SAN/ storage self-healing/capacity planning system and method

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 60/486,790 entitled SAN/STORAGE SELF-HEALING/CAPACITY PLANNING POLICIES filed on Jul. 11, 2003, the entire disclosure of which is incorporated herein by reference.

[0002] This application relates to storage area network management.

[0003] The main fear with storage administrators is the loss of data in business applications resulting in system-wide outages. To restore the data would be costly. Although storage management needs to be made easy for storage administrators, for instance, user friendly to those that may be less experienced in storage administration and to cover the lack of knowledge, if provisioning actions are very user friendly, mistakes can be made more readily as well. For example, drag and drop provisioning is a very popular feature in SAN administration, reducing the complexity of managing a SAN. However, it is also easy to make a mistake using a drag and drop feature.

[0004] Accordingly, a storage management system and method that is user friendly and easy to use, but also allow for tighter control so that mistakes are not made easily or to quickly detect and counteract the mistakes, are desirable.

[0005] Another area of desirable improvement is the ability to integrate SAN design tools with the SAN management tools. For example, SAN designer technology is available that allows storage administrators or users to setup policies that they desire. It would be desirable to have an import tool that imports the policies for instance, designed through SAN designer technology, into the SAN manager such that SAN manager would capture the intent of the storage administrator, and automatically provision the policies.

[0006] Yet another area of desirable improvement stems from the assumption that storage administrators need similar control over their environment the same way as the system administrators in the IT (information technology) world. For example, the storage administrators need to assure that their systems are readily available for business. They cannot afford errors or if there are problems, need to be able to determine very quickly what happened. The current provisioning tools are lacking a mechanism for change control. Therefore, it is desirable to have a system and method that would allow a storage administrator to quickly determine and/or have control over what occurs in the SAN.

[0007] For instance, customer's systems may accidentally gain access to restricted volumes and cause outages. Without proper control, it may be difficult for the customer to track what had changed and what action eventually caused the problem. Although guesses can be made as to the source of the problem, for instance, a bad LUN masking operation, there may be no record or proof of it. Thus, there is a need for change control, even in small SAN environments. Even if the only enforcement action is to record a change and report a policy violation, this customer would be equipped with the information of what went wrong, and may be able to prevent the same problem in the future.

[0008] The currently existing automatic provisioning supported by various vendors are heavily concentrated on QOS (Quality of Service). Usually, these policies allow the user to determine what level of QOS they want to have and if they want to use zoning versus LUN masking. They are limited in the automated actions they can provide and policies are typically hard-coded and there is a very limited set of policies available. A limited set of events like exceeding thresholds is supported in the existing provisioning tools. Accordingly, wider-coverage of automatic, for instance, event-driven, policy provisioning system and method is desirable.

[0009] A storage self-healing and capacity planning system and method are provided. The system in one aspect comprises one or more policy wizard modules operable to setup one or more policies associated with one or more computer storage device resources. A conformance policy checker is operable to check for conformance of the one or more policies in response to receiving one or more events associated with the one or more computer storage device resources. The conformance policy checker is further operable to invoke one or more enforcement rules associated with one or more policies, if any, if a violation of the one or more policies is detected.

[0010] The method in one aspect comprises allowing one or more policies to be reserved for one or more computer storage device resources, receiving an event associated with the one or more computer storage device resources, checking that a computer storage device resource associated with the event received conforms to the reserved one or more policies, and if the computer storage device resource associated with the event received does not conform to the reserved one or more policies, invoking an enforcement rule associated with the reserved one or more policies.

[0011] Further features as well as the structure and operation of various embodiments are described in detail below with reference to the accompanying drawings. In the drawings, like reference numbers indicate identical or functionally similar elements.

[0012] FIG. 1 is an architectural diagram illustrating the components of the system of the present disclosure in one embodiment.

[0013] FIG. 2 illustrates an example listing of resource classes, their supported policies and their hierarchies.

[0014] FIG. 3, FIG. 4, and FIG. 5 illustrate resource class hierarchy diagram for switch ports, disk array ports, and LUN/RAID group/Spindle resources respectively.

[0015] FIG. 6 illustrates a flow diagram for the policy conformance checker in one embodiment.

[0016] The system and method of the present disclosure in one embodiment allows storage administrators to discover, monitor, and administer their networked storage based environment. The system and method of the present disclosure in one embodiment provide SAN (storage area network) capacity planning and self-healing policies that enable a SAN administrator to reserve SAN resources for future usage, ensure that resources are properly allocated, and for change control, that is, capture events that occur in the SAN to monitor and control changes occurring. SAN capacity planning and self-healing policies may be implemented as an integrated function of an existing SAN managers, or alternatively, as a stand along program that, for instance, can communicate with an existing SAN managing components.

