The Microsoft High Availability and Disaster Recovery Solution for TEMENOS T24

Transcription

1 The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 A deplyment reference architecture and guidance fr implementing a high-availability and disaster-recvery slutin fr TEMENOS T24 running n the Micrsft Applicatin Platfrm Technical White Paper Published: May 2012 Applies t: Micrsft SQL Server 2012 Authrs: Igr Pagliai (Micrsft) Dammika Wickramasinghe (Temens) Abstract Temens and Micrsft wrked tgether t define a deplyment architecture/tplgy that prvides high availability and disaster recvery fr the TEMENOS T24 cre banking slutin using the Micrsft Applicatin platfrm and Micrsft technlgies. This white paper describes the results f this jint effrt. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 i

2 2012 Micrsft Crpratin. All rights reserved. This dcument is prvided as-is. Infrmatin and views expressed in this dcument, including URL and ther Internet Web site references, may change withut ntice. Yu bear the risk f using it. This dcument des nt prvide yu with any legal rights t any intellectual prperty in any Micrsft prduct. Yu may cpy and use this dcument fr yur internal, reference purpses. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 ii

3 Table f Cntents Intrductin... 1 Technical Overview f TEMENOS T SQL Server AlwaysOn... 6 Recvery Objectives... 7 Fault Tlerance and Disaster Recvery Architecture... 8 High Availability and Disaster Recvery Slutin Setup and Cnfiguratin SQL Server 2012 HADR Cnfiguratin Windws Server Firewall Cnfiguratins T24 File Share Cnfiguratin Active Directry Dmain Services DNS Cnfiguratin Applicatin-Tier NLB Cnfiguratin T24 Applicatin Server Cnfiguratin Web-Tier NLB Cnfiguratin T24Brwser Cnfiguratin Disaster Recvery Prcedures DNS Switching SQL Server 2012 HADR Failver Findings and Carryvers Recmmended Htfixes and Service Packs Additinal Resurces SQL Server Windws Server Failver Cluster Netwrk Lad Balancing Abut Temens Abut Micrsft The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 iii

4 Intrductin TEMENOS T24 (T24) is a fully integrated, mdular cre banking slutin that cvers a brad spectrum f functinal requirements fr the retail, private, crprate, universal, and Islamic banking and micrfinance sectrs. T24 prvides a single, real-time view f client cmputers acrss the entire enterprise, making it pssible fr banks t maximize returns while als streamlining csts. Micrsft SQL Server 2012 data management sftware prvides an ideal data management framewrk fr T24. With this fundatin, T24 custmers can experience faster funds transfers, higher security-trades vlumes, and quicker clse-f-business prcesses; they can benefit frm pen, state-f-the-art technlgies t accelerate innvatin, which helps t greatly increase the speed and effectiveness with which new prducts and services are created. As part f their strategic alliance, Micrsft and Temens wrked tgether t define a recmmended deplyment architecture that prvides high availability and disaster recvery (HADR) fr T24 running n the Micrsft Applicatin Platfrm and using Micrsft technlgies. This jint effrt was cnducted in the Temens Hemel Hempstead lab. One f the main drivers fr develping the architecture/tplgy was t reduce the cst f Micrsft sftware licenses and the use f specialized hardware (such as lad balancers) t minimize the ttal cst f wnership (TCO). Therefre, the recmmended sftware tplgies can be custmized t meet custmer s needs. The fllwing cnsideratins apply t the recmmended architecture: The SQL Server 2012 Availability Grup feature, part f the AlwaysOn technlgy set, was selected instead f strage area netwrk (SAN) level synchrnus strage replicatin t avid the cst f an additinal SAN device and the licensing cst fr SAN replicatin sftware. A SQL Server 2012 Failver Cluster Instance (FCI) was adpted fr the primary site instead f tw standalne instances t reduce licensing cst, minimize management and perfrmance verhead, and augment the pssibility f using an existing deplyment based n a typical Windws Failver Clustering (WSFC) cnfiguratin. The Netwrk Lad Balancing (NLB) feature f Windws Server 2008 R2 was chsen t eliminate the need fr an expensive hardware lad balancer device in frnt f the JBss servers. The NLB feature f Windws Server 2008 R2 was chsen t prvide better lad balancing perfrmance than the native T24 capabilities in frnt f T24 servers. Tw cluster ndes in the primary site with shared SAN strage were used t prvide high availability fr the T24 applicatin file share. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 1

5 The implementatin/requirements f HADR slutins can vary based n variety f factrs, including service level agreements (SLAs), cst, number f sites, and netwrk infrastructure. Therefre, the requirements f individual HADR slutins need t be determined n a case-by-case basis fr each deplyment. Alternatives t the Recmmended Architecture The architecture prpsed in this white paper is nt the nly ne pssible using SQL Server 2012 AlwaysOn features, but this architecture has been thrughly tested. Pssible alternatives t the recmmended schema can include the fllwing: Use tw standalne SQL Server 2012 instances (in an AlwaysOn Availability Grup) instead f a single SQL Server 2012 Failver Cluster Instance. This lets yu avid using shared SAN fr the cluster ndes in the primary site. If yu are using an availability grup, all ndes in the must still be part f a cluster, and a standalne SQL Server 2012 instance must still be installed n each nde. The cst savings with this alternative cme frm eliminating the need fr shared strage. T ensure that there is n lcal data lss if there is lcal failver between instances in the primary site, the tw standalne SQL Server 2012 instances, alng with the ne (r mre) in the disaster recvery site, must be cnfigured fr synchrnus replicatin. In this cnfiguratin, autmatic failver can be prvided by the AlwaysOn Availability Grup feature, but extra care must be taken t avid unwanted failver t the remte disaster recvery site. Use an existing highly available netwrk strage fr the cluster file share witness. Used in cmbinatin with the previus ptin, a highly available netwrk strage fr the cluster file share witness can render the installatin f a Windws Server Failver Cluster unnecessary. NOTE Distributed File System Replicatin (DFS-R) can be used t replicate files frm the primary site t the disaster recvery site with a less frequent schedule. Use f DFS-R as a slutin t avid a clustered file share by having cntinuus replicatin with lcal flders, hwever, is nt recmmended because f the pssible perfrmance impact. Use an additinal nde in the disaster recvery site with shared SAN strage between the ndes. With this alternative, a secnd SQL Server 2012 FCI can be used, prviding high availability at the level f the disaster recvery site as well. This secnd instance must be installed nly n the ndes in the disaster recvery site. This instance is distinct frm the ne used in the primary site. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 2

6 This instance shuld be cnfigured fr synchrnus replicatin in the availability grup replicatin. The shared SAN strage between the ndes in the disaster recvery site is nt linked/replicated t the shared strage between the ndes in the primary site. IMPORTANT In the prpsed scenari, the minimum number f servers has been used in the disaster recvery site t reduce csts. This means that in the case f a cmplete primary site disaster, the disaster recvery site will perate in an expsed cnfiguratin that is nt highly available. Fr this reasn, it is highly recmmended that yu recver the primary site as sn as pssible r use an additinal nde in the disaster recvery site with shared SAN strage between the ndes, as mentined previusly. Additinal SQL Server 2012 HADR Capabilities fr Future Cnsideratin Nte that the fllwing SQL Server 2012 HADR capabilities have nt been tested prir t publicatin f this white paper because f time, resurce, and cnfiguratin cnstraints. They shuld be cnsidered t be future enhancements t the recmmended architecture, and shuld be tested fr custm deplyments and/r lab testing sessins: Readable secndary fr Availability Grup replicated databases This feature presents n theretical risks and culd be used t better utilize hardware resurces in the disaster recvery site (including read-nly queries, reprting, backups, and integrity checks,), but T24 shuld be mdified t take advantage f this capability (fr readnly queries nly). The fllwing links prvide mre infrmatin: Active Secndaries: Readable Secndary Replicas ( Cnfigure Read-Only Access n an Availability Replica ( NOTE In the recmmended cnfiguratin, the secndary replicas fr the availability grup replicated the databases. Read-nly access is nt enabled, but can be easily activated with n dwntime. Availability Grup Read-Only Ruting and Applicatin Intent These features cannt be used because they require the SQL Server 2012 Native Open Database Cnnectivity (ODBC) client t be installed n the T24 servers. As a future enhancement, this versin f the client shuld be tested fr T24 use. The fllwing links prvide mre infrmatin: Cnfigure Read-Only Ruting fr an Availability Grup (SQL Server) ( Client Cnnectin Access t Availability Replicas (SQL Server) ( The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 3

