Extending MSCS Cluster High Availability Offsite

Transcription

1 Extending MSCS Cluster High Availability Offsite XOsoft solutions and MSCS technology February Trapelo Road Waltham, MA WANSync

2 Contents The Value Proposition... 1 Financial / Executive Impact... 2 Understanding the Options... 3 MSCS clusters with emulated shared storage... 4 MSCS majority node set clusters... 5 Cluster aware high availability software solutions... 7 Additional Layers of Protection / Added Value WANSyncHA provides exceptional added value Implementing the Solution Other XOsoft Products Contact Information... 13

3 The Value Proposition Traditional Microsoft Cluster Service (MSCS) clusters provide excellent protection from server failures and, in some cases, even application failures. Clusters also enable you to reduce planned downtime requirements via rolling maintenance or upgrades. These factors make MSCS shared storage clustering a critical layer of protection for many organizations. Due to the significant levels of protection provided by MSCS shared storage clusters it is easy to forget that such clusters are only one layer of protection in your overall high availability strategy. This type of clustering is unable to protect from data corruption, storage device failure or site/subnet level failures. Examples of such failures include virus outbreaks, human error, network failures, storage device failure, power outages, server room overheating, fire or flooding and natural disasters. Extending your MSCS cluster offsite with a cluster aware high availability solution can close this gap in protection. By using a solution that integrates continuous data protection (CDP) technology you can also protect from data corruption caused by software errors, human errors, or even viruses.

4 Financial / Executive Impact You have, or are seriously considering, Microsoft Cluster technology. Given the nontrivial expense associated with implementing and maintaining Microsoft Clusters, we can safely assume downtime is costly to your organization. With local high availability covered by MSCS shared storage clusters, the ability to quickly failover offsite is simply the next logical layer of protection to prevent downtime you have already identified as costly. A second and perhaps even more important benefit to extending protection offsite is that you now have true disaster recovery and business continuance capabilities. While the risk of such a major disaster might be relatively low, vs. the more common failures clusters typically protect against, the impact is also much higher. According to a study by accounting firm McGladrey and Pullen, 43% of companies that experience a disaster never re-open and 29% close within two years. Of those that do manage to survive, the long-term financial impact can be tremendous. As Figure 1 illustrates for publicly traded companies, an organization that does not respond effectively to a crisis faces a double penalty in the direct impact of the crisis and in a subsequent crisis of confidence by investors, dissatisfied customers, bad press or even legal ramifications. While this example illustrates impact to publicly traded companies keep in mind that privately held companies are no exception. Businesses of all sizes and types face the same core challenges and risks. Figure 1: Shareholder impact Page 2

5 Understanding the Options Traditional MSCS shared storage clusters are necessarily local solutions due to their use of shared storage. Since all nodes in the cluster use the same storage device they must all be in the same physical location. It is this which makes such clusters vulnerable to a variety of threats, including network failures, storage device failure, power outages, server room overheating, fire or flooding and even natural disasters. Figure 2: Shared storage clusters This inherent gap in protection can be overcome by using real time data replication in addition to, or instead of, shared storage. Real-time data replication allows two geographically distant storage devices, or servers, to hold mirror copies of the data at all times, which in turn enables additional offsite nodes which utilize the replicated data. Since the data replication is real-time, potential data loss is zero or at most only a few seconds, even under the most extreme circumstances. Microsoft alone does not provide a complete end-to-end geographically dispersed cluster solution, but it does work with hardware and software vendors to provide a complete solution. This guide presents solutions that use real-time replication to close the gap left by MSCS shared storage clusters. We will discuss the three most common technologies used to allow offsite failover for MSCS clusters: MSCS clusters with emulated shared storage MSCS majority node set clusters Cluster aware high availability software solutions Page 3

