Data backup method

[0001] This patent application is a continuation-in-part application of U.S. patent application Ser. No. 11/274,886, filed Nov. 16, 2005, which claims the benefit of U.S. Provisional Patent Application No. 60/627,971, filed Nov. 16, 2004, which are hereby incorporated by reference.

[0002] The present invention relates generally to safeguarding data, and more particularly to a system and method for mirroring and/or backing up data.

[0003] It is almost axiomatic that a good computer data network should be able to still function if a catastrophic event such as the “crash” of a disk or a computer occurs. Thus, network administrators typically perform routine processes in which data is backed up to prevent its permanent loss if such an event were to occur. When such an event occurs, the backup version of the data can be introduced into the computer network and operation of the network can continue as normal. Although routine backup processes are typically effective in restoring data on the network to allow normal operation to continue, they often do not safeguard against the loss of all data. For instance, data that is introduced into the computer network at a time period shortly after a routine backup operation is completed is often permanently loss if a catastrophic event occurs before a subsequent backup operation.

[0004] In an effort to prevent such a type of loss, in addition to performing back up processes, network administrators often use a process known as mirroring. Such a process typically includes copying data from a first data storage location to at least one other data storage location in real time. If a catastrophic event such as a “disk crash” occurs, a failover operation can then be implemented to switch to a standby database or disk storage space, thereby preventing or acutely minimizing data loss. As the data is copied in real time, the data on the other data storage location is a substantial replica of the data residing on the first data storage location most of the time. Mirroring is often strongest when it is performed remotely. Although remote mirroring is ideal, it is sometimes not used because of its degradation on input/output performance of the network. For instance, transmission latency, for example, the time it takes to copy from the main storage device to the mirror, is often one of the greatest deterrents to remote data mirroring.

[0005] Data mirroring has a significant problem similar to that described above with respect to performing routine data backups. Data as part of an input/output (I/O) request introduced into the network prior to the mirroring processes is subject to permanent loss if the main storage device becomes inoperable, for example, crashes, while processing the I/O request that has not been sent to the mirror storage device. Such a result can be disastrous for a critical computer data network such as one utilized by an intelligence agency, a financial institution or network, a computer data medical network, or any other computer data network in which it is essential to prevent any loss of data.

[0006] In light of the foregoing, what is needed is a system and method for mirroring data, reducing data transmission latency, and preparing for data failover and/or synchronization.

[0007] In at least one exemplary embodiment, a system according to the invention includes a primary data storage space having a first non-volatile buffer and a secondary data storage space having a second non-volatile buffer in at least one exemplary embodiment wherein mirroring is performed to cause data stored on the secondary data storage space to replicate data stored on the primary data storage space and input/output requests affecting the primary data storage space are logged on at least the first non-volatile buffer to manage an event affecting data on the primary data storage space or data on the secondary data storage space.

[0008] In at least one exemplary embodiment, a method of the present invention includes logging a current data operation in a non-volatile buffer on a first device, executing the current data operation on the first device, transmitting the current data operation to a second device as the current data operation occurs on the first device, receiving a confirmation from the second device that the current data operation has been executed, and executing a subsequent data operation on the first device. The system and method of the invention can reduce latency and better prepare a network storage device for failover procedures.

[0009] In at least one exemplary embodiment, a method for mirroring data and preparing for failover, including logging a first data operation in a non-volatile buffer on a first device; executing the first data operation on the first device; transmitting the first data operation to a second device from the buffer on the first device; executing the first data operation on the second device; receiving a confirmation from the second device that the first data operation has been executed; logging a second data operation in the buffer on the first device; and executing a subsequent data operation on the first device.

[0010] In at least one exemplary embodiment, a system for providing fail-over for data storage includes a primary data storage unit including a buffer; a secondary data storage unit including a buffer; means for communicating between the primary data storage unit and the secondary data storage unit; and each buffer includes means for receiving a data operation and means for forwarding the data operation to at least one data storage unit.

[0011] In at least one exemplary embodiment, a system for providing failover protection for each data operation communication to the system, the system includes a first storage device having a non-volatile buffer; a second storage device; means for logging at least one data operation in the non-volatile buffer on the first storage device; means for executing the data operation on the first storage device; means for transmitting the data operation to the second storage device from the non-volatile buffer on the first storage device; means for executing the transmitted data operation on the second storage device; means for receiving a confirmation from the second storage device that the transmitted data operation has been executed.

[0012] In at least one exemplary embodiment, a method for backing up data includes connecting a source data unit to a backup data unit through a plurality of network connections, copying data in blocks of data irrespective of file structure from the source data unit to the backup data unit, disconnecting the source data unit from the backup data unit, copying data from the backup data unit to a computer readable medium, and repeating the above steps on a predetermined schedule.

[0013] In at least one exemplary embodiment, a method for backing up data includes connecting a source data unit to a backup data unit through a plurality of network connections; copying data in blocks of data irrespective of file structure from the source data unit to the backup data unit; disconnecting the source data unit from the backup data unit; in response to disconnection of the source data unit, readdressing the backup data unit to a predetermined address, and readdressing a second backup data unit to the backup address for receiving the next backup; and repeating the above steps on a predetermined schedule.