[0017] The policies of the present disclosure enable the storage or SAN administrator to pre-allocate resources and enforce their proper distribution. Thus, for example, SAN provisioning policies allow the user to specify by application or host how new disk space should be allocated once it is requested. For example, an administrator may want an application to have RAID0+1 types of LUNs, which means that the volume shall be locally mirrored and remotely replicated. RAID refers to redundant array of independent disks. LUN refers to logical unit number, for example, used, for example, to identify SCSI devices so that host can address and access the data on each disk drive in an array.

[0018] Through the policies, administrators can control that the right storage resources are assigned to the right consumers. The policies are a set of error checks and reservation guidelines implemented as properties in the Common Services CORE (Worldview repository) for every SAN resource. In one embodiment, the resources supported may include switch ports, storage ports, RAID (redundancy array of independent disks) volumes, and RAID spindles. Examples for reservation policies may include reserve by application, list of hosts, operating system, storage type (tape or disk), RAID model, and World Wide Name.

[0019] In one embodiment, the reservation policies are hierarchically structured to allow very generic down to very specific reservation of resources. The policies have a set of predefined enforcement actions. An example of an enforcement action may be the prevention of the resource allocation. Combined with change monitoring/events and integrated into administrative actions, these policies allow the SAN/Storage to be laid out the way the storage administrator intended them to be.

[0020] In one embodiment, the policies are designed to warn of policy violations coupled with SAN resource specific enforcement actions, for example, to prevent costly errors. SAN/storage administrators may be enabled to plan ahead as well as get control over a complex environment, for instance, by defining policies for the SAN layout/plan as desired.

[0021] FIG. 1 is an architectural diagram illustrating the components of the system of the present disclosure in one embodiment. One or more policy wizards 102, 104, 106 guide the user through the various reservation methods. Policy wizards are java based in one embodiment, and may be made available through a commercially available SAN Explorer and SAN Manager products, for instance, as a separate global policy with tabs for every resource class from an available SAN Manager product start menu. The policy wizards may also be available through the SAN Manager products' portal. as well.

[0022] An example of a policy resource wizard is a dynamic resource allocation wizard 102, which specifies the type of volume an application should be automatically assigned when provisioning new disk space. Examples of resource classes utilized by the dynamic resource allocation wizard may include application, logical volume, and host 108. Another example of a policy resource wizard is a switch port reservation wizard 104, which specifies what a port should be connected to in the future. An example of a resource class utilized by the switch port reservation wizard is a switch port 108. Yet another example of a policy resource wizard is a storage pool setup wizard 106, which allows a user to reserve unused storage according to capacity planning rules. For example a list of spindles could be reserved for a list of hosts. In the event that the spindles are used, policy conformance is checked to assure that the disk space is assigned properly, for example, by a conformance checker 110. This wizard, for example, has three resource levels: Spindles (raw disks), RAIDgroups, and LUNs 108.

[0023] In one embodiment, resource allocation policies are resource class dependent. For example, the following resource classes have policies defined: Applications, Logical Volumes, Hosts, Switch Ports, Disk array ports, LUNs/RAIDgroups/Spindles 108.

[0024] Different types of policies may exist depending on the resource type. Self-healing/resource planning policies type has enforcement rules defined, and addresses resources such as Switch Ports, Disk array ports, LUNs/RAIDgroups/Spindles. Zoning policies type also has enforcement rules defined, and addresses resources such as Switch Ports, RAID ports, Logical/Physical Volumes.

[0025] Resource planning/self-healing policies have enforcement actions that can be invoked when policy violations occur. In one embodiment, a disabling method is available that prevents an erroneous resource allocation. An example of a preventive action for resources such as the switch port may be an action that disables the ports. An example of a preventive action for resources such as the Disk Array ports may be an action that zones out port and/or disables the connected switch port. An example of a preventive action for resources such as the LUNs/RAIDgroups/Spindles may be an action that masks out the LUN.

[0026] Additional enforcement rules are available for all of these objects, for instance, in case the administrator only wishes to be notified of policy violations or would like to switch a particular policy off for testing, etc. These additional enforcement rules may include: Do nothing; Send warning message.

[0027] Other enforcement actions may also send warning messages as well. The default enforcement action may be set to “Send warning message” for all self-healing policies. These messages can be used to institute user customized actions to react to policy violations through an available event management system. For example, an administrator may send an e-mail or a wireless message, for instance, coupled to the SAN manager, to a system's event management system, which would initiate its own actions based on the message (event) received.