6 MSCS clusters with emulated shared storage When you hear geographically dispersed or stretch cluster, it usually refers to this type of cluster. In this case the Microsoft Cluster Service is unaware that replication is taking place and still believes a shared storage device is in use. There are no special features in the Microsoft Cluster Service specific to this kind of configuration. The network and storage devices must preserve the semantics that the cluster service expects. For example, both sites must be in the same IP subnet and the storage device must respond to SCSI commands as if it was a shared storage device. The extended nature of such a solution is the sole responsibility of the hardware vendor, not the Microsoft cluster service. Cluster quorum (internal cluster data) data must be replicated between nodes using synchronous replication. Although application data can be replicated using either asynchronous or synchronous methods, these cluster solutions will generally utilize synchronous replication for both quorum and application data. Synchronous replication means that an I/O is acknowledged on the server only when the change has been committed at both sites. The obvious advantage here is that zero data loss is guaranteed. The downside is that network latency directly affects application performance. The longer it takes to communicate between sites, the lower your disk performance becomes. In effect, this limits the distance over which synchronous replication is viable and it is generally used only between geographically close sites. Performance starts to degrade at around 20 miles and is generally unacceptable beyond 150 to 200 miles. In addition, a dedicated network link of exceptionally high quality and bandwidth is needed. A high-quality emulated shared storage MSCS cluster provides advanced business continuance capability, but it is a benefit that comes at a very steep price, both in terms of dollars to implement and maintain the solution, and in terms of overall complexity. Because of this, such clusters are used relatively infrequently compared to shared storage clustering, and only when exceptional data protection and availability requirements must be met. Page 4

7 Figure 3: Traditional stretch cluster using emulated shared storage MSCS majority node set clusters Majority node set clusters are a new type of cluster introduced in Windows Server Shared storage clusters locate the quorum (internal cluster data) on a shared disk. With majority node set clusters the cluster service uses internal replication to keep the quorum data located on local drives in sync between all nodes. Shared storage is not required for hosting the quorum. This makes majority node set clusters more appropriate for offsite failover. It is important to note, however, that the cluster service does NOT replicate application data this is handled by hardware replication. Keep in mind that the hardware vendor must offer specific support for majority node set clusters. Majority node set clusters still require that all nodes be in the same IP subnet. Synchronous replication is no longer required, although network latency must never exceed 500ms. With this restriction, more flexible asynchronous replication becomes a viable option. Asynchronous replication does not impose any distance limitations nor does it affect application performance. With asynchronous replication disk I/O is not delayed. Changes are simply copied and sent to the target as fast as bandwidth allows. Asynchronous replication gracefully handles minor network issues and even temporary disconnections without impacting application performance. The trade-off for this flexibility and performance is that the target data set can lag slightly behind data on the primary server. For planned switchovers this is not an issue. However, in the event of an unexpected storage device or site failure, you may lose up to a few seconds of data. Considering the relatively infrequent nature of such occurrences, and the many benefits of asynchronous replication, it is the preferred offsite replication method for most organizations. Page 5

8 While majority node clusters provide some attractive functionality, they do have serious design considerations. You may wonder what majority node set means. This is the method by which the cluster ensures that the same resource is not brought online by two nodes at once. This becomes a consideration when network connectivity is lost between nodes. With shared storage clusters the presence of a shared storage device prevents this since only one node may physically access the shared disk at a time. Majority node set clusters prevent two nodes from simultaneously hosting the same resource by allowing the cluster service to run only when a majority of the nodes can communicate. By doing this the cluster ensures that two disconnected nodes will never host the same resource simultaneously. For example, a 5 node cluster can lose up to 2 nodes without problems; failover to functional nodes can occur as needed. However, if 3 out of the 5 nodes fail the other 2 will take themselves offline, effectively bringing the entire cluster offline. While the frequency of such cluster-wide failures should be infrequent, they do add more complexity and require close monitoring to ensure such situations do not occur. Number of nodes in the cluster Number of node failures before entire cluster goes offline Many variations of this cluster type exist, with widely varying levels of protection and availability, depending on the specific features offered by the third-party replication product used. Majority node set clusters can provide high levels of availability with a slightly more Microsoft-centric approach. As with emulated shared storage, however, these benefits typically come with high levels of cost and complexity. This type of cluster is again used relatively infrequently compared to shared storage clustering, and only when specific data protection and availability requirements must be met. Page 6