[0014] In at least one exemplary embodiment, a data backup system includes a production data unit, a source data unit, at least two backup data units, means for connecting the source data unit to the production data unit and the at least two backup data units on a predetermined schedule, means for rotating through the at least two backup data units based on the predetermined schedule, means for receiving a search query from a user for a search of backup files, means for performing the search in the plurality of backup data units, and means for returning the search results to the user.

[0029] The present invention relates to protection of data to prevent data loss resulting from system failure. At least one exemplary system also logs data input/output requests to prepare for failover and improve the integrity of the mirroring process. When one storage unit has a failure and becomes unusable, by switching the IP address or the DNS entry, the secondary storage unit can take the place of the primary storage unit (or a replacement storage unit or back-up storage unit can take the place of the secondary storage unit).

[0030] FIGS. 1 and 4 illustrate exemplary embodiments having a mirroring system 100 that includes a primary storage unit 100 and a secondary storage unit 150. For example, in at least one exemplary embodiment, each of the storage units includes a storage array 120, 170 such as a set of multiple hard drives in a RAID arrangement. Two exemplary configurations are twelve 160 gigabyte hard drives are arranged to provide 1 terabyte of storage or sixteen 500 gigabyte hard drives for 1.4 terabyte of storage while using the highest performance portion of each hard drive in the array to improve access times. The arrangement, the number, the percentage used, and the size of the hard drives used for a storage array can vary depending upon the storage requirements of the system. In addition, there may be multiple storage units pooled together to form larger storage systems. Additionally, the entire hard drive may be used instead of the highest performance portion.

[0031] Each of the storage units illustrated in FIG. 1 includes a buffer storage space. For example, the illustrated primary storage unit (or first device) 100A includes a non-volatile random access memory (NVRAM) 130 as the buffer, but other types of buffer storage may be used including memory and non-volatile memory. Likewise, the illustrated secondary storage unit (or second device) 150A includes a NVRAM 180, which may be omitted but if omitted then the secondary storage unit will not be able to fully replace the primary storage unit. The NVRAM 130 and the NVRAM 180 in the discussed exemplary embodiments preferably have the same capabilities unless noted otherwise. In at least one embodiment, the NVRAM is included on a memory card such as an eight gigabyte PC3200 DDR REG ECC (8×1 gigabyte) random access memory card.

[0032] In at least one embodiment, the storage units 100A, 150A include an emergency reboot capability. In such an embodiment, the NVRAM 130 resides on a card with its own processor so that if the primary storage unit 100A crashes and is unable to recover, the NVRAM 130 is able to transmit the last few instructions relating to, for example, writing, deleting, copying, or moving data within the storage unit to the secondary storage unit 150A. In at least one embodiment in which the storage unit 100A, 150A includes an emergency reboot capability, the card includes a power source to supply power to the card to complete the transmission of the last few instructions. Either of the last two embodiments can be thought of as an emergency reboot capability.

[0033] For purposes of explanation, primary means for intercepting 110A and secondary means for intercepting 160A are also illustrated in FIG. 1. For example, in at least one embodiment, primary intercepting means 110A and secondary intercepting means 160A are each software, for example, computer program or kernel modules, resident in their respective units for intercepting I/O request(s) and logging the I/O request(s) in the NVRAM before (or simultaneously with) the I/O request(s) are executed by the storage unit. The flow of instructions between the primary storage unit 100A and the secondary storage unit 150A including their respective buffer storage spaces will be explained in more detail with respect to FIG. 3.

[0034] Referring now to FIGS. 1 and 2, in step S200 of FIG. 2, at least one data operation such as a data input/output request is logged in the NVRAM-1 130. In decision step S204, if it is determined whether an event has occurred, and if an event has occurred then step S268 is executed. Examples of an event that would cause synchronization in this exemplary embodiment include, for example, the buffer 130 filling up (or reaching a predetermined limit), the primary storage unit 100A crashing or having other hardwire issues, and the communication link with the secondary storage unit 150A is restored after a communication failure. In at least one exemplary embodiment, synchronization automatically occurs after a request for a file synchronization and/or a request from a database to commit a transaction. In step S268, all data is synchronized between the two storage units. In other words, the primary storage unit 100A is synchronized with the secondary storage unit 150A. In the illustrated embodiment, synchronization occurs during specified events as opposed to frequent predetermined time intervals; however, synchronization could occur at predetermined time intervals. The event determination steps may be omitted and replaced by an interrupt that will stop the process when an event is determined to have occurred.

[0035] In step S208, the data operation is executed. In at least one exemplary embodiment, only data operations that change stored data are sent to the secondary storage unit 150A. For example, a data write operation may be executed to write a new block of data to the storage array 120A of the primary storage unit 100A and this type of operation will also occur on the storage array 170A of the secondary storage unit 150A. As illustrated in FIG. 2, after each step, it is determined whether an event has occurred that requires the storage units to be synchronized. For example, in at least one exemplary embodiment, the storage units are randomly synchronized. It should be noted that the storage units are also preferably synchronized upon bringing one of the storage units on-line, for example, after a secondary storage unit is brought on-line. In at least one exemplary embodiment, the determination as to whether the above-referenced event has occurred is determined by whether the communication link of one or both of the storage units has been interrupted (or disrupted).

