US 7350043 B2
A continuous data protection system, and associated method, for point-in-time data recovery. The system includes a consistency group of data volumes. A support processor manages a journal of changes to the set of volumes and stores meta-data for the volumes. A storage processor processes write requests by: determining if the write request is for a data volume in the consistency group; notifying the support processor of the write request including providing data volume meta-data; and storing modifications to the data volume in a journal. The support processor receives a data restoration request including identification of the consistency group and a time for data restoration. The support processor uses the data volume meta-data to reconstruct a logical block map of the data volume at the requested time and directs the storage processor to make a copy of the data volume and map changed blocks from the journal into the copy.
1. A method for providing data protection, comprising:
creating a consistency group comprising a set of data volumes;
at a storage processor, receiving a write operation request for a data volume in a data storage resource;
determining with the storage processor if the data volume is a member of the set of data volumes in the consistency group;
when determined a member of the consistency group, operating the storage processor to provide notification to a support processor of the write operation request for the data volume, wherein the notification includes providing a token with information pertaining to the data volume;
with the storage processor, scheduling the write operation request for the data volume in the data storage resource and storing the write operation request in a data protection journal; and
responding to a data restoration request for the consistency group by restoring the data volume by first using the token information to construct with the support processor a logical block map of the volume and by applying the data protection journal to a current state of the data volume.
2. The method of
3. The method of
4. The method of
5. The method of
6. The method of
7. A continuous data protection system for allowing data recovery at a user-specified point-in-time, comprising:
a data storage resource with a consistency group defined therein comprising a set of volumes including an attribute indicating membership in the set;
a support processor managing a journal of changed data to the set of volumes and meta-data for the volumes; and
a storage processor linked to the data storage resource and the support processor, the storage processor processing write requests including:
determining if the write request is for a data volume with the attribute indicating membership in the set of volumes in the consistency group;
when determined in the set, notifying the support processor of the write request including providing meta-data for the data volume;
storing modifications to the data volume associated with the write request in a data protection journal; and
scheduling the write request for execution in the data storage resource.
8. The system of
9. The system of
10. The system of
11. The system of
12. The system of
13. The system of
14. A method for continuous data protection, comprising:
creating a data volume for management by a storage controller in a set of data storage drives, the data volume including an attribute defining membership of the data volume in a consistency group managed by a storage processor and a support processor; and
processing a write operation for the data volume with the storage processor, the processing including buffering the write operation to cache, storing prior data associated with the write operation in a data protection journal, and notifying the support processor of the write operation to the data volume comprising providing meta-data for the data volume to the support processor.
15. The method of
16. The method of
17. The method of
18. The method of
19. The method of
1. Field of the Invention
The present invention relates, in general, to data storage and back-up solutions for recovering data existing at a particular point in time, such as after a system crash, and, more particularly, to software, hardware and systems, and methods for providing continuous data protection in a manner that allows a user or customer to obtain a copy of information or stored data from a selected point of time.
2. Relevant Background
In the data storage industries, the need for effective and reliable backup and archive of data or information is well known. Today's businesses and other institutions are devoting a significant amount of time and money toward information system (IS) resources that are devoted to providing backup and archive of information resident in computers and servers within their organizations that produce and rely upon digital information. The customers of the data storage industry are more frequently demanding that not only is their data properly backed up but also that when needed, such as after a system failure that causes a loss of data, that the backed up data be accessible at a particular point in time. In other words, there is an increasing demand for continuous data protection that allows data to be restored back to its state at a particular moment in time, which is most commonly a point in time just before their computer or data storage system crashed or was lost. The demand for continuous data protection, though, must also be balanced against the demand for low data storage costs and for speed in processing data.
Today, the term “backup” generally means that periodically, such as each day, a backup record is made that mirrors then-present information in active memory and storage of a computer or computer server. This backup operation usually involves a transfer of data to disk storage, such as to a redundant array of inexpensive disks (RAID) system, and/or to magnetic tape. The backup operation often occurs during a period of likely minimum usage of the active memory and/or data storage (or data storage resources), such as in the middle of the night. If the storage resource is thereafter lost or becomes unavailable on account of equipment failure, or for any other reason (e.g., a virus strikes at noon or a personnel error causes a crash), it is then possible to use the backup record to reconstruct the state of the information in storage as of the last backup time and date.