9 Figure 4: Majority node set cluster Cluster aware high availability software solutions Up to this point we have discussed solutions that extend the actual clusters offsite by adding more nodes. These solutions are well suited for some situations but are too complex and costly for the majority of organizations to justify. This is especially true for organizations already using shared storage clustering since migrating to one of the above solutions frequently requires a total investment near, or even exceeding, that of the original cluster implementation. Other challenges exist on the technical side. Adding offsite nodes requires that you meet Microsoft cluster requirements across a WAN link. The following notable requirements and considerations apply to both of the solutions described above: All nodes in both sites must be in the same IP subnet Additional heartbeat network must be provided between all nodes Network latency must NEVER drop below 500ms All nodes must be of the same hardware type Windows Server 2003 only supports up to 8 nodes in all Windows 2000 Advanced Server only supports up to 2 nodes in all Windows 2000 Datacenter Server only supports up to 4 nodes in all Added hardware expense is required for data replication IT staff must be trained and equipped to support the implementation Generally, consulting services are required during implementation Page 7

10 Cluster-aware high availability software solutions provide an effective alternative at much lower complexity and cost. The concept behind such solutions is a bit different. Rather than adding nodes to the cluster, such software allows failover to a separate [backup] offsite shared storage cluster or even to a stand-alone machine. Replication of the application data is handled from each active host node to the corresponding backup node or server. If a node fails and the resource is moved to a different node the replication source is changed to be the new active node. This approach is referred to as cluster-aware host-based replication. Implementing a host-based software solution is generally the preferred and most cost effective method for extending MSCS cluster high availably offsite. With this type of solution, the offsite machines no longer have to meet Microsoft Cluster requirements, such as those listed above. Failover between different IP subnets is allowed, which reduces network infrastructure complexity and cost. Further cost savings are now possible since the offsite hardware can be completely different from the local machines, so long as they are powerful enough to host the applications in question. For example, you may failover to offsite shared storage clusters, standalone servers or even virtual servers using VMWare or Microsoft Virtual Server. The application failover is handled entirely by the cluster-aware software and can be fully automatic should all available local cluster nodes fail. Generally, the level of automation is configurable and includes several levels, from manual failover, to push-button failover, to automatically triggered failover. Figure 5: Cluster to cluster Page 8

11 Figure 6: Cluster to standalone Figure 7: Cluster to virtual server Software solutions of this type utilize asynchronous replication, which imposes no distance limitations and does not affect application performance. There are many hostbased software solutions available with varying levels of complexity and protection. Some solutions are more intrusive to install, others install with zero downtime. Some require the source cluster to be reconfigured, others do not. Some require that the target machine be a cluster identical to the production system, others have no restrictions. With such a wide variety of capabilities, it is critical that you carefully evaluate and test the solution before selecting and implementing it. Page 9

12 Additional Layers of Protection / Added Value A major advantage to extending protection offsite comes in the form of added value from the software or hardware solution you choose. Ensure that you close as many gaps in protection as possible and that you get the most value possible for your money. For example, in addition to protecting you from loss of your production server, will it also offer protection from corruption via scheduled snapshots, or better yet, true CDP (Continuous Data Protection) technology, which allows you to roll back to a previous point in time should a corruption event occur. Such technology can preserve hours of data compared to restoration from traditional backups. What about testing? Your replica clusters, or servers, are using different Domain Controllers and DNS servers which are located offsite. In addition, a replica server typically sits idle for weeks or even months. Are you really comfortable failing over to a system which has been idle and untested for so long? Clearly offsite replica application and database testing is very important, but is traditionally performed all too infrequently. This is primarily due to the amount of administrative involvement required and the fact that replication must be stopped. Stopping replication leaves you unprotected both during the test and while resynchronization is performed. Ensure that your chosen solution offers the ability to easily test and validate the replica application and data. Offsite backups and/or snapshots offer an additional and cost effective method to add a final layer of protection. Your selected solution should support the ability to perform such operations in a way that ensures the integrity of the backed up data. Example Scenario We consider XOsoft s WANSyncHA as an example of a cluster-aware high availability software solution. WANSyncHA is a typical solution in that it uses host-based asynchronous replication, but is unique in many of its more advanced features and value-add capabilities. WANSyncHA supports push-button or fully automatic offsite failover to another cluster, standalone servers, or virtual servers, as shown in the above diagrams. In addition, completely transparent replica server testing, true CDP and supplemental validated offsite backups are also fully integrated into the product. Rather than a fictitious example, we will review a real-world implementation by one of XOsoft s large legal customers, Locke Liddell & Sapp LLP. Locke Liddell & Sapp are failing over from clusters to standalone servers. By supporting this type of failover across different IP subnets, WANSyncHA provided Locke Liddell & Sapp a cost-effective and low-impact solution. WANSyncHA is deployed on Exchange 2003 and SQL 2000 clusters located at Locke Liddell s Dallas and Houston offices, enabling both sites to serve as standbys for each other. Thus, the passive standalone servers R1/2 in the Dallas office serve as remote standby replicas for the C5/6 Exchange server clusters in the Houston office, while the passive standalone servers R7/8 in the Houston office ensure high availability of the C3/4 SQL server clusters in the Dallas office. Continuous, real-time replication and automated failover together with integrated CDP technology to protect against corruption provide Locke Liddell with complete immunity to disasters of any magnitude. Page 10