[0036] In decision step S212, if it is determined that an event has occurred, and then step S268 is executed.

[0037] In step S216, the data operation that was executed in step S208 is executed on the storage array 170A of the secondary storage unit 150A. After a determination is made as to whether an event has occurred in step S220, in step S224, data relating to the data operation is erased from the buffers in both primary and secondary storage units, for example, by having the secondary storage unit 150A notify the primary storage unit 100A of completion of the data operation. Steps S208 and S216 may be performed in reverse order to that illustrated in FIG. 2 or simultaneously. Step S224 may occur prior to step S208 or simultaneously with step S208. In step S228, it is determined whether an event has occurred.

[0038] In step S232, a subsequent data operation is logged in the buffer to prepare for a fail over. In decision step S236, it is determined whether an event has occurred.

[0039] In step S240, in at least one exemplary embodiment, a subsequent data operation is executed before mirroring of the data operation executed in step S216 has completed. Executing the subsequent data operation before the previous data operation has been completed on the secondary storage unit 150A can reduce latency during the mirroring process, as data operations on the primary storage unit 100A can continue without being delayed due to waiting on the data operation on the secondary storage unit 150A to be completed. Since the data operation is stored in a buffer 130, the data operation will be available for transmission to the secondary storage unit 150A. In at least one embodiment, the subsequent data operation is not executed on the primary storage unit 100A until after the mirroring of the current data operation has occurred. In such a situation, after the current data operation has been completed on the primary storage unit 100A, completion is not signaled to the process sending the I/O instruction on the primary storage unit 100A until after the current data operation has been completed on the secondary storage unit 150A.

[0040] In decision step S244, it is determined whether an event has occurred. In step S248, the subsequent data operation is mirrored. In decision step S252, it is determined whether an event has occurred.

[0041] In step S256, data relating to the data operation is removed (or erased) from buffers in both the primary storage unit 100A and the secondary storage unit 150A upon performance of the data operation by the secondary storage unit 150A. In step S260, a determination is made regarding whether an event has occurred. If it is determined in step S264 that there are more data operations, steps S200-S260 are repeated. Alternatively, if it is determined that there are no more data operations to be processed, in step S268, in at least one exemplary embodiment, the data is synchronize upon occurrence of an event such as one of the events described above. Alternatively, the system waits for the next data operation. Another exemplary embodiment eliminates one or more of event decision steps from the illustrated method of FIG. 2.

[0042] Referring now to FIG. 3, in step S305, an I/O request is received as the data operation at the primary storage unit 100A. For example, in at least one embodiment, a data write operation is received that includes data to be written and a particular block address where the data is to be written within the storage array 120A of the primary storage unit 100A.

[0043] In step S310, the I/O request received in step S305 is intercepted by the intercepting means 110A and transmitted to (or logged in) the NVRAM-1 130, in preparation for a fail-over situation. In particular, if the primary storage unit 100A should experience a disk crash before the I/O request can be processed, when the repaired primary storage unit 100A or its replacement storage unit (such as the secondary storage unit 150A) enters an on-line state, the I/O request can be transmitted from the NVRAM-1 130 and executed, thereby minimizing restoration time.

[0044] In at least one exemplary embodiment, at least one data block pointer to the data block associated with an instruction, for example, is written to the NVRAM-1 130. For example, continuing with the write operation offered above, in step S310, a pointer to the actual data block that is to be written to the primary storage unit 100A is sent to the NVRAM-1 130. If a mishap such as a crash of the secondary storage unit 150A were to occur before the data is actually written to the secondary storage unit 150A, the copy of the data in the NVRAM-1 130 can be accessed and written to the mirror storage unit replacement. In at least one exemplary embodiment, the actual data to be written is stored in the NVRAM-1 130.

[0045] In addition to handling a failover situation in which the secondary storage unit 150A crashes, the present invention includes an exemplary embodiment that handles a failover situation in which the primary storage unit 100A crashes. In particular, in at least one exemplary embodiment, data associated with an instruction is stored in the NVRAM-1 130. For example, continuing with the example offered above, in step S310, the actual data block that is to be written to the primary storage unit 100A is written to the NVRAM-1 130. In such a situation, if the primary storage unit 100A were to experience a disk crash, thereby rendering its data inaccessible, the data can be copied from the NVRAM-1 130 to the primary storage unit replacement and ultimately to the secondary storage unit (or its replacement) 150A, which likely would be the primary storage unit replacement. In particular, in at least one embodiment, a central processing unit (CPU) on the primary storage unit 100A reboots with an emergency operating system kernel which is responsible for accessing the NVRAM-1 130 and performs data synchronization with secondary storage unit 150A. The NVRAM logged data and the block pointers, for example, stored therein can be used to replay the mirror block updates and then the input/output requests that were “in flight” when the primary storage unit 100A failed. The secondary storage unit 150A or another storage unit can then transparently take over input/output requests. In at least one exemplary embodiment, the processing card on which the NVRAM-1 130 is stored includes its own CPU which can perform a synchronization regardless of whether the primary storage unit 100A is operable.