For many users, it is unacceptable to not be able to go back to a time immediately before the loss of the storage resource, which may mean the loss of a days or at least several hours of stored data changes (e.g., want to go back to a minute or even seconds before the virus hit or personnel mistake occurred). Unfortunately, only a limited number of alternatives have been available to the common point-in-time backup method for protecting data. Some of the solutions directed to providing continuous data protection (or “CDP”) have been very complex and have required significant software and/or hardware modifications to existing systems. This has generally resulted in customers refusing to implement such CDP solutions as being too expensive or complex, host specific, or processor hungry, and instead, these users go forward relying on existing periodic backup possibly with more frequent point-in-time backups of their data as the only improvement.
As a result, existing backup solutions including existing CDP techniques do not meet the needs of data storage customers, and there is a continuing need for enhanced techniques for providing continuous or near continuous data protection. Such techniques preferably can be implemented using existing data storage hardware with only limited increases in their operating complexities, with minimal changes in their processing speeds, and at costs that are more acceptable to data storage users.
The present invention addresses the above problems by providing a method (and corresponding software and hardware components) for providing continuous data protection (CDP) in a computer system with data storage resources. This is generally achieved through a combination of hardware and software components. When the method is implemented in a system, the user (or customer) has a mechanism to recover their information at any point in time with minimal cost and, typically, no loss of performance. Use of the CDP method of the invention also spreads cost of the backups of data over the lifetime of the information. Briefly, the CDP method involves providing an indication on a data volume that the information on the volume is to be continuously protected. As part of the method, changed information in the CDP-marked volume is prestaged to cache memory. Then, a storage or support processor (such as a RAID processor implemented as an ASIC or the like) reliably time stamps and journals all changes to block-level volumes having the CDP indications by interacting with a meta-data management system.
As will become clear, the CDP method of the invention acts at higher speeds and is a simpler implementation from the user's perspective. It also provides a much simpler mechanism (when compared with prior CDP techniques) to provide continuous data protection of a user's or customer's information while requiring no changes to any host systems that may be accessing a storage controller on which the CDP method is implemented.
More particularly, a continuous data protection system is provided for facilitating point-in-time data recovery. The system includes a data storage resource with a consistency group including a set of volumes, with each volume marked with an attribute indicating membership in the consistency group. A support processor is included for managing a journal of changes to the set of volumes and storing/managing meta-data for the volumes. The system also includes a storage processor that is communicatively linked to the data storage resource and to the support processor. The storage processor (which may be a RAID or similar storage processor) processes write requests by: (a) determining if the write request is for a data volume with the attribute that indicates membership in the set of volumes in the consistency group; (b) when determined to be in the set, notifying the support processor of the write request including providing meta-data for the data volume; (c) storing prior data from the data volume associated with the write request location in a data protection journal; and (d) scheduling the write request for execution in the data storage resource such as in back-end drives. The meta-data for the data volume that is passed to the support processor typically includes identification of the data volume and the logical block address of the modified block(s) of the data volume.
During operation of the system, the support processor receives a data restoration request including identification of the consistency group and a time for data restoration. In response, the support processor uses information in the data restoration request and the meta-data related to the data volume to reconstruct a logical block map of the data volume at the data restoration time. The support processor directs the storage processor to make a snapshot copy of the data volume and to map changed blocks from the data protection journal into the snapshot copy using the logical block map. To support time synchronization between a requesting host or other restoration initiator, the system includes a Real-Time-Clock (RTC) that provides the storage processor with a reference clock value based on a standard epoch and wherein the data restoration request includes a current time as an initiator of the data restoration request with respect to the standard epoch. Of course, the system may include an additional storage processor and support processor each acting to maintain the consistency group, and in such an embodiment, the support processors exchange synchronization messages over a communication facility at preset time intervals to establish recovery points for the set of volumes in the consistency group.