7 Multi-subnet failver clustering Windws Server 2008 R2 and SQL Server 2012 supprt this type f cnfiguratin, but this has nt been tested fr using in reducing dwntime because f Dmain Name System (DNS) replicatin latency. The fllwing links prvide mre infrmatin. SQL Server Multi-Subnet Clustering ( SQL Server 2012 AlwaysOn: Multisite Failver Cluster Instance ( alwaysn_3a00_-multisite-failver-cluster-instance.aspx) Flexible failver plicy SQL Server 2012 intrduces a new health detectin mechanism fr clustered installatin that can be mdified s that the Windws Failver Clustering is mre alert t pssible SQL Server 2012 health prblem cnditins. The fllwing links prvide mre infrmatin. Failver Plicy fr Failver Cluster Instances ( Cnfigure FailureCnditinLevel Prperty Settings ( Dcument Scpe The fllwing are cnsidered in the scpe f this white paper: This dcument applies t T24 R11 and R12 (Temens Applicatin Framewrk C) with T24Brwser as a channel. This dcument fcuses nly n HADR functinality. The dcument applies t fllwing sftware: Windws Server 2008 R2 with Service Pack 1 (SP1) Windws Server 2008 R2 Netwrk Lad Balancing (NLB) Windws Server 2008 R2 clustering Windws Server 2008 R2 clustered file share Windws Server 2008 R2 Distributed File System (DFS) Replicatin SQL Server 2012 AlwaysOn Availability Grup Windws Server 2008 R2 dmain cntrller JBss GA The fllwing are cnsidered ut f the scpe f this white paper: Perfrmance tuning recmmendatins. T24 channels ther than T24Brwser, such as TWS.NET, TOCF.NET, and BizTalk Adapter. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 4

8 Administratin and mnitring f the sftware. Hardware cnfiguratins, such as RAID and netwrk adapter teaming. Security. Lcal area netwrk (LAN)/wide area netwrk (WAN) cnfiguratins and recmmendatins. Technical Overview f TEMENOS T24 The varius cmpnents f a T24-based slutin are shwn in Figure 1. Windws Server 2008 R2 Windws Server 2008 R2 Internet Infrmatin Services (IIS) 7.5 T24 Brwser TWS.NET TOCF.NET TWS (EE) TOCF (EE) ARC IB ARC Mbile Channels Cnnectivity Temens T24 Security Management Applicatin Windws Server 2008 R2 Active Directry T24 Mnitr C C / / C++ C++ TAFC Agent C TAFC Agent C / C++ TAFC Agent C / C++ C / / C++ C++ TAFC Agent C / C++ C / C++ TAFC Agent C / C++ TAFC Agent C / C++ T24 Agent C / C++ T24 C / C++ T24 T24 T24 T24 T24 C C / / C++ T24 C++ TAFC C / C++ TAFC C / C++ TAFC C C / / C++ C / C++ TAFC C++ C / C++ DCDTAFC C / C++ DCDTAFC C / C++ DCD C / C++ DCD TAFC C / C++ DCD DCD Database Driver FX FX FX EB AA DX AC Message Queue SQL Server 2012 Windws Server 2008 R2 Figure 1. T24 lgical cmpnent view Table 1 prvides a descriptin f the cmpnents. Nte that the HADR slutin recmmended in this white paper fcuses n T24 with T24Brwser as a channel. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 5

9 Table 1. Cmpnent descriptins Cmpnent T24 Agent T24 TAFC Database Driver T24 Mnitr Message Queue Database Descriptin T24 Agent is a server-side jbase cmpnent that is respnsible fr accepting and prcessing incming client requests. Cmmunicatin is established via TCP scket cnnectins and by means f a well-defined prtcl. T24 Agent is a scket server listening n a user-defined TCP prt, and has the capability t serve a wide range f client applicatins as lng as they speak the same prtcl. T24 is the banking business lgic written by using jbc, which is used t generate C / C++ cde. The Temens Applicatin Framewrk C (TAFC) versin prvides additinal runtime services that are currently nt available in jbc. Direct Cnnect Driver (DCD) is the T24 data abstractin layer that decuples T24 business lgic frm the underlying data strage/structure. T24 Mnitr is a Java Management Extensins (JMX) and web-based nline mnitring tl fr T24, ffering real-time statistics, as well as histrical views f a particular T24 system. Message Queue is an ptinal middleware infrastructure that lets T24 use message-driven cmmunicatin with the channel layer. The jbase r vendr-prvided relatinal database management system (RDBMS); currently supprted platfrms are Oracle, Micrsft SQL Server, and IBM DB2. SQL Server AlwaysOn SQL Server AlwaysOn is a new integrated, flexible, and cst-efficient HADR slutin. AlwaysOn can prvide data and hardware redundancy within and acrss data centers, and it can imprve applicatin failver time t increase the availability f missin-critical applicatins. AlwaysOn is flexible and lets yu reuse existing hardware investments. A slutin using AlwaysOn can take advantage f tw majr SQL Server 2012 features fr cnfiguring availability at bth the database and the instance level: The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 6

10 AlwaysOn Availability Grups AlwaysOn Availability Grups are new in SQL Server They greatly enhance the capabilities f database mirrring, help ensure availability f applicatin databases, and enable zer data lss thrugh lg-based data mvement fr data prtectin withut shared disks. Availability grups prvide an integrated set f ptins, including autmatic and manual failver f a lgical grup f databases, supprt fr up t fur secndary replicas, fast applicatin failver, and autmatic page repair. AlwaysOn Failver Cluster Instances (FCIs) FCIs enhance the SQL Server failver clustering feature and supprt multi-site clustering acrss subnets, which enables crss-data-center failver f SQL Server instances. Faster and mre predictable instance failver is anther key benefit that enables faster applicatin recvery. Recvery Objectives Data redundancy is a key cmpnent f a high-availability database slutin. Transactinal activity n yur primary SQL Server instance is synchrnusly r asynchrnusly applied t ne r mre secndary instances. When an utage ccurs, transactins that were in-flight might be rlled back, r they might be lst n the secndary instances because f delays in data prpagatin. Yu can measure the impact and set recvery gals in terms hw lng it takes t get back in business and hw much time latency there is in the last transactin recvered: Recvery Time Objective (RTO) The RTO is the duratin f the utage. The initial gal is t get the system back nline in at least a read-nly capacity t facilitate investigatin f the failure. Hwever, the primary gal is t restre full service t the pint that new transactins can take place. Recvery Pint Objective (RPO) The RPO is ften referred t as a measure f acceptable data lss. It is the time gap r latency between the last cmmitted data transactin befre the failure and the mst recent data recvered after the failure. The actual data lss can vary depending n the wrklad n the system at the time f the failure, the type f failure, and the type f high availability slutin used. Yu shuld use RTO and RPO values as gals that indicate business tlerance fr dwntime and acceptable data lss, and as metrics fr mnitring availability health. The business gals fr RTO and RPO shuld be key drivers in selecting a SQL Server technlgy fr yur high-availability and disaster-recvery slutin. Table 2 ffers a rugh cmparisn f the type f results that thse different slutins may achieve. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 7