[0046] In step S315, the I/O request is executed on the primary storage unit 100A. For example, the data is written to a block address within the storage array 120A of the primary storage unit 100A.

[0047] It should be noted that the order of steps illustrated in FIG. 3 represents a sequence of steps performed in an exemplary embodiment, and as such the order of steps may vary. For example, in at least one exemplary embodiment, step S315 occurs before step S310. Alternatively, in at least one exemplary embodiment, the steps S310 and S315 occur simultaneously.

[0048] In step S320, the instruction received in the NVRAM-1 130 is transmitted from the NVRAM-1 130 to the secondary storage unit 150A and/or the means for intercepting 160A. In at least one embodiment, the instruction is transmitted from the NVRAM-1 130 to the NVRAM-2 180. It should be noted that step S320 may not occur at the exact sequence point as illustrated in FIG. 3. For example, in at least one embodiment, step S320 may occur at the same time as or before step S310 and/or step S315.

[0049] In step S325, the I/O request is transmitted from the intercepting means 110A to the NVRAM-2 180 in preparation for failover. In particular, if the primary storage unit 100A should experience a disk crash, for example, the secondary storage unit 150A can serve as the primary storage unit. In at least one embodiment, a synchronization is performed before the primary storage unit 100A experiences a disk crash to bring the secondary storage unit 150A up-to-date compared to the primary storage unit 100A. When the primary storage unit 100A experiences a disk crash, a function of the secondary storage unit 150A will require replacement by a new secondary storage unit, which is preferably added to the system to serve the function of the secondary storage unit 150A. Logging to the NVRAMs preferably continues after the replacement with the secondary storage unit 150A serving as the primary storage unit. When the original secondary storage unit 150A receives an I/O request, the I/O request will be transmitted to an NVRAM on the original secondary storage unit 150A and then ultimately transmitted to an NVRAM on the new secondary storage unit. In at least one embodiment, the primary storage unit 100A is rebuilt from the secondary storage unit 150A. After the primary storage unit 100A is rebuilt, I/O operations on the primary storage unit 100A are performed.

[0050] It should be noted that the primary storage unit 100A may crash before a synchronization is possible. In such an instance, the primary storage unit 100A preferably reboots with an emergency kernel whose job includes accessing the NVRAM-1 130 and performing a synchronization and/or transmission of any pending data operations. In at least one exemplary embodiment, as discussed earlier, the NVRAM-1 130 includes its own processor which performs synchronization and/or transmission of any pending data operations even when the primary storage unit 100A is inoperable, for example, when a disk crash is experienced.

[0051] Failover preparation also occurs when the secondary storage unit 150A or the network to the secondary storage unit 150A should experience a disk crash, mirror block pointers preferably remain in the NVRAM-1 130, for example, as the asynchronous mirror input/output has not been completed. When the secondary storage unit 150A is again available, data blocks from the primary storage unit 100A identified by the NVRAM pointer(s) are preferably asynchronously copied over to the secondary storage unit 150A.

[0052] In step S330, the I/O request is executed on the secondary storage unit 150A.

[0053] In step S335, the NVRAM-1 130 is cleared. For example, in step S335, after all data operations are allowed to complete, the data logged in NVRAM-1 130 is flushed or cleared. An exemplary method of accomplishing this is for the secondary storage unit 150A to send a signal to the NVRAM-1 130 confirming the I/O request has been performed. It should be noted, however, that the NVRAM-1 130 may also be cleared at other times. In particular, in at least one exemplary embodiment, synchronization automatically occurs when the NVRAM-1 130 is full. In at least one exemplary embodiment, synchronization automatically occurs with a third storage unit in communication with the secondary storage unit when the NVRAM-2 180 is full. In an embodiment where there is not a third (or backup) storage unit in communication with the secondary storage unit 150A, then the completed data operation is cleared form the NVRAM-2 180. Alternatively, the buffers could delete on a first-in-first-delete basis.

[0054] It should be noted that the present invention can be utilized in conjunction with other utilities. For instance, Linux, such as Suse Linux, Knoppix Linux, Red Hat Linux, or Debian Linux high availability clustering, mirroring and fail-over capabilities can be utilized by the present invention in conjunction with the NVRAM data logging feature and the emergency reboot capability mentioned above. Such mirroring and fail-over facilities can work with networking input/output protocols used by storage devices, for example, Unix/Linux clients, SMB for Microsoft® Windows clients, and Internet Small Computer Systems Interface (ISCSI).

[0055] FIG. 4 illustrates an exemplary embodiment where a kernel module handles the processing and instruction intercept for the storage units 100B, 150B. The primary storage unit 100B as illustrated includes a kernel module (or means for intercepting) 110B, a storage array 120B, and a hash table daemon 125. The hash table daemon 125 instead may be a module or other type of controller.