13 Figure 8: Example scenario WANSyncHA provides exceptional added value Protects from data corruption via integrated Rewind technology (CDP - continuous data protection) This means you can literally go back to your last consistent state if corruption should occur, instead of potentially losing the hours of data changes since the last backup or snapshot. Corruption could be a logical corruption such as a user who deleted files or database tables accidentally or it could be a physical file level corruption which causes the file or database to be unreadable. It might even be restoring a file or entire folder structure that was accidentally deleted. Because data changes are captured at the file level, rewind can be used to restore individual files or an entire server. The same concept applies to databases as well. In fact WANSync is application-aware for Exchange, SQL and Oracle which means Rewind can take you back to the last consistent database checkpoint or log rotation should a file or logical corruption occur. Assured Recovery enables transparent testing of your replica server Replica server application and database testing is very important but is traditionally performed all too infrequently. This is primarily due to the amount of administrative involvement required and the fact that replication must be stopped. Stopping replication leaves you unprotected both during the test and even longer after the test while resynchronization is performed. Testing has always been important but is becoming even more critical as systems become more complex and compliance requirements are rolled out. Page 11

14 XOsoft s patented Assured Recovery technology will transparently bring your replica MS Exchange, MS SQL or Oracle application services and databases online for automated (or manual) testing on a scheduled basis. Not only does Assured Recovery require no admin staff involvement but replication continues so you are still protected during the test. Assured Recovery is the only testing solution able to actually bring replica application and databases online for full testing without stopping replication or affecting the primary server in any way. Daily or even more frequent replica testing is now feasible. Assured Recovery adds additional layers of protection via offsite backups and snapshots After testing your databases Assured Recovery can trigger backups or VSS snapshots to provide added layers of offsite protection from server failures or data corruption. This does not replace primary site backups or snapshots but does provide key layers of offsite or off-server protection. Quick comparison Feature #1: XOsoft Solution #2: Hardware solutions * #3: Majority node set Asynchronous replication with no distance limitation ** Able to support synchronous replication Able to support automatic, push button or manual failover Does not affect existing local cluster failover behavior Does not require cluster reconfiguration to implement Zero downtime required to implement Allows failover to different server hardware or even virtual servers Able to failover across subnets Minimal IT staff training required Integrated true CDP technology to protect from data corruption Automated offsite server testing/validation Able to support supplemental offsite backups/snapshots *** * Varies depending on the hardware vendor. ** Latency must be under 500ms at all times. *** Depends on replication and/or hardware device functionality. Page 12

15 Implementing the Solution Implementing WANSyncHA on a cluster is refreshingly clear-cut process, and is thoroughly documented in XOsoft s application-specific operations guides. No cluster reconfiguration or reboots are required, which means, honestly, zero downtime to implement. Potential customers are encouraged to experience WANSyncHA first-hand. Full-featured trial versions of WANSyncHA can be downloaded from XOsoft s web site. To further ease the implementation process presales technical support and demos are provided free of charge. Other XOsoft Products XOsoft offers several other products to protect access to your critical data and applications, as well as to add value through fast and completely flexible content delivery. Please check out our website or contact a XOsoft representative for more information. WANSync for Disaster Recovery WANSync for Content Delivery Enterprise Rewinder A 14 day trial evaluation of the software is available for download at: Contact Information North America (1.866.WANSync) International Headquarters New York West Coast Israel 1601 Trapelo Road Waltham, MA Tel: Fax: th floor 250 West 34th Street New York, NY Tel: Fax: Stevens Creek Blvd. Cupertino, CA Tel: Fax: Menahem Begin Ave. P.O. Box 31 Beit Dagan 50250, Israel Tel: Fax: Tinfo@xosoft.comT Web: Thttp:// Page 13