The present invention is directed to methods and systems for providing continuous data protection or CDP in a manner that allows a user or customer (e.g., an operator of a host) to select a point-in-time recovery of backed up data and, more specifically, CDP marked volumes and/or data. The method is typically implemented with software in storage processors (e.g., RAID processors or the like) and in a support processor in a storage controller or similar device or assembly. The following description will describe the CDP method that can be used to continuously protect a customer's data inside a storage controller that is operating to provide a host access to data storage, i.e., is providing SCSI block device volumes or other data volumes. The description of the method and systems used to implement such a method details the interaction between the customer (e.g., what input and control an operator may have including indicating which volumes should have CDP and which volumes should be grouped into which contingency groups (CGs)), the initiating by a host processor, and the operations that occur within a storage controller configured according to the present invention. From this description, it will be clear how the invention provides a mechanism to restore a volume or set of volumes to a specified point-in-time, and how this can be done without requiring that the storage controller's clock be synchronized to a host or customer system.
To practice the invention, the computer and network devices may be any devices useful for providing the described functions, including well-known data processing and storage and communication devices and systems such as computer devices typically used as hosts in user systems with processing, memory, and input/output components, and server devices configured to maintain and then transmit digital data over a communications network. Data typically is communicated in digital format following standard communication and transfer protocols. The data storage resources are generally described as disk devices that implement RAID storage techniques and that may use SCSI and other I/O, data transfer, and storage protocols but the invention is not intended to be limited to the exemplary embodiments shown herein as it is useful for nearly any data storage arrangement in which data volumes are generated and maintained and are written to by write operations (as will be clear to those skilled in the art). The storage controllers described herein may take many forms and typically are shown to include a RAID processor, an alternate RAID processor, and a support processor, but, of course, the RAID processors may be thought of more generally as storage processors useful for performing the functions described herein. Further, the description typically shows devices such as the RAID processors, support processors, and associated memory and/or cache as having a location (such as within a single housing or box) but the physical location is not limiting with the functionality of the components and their ability to communicate being the more important aspects.
Prior to discussing particular embodiments of the invention, it may be useful to discuss more generally some of the components that are used to describe the CDP method of the invention. A volume is a block storage device that is declared by a user or customer via a host or user system to have specific RAID characteristics or levels (e.g., 0, 5, 6, 0+1, or the like). The volume is created on a number of block-level physical disk drives in a controller back-end storage pool that implements the RAID requirements. The volume is presented to the user or customer (or a host) in the terms of the SCSI protocol as a SCSI Logical Unit, typically referred to as a LUN. The LUN is associated with at least one SCSI target on a storage controller, and more than one LUN may be associated with a single target. A storage controller is a group of RAID storage processors that implement the functionality necessary to define and implement customer volumes.
According to one aspect of the invention, a consistency group may be defined by a customer or user (such as via a user interface in a user system or via a host). A consistency group (or CG) is a collection of volumes that are logically bound together (or grouped). When the continuous data protection (CDP) feature of the invention is exercised all the volumes within the CG are restored together. The CG may extend across a number of storage controllers. If the CG extends across more than one storage controller, then there preferably is provided an inter-controller communication facility between the controllers to facilitate either in-band or out-of-band communication between the controllers (such as to allow the support processors implementing CDP management functions to talk).
In the storage controller, the RAID processor provides the mechanism to process SCSI I/O commands addressed to one or more volumes. The RAID processor generates the necessary disk I/O operations to affect the intent of the I/O command on the physical drives comprising the volume. The RAID storage processor uses cache memory to stage its I/O operations to and from the physical drives. The contents of this cache are protected against a power failure. A cache slot is used by the RAID storage processor to buffer I/O operations. Any changes to a cache slot are mirrored to the cache of the alternate RAID storage processor. A Real-Time-Clock (RTC) provides the RAID storage processors in the storage controller with a reference clock value, e.g., based on a standard epoch. A support processor is provided in a storage controller that manages the meta-data associated with the volume and directs the RAID or storage processor(s).
With this terminology in mind,
Each storage controller 120, 180 is similarly configured with an RTC 121, 181 that provides a reference clock value, with the RTCs 121, 181 being kept synchronized. Each storage controller also includes a pair of RAID processors 122, 124, 182, 184 each running a CDP module 123, 125, 183, 185 and includes a support processor 130, 186 running a CDP manager 132, 187. The CDP modules 123, 125, 183, 185 and CDP managers 132, 187 are typically software (and/or hardware) that enables the processors to perform the CDP functions of the invention (as discussed above and in more detail below with reference to
Further, as shown, memory 134, 190 is provided for each of the support processors 130, 190 (and may be provided separately as shown or as part of the data storage resources 150, 160). The CDP managers 132, 187 act to store CDP data 136, 191 that facilitates the CDP method of the invention including volume meta-data and token information as described below as well as user input defining CGs and other CDP-related information. Additionally, the CDP managers 132, 187 act to store CDP prior data in the form of a journal 138, 192 either in memory 134, 190 or within local or remote data storage resources 150, 160 to enable recovery to a particular point-in-time.