11 Table 2. Cmparisn f SQL Server HADR slutins SQL Server HADR Slutin AlwaysOn Availability Grup synchrnuscmmit AlwaysOn Availability Grup asynchrnuscmmit Ptential Data Lss (RPO) Ptential Recvery Time (RTO) Autmatic Failver Zer Secnds Yes Secnds Minutes N 0 4 Readable Secndaries 1 AlwaysOn Failver Cluster Instance NA 3 Secnds -t-minutes Yes NA Database Mirrring 4 High-safety (sync + witness) Zer Secnds Yes NA Database Mirrring 2 High-perfrmance (async) Secnds 5 Minutes 5 N NA Lg Shipping Minutes 5 Minutes -t-hurs 5 Backup, Cpy, Restre 6 Hurs 5 Hurs -t-days 5 Fault Tlerance and Disaster Recvery Architecture N N Nt during a restre Nt during a restre SQL Server AlwaysOn slutins help prvide fault tlerance and disaster recvery acrss several lgical and physical layers f infrastructure and applicatin cmpnents. Histrically, it has been cmmn practice t separate duties and respnsibilities fr the varius audiences and rles invlved, s that each was predminately cncerned with nly a prtin f thse slutin layers. This sectin describes each f thse layers and ffers guidance fr yur design discussins and implementatin decisins. A successful SQL Server AlwaysOn slutin requires understanding and cllabratin acrss these slutin layers: 1 An AlwaysOn Availability Grup can have n mre than a ttal f fur secndary replicas, regardless f type. 2 Autmatic failver f an Availability Grup is nt supprted t r frm a failver cluster instance. 3 The FCI itself des nt prvide data prtectin; data lss is dependent upn the strage system implementatin. 4 This feature will be remved in future versins f Micrsft SQL Server. Use AlwaysOn Availability Grups instead. 5 This is highly dependent upn the wrklad, data vlume, and failver prcedures. 6 Backup, Cpy, Restre is apprpriate fr disaster recvery, but nt fr high availability. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 8

12 Infrastructure level Server-level fault-tlerance and intra-nde netwrk cmmunicatin use Windws Server Failver Clustering (WSFC) features fr health mnitring and failver crdinatin. SQL Server instance level A SQL Server AlwaysOn Failver Cluster Instance (FCI) is a SQL Server instance that is installed acrss and can fail ver t server ndes in a WSFC cluster. The ndes that hst the FCI are attached t rbust symmetric shared strage (SAN r SMB). Database level An availability grup is a set f user databases that fail ver tgether. An availability grup cnsists f a primary replica and ne t fur secndary replicas. Each replica is hsted by an instance f SQL Server (FCI r nn-fci) n a different nde f the WSFC cluster. Client cnnectivity Database client applicatins can cnnect directly t a SQL Server instance netwrk name, r they may cnnect t a virtual netwrk name (VNN) that is bund t an availability grup listener. The VNN abstracts the WSFC cluster and Availability Grup tplgy, lgically redirecting cnnectin requests t the apprpriate SQL Server instance and database replica. Figure 2 shws a lgical tplgy f a representative AlwaysOn slutin. Figure 2. Lgical representatin f an AlwaysOn slutin The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 9

13 High Availability and Disaster Recvery Slutin The recmmended HADR slutin fr T24 deplyments was designed based n the fllwing: Incurring zer data lss when failing ver t the disaster recvery site, assuming that there is a cmpatible netwrk cnnectin between the sites that are capable f synchrnus data replicatin. Reducing the cst f Micrsft sftware licenses and specialized hardware (such as lad balancers) t minimize the ttal cst f wnership. Maximizing use f any Windws Server 2008 R2 features and capabilities that cmplement T24. The fllwing decisins were made in the slutin design. Refer t Figure 3 fr further infrmatin. The disaster recvery site used fr testing had nly ne server fr each tier. If the disaster recvery site als requires high availability, the cnfiguratin used in the primary site shuld be used fr the disaster recvery site. The Windws Server 2008 R2 NLB feature is used t lad balance the traffic int the JBss applicatin servers in the primary site. The same feature can be used fr the disaster recvery site if there will be tw r mre disaster recvery ndes. A DNS hst recrd was created fr the web-tier NLB IP t make the failver t the disaster recvery site transparent t the users (fr example, T24Brwser.CE.Temens.cm). T24Brwser is a stateful applicatin that nrmally deplys with a sticky-sessin cnfiguratin. Althugh this cnfiguratin prvides the required functinality, it reduces the scalability f the T24 web tier. The user might lse the sessin if an applicatin server ges dwn, reducing the availability. The slutin presented in this white paper eliminates these limitatins by remving sticky sessins. This is achieved by persisting the JBss sessin state in the SQL Server database and cnfiguring NLB t Affinity: Nne. Using NLB and DNS hst recrd and aviding the use f sticky sessins lets yu add r remve web-tier servers transparently, withut affecting users. T24Brwser is capable f perfrming simple lad balancing amng the available T24 applicatin servers when a lad balancing slutin is nt available in the applicatin tier. This feature is disabled in the recmmended slutin, and NLB is used instead with the Affinity: Nne cnfiguratin t achieve the best pssible lad balancing. DNS hst recrd was created fr the applicatin-tier NLB IP s that yu have the ptin f failing ver nly the applicatin tier t the disaster recvery site if necessary (fr example, T24Server.CE.Temens.cm). This is an ptinal cnfiguratin that is nly required if a facility needs t simplify server maintenance and keep the T24Brwser cnfiguratins identical in bth sites. Hwever, this ptin des create an additinal step in the disaster recvery prcedures. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 10

14 Using the NLB Affinity: Nne cnfiguratin makes it pssible t add r remve applicatin-tier servers transparently, withut affecting nline transactins. The SQL Server 2012 HADR AlwaysOn (HADRON) cnfiguratin with a SQL Server 2012 Failver Cluster instance fr the primary site is used t reduce the number f required SQL Server 2012 licenses. The primary site can have tw standalne instances f SQL Server 2012 instead f the failver cluster instance if yu need t remve the shared strage; hwever, this will require licenses fr each SQL Server 2012 instance, while the failver cluster instance requires nly ne license regardless f the number f ndes in the cluster. The disaster recvery instance f SQL Server 2012 is cnfigured as a SQL Server 2012 HADRON synchrnus AlwaysOn replica fr zer data lss. Synchrnus replicatin requires a fast and stable netwrk cnnectin in rder t wrk as expected. This needs t be taken int accunt when setting up the netwrk. If yu d nt have a fast and stable netwrk cnnectin, implement asynchrnus replicatin instead, but understand that asynchrnus replicatin des have a pssibility f data lss. The same Windws Server Failver Cluster that hsts the SQL Server 2012 clustered instance is used t hst a clustered file share t keep T24 shared files and flders. The clustered file share increases the availability f the T24 shared files and flders. The disaster recvery site has a lcal flder fr T24 shared files/flders. Windws Server 2008 R2 Distributed File System Replicatin (DFS-R) is implemented with an Active Directry Dmain Services (AD DS) published namespace t make the file share failver t the disaster recvery site transparent and t replicate T24 shared files/flders. Making the T24 shared files available in the disaster recvery site is nt mandatry because T24 can recver withut them. Hwever, having the T24 shared files available has a psitive impact. Therefre, DFS-R is scheduled t ccur several times per day t reduce the verhead f the replicatin. T24 typically accesses shared files and flders via a mapped drive letter in each T24 server. Since accidentally remving r changing the mapped drive letter can cause failures, file and flder symblic links were created by using the mklink utility f Windws and used instead f the mapped drive letters t avid unintended mistakes. Symblic links make the shared files and flders imitate lcal entities, and therefre T24 can access them directly. A JBss sessin persistence database was created in the same SQL Server 2012 HADRON cnfiguratin as the T24 database, therefre having the same high availability and disaster recvery capabilities. This makes management easier and reduces the steps in disasterrecvery prcedures. Yu can, hwever implement the JBss sessin persistence database as a different instance, if required. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 11

15 Figure 3. HADR slutin The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 12

16 Setup and Cnfiguratin This sectin describes hw t cnfigure the HADR slutin. SQL Server 2012 HADR Cnfiguratin SQL Server 2012 HADR is cnfigured with a clustered instance fr the primary site and a standalne instance in the disaster recvery site. The cnfiguratin uses the AlwaysOn Availability Grup t replicate database cntent and t prvide transparent failver. The disaster recvery instance is cnfigured as a synchrnus replica fr zer data lss. Figure 4 shws a schematic f the slutin. Figure 4. SQL Server 2012 HADR slutin The Windws Server Failver Cluster cnsists f a cluster with three ndes: tw ndes in the primary site and ne nde in the disaster recvery site with a SAN shared nly between the tw ndes in the primary site. The disaster recvery instance has nly lcal strage where the database cntent is replicated by using the availability grup. The cst f the slutin is reduced because there is n shared strage between ndes in the primary site and the nde in the disaster recvery site, because there is n SAN in the secndary site, and because yu d nt need an expensive strage-level synchrnizatin mechanism t replicate disk data cntent. A clustered SQL Server 2012 instance is primarily used t reduce the number f SQL Server 2012 licenses that are required. The primary site culd have tw standalne instances f SQL Server 2012 instead f the failver cluster instance if this is required t remve the shared strage; hwever, this ptin requires licenses fr each SQL Server 2012 instance, while the failver cluster instance requires nly ne licence regardless f the number f ndes in the cluster. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 13