[0028] In one embodiment, the policy rules and enforcement actions are stored within the Common Services Worldview Repository (CORE) as properties to their corresponding resource classes.

[0029] In one embodiment, a policy conformance checker 110 checks for proper conformance. For instance, for resource capacity planning, self-healing policies there is a conformance check by resource class. For each class a conformance check method is made available through a runtime dll. The following conformance checks are defined: Check switch port for reservation conformance; Check RAID port for reservation conformance; Check LUN for reservation conformance; Check RAIDgroup for reservation conformance; Check Spindle for reservation conformance.

[0030] For zoning policies, the conformance check is checked whenever a zone change occurs. The hierarchy for zoning policies is not within the protected resources but in the hierarchy of objects on which level zoning can be defined, for example, fabric, switch, switch port level. Examples of checks in these policies are: Check zone for fabric zoning policy (no zoning, hard, soft zones, zone by node, zone by fcid); Check zone for switch zoning policy (no zoning, hard, soft zones, zone by node, zone by fcid); Check zone for port zoning policy (no zoning, hard, soft zones, zone by node, zone by fcid).

[0031] In one embodiment, the system and method of the present disclosure also may include policy reports, for example, generated by a policy reporter 112. Policy reports about future allocation keep the user informed about pending policies. In one embodiment, an overall status report provides details about existing policies as well as possible conflicts. Capacity/utilization reports may be updated to include reserved capacity/utilization. A report of all past policy violations may also be available.

[0032] The policy conformance checker 110 can be implemented as a runtime library, and integrated into active SAN discovery, zone manager, and storage manager components. These components are responsible for generating intelligent configuration change events. Whenever anything in the SAN changes, for example a new device is added, or the active zone set of a fabric changes, a new LUN is created and made available, the conformance checks are launched.

[0033] FIG. 6 illustrates a flow diagram for the policy conformance checker in one embodiment. At 602, switch port for reservation conformance is checked, for example, when a configuration change event is detected in one or more switch ports. At 604, RAID port for reservation conformance is checked, for example, when a configuration change event is detected in one or more RAID ports. At 606, LUN for reservation conformance is checked, for example, when a configuration change event is detected in one or more LUNs. At 608, RAIDgroup for reservation conformance is checked, for example, when a configuration change event is detected in one or more RAIDgroups. At 610, Spindle for reservation conformance is checked, for example, when a configuration change event is detected in one or more Spindles. At 612, further zoning conformance check may be performed, for example, when a zone change occurs. Example of zone checking include fabric zoning policy check, switch zoning policy check, and port zoning policy check.

[0034] The system and method of the present disclosure accommodates the policies on different platforms, for instance, since how the policies are implemented may depend on different default device behavior. For example on some director type switches the default behavior for zoning disabled is that no device can see the other. On others, if no zones are enabled all the devices have access to each other.

[0035] For disk arrays there are a couple of different behaviors in creating, masking, and exporting LUNs. On some arrays for example LUNs will be mapped to all ports when exported. On some disk array the LUN number is global, on some it is not. For example, on high end disk arrays LUN 0 on port 1 is not the same as LUN 0 on port 2. These disk arrays usually have an LDEV (logical device) concept. Usually, an LDEV is mapped 1:1 to a RAID group. An LDEV can be mapped to several ports (1:n relationship).

[0036] On low end disk arrays the LUN is usually mapped to the RAID group directly. To check the access rights to RAID groups and spindles, the conformance checker adjusts to these different layouts. Thus, the access check functions have device properties defined and use them accommodate these differences.

[0037] Some examples of access check properties are:

	Switches:	NoZoningByDefaultVisible	Boolean
		FibreTrunkingSupported	Boolean
	Disk Arrays:	LUNsMaskedByDefault	Boolean
		LUNsMappedToAllPortsByDefault	Boolean
		LDEVSupported	Boolean

[0038] In one embodiment, these properties are made available as properties to the corresponding resource classes such as switches, storage subsystems, in the CORE (Worldview repository) as well. In one embodiment, these properties are read-only.