Data storage resources, such as a plurality of disk drives that may use to provide RAID or other storage, 150, 160 are controlled by storage controllers 120, 180 in system 100. The resources 150,160 may take many forms and have varying size to practice the invention and are shown in simplified form to include storage components 151, 152, 161, 162. Volumes 156, 158, 165, 167, 170, and 174 are created on these storage devices (e.g., drives). As shown, CDP attributes 157, 159, 166, 168, 176 are assigned to (or specified for) a number of the volumes, and these attributes are assigned at or after volume creation so as to assign the volumes to particular contingency groups 154 and 164. Note, a consistency group may also be contained within a single storage device 151, 152, 161, 162 as long as it contains all volumes that belong to that group 154, 164. Note, also, that not all volumes need to be assigned to a consistency group to practice the invention, e.g., volume 174 is not being provided CDP protection and may be only recoverable under different data protection criteria (such as periodic backup or the like).
To further explain features of the invention,
An exemplary continuous data protection (CDP) method 300 is shown in
At 310, the method 300 continues with establishing one or more available back-end slot pools. Typically, this occurs when a RAID processor is initialized. The RAID processor acts to provide a pool of back-end storage slots that can be used later during asynchronous write operations. This slot pool may be subdivided during the process 300 to assign a subset of the pool to a particular consistency group.
According to another feature of the inventive method 300, at 320, one or more consistency groups are created. Step 320 typically involves a customer defining, such as via a U/I or via a host, a consistency group across one or more storage controllers. When the consistency group is created, the customer/operator may in some embodiments be able to define a level of granularity to be used by each created consistency group while in other embodiments a default granularity is used. The granularity defines the resolution of the continuous data protection. An upper bound on the amount of storage used by each consistency group per storage controller is also typically specified, with the upper bound being defined by the total number of back-end slots used for the deltas and may also provide a limit on the age of these slots. Further, the consistency group may also specify the back-end slot pool requirements to the storage or RAID processor. Consistency groups (or CGs) are defined as a collection of volumes with common or shared synchronization point guidelines. A synchronization point may be time based, journal utilization based (e.g., amount of storage in journal used since last synchronization point), controller based, host based, or a combination thereof. Data for the CG characteristics is typically maintained within the controller.
At 326, a next data volume is created in the CDP system (such as system 100 of
At 340 the method 300 continues with processing a write operation. More detail of such processing shown in write operation processing 400 in
At 450, the method continues with the support processor being notified by the RAID storage processor (e.g., the CDM manager of the support processor is contacted by the CDP module of the RAID processor) that a volume with a CDP attribute has been updated. Additionally, the unique CDP token associated with the back-end and cache slots is provided to the support processor for use in managing CDP activities. At 460, the method continues with the RAID processor indicating the write operation is complete to the initiating host. At 470, the RAID processor schedules necessary write operations against the back-end drives or resources. Further, the CDP maintains prior data from the target location (for writes affecting CDP marked volumes) in journal format (e.g., in journals maintained in memory by the support processor (and/or by the RAID processor) as shown in memory 134 as journal 138). The method 400 may now end at 490 or continue with receiving additional write operation requests at 410.
The method 300 then continues at 350 with performing CDP manager functions in the support processor associated with the RAID storage processor performing the write operations at 340 (but, of course, some of these CDP functions may be concurrently performed by the support processor).
As shown at arrow 3, the support processor 624, is notified that a CDP volume was updated and is supplied the associated token. Then, at arrow 4, the support processor 624 assigns a slot for the original data and returns that the assignment to the storage processor 622. The storage processor 622 is shown at arrow 5 reading the “old” data from the back-end storage 630 into cache 628 destined for the new back-end location that was assigned in the step shown by arrow 4 (i.e., step 4). Arrow 6 is used to illustrate that the server 610 is notified by the storage processor 622 that the write is complete. Then with the customer updated, the “new” data is written to the back-end storage 630 as shown with arrow 7. The “old” data may then be destaged to the back-end storage 630 (such as in a step 8 not shown), and the seventh and eighth steps may be performed in parallel. As shown with arrow 9, the support processor 624 acts to update journals.