17 If the disaster recvery site als requires high availability, the same cnfiguratin used in the primary site needs t be available in the disaster recvery site. When the recmmended slutin was tested, all f the SQL Server instances were created as named instances t make them easy t identify during maintenance and mnitring. Table 3 lists the names that were used in the test envirnment during setup; these names can be used as a reference guideline. Table 3. Names f SQL Server instances Name SQL11HA SQL11DR T24AG T24AgListener Descriptin SQL Server 2012 instance name f the primary site. Since the named instance uses a dynamic TCP prt, static TCP prt 1533 was cnfigured via the SQL Server Cnfiguratin Manager. SQL Server 2012 instance name f the disaster recvery site. Since the named instance uses a dynamic TCP prt, static TCP prt 1533 was cnfigured via the SQL Server Cnfiguratin Manager. SQL Server 2012 AlwaysOn Availability Grup name. This name is nt used by T24, and is used in SQL Server Management Studi when required t fail ver t the disaster recvery instance. The JBss sessin persistence database was added t the same availability grup in the test envirnment. This makes management easier, and disaster recvery failver becmes a single prcess fr bth the databases. SQL Server 2012 AlwaysOn Availability Grup listener name. This is the name T24 uses t cnnect the SQL Server 2012 HADRON instance. When creating the listener, 1433 (the SQL Server default prt) was used as the TCP prt number t avid having t change the T24 cnnectin parameters t use a different prt number. Windws Server Firewall Cnfiguratins The Windws Server Firewall is n by default; therefre, yu need t create relevant inbund firewall exceptins in the servers fr the cnfiguratin t wrk as expected. Table 4 shws the inbund firewall rules that need t be created in all the database servers. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 14

18 Table 4. Firewall rules Name SQL11 (1533) SQL11 Brwser (1434) SQL11 AG (5022) SQL11 AG Listener (1433) Descriptin Inbund firewall exceptin rule fr TCP prt 1533, which is the static prt cnfigured fr the SQL Server instance. Inbund firewall exceptin rule fr UDP prt 1434, which is required fr the SQL Server Brwser when named instances exist. Inbund firewall exceptin rule fr TCP prt 5022, which is required fr the SQL Server 2012 HADRON Availability Grup. Inbund firewall exceptin rule fr TCP prt 1433, which is cnfigured fr the SQL Server 2012 HADRON Availability Grup Listener. T24 File Share Cnfiguratin In the multi-server cnfiguratin, T24 is required t have a shared lcatin fr its wrking files and flders. Any single file is created r written by nly ne T24 instance and is read by all instances. There is n cncern abut file write lcks; hwever, the share needs t be resilient fr the multiserver cnfiguratin t functin prperly. If T24 fails ver t the disaster recvery site, making the T24 shared files available in the disaster recvery site is nt mandatry because T24 can recver withut them. Hwever, having the shared files available des have a psitive impact. A resilient file share slutin with less frequent (nce r twice a day) file replicatin t the disaster recvery site is therefre a gd slutin. Windws Server Clustered File Server, in cnjunctin with DFS-R, prvides an ptimal slutin and des nt require any additinal licenses. Fr simplicity, an Active Directry Dmain Services (AD DS) published DFS Namespace is used t refer the shared file flder. Therefre, T24 can refer the same path (namespace) fr shared files, whether it is in the primary site r in the disaster recvery site. Figure 5 shws the T24 file share and file replicatin cnfiguratin. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 15

19 Figure 5. File share and file replicatin Windws Server Clustered File Share Cnfiguratin The recmmended SQL Server 2012 HADR cnfiguratin uses a Windws Server Cluster. Using the same cluster t hst the file server reduces the cmplexity f the slutin and simplifies management and mnitring. Since nly the primary site servers in the cluster have access t the shared strage, the nly pssible wners f the file server are the servers in the primary site. The file server, therefre, des nt fail ver t the disaster recvery site, and the disaster recvery instance f T24 will nly have access t its lcal flders. A shared flder called T24FileShare was created in the file server and used as the resilient file share lcatin f the primary site. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 16

20 If the disaster recvery site als uses a T24 multi-server cnfiguratin, the same type f file share needs t be created in the disaster recvery site. Hwever, because the test envirnment had nly a single T24 instance, a lcal flder was created with the same shared flder name. Distributed File System Replicatin Cnfiguratin DFS-R was used t peridically replicate T24 shared files between the primary site and the disaster recvery site. The replicatin frequency was set t the lwest pssible (nce r twice per day) t avid any perfrmance implicatins, and because having the shared files available in the disaster recvery site is nt mandatry t T24. The disaster recvery site f the test envirnment had a single instance f T24; therefre, the flder fr the shared files was created lcally in the same server. The DFS replicatin was set up t replicate the files between the clustered file share in the primary site and the lcal flder in the T24 disaster recvery instance. Active Directry Dmain Services DNS Cnfiguratin T make the web-tier failver transparent t the users, yu must have a DNS hst recrd that can be referred by the users t reach T24Brwser instead f the lad balancer IP. Failver t disaster recvery will therefre nly require changing the IP address f the DNS hst recrd, and users d nt need t use a different URL. In the test envirnment, the DNS hst recrd T24Brwser.CE.Temens.cm was created fr the web-tier Netwrk Lad Balancing IP. Yu can als create a DNS hst recrd fr the applicatin-tier servers if it is a requirement t be able t transparently fail ver the applicatin tier independently t the web tier. Nte that this is an ptinal cnfiguratin that is helpful if yu need t ease server maintenance and keep the T24Brwser cnfiguratins identical in bth sites. Hwever, this cnfiguratin des add a step t the disaster recvery prcedures. The DNS hst recrd T24Server.CE.Temens.cm was created fr the applicatin-tier NLB IP in the test envirnment. One drawback f using DNS hst recrds is that the client applicatin using the name caches the IP address. Therefre, even if the IP address f the DNS hst recrd is changed at the server-side in a disaster recvery failver, the client applicatin might still use the ld IP address, and this ld IP address might n lnger be available. T minimize the chance t this happening, the time t live (TTL) value f the DNS hst recrd needs t be adjusted. In the test envirnment, the TTL value was set t ne minute, which means that the client applicatin verified the DNS hst recrd IP address with the server every ne minute. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 17

21 While shrter TTL values can increase the lad n the DNS server, they can be useful with critical services like web servers, applicatin servers, and lad balancers. TTL values are ften reduced by the DNS administratr befre service is mved t minimize disruptins. Table 5 shws the DNS hst recrds that were created in the test envirnment. Table 5. DNS hst recrds DNS Hst Recrd T24Brwser.CE.Temens.cm T24Server.CE.Temens.cm Descriptin The Dmain Name System (DNS) hst recrd f the T24 web-tier lad balancer that was used in the web brwser URL t cnnect t T24Brwser. The TTL value was set t ne minute fr testing. An ptinal DNS hst recrd created fr the T24 applicatin-tier lad balancer t test transparent failver f the applicatin tier independently t the web tier. This was used by the T24Brwser (cnfigured in t24- ds.xml) t cnnect t the lad balancer in the test envirnment. The TTL value was set t ne minute fr testing. Applicatin-Tier NLB Cnfiguratin T24Brwser is capable f perfrming simple lad balancing amng the available T24 applicatin servers when a lad balancing slutin is nt available in the applicatin tier. Hwever, specialized lad balancing slutins can prvide better lad balancing capabilities. The NLB feature in Windws Server is a sftware lad balancing slutin that des nt require additinal licenses and cmplements T24 by prviding a specialised lad balancing slutin. In the recmmended slutin, the NLB feature In Windws Server is enabled and cnfigured in the T24 applicatin servers in the primary site, and created an NLB cluster cnsisting f the tw servers. Figure 6 shws the applicatin-tier NLB cluster. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 18