[0039] FIG. 2 illustrates an example listing of resource classes, their supported policies and their hierarchies, that is, a list of policy types and enforcement actions for a plurality of resources. In one embodiment, reservations are saved through properties in the matching resource WV classes. Examples of the identifiers of the various reservation methods are range of hosts, host that may include IP (Internet Protocol) address (WV address property), WV name property, UUID of object in WV; Cluster, which may include IP address (WV address property), WV name property, UUID of object in WV; WorldWideName, which may induce portWWN (WV property of all fibre channel port types), nodeWWN (WV property of StorageSubsystems, HBAs, TapeSubsystems), UUID of port; Operating System, which may include class name of WV host (e.g. Windows2000Server); Logical Volume and/or Physical Volume, which may include Name of WV object, UUID of WV object.

[0040] FIG. 3, FIG. 4, and FIG. 5 illustrate resource class hierarchy diagram for switch ports, disk array ports, and LUN/RAID group/Spindle resources respectively. All classes in Worldview which are corresponding to the resource classes may be updated by the following properties:

	PolicyReservationHierarchy:	String
	PolicyEnforcementAction:	String

[0041] The policy wizards, in one embodiment, may gather the resource allocation of the user through selection screens. Reservation hierarchy string is then created, the resource is mapped to the corresponding Worldview class, and the reservation properties are filled. The policy wizards may fill in the reservation hierarchy property by, for example, using a grammar to express the tree branch that has been traversed to reserve a resource. For example, to reserve a RAID group for a Logical Volume on a Windows host the PolicyReservationHierarchy property may look like this:

• • [0042] Initiator:RangeOfHosts{xxx.xxx.xxx.xxx}:LogicalVolume: C; or
  • [0043] Initiator:Cluster:{xxx.xxx.xxx.xxx}
    To reserve a switch port for a disk array the property may look like this:
  • [0044] Target: Disk

[0045] Thus, the reservation hierarchy grammar, in one embodiment, may have the following rules: tree nodes are separated by “:”; if a tree node has an identifier assigned then the identifying property is listed with “{” and “}” and is separated by “,”;

[0046] The reservation hierarchy can be cut off at any level in the tree. In one embodiment, only one tree branch is used to reserve a resource.

[0047] In one embodiment, the system and method of the present disclosure enables administrators to automatically import SAN policies designed through SAN designer technology. For instance, SAN Manager can tie into the original design intends of the user. Users can design their SAN in Visio through SAN Designer. An import tool from SAN Designer may allow SAN Manager to capture the intent of the storage administrator. The import utility sets up the reservation policies according to the SAN Designer layout. For example, if a specific disk array is connected to one switch port, SAN Manager reserves this switch port for storage and the vendor/model that was specified. At the same time SAN Manager checks, if the already connected ports match the SAN design. A report may be launched that warns the user of all inconsistencies. In the case where a port is not connected and reserved for future usage, SAN Manager waits until a port comes online and then run the policy checks accordingly. If enforcement actions were set SAN Manager could disable the port from being put online whenever there are policy violations.

[0048] In another embodiment, the system and method of the present disclosure utilized configuration events that SAN Manager is able to capture. These events are user to detect policy violations when a user changes a storage configuration. It is assumed that the user can choose any tool to make these configuration changes. The system and method of the present disclosure detects a configuration change event even if the change was made through another tool but their own. For example, a user could use an element manager of a switch or disk array to activate a new zone set or create a new LUN. The SAN Manager of the present disclosure, in one embodiment, supplies the event and is able to counteract its negative effects even though the change was not made through its own tools.

[0049] The self-healing and capacity planning policies of the present disclosure in one embodiment allows the user to reserve all SAN resources such as switch port, disk array port, LUNs, RAID groups, or spindles before actual provisioning action is performed. Human error is still one of the highest risk when managing a SAN. The potential to destroy valuable data is great. A very common error is to give read/write access to hosts of different operating systems to the same volume. If one of the operating systems were to not recognize the disk as valid, the operating system would format the disk, treating it as a raw volume. The result is loss of data. The system and method of the present disclosure, via the policies, reserves unassigned disk space for specific applications, hosts, or operating systems and trigger preventive actions if mistakes are made such as masking a LUN or disabling a port. This in one aspect, provides full change control, in that the storage is laid out exactly the way it was planned.

[0050] In addition, the events monitored by a SAN manager, for example, all zone configuration and connectivity changes, all LUN configuration changes, all the events necessary to trigger policy checks and enforcement actions are detected and acted upon according to the policy provisioning of the present disclosure. Thus, even if the user is making changes through another tool such as a switch element manager, policies are enforced.

[0051] The system and method of the present disclosure may be implemented and run on a general-purpose computer. The embodiments described above are illustrative examples and it should not be construed that the present invention is limited to these particular embodiments. Thus, various changes and modifications may be effected by one skilled in the art without departing from the spirit or scope of the invention as defined in the appended claims.