ActiveX HTML Reports note the drill-down hot link in the Category column Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 9

Many summary-style reports offer the ability to automatically create drill-down reports. For example, in the above screen capture, the Category column includes hot-linked items.

10 Many summary-style reports offer the ability to automatically create drill-down reports. For example, in the above screen capture, the Category column includes hot-linked items. Clicking one automatically creates a report for that category, as shown below: Detail reports like the one above allow users and administrators to examine individual files and folders. As shown below, right-clicking any file provides a number of options: Copyright 2004 VERITAS Software Corporation. All Rights Reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other 10

VERITAS StorageCentral 5.2

VERITAS StorageCentral 5.2 Release Notes Windows Disclaimer The information contained in this publication is subject to change without notice. VERITAS Software Corporation makes no warranty of any kind