22 Figure 6. Applicatin-tier NLB cluster If the disaster recvery site has multiple T24 applicatin servers, an NLB cluster needs t be cnfigured in thse servers as well. Table 6 shws the NLB cnfiguratins used. Table 6. NLB cnfiguratins Cnfiguratin Cluster peratin mde Prtcl Prt range Filtering mde Descriptin Multicast peratin mde was used t keep the netwrk adapter s built-in media access cntrl (MAC) address. This was because the test servers had nly ne netwrk adapter, and this netwrk adapter had t be used fr server management as well. If the server has multiple netwrk adapters, the cluster peratin mde can be set t Unicast. The prtcl used fr cmmunicatin with T24 was TCP/IP. The prt range was limited t 20002, which is the T24 agent prt cnfiguratin. Affinity: Nne was selected t achieve best pssible lad balancing. The simple lad balancing feature in T24 f T24Brwser is disabled and used NLB cluster name (T24Server.CE.Temens.cm) as the T24 instance. This lets the netwrk lad balancing rute the cnnectins t the T24 instances in the cluster. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 19

23 Using NLB with the Affinity: Nne cnfiguratin lets yu add r remve applicatin-tier servers transparently, withut affecting nline transactins. T24 Applicatin Server Cnfiguratin The T24 applicatin tier is cnfigured with tw T24 instance (ndes: App Nde 1 and App Nde 2) in the primary site and a single instance (nde: App Nde 3) in the disaster recvery site. Nte that it is pssible t have multiple T24 instances (applicatin server ndes) in the disaster recvery site if high availability is a requirement fr the disaster recvery site. The Windws Server 2008 R2 NLB feature was used t balance the T24 applicatin servers. The HADR slutin fr the T24 file share is implemented by using a Windws Server 2008 R2 clustered file share and DFS-R. Figure 7 shws the T24 applicatin tier cnfiguratin. Figure 7. T24 applicatin tier The Temens Applicatin Framewrk C (TAFC) is the executin envirnment fr the T24 applicatin. Install TAFC and T24 applicatin n all applicatin servers (fr installatin guidance, cntact Temens). The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 20

24 Fllwing is a descriptin f hw the T24 applicatin servers were cnfigured: All the T24 instances in the test envirnment used multiple server cnfiguratins with the required licenses. T use ne instance f T24 n multiple servers, install the multiple applicatin server mdule. When using multiple applicatin servers, define prt ranges fr each T24 applicatin server t avid cnflicts r deadlck situatin during clse f business. Prts can be assigned by using the fllwing variable in each applicatin server: JBCPORTNO= {prt range} The same jbase_agent prt must be used n all T24 applicatin servers. The default jbase_agent prt was used in the test envirnment. The same prt must be used because requests t the T24 servers are cntrlled by the lad balancer, and therefre T24Brwser sees nly a single instance f T24 (lad balancing cluster name), regardless f the number f T24 applicatins servers available. Inbund Windws firewall exceptin rule fr TCP prt was created t make the jbase_agent prt accessible frm T24Brwser. The T24 database driver (Direct Cnnect Driver *DCD+) requires the SQL Server client t be installed n the server. At the time f testing, the DCD fr the SQL Server 2012 Native Client was still in develpment. Fr this reasn, the SQL Server 2008 R2 Native Client was used. Because the SQL Server 2012 HADR cnfiguratin is used fr the database tier, the T24 database must be accessed via the SQL Server 2012 AlwaysOn Availability Grup. Therefre, the availability grup listener name was used in the T24 cnfiguratin instead f the database server IP address. File jedi_cnfig, Recrd 'XMLMSSQL_FRMWRK' Cmmand-> 0001 R Direct cnnect driver versin T24AgListener]T24R12 DB Server name] DB name 0003 T24User]uHdE9Jj8B5Y0cUF0hGh0A==] DB User/Passwrd encrypted Default database lcking (SQL Server applicatin lck) was used fr the testing. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 21

25 Limitatins f Using the SQL 2008 R2 Native Client During the testing, the SQL Server 2008 R2 Native Client was used with the T24 database driver because the DCD did nt supprt SQL Server 2012 client libraries. The fllwing limitatins therefre apply t the SQL Server 2012 HADR AlwaysOn functinalities: Read-nly ruting fr the availability grup is nt available. Applicatin intent is nt available. Optimizatins fr fast multi-subnet failver clustering are nt available. When the SQL Server 2012 Native Client is certified fr use with T24, the cnsideratins fr client availability features shwn in Table 7 will apply. Table 7. Client type cnsideratins Driver Multisubnet failver Applicatin intent Readnly ruting Multi-subnet failver: faster single subnet endpint failver Multi-subnet failver: named instance reslutin fr SQL Server clustered instances SQL Server Native Client 11.0 ODBC SQL Server Native Client 11.0 OLE DB ADO.NET with Micrsft.NET Framewrk 4.0 update 4.0.2* Yes Yes Yes Yes Yes N Yes Yes N N Yes Yes Yes Future date Future date ADO.NET with.net Framewrk 3.5 Future date Future date Future date Future date Future date Micrsft Java Database Cnnectivity (JDBC) driver 4.0 fr SQL Server Yes Yes Yes Yes Future date *ADO.NET with.net Framewrk patch dwnlad fr cnnectivity imprvement ( Fr mre infrmatin abut cnnectin string keywrds, see: Using Cnnectin String Keywrds with SQL Server Native Client ( The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 22

26 T24 Shared Files Fr T24 multiple server installatin, it is necessary t share certain files and flders amng T24 applicatin servers. T24 typically accesses shared files and flders via a mapped drive letter in each T24 server. Hwever, accidentally remving r changing the mapped drive letter can cause failures. Therefre, file and flder symblic links were created by using the Windws mklink utility instead f mapped drive letters t avid unintended mistakes. Symblic links make the shared files and flders act as lcal entities, s T24 can directly access them. If there are additinal flders/files that need t be shared, apprpriate symblic links shuld be created. Web-Tier NLB Cnfiguratin When the web tier has multiple servers (ndes), there needs t be a mechanism t rute the requests t the servers and t prvide a single address t the requester (web brwser), regardless f the number f servers in the tier. This functinality is typically prvided by using the prxy server r/and lad balancer with redundancy t increase the availability f the service. The Netwrk Lad Balancing (NLB) feature f Windws Server des nt have a single pint f failure because the service wrks n the netwrk layer f all the servers. Because it is a readily available feature in Windws Server, the NLB feature des nt require additinal licenses. The NLB feature is enabled and cnfigured in the web servers in the primary site, and created an NLB cluster cnsisting f the tw servers. Figure 8 shws the web-tier NLB cluster. Figure 8. Web-tier NLB cluster The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 23

27 If the disaster recvery site has multiple web-tier servers, an NLB cluster needs t be cnfigured in thse servers as well. Table 8 shws the NLB cnfiguratins used. Table 8. NLB cnfiguratins Cnfiguratin Cluster peratin mde Prtcl Prt range Filtering mde Descriptin Multicast peratin mde was used t keep the netwrk adapter s built-in media access cntrl (MAC) address. This was because the test servers had nly ne netwrk adapter, and this netwrk adapter had t be used fr server management as well. If the server has multiple netwrk adapters, the cluster peratin mde can be set t Unicast. TCP was used as the HTTP traffic transprt ver TCP/IP. The prt range was limited t 8080, which was the JBss web site prt range cnfigured in the test envirnment. Affinity: Nne was selected t achieve best pssible lad balancing. Typically, the T24Brwser requires Affinity: Single (stickysessin) cnfiguratin because it is a stateful applicatin. Hwever, in the recmmended slutin, JBss is cnfigured t persist sessin states in the SQL Server database; therefre, it is pssible t use the Affinity: Nne cnfiguratin in the lad balancer. T make it pssible t fail ver the web tier t the disaster recvery site transparently, the DNS hst recrd (T24Brwser.CE.Temens.cm) is used fr the NLB cluster IP address. Therefre, the web brwser URL remains unchanged, even if there is a failver t the disaster recvery site. Nt using sticky-sessins increases the availability f the site; in additin, using NLB with the DNS hst recrd allws fr adding r remving web-tier servers transparently and withut affecting the users. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 24