An exemplary CDP management process 500 is shown in more detail in
The data journal contains prior data changes to volume data and has the changed data buffer, its size and LBA, a time stamp or other synchronization point data, and a volume and CG identifier. The quick index or second smaller journal contains broad value synchronization points such as the controller synchronization points or journal usage synchronization points. This data includes the type of synchronization point, a time stamp, and the relative offset within the data journal where the first journal entry begins after this synchronization point. The journals are preferably self-describing and recoverable so that no single point of failure exists. The quick index (or synchronization point) journal may be recovered from the data journal as a background task. The data journal may be RAID protected or protected by creating multiple identical journals depending on user and/or implementation preferences.
As to restoration using the journals, the user requests a restoration to a given time synchronization point. After the copy of the volume(s) in the consistency group is made, the synchronization point journal is traversed to find the basic starting location within the journal of all changes since the requested time. The data journal is then searched for all changes in oldest to youngest direction. In parallel or sequentially, as changes are found, a bit map of CG changes is created so that only the earliest change is placed on the volume copy. The data is restored to the copy of the volumes at the proper location. It would be possible to present the volume immediately to the host/user and only hold up volume access for those tracks that need updating to older data when they are accessed by the user. In this case, the bit map of changes would have to be fully known prior to making the volume available for use.
At 530, the CDP manager of the support processor extracts CDP data from the token and saves it to memory. The token contains a variety of data useful for performing CDP (for restoring data to a point in time) including, for example, information regarding a CDP write operation, its logical block address, its size, and the newly-assigned back-end slot. The extracted token information is bound in the volume's meta-data, and at this point in the write operation process, the RAID processor acts to schedule the necessary write operations against the back-end drives. Upon completion of the write operations, the cache slots associated with the unique token are cleared.
At 550, the CDP manager of the support processor acts to determine whether the interval defined for the contingency group has expired or is satisfied and such interval analysis is performed for each consistency group (which may have the same or differing intervals). At or after the interval, the method 500 continues at 560 with support processors managing or implementing a particular contingency group exchanging synchronizing messages. This message is sent over the connecting communication facility and is used to establish the recovery points defined when the consistency group is created.
At 570, the support processor determines whether the slot pool is depleted and if not, the processing 500 continues at 510. If determined depleted or near depleted, the CDP manager at 580 acts to replenish the slot pool in the data resources with additional slots. This event (i.e., step 580) is typically triggered at 570 by the detection of reaching a low-water mark or minimum number of slots (which may be detected by the RAID storage processor or the support processor). The support processor operates to replenish the back-end slot pool by supplying unused slots or slots that have been reclaimed from consistency groups. The method 500 ends at 590 or may continue at 510.
Referring again to
According to one important aspect of the invention, the CDP process allows a CDP enabled storage system to restore CDP marked data back to its state at a user-selected point-in-time (such as to a particular hour, minute, or even second just prior to a system crash or loss of active memory). When a customer or user needs a set of volumes, i.e., a set of volumes assigned to a particular consistency group, restored to a particular point-in-time, a request is sent to the support processor. Its CDP manager processes the request to determine: (1) the consistency group to be restored; (2) the time to which it is to be restored; and (3) the customer's current time with respect to the common epoch. The support processor uses the request and all of the volume's meta-data to reconstruct a logical block map at the user-specified restoration time.
To achieve restoration, the CDP journal may have a number of characteristics. For example, the CDP data in the journal may be saved in increments of the smallest of cache slots. Additional data is typically saved to represent time slices and volume utilization. Further, data in the CDP journal may be offloaded to another storage medium if CDP restore time frames are not an issue. Also, the CDP journal data may be compressed.
Although the invention has been described and illustrated with a certain degree of particularity, it is understood that the present disclosure has been made only by way of example, and that numerous changes in the combination and arrangement of parts can be resorted to by those skilled in the art without departing from the spirit and scope of the invention, as hereinafter claimed.