[0056] As illustrated in FIG. 5, when an I/O instruction is received by the primary storage unit 100B from a client system 90, the kernel module 110B determines whether the I/O instruction is for modifying data contained in the storage array 120B, step S505. If the I/O instruction is for retrieving data, the kernel module 110B retrieves the data from the storage array 120B, step S515, and sends the retrieved information to the requesting entity, step S520. If the I/O instruction is for writing data to or otherwise modifying data on the storage array 120B, then the kernel module 110B intercepts the I/O instruction, step S525. The kernel module 110B sends the I/O instruction to the storage array 120B, step S530, and sends the I/O instruction to the secondary storage unit 150B, step S535. The steps S530 and S535 can also occur in reverse order or simultaneous instead of the illustrated order in FIG. 5. The kernel module 110B waits for the next I/O instruction, step S550. The secondary storage unit 150B in at least one exemplary embodiment is also able to perform the exemplary method in FIG. 5. In an implementation where there is no further downstream storage unit attached to the secondary storage unit 150B, then step S535 is omitted as not being needed, for example, by a setting on the secondary storage unit, although if performed would not have a large impact on the operation of the secondary storage unit 150B and may allow for an easier swap of the secondary storage unit 150B for the primary storage unit 100B. By having a similar structure between the primary and secondary storage units, the storage units are interchangeable.

[0057] The storage array 120B illustrated in FIG. 4 includes a plurality of hard drives, which in combination provide the storage requirements desired for a particular implementation. An exemplary implementation for the storage array 120B is an arrangement of sixteen 160 gigabyte hard drives with fourteen hard drives used for storage and two hard drives used for storing the operating system for the system and the location in particular implementations of a buffer for I/O instructions. This arrangement when using the fastest portion of each hard drive provides a storage capacity of approximately 1.4 terabyte for the storage unit. The fastest portion of a hard drive includes the sectors on the inner tracks of each platter surface. This type of arrangement also allows for the slower portion of each of the hard drives to be used for providing a in-storage unit mirror of the data by providing a mirror location such that, for example, a working data block on hard drive number 1 is mirrored on the backup portion of hard drive number 2 (or another hard drive other than number 1). To provide additional redundancy the data stored in the working data areas is stored using a cascade RAID 5 across the fourteen storage hard drives, which will provide two parity bits for each stripe of data. A second exemplary configuration has sixteen 500 gigabyte hard drives in an array to form an 8.0 terabyte storage capacity, which would require using the entire drive for storage. Depending upon the size of hard drive used and the number of hard drives, a wide range of modular storage capacities are possible including the situation where the entire hard drive is used as primary storage when speed and performance is less of (or not) an issue for the user.

[0058] An exemplary configuration for the Ethernet cards is a set of four 1 gigabyte Ethernet cards to allow for two input connections and two output connections or alternatively a dedicated set depending upon the operation occurring (i.e., connection to the primary storage unit as opposed to the backup storage unit). Another exemplary configuration is a set of ten 1 gigabyte Ethernet cards to allow for routing of communication links through different networks to provide redundancy in the connections for each storage unit.

[0059] In the exemplary embodiment illustrated in FIG. 4, when there is a need for synchronization between the primary storage unit 100B and the secondary storage unit 150B, step S605, the hash table daemon 125 performs a comparison of the hash table(s) for the storage array 120B with the storage array 170B to see where differences exist, step S610. When a difference exists, copying the relevant data from the storage array 120B to the storage array 170B, step S615. The hash table daemon 125 waits for the next synchronization, S605. Alternatively, the hash table daemon 125 may continually compare hash tables instead of waiting for a synchronization request or event to occur. The hash table daemon 125 can also be used in at least one exemplary embodiment to bring a backup storage unit current when it takes the place of a secondary storage unit 150B.

[0060] FIG. 7 illustrates a system similar to the system illustrated in FIG. 5 with the addition of a buffer 730 being present in the storage units 100C, 150C. The buffer 730 is present in the communication path between the kernel module 120B and the secondary storage unit 150C. Although not illustrated, the buffer may be present in a parallel path to the communication link between the kernel module 120B and the secondary storage unit 150C. The buffer 730 in the illustrated exemplary embodiment provides a place to hold I/O instructions that modify the contents of the storage array particularly if the link with the secondary storage unit 150C is broken thus providing a queue. The buffer 730 in at least one exemplary embodiment retains the I/O instruction until a confirmation is received from the secondary storage unit 150C that the I/O instruction has been performed. The buffer 730 in at least one exemplary embodiment includes the NVRAM discussed above. Alternatively, the buffer 730 may retain the I/O instruction until it has been transmitted by the primary storage unit to the secondary storage unit, and upon transmission deleting the I/O instruction. The presence of the buffer 730 allows for storage of I/O instructions during the period of disconnection of the secondary storage unit 150C and transmission of these stored I/O instructions once reconnection has occurred.