28 T24Brwser Cnfiguratin The T24 web tier is cnfigured with tw JBss instances with T24Brwser (ndes: Web Nde 1 and Web Nde 2) in the primary site and a single instance (nde: Web Nde 3) in the disaster recvery site. It is pssible t have a multiple JBss/T24Brwser instances (web server ndes) in the disaster recvery site if high availability is a requirement fr the disaster recvery site. The Windws Server 2008 R2 NLB feature was used t balance the lads n the JBss server ndes. Figure 9 shws the T24 web tier. Figure 9. T24 web tier JBss Cnfiguratin The JBss applicatin server GA was used in the test envirnment that hsted T24Brwser Java Servlet applicatin. N clustered instance f JBss was installed in the web-tier servers. Fllwing is the list f cnfiguratins that were made after successfully installing JBss: Because f the limitatins f JBss cluster sessin replicatin and t avid using sticky sessins, JBss sessin persistence functinality was implemented using a SQL Server database. A JBss sessin persistence database was created in the same SQL Server 2012 HADR cnfiguratin as the T24 database. Therefre, the JBss sessin persistence database has the same high availability and disaster recvery capabilities as the T24 database. This makes management easier and reduces the number f steps in the disaster recver prcedures. (Nte that the JBss sessin persistence database can be implemented as a different instance if required.) The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 25

29 An inbund Windws firewall exceptin rule fr TCP prt 8080 was created t make JBss accessible t users. T24Brwser with AGENT Cnnectin Methd After successful installatin f the JBss applicatin server, T24Brwser can be deplyed and cnfigured t use ne f the tw types f supprted cnfiguratins, AGENT r JMS. Detailed stepby-step setup and cnfiguratin can be requested frm Temens. Fr the nline transactins used in this testing, the AGENT cnfiguratin is recmmended. Tables 9 and 10 shw the settings that were cnfigured in the T24Brwser. Table 9. Settings in brwserparameters.xml Parameter name Server Cnnectin Methd CnnectinTime ut RetryCunt RetryWait Descriptin Cnfiguratin f the cnnectin t the T24 server. AGENT cnnectin methd was used fr the testing. The cnnectin expiratin time if T24Brwser des nt get a respnse frm the T24 applicatin server. This was set t 20 secnds. The number f retry attempts the T24Brwser shuld make if it can t reach T24 t successfully execute a transactin. This was set t 20 times. When retrying, the number f secnds t wait befre attempting t retry the transactin. This was set t 5 secnds. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 26

30 Table 10. Settings in t24-ds.xml Prperty name Hst Prts ladbalancing actintimeut Descriptin A cmma-separated list f available T24 servers. Because the NLB feature in Windws Server 2008 R2 is cnfigured at the applicatin tier, the name f the lad balancing cluster needs t be used instead f the names f the T24 servers. The lad balancing cluster T24Server.CE.Temens.cm was used in the test envirnment. The jbase_agent TCP prt number. All T24 instances in the test envirnment are cnfigured t use TCP prt 20002; therefre, is used as the jbase_agent prt number. T enable r disable the simple lad balancing feature in T24Brwser. This is set t false because the NLB feature in Windws Server 2008 R2 perfrms the lad balancing in the recmmended slutin. The number f secnds that the jbase_agent waits fr a respnse frm T24 applicatin server. This was set t 60 secnds in the test envirnment. Disaster Recvery Prcedures The high availability slutin described in this dcument implements autmatic failver between the primary site servers (ndes). Human interventin is therefre nt required. Hwever, the disaster recvery failver is intentinally designed t be manual, because this is typically part f the business cntinuity plan. Therefre, the disaster recvery failver might require additinal prcedures t be fllwed. This sectin describes the disaster recvery prcedures that were successfully tested fr the recmmended slutin. Figure 10 shws the three failver activities that are required. Nte that the secnd failver activity is ptinal, and can be used if applicatin-tier failver is implemented t ease maintenance activities. In additin, if the ptinal DFS-R is implemented, the DFS Namespace fails ver autmatically and manual failver is nt required. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 27

31 Figure 10. Failver t disaster recvery site The steps required fr the failver activities are described in detail in the sectins that fllw. Nte that the steps in all sectins need t be cmpleted t successfully fail ver t the disaster recvery site. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 28

32 DNS Switching Web-tier and applicatin-tier DNS switching require changing the IP address f the DNS hst recrds t the IP address f the relevant server (nde) in the disaster recvery site. Fllwing are the steps that need t be fllwed t change the IP addresses f the DNS hst recrds: 1. Lg n t the dmain cntrller as the administratr. 2. Navigate t Server Manager. 3. Expand Rles, expand DNS Server, expand DNS, expand Server Name, and then expand Frward Lkup Znes. 4. Select the dmain name (fr example, CE.Temens.cm). Nte that T24Brwser and ptinal T24Server are the DNS hst recrds that require the IP changes (Figure 11). Figure 11. Select the DNS hst recrd The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 29

33 5. Right click n the DNS hst recrd T24Brwser, and then select Prperties (Figure 12). Figure 12. T24Brwser DNS hst recrd prperties 6. Change the address in the IP address field t the IP address f the web-tier server in the disaster recvery site, and then click OK. If the disaster recvery site has mre than ne web-tier server, the previus IP address shuld be the IP address f the web-tier lad balancer (NLB cluster). The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 30

34 7. If the T24Server DNS hst recrd is als available, right-click the DNS hst recrd, and then select Prperties. Change the address in the IP address field t the IP address f the applicatin-tier server in the disaster recvery site, and then click OK (Figure 13). Figure 13. T24Server DNS hst recrd prperties If the disaster recvery site has mre than ne applicatin-tier server, the IP address shuld be the IP address f the applicatin-tier lad balancer (NLB cluster). SQL Server 2012 HADR Failver The SQL Server 2012 HADR failver t the disaster recvery site might be required fr the fllwing tw scenaris: Planned manual failver Primary site database servers are available, but required t fail ver t the disaster recvery site. Unplanned frced failver Cmplete primary site r primary site database server failure, and the database servers in the primary site are nt accessible. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 31

35 Planned Manual Failver When the failver is planned, there is n server dwntime in the primary site, the Windws Server Failver Cluster (WSFC) is active, and databases are in Synchrnized state in bth primary and disaster recvery instances f SQL Server. Therefre, befre starting the failver prcedure, make sure that the databases are in Synchrnized state in bth primary and disaster recvery instances f SQL Server (Figure 14 and Figure 15). Figure 14: SQL Server primary instance database status The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 32

36 Figure 15. SQL Server disaster recvery instance database status Fr mre infrmatin abut planned manual failver, see: Perfrm a Planned Manual Failver f an Availability Grup (SQL Server) ( Limitatins and Restrictins A failver cmmand returns as sn as the target secndary replica has accepted the cmmand. Hwever, database recvery ccurs asynchrnusly after the availability grup has finished failing ver. Crss-database cnsistency acrss databases within the availability grup is nt maintained during failver. Crss-database transactins and distributed transactins are nt supprted by AlwaysOn Availability Grups. Fr mre infrmatin, see: Crss-Database Transactins Nt Supprted fr Database Mirrring r AlwaysOn Availability Grups (SQL Server) ( The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 33

37 Prerequisites and Restrictins The target secndary replica and the primary replica must bth be running in synchrnuscmmit availability mde. The target secndary replica must currently be synchrnized with the primary replica. This requires that all the secndary databases n this secndary replica must have been jined t the availability grup and must be synchrnized with their crrespnding primary databases (that is, the lcal secndary databases must be synchrnized). T determine the failver readiness f a secndary replica, query the is_failver_ready clumn in the sys.dm_hadr_database_cluster_states dynamic management view (see: r lk at the Failver Readiness clumn f the AlwaysOn Grup Dashbard (see: This task is supprted nly n the target secndary replica. Yu must be cnnected t the server instance that hsts the target secndary replica. Failver Prcedure Fllwing are the steps that need t be fllwed t fail ver the SQL Server 2012 HADR t the disaster recvery site. 1. Cnnect t Primary r Secndary (disaster recvery) instance f SQL Server by using the SQL Server 2012 Management Studi (Figure 16). Figure 16. SQL Server 2012 primary instance The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 34

38 2. Right-click n the Availability Grup (fr example, T24AG), and then select Failver (Figure 17). Figure 17. Select "Failver" 3. In the Fail Over Availability Grup Wizard, click Next (Figure 18). Figure 18. Failver Availability Grup wizard Intrductin page The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 35