[0061] FIG. 8 illustrates a system 800 that includes a distributed twenty terabyte Network Attached Storage (NAS) configuration in which the at least one exemplary embodiment can be utilized. To improve the level of security in the NAS configuration (locations 810 and 850), the network connections within the NAS configuration can be through a private network that is connected to the outside world through a gateway or similar device to allow for access to the stored data. After being presented with the disclosure herein, one of ordinary skill in the relevant art will appreciate that although twenty storage units (or devices) are illustrated in FIG. 8, any viable number of storage device sets can be used, for example, one or more of the storage devices.

[0062] Network File System (NFS) can provide UNIX client file connectivity, and SAMBA can provide Microsoft Windows client connectivity. The XFS file system can provide a solid, scalable journaling file system. The Logical Volume Manager (LVM) can be utilized to administer the large volumes of data and provide “snapshot” capability which can allow backups to be conducted without stopping primary I/O operations. The Enhanced Network Block Device (ENBD) can allow remote mirroring to be accomplished, as it can cause a remote file-system to appear as a local disk so the remote file system can be specified as a mirror in a standard Linux RAID 1 setup. ENBD can also perform other functions which can cause remote mirroring to be practical. For example, RAID 1 can automatically be rebuilt in an entire mirror when a “bad disk” has to be replaced. ENBD is “intelligent” enough to know that after a bad disk condition is created by network service interruption, the mirror can be incrementally rebuilt with just those disk blocks changed during the network interruption.

[0063] Domain Name Service (DNS), the standard Internet Protocol (IP) dynamic name service, can enable UNIX and Windows clients to locate remote NAS file resources. Using DNS round robin IP assignment, I/O work load balancing can be achieved between the primary and mirror NAS machines, in such a case, both NAS machines should serve as primaries and would serve as mirrors for the other NAS machine, i.e., when one machine receives a data operation manipulating data it will transmit the data operation to the second machine. It should be noted that a code change to the root DNS server can be performed so that it only assigns an IP address if a particular machine is operable.

[0064] In the example shown in FIG. 8, a distributed 20 terabyte configuration is shown that includes Unix and Microsoft Windows client machines in the “outside world” 805. A large gigabit switch 812 in addition to twenty NAS-A primary storage units, for example, NAS-A-1 821 through NAS-A-20 840, are located in a first building 810, as illustrated in FIG. 8. As illustrated in FIG. 8, a second building 850 includes twenty NAS-B secondary storage units, for example, NAS-B-1 851 through NAS-B-20 870, twenty NAS-C backup storage units, for example, NAS-C-1 871 through NAS-C-20 890, and twenty smaller switches, for example, switch 8951 through switch 8970 located in, for example, racks in the second building 850. It should be noted that the configuration depicted in FIG. 8 requires a bundle of approximately eighty cables (or equivalent bandwidth) connecting the first building 810 to the second building 850. But this is very reasonable since it enables the real-time mirroring of a twenty terabyte setup, and a full twenty terabyte backup of the entire configuration in less than one hour.

[0065] The primary unit NAS-A-1 821 in FIG. 8 and the secondary storage unit NAS-B-1 851, are preferably both configured with four one gigabit Network Information Cards (NICs), two of which preferably plug into a gigabit switch 812, which preferably connects the storage units to the “outside world” having, for example, at least one group 807 of Microsoft Windows clients and at least one group 809 of Unix clients although different client types could be present instead. The other two NICs of each storage unit are preferably plugged into a small, 8-port gigabit switch 8951, which is connected to the backup storage unit NAS-C-1 871. Each NAS-C storage unit in this exemplary embodiment includes 4 NICS, and each of the 4 NICS connects to a small gigabit switch. For example, NAS-C-20 890 includes 4 NICS that connect to the small, 8-port gigabit switch 8970, as shown in FIG. 8. Alternatively, each NAS storage unit may include between two and sixteen gigabyte Ethernet cards, and more particularly ten gigabyte Ethernet cards to improve throughput. In at least one embodiment, each NAS storage unit preferably includes at least twelve 120 gigabyte hard drives attached together using a hardware RAID, for example set up as a RAID 5 configuration. As discussed above in connection with at least one exemplary embodiment, each NAS storage unit includes sixteen 120 gigabyte hard drives with fourteen hard drives providing storage and two hard drives to provide approximately 1.4 terabytes of storage.

[0066] Good throughput is experienced by the system, as both NAS-A and NAS-B storage units are used as DNS load balanced primaries in the illustrated embodiment of FIG. 8. Thus, approximately half the workload was being accomplished by each machine. This is preferably ideal as read activity is usually higher than update activity requiring mirroring. In situations of high update activity, it is probably best to configure the NAS-B storage units as dedicated to mirroring and fail-over.

[0067] An exemplary way to recover a file (when needed) from a NAS-C backup storage unit, the required NAS-C file system is mounted, and “DD copy” is used to copy the required file. In cases where client machines (that is, in cases which other machines in addition to the NASs) required connectivity to NAS backup storage units, corresponding NAS-A and NAS-B storage units provided needed IP forwarding, as NAS-C storage units did not have a direct connection to the big gigabyte switch 812 shown in FIG. 8.

[0068] FIG. 9 illustrates an exemplary implementation of the invention. The client and server side of the network being located in the outside world 905 and connected to the data storage through a plurality of switches, which in the illustrated embodiment of FIG. 9 are 8 port switches, that have two levels of redundancy between A1P, A2P, A3P, A4P to the ANP switches and A1S, A2S, A3S, A4S to the ANS switches for each level of terabyte NAS storage units. Each illustrated set of terabyte NAS storage units includes a primary storage unit NAS-A1, a secondary storage unit NAS-A2, a current backup storage unit NAS-A3, and at least one prior generation backup storage unit NAS-A3-2 through NAS-A3-N. As illustrated in FIG. 9, the system may be expanded for multiple terabyte storage from NAS-B to NAS-N each with there respective set of switches (not illustrated). In an ideal environment, the primary storage units would be located in one building, the secondary storage units would be located in a second building, the current backup storage units would be located in a third building, and each additional set of backup storage units would be located in their own building. A compromise arrangement would have the primary storage units in building one and the remaining units located in building two similar to the arrangement illustrated in FIG. 8. However, a variety of combinations would be possible including having all the storage units in one building.

[0069] Backups for the systems illustrated in FIGS. 8 and 9 were executed smoothly without interruption. The back-up methodology illustrated in FIG. 10 allows the primary storage unit to continue to operate with no performance depreciation (or little impact on performance) during a back-up routine when the back-up is taken from the secondary storage unit. Alternatively, when load balancing is used between a primary storage unit and a secondary storage unit the methodology will still work. The performance impact is minimal on both units because the data present on the storage units is copied as it resides irrespective of the file system used to store the data. Using the exemplary system 800, for example, a back-up of a terabyte of data can occur in one hour or less due to the throughput that exists in the exemplary system 800 as described above in connection with FIG. 8. The data is copied irrespective of the file system used to store the data. Additionally, since each terabyte or more of data operates as a self-contained backup, additional set of data are backed up in parallel thereby enabling many multi-terabyte configurations to be backed up in a total time of under one hour.

[0070] The testing of the system 800 illustrated in FIG. 8 included quiescing databases (for example, Oracle and DB2), quiescing the XFS file systems, taking logical LVM file system snapshots, and resuming the XFS file systems and databases. After this procedure, the NAS-A primary storage units and NAS-B secondary storage unit snapshots were “DD copied” to the NAS-C backup (or third) storage units, with the first six disk snapshots being transmitted from the NAS-A primary storage units, and the second six disk snapshots coming from the NAS-B secondary storage units. Finally, the snapshots were “LVM deleted.” The above described backup procedure was accomplished in approximately one hour, with no interruption of ongoing work, with the exception of a pause to quiesce and snapshot.

[0071] FIGS. 10 and 11 illustrate how offline backing up of data may occur. In step 1015 of FIG. 11, the connection 1195 between the primary storage unit 1100 and the secondary storage unit 1150 is broken. For instance, the connection 1195 may be broken (or disconnected from the primary storage unit 1100) by changing an IP address of the mirror storage unit 1150. It should be noted that database activity on the primary storage unit 1000 is first quiesced to provide a backup point in time in this exemplary embodiment. In step S1020, the mirror storage unit 1150 is configured as a source for a backup operation to be performed. In other words, a copy of the data on the mirror storage unit 1150 will be transferred to a third storage unit 1198. In step S1025, the third storage unit 1198 is configured as a target for the backup operation to be performed. In step S1030, the backup operation is performed and may, for example, be any of the various backup schemes described above. In step S1035, the mirror storage unit 1150 is preferably placed in an on-line status such that the connection 1195 with the primary storage unit 1100 is restored. In step S1040, the primary storage unit 1100 and the mirror storage unit 1150 are preferably resynchronized for data operations occurring since the mirror storage unit 1150 went offline by, for example, instructions stored in a buffer or comparison of hash tables. After the resynchronization, database activity on the system preferably resumes.

[0072] While the mirror storage unit 1150 is offline, the primary storage unit 1100 preferably continues to handle production operations and changed block numbers are in at least one exemplary embodiment above logged in buffers, for example, NVRAMs so that the mirror storage unit 1150 can be updated, that is, synchronized when it is brought back on-line after the backup has been completed. Alternatively, synchronizing can be accomplished by performing a hash table check to determine where changes have occurred and copying the relevant data to the mirror storage unit 1150 once it is reconnected. In at least one exemplary embodiment, the performance of the hash table check is done during periods of time when the level of activity on the primary storage unit is below a predetermined threshold to minimize the performance impact on the overall system performance.