39 4. In the Select New Primary Replica page, select the secndary SQL Server instance if it is nt already selected, and then click Next (Figure 19). Figure 19. Fail Over Availability Grup wizard Select New Primary Replica page 5. In the Cnnect t Replica page, cnnect t the secndary instance by prviding the credentials, and then click Next (Figure 20). Figure 20. Fail Over Availability Grup wizard Cnnect t Replica page The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 36

40 6. Click Finish at the Summary page t start the failver (Figure 21). Figure 21. Fail Over Availability Grup wizard Summary page 7. After the successful failver, the wizard will shw a Results page similar t the fllwing (Figure 22). Figure 22. Fail Over Availability Grup Wizard Results Page The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 37

41 The Validating WSFC qurum vte cnfiguratin warning appears because f the special qurum cnfiguratin used in this slutin and is safe t ignre (Figure 23). Figure 23. Fail Over Availability Grup wizard WSFC qurum cnfiguratin warning 8. Check the database status and Availability Grup status in SQL Server 2012 Management Studi t verify the failver (Figure 24). Figure 24. Management Studi after Fail Over Availability Grup wizard The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 38

42 Unplanned Frced Failver When the primary site r the database servers (ndes) in the primary site are nt available, the Windws Server Failver Cluster (WSFC) will nt have qurum t bring the cluster nline. Therefre WSFC needs t be deliberately started (frced) befre the database failver. After bringing the WSFC nline with a frced qurum, the SQL Server 2012 AlwaysOn Availability Grup needs t frce failver t the disaster recvery instance. Fr mre infrmatin abut unplanned frced failver, see: Perfrm a Frced Manual Failver f an Availability Grup (SQL Server) ( Limitatins and Restrictins Data lss is pssible during the frced failver f an availability grup. In additin, if the primary replica is running when yu initiate a frced failver, client cmputers might still be cnnected t frmer primary databases. Therefre, it is strngly recmmended that yu frce failver nly if the primary replica is n lnger running and if yu are willing t risk lsing data t restre access t databases in the availability grup. When a database n a secndary replica is in the REVERTING r INITIALIZING state, frcing failver causes the database t fail t start as a primary database. If the database was in the INITIALIZING state, yu will need t apply the missing lg recrds frm a database backup r fully restre the database frm scratch. If the database was in the REVERTING state, yu will need t fully restre the database frm backups. A failver cmmand returns as sn as the target secndary replica has accepted the cmmand. Hwever, database recvery ccurs asynchrnusly after the availability grup has finished failing ver. Crss-database cnsistency acrss databases within the availability grup is nt maintained upn failver. Crss-database transactins and distributed transactins are nt supprted by AlwaysOn Availability Grups. Fr mre infrmatin, see: Crss-Database Transactins Nt Supprted fr Database Mirrring r AlwaysOn Availability Grups (SQL Server) ( The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 39

43 Prerequisites and Restrictins Windws Server Failver Cluster (WSFC) needs t be brught nline with a frced qurum. Fr mre infrmatin abut the frced qurum prcedure, see: WSFC Disaster Recvery thrugh Frced Qurum (SQL Server) ( Yu must be able t cnnect t the server instance that hsts the target secndary replica. Failver Prcedure When the primary site r the primary site database servers are nt available, the nly accessible database server will be the disaster recvery instance. The fllwing shws hw Windws Server Failver Cluster and SQL Server instance can be seen in the disaster recvery database server (Figure 25 and Figure 26). Figure 25. Windws Server failver Cluster withut qurum The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 40

44 Figure 26. SQL Server 2012 primary site failure T bring the database nline in the disaster recver site, yu first need t start Windws Server Failver Cluster with frced qurum, fllwed by SQL Server 2012 availability grup frced failver. The fllwing sub-sectins prvide the steps required t bring the database nline. The steps in all sectins need t be cmpleted t successfully fail ver t the disaster recvery site. Frce Cluster Start with Frce Qurum Fllwing are the steps need t be fllwed t frce the cluster t start in the disaster recvery site with frce qurum: 1. Lg n t the disaster recvery database server with a dmain accunt that has administratr privileges t the lcal cmputer. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 41

45 2. Open Server Manager, expand Features, and then expand Failver Cluster Manager. Select the cluster (Figure 27). Figure 27. Failed cluster due t qurum vte 3. Click Frce Cluster Start in the Actins pane (Figure 28). Figure 28. Cluster Manager - frce cluster start ptin The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 42

46 4. Cnfirm the actin by selecting Yes Frce my cluster t start ptin (Figure 29). Figure 29. Cnfirm frce cluster start 5. Cluster start will take sme time wait till the cluster starts successfully (Figure 30). Figure 30.Cluster frce start in prgress The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 43

47 6. After the cluster starts, the cluster will lk like the fllwing figure in the Failver Cluster Manager (Figure 31). Frce Failver SQL Server 2012 Availability Grup Figure 31. Cluster started with frce qurum Once the Windws Server Failver Cluster is nline with frce qurum, the fllwing steps need t be fllwed t frce failver in the SQL Server 2012 availability grup: 1. Open SQL Server 2012 Management Studi and cnnect t the SQL Server disaster recvery instance (Figure 32). Figure 32.SQL Server instance befre frced failver The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 44

48 2. Right-click n the Availability Grup (fr example, T24AG), and then select Failver (Figure 33). Figure 33. Start frce failver 3. In the Fail Over Availability Grup Wizard, click Next (Figure 34). Figure 34. Fail Over Availability Grup wizard Intrductin page The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 45

49 4. In the Select New Primary Replica page, select the secndary SQL Server instance if it is nt already selected. Als nte the warning. Click Next (Figure 35 and Figure 36). Because the cluster qurum is frced, the qurum status is shwing as Frced Qurum. Figure 35. Fail Over Availability Grup wizard Select New Primary Replica page Figure 36. Fail Over Availability Grup wizard Select New Primary Replica page warning The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 46

50 5. Select and cnfirm failver with ptential data lss, and then click Next (Figure 37). Because the database status is nt synchrnized, SQL Server warns abut ptential data lss. Hwever, there is n data lss if the databases were in Synchrnized state at the time f the site failure Figure 37. Fail Over Availability Grup wizard Ptential Data Lss cnfirmatin The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 47

51 6. Click Finish n the Summary page t start the failver (Figure 38). Figure 38. Fail Over Availability Grup wizard Frce Failver Summary page 7. After the successful frce failver, wizard will shw the Results page (Figure 39). Figure 39. Fail Over Availability Grup wizard Results page The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 48

52 The Validating WSFC qurum vte cnfiguratin warning appears because f the special qurum cnfiguratin that is used in the recmmended slutin and is safe t ignre (Figure 40). Figure 40. Fail Over Availability Grup wizard WSFC Qurum Cnfiguratin warning 8. After successful frce failver, the database status and availability grup status in SQL Server 2012 Management Studi will lk like the fllwing figure (Figure 41). Additinal Cnsideratins Figure 41. Management Studi after Fail Over Availability Grup wizard It is highly recmmended that yu change the cluster qurum cnfiguratin if planned (scheduled maintenance) r unplanned (primary site disaster) shutdwn f all cluster ndes in the primary site ccurs, and if the disaster recvery SQL Server 2012 instance becmes active as the primary instance fr an extended perid f time. If yu d nt change the cluster qurum cnfiguratin, the entire cluster might shut dwn because f insufficient qurum vte availability. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 49

53 Change the value fr the disaster recvery cluster nde prperty NdeWeight t 1, and change the value fr the cluster ndes in the primary site t 0. Fr mre infrmatin, see the Micrsft Supprt article at Shutting dwn nly ne nde in the primary site will nt affect cluster availability as lng as the secnd nde in the primary site will be still up and running alng with the File Share Witness (FSW). If the FSW in the primary site will nt be available and cannt be cntacted by the cluster nde in the disaster recvery site, change the FSW lcatin t be in the disaster recvery site. Running the entire system with nly ne nde in the disaster recvery site will nt guarantee high availability. Therefre, this shuld nly be dne fr a limited amunt f time. Otherwise, it is highly recmmended that yu add a secnd nde in the disaster recvery site and mdify the cluster qurum cnfiguratin accrdingly. Findings and Carryvers The fllwing findings and carryvers were nted during the testing f the prpsed slutin in this dcument. Using the NLB feature in Windws Server prvides better stability, better scalability, and faster failver with n additinal cst. NLB als lets yu transparently add r remve ndes in the web and applicatin tiers. JBss sessin persistence increases the reliability and prvided better scalability fr the slutin. Remving the sticky-sessin requirement in T24Brwser makes the slutin mre reliable and scalable. A JBss sessin persistence database in the same SQL Server 2012 AlwaysOn Availability Grup reduces the administrative wrk and reduces the steps in the disaster recvery prcedures. SQL Server 2012 HADR and AlwaysOn prvides simplified disaster recvery failver while maintaining database replica in the disaster recvery site. T24 wrks well with a cnfiguratin that uses the NLB feature in Windws Server and prvides faster applicatin-tier failver. The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 50