[0073] The illustrated functional relationship during the backup is the mirror storage unit 1150 operates as a primary storage unit 1100, and the backup storage unit 1198 operates as a mirror storage unit through connection 1008 as illustrated in FIG. 11. Then software can be used to perform a complete, efficient re-synchronization of the mirror storage unit 1150 (which is now serving as a primary storage unit) to the backup storage unit 1198 (which is now serving as the secondary storage unit). After the backup has been accomplished, the mirror storage unit 1150 is disconnected from the backup storage unit 1198 and is reconnected to the primary storage unit 1100, and the system automatically updates the mirror storage unit 1150 to match the primary storage unit 1100, which continued production operations while backups were performed, by transmitting the instructions stored in the buffer of the primary storage unit 1100 to the mirror storage unit 1150.

[0074] Another exemplary backup method is to copy only the data segments (or blocks) that have different hash tables between the source storage unit and the backup storage unit. This will streamline and reduce the amount of data potentially being copied from the source storage unit to the backup storage unit, which has the benefit of increasing the speed at which the backup occurs. Instead of copying every data block in the storage unit, the backup time is reduced potentially to seconds depending upon the number of write transactions that occurred since the last backup.

[0075] An exemplary extension of the backup methodology includes a rotation of backup units and/or mediums. As described in connection with FIG. 10, the exemplary method includes a nightly backup of the data contained in the system. That exemplary method can be extended to include thirty-three backup storage units to allow for a rotation of seven backup storage units for performing daily backups (this could be decreased to five if backups done on weekdays), four backup storage units for providing a rotation of four backup storage units for weekly backups, twelve backup storage units for providing a rotation of twelve backup storage units for monthly backups, and ten backup storage units for providing a rotation of ten backup storage units for annual backups. An exemplary way to switch between backup storage units is by switching the IP address of the backup storage unit just used and the next one in the rotation. Alternatively, the reassignment of the IP address is done in a preassigned order can be done almost immediately after completion of the backup. Alternatively, the labeling of the backup storage unit may rotate through a pattern of DNS hostnames: “yesterday”, “two days ago”, the name of a day (e.g., Sunday, Monday, etc.), “last week”, two weeks ago”, “three week ago”, “four weeks ago”, “last month”, the name of the month (e.g., January, February, etc.), and identification of the year. This labeling scheme maintains a logical view that is user friendly rather than a physical view using IP addresses for the backup domain space.

[0076] An advantage to this type of arrangement is a wealth of old data is readily accessible for data mining and quick restoration if the user knows from which backup they wish to restore from. A variety of combinations may be utilized in terms of numbers of units for providing desired backup rotation scenarios depending upon the desired backup strategy, for example, the strategy could stop at the monthly level or only maintain five years of backups. The rotation scenarios could increase the frequency of backups such that instead of a daily backup, the backup would occur every 4, 6, 8, or 12 hours depending upon the size of the backup and transaction load and activity of the overall system.

[0077] A hybrid approach is to have one backup storage unit and in place of the described rotation sets using tape backup or other medium. This arrangement provides for at least a twenty hour window (if not a window in excess of twenty-three hours) for moving a daily backup to tape storage. The window should provide sufficient time to move the data offline from the backup storage unit to the slower tape drives while allowing rotation of the backup tapes or other medium. The tape or other medium storage is cost effective although it has the drawback of removing the previous backups offline, which leads to a slower restoration process.

[0078] Another approach combines the two above-described approaches and places older backups onto tape or other medium to save on the expense of maintaining multiple backup storage units.

[0079] FIG. 12 illustrates an exemplary user interface 1200 for monitoring the performance of a storage system having a primary storage unit, a secondary storage unit, and a backup storage unit. As illustrated in this exemplary implementation, each storage unit includes a pair of CPUs, 3.8 gigabyte of RAM, approximately 1.3 terabyte of storage, and five network interface cards. The interface is divided into two portions: an overall summary portion 1210 and a detailed view portion 1220 of individual storage units. The overall summary portion 1210 includes a breakdown of the number of storage units in the network and detailed information about one select storage unit whose selection is controlled by selection arrows 1212, 1213. The exemplary interface includes the ability for the user to swap network identifications of the storage units by selection of the swap icon 1214. If a user needs to perform a manual backup in the system, they can select the backup icon 1216. The overall summary portion 1210 includes an identification of the roles of the storage units in the network and their respective machine status.

[0080] The detailed view portion 1220 allows the user to select a particular storage unit by selecting the desired unit to display detailed information including a line graph 1222 indicating usage level. In the illustrated interface, the detailed view portion 1220 replicates information contained in the summary portion 1210, but allows the user to have detailed information displayed for selected storage units and then be able to scroll through a list. One of ordinary skill in the art will appreciate based upon this disclosure that the user interface can display a variety of information about the status and capabilities of individual components of the storage network.

[0081] FIG. 13 illustrates an exemplary web accessible user interface for recovering previously backed up files from the backup storage unit(s). The user would enter the appropriate IP address for the backup that has the file(s) that the user wants to restore. The exemplary interface includes a search function to assist in locating the particular file, and allows the user to save the search as a filter for latter use. A list of files is provided including identification of file path, modification date, and owner although other file attributes could be displayed. The user would select the file or files that they want to restore and in at least one exemplary embodiment allow them to save the files to a location other than the file path to avoid replacing the version of the file(s) currently available. The illustrated interface also