54 Windws Server DFS-R with DFS Namespace published in Active Directry Dmain Services prvides a unique URL that can be used t refer the file share, regardless f the system that is perating in the primary r the disaster recvery envirnment. File and flder symblic links make the shared file/flder access mre resilient. A clustered instance f SQL Server 2012 fr high availability reduces licensing requirements. A SQL Server 2012 AlwaysOn Availability Grup eliminates SAN replicatins. DNS hst recrds used fr the lad balancer IP addresses make disaster recvery failver transparent at the web and applicatin tiers. Recmmended Htfixes and Service Packs The fllwing best practices apply t the recmmended cnfiguratin: Regularly check and apply all the security htfixes fr Windws Server 2008 R2. Regularly check and apply the latest available service pack fr Windws Server 2008 R2 after checking with Temens abut the supprtability. NOTE Currently, Service Pack 1 (SP1) fr Windws Server 2008 R2 is available and certified by bth Micrsft and Temens. Regularly check and apply the pertinent htfixes mentined in the fllwing knwledge base (KB) article t enhance stability and fix knwn critical bugs (nt security related). Recmmended htfixes and updates fr Windws Server 2008 R2 based server clusters As a special ut-f-band recmmended htfix fr Windws Server 2008 R2, please install the fllwing htfix n all the cluster ndes in the primary and disaster recvery sites. A htfix that imprves the perfrmance f the "AlwaysOn Availability Grup" feature in SQL Server 2012 is available fr Windws Server 2008 R2 Regularly check and apply all the security htfixes fr SQL Server NOTE Currently, SQL Server 2012 des nt have any security htfixes released. Regularly check and apply the latest available service pack fr SQL Server 2012 after checking with Temens abut the supprtability. NOTE Currently there is n released service pack fr SQL Server The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 51

55 As a special ut-f-band recmmended htfix fr SQL Server 2012, install the fllwing update package n all the SQL Server 2012 instances in the primary and disaster recvery sites. Cumulative update package 1 fr SQL Server NOTE If a mre recent update is available, it is nt necessary t install the previus htfix. Regularly check fr latest cumulative update (CU) release fr SQL Server 2012, review the fixed bugs and install nly if yu are affected and after checking with Temens abut supprtability. Fr a list f released CUs fr SQL Server 2012, see the fllwing KB article. The SQL Server 2012 builds that were released after SQL Server 2012 was released Finally, it is highly recmmended that yu check peridically with the Micrsft Supprt Service fr any recmmended nn-security related htfixes fr Windws Server 2008 R2 and SQL Server Additinal Resurces Fllwing are links fr further infrmatin. SQL Server 2012 Bks Online fr SQL Server Database Availability Key Capabilities and Cncepts: Failver Clustering and AlwaysOn Availability Grups (SQL Server) Active Secndaries: Readable Secndary Replicas (AlwaysOn Availability Grups) Database Availability Step-by-Step Guide: Deplying a new Availability Grup Create r Cnfigure an Availability Grup Listener (SQL Server) Perfrm a Frced Manual Failver f an Availability Grup (SQL Server) Instance Availability Key Capabilities and Cncepts: The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 52

56 Failver Plicy fr Failver Cluster Instances Instance Availability Step-by-Step Guide: SQL Server Multi-Subnet Clustering Cnfigure FailureCnditinLevel Prperty Settings View and Read Failver Cluster Instance Diagnstics Lg AlwaysOn FAQ fr SQL Server Hardware and Sftware Requirements fr Installing SQL Server Intrducing SQL Server AlwaysOn Overview f AlwaysOn Availability Grups Prerequisites, Restrictins, and Recmmendatins fr AlwaysOn Availability Grups Befre Installing Failver Clustering Create a New SQL Server Failver Cluster (Setup) Add r Remve Ndes in a SQL Server Failver Cluster (Setup) Micrsft SQL Server AlwaysOn Slutins Guide fr High Availability and Disaster Recvery FEF9550EFD44/Micrsft%20SQL%20Server%20AlwaysOn%20Slutins%20Guide%20fr% 20High%20Availability%20and%20Disaster%20Recvery.dcx Availability Mdes The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 53

57 AlwaysOn Failver Cluster Instances Enable and Disable AlwaysOn Availability Grups (SQL Server) Creating an Availability Grup (SQL Server) Create r Cnfigure an Availability Grup Listener (SQL Server) Mnitr Availability Grups AlwaysOn Availability Grups Dynamic Management Views and Functins Manually Prepare a Secndary Database fr an Availability Grup (SQL Server) SQL Server 2012 AlwaysOn: Multisite Failver Cluster Instance alwaysn_3a00_-multisite-failver-cluster-instance.aspx Perfrm a Frced Manual Failver f an Availability Grup Availability Grup Listeners, Client Cnnectivity, and Applicatin Failver (SQL Server) Cnfigure Read-Only Access n an Availability Replica (SQL Server) Cnfigure Read-Only Ruting n an Availability Grup (SQL Server) Client Cnnectin Access t Availability Replicas (SQL Server) Cnfigure Read-Only Access n an Availability Replica Cnfigure the Windws Firewall t Allw SQL Server Access The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 54

58 Hw t use Kerbers authenticatin in SQL Server Hw t transfer the lgins and the passwrds between instances f SQL Server 2005 and SQL Server SQL Server Web site SQL Server Tech Center SQL Server Dev Center Windws Server Failver Cluster Windws Server Failver Clustering and Nde Balancing Checklist: Create a Failver Cluster Failver Cluster Step-by-Step Guide: Validating Hardware fr a Failver Cluster Failver Cluster Step-by-Step Guide: Cnfiguring the Qurum in a Failver Cluster Failver Cluster Step-by-Step Guide: Cnfiguring Accunts in Active Directry Cnfigure Cluster Qurum NdeWeight Settings Frce a WSFC Cluster t Start Withut a Qurum Failver Plicy fr Failver Cluster Instances Checklist: Create a Clustered File Server The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 55

59 Recmmended htfixes and updates fr Windws Server 2008 R2-based server clusters A htfix that imprves the perfrmance f the "AlwaysOn Availability Grup" feature in SQL Server 2012 is available fr Windws Server 2008 R2 Netwrk Lad Balancing Netwrk Lad Balancing NLB 101: Hw NLB balances netwrk traffic Netwrk Lad Balancing parameters Specifying the Affinity and Lad-Balancing Behavir f the Custm Prt Rule Upgrading the Netwrk Lad Balancing Cluster (t 2008) Netwrk Lad Balancing: Cnfiguratin Best Practices fr Windws 2000 and Windws Server d86584a12ca4&displaylang=en The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 56

60 Abut Temens Funded in 1993 and listed n the Swiss Stck Exchange (SIX: TEMN), Temens Grup AG is the market-leading prvider f banking sftware systems t retail, crprate, universal, private, Islamic, and micrfinance and cmmunity banks. Headquartered in Geneva with mre than 60 ffices wrldwide, Temens serves mre than 1,500 custmers in 125 cuntries. Temens sftware prducts prvide advanced technlgy and rich functinality, incrprating best-practice prcesses that take advantage f Temens experience in 700 implementatins arund the glbe. Fr mre infrmatin, visit: Abut Micrsft Funded in 1975, Micrsft (Nasdaq "MSFT") is the wrldwide leader in sftware, services, and slutins that help peple and businesses realize their full ptential. Fr mre infrmatin, visit: The Micrsft High Availability and Disaster Recvery Slutin fr TEMENOS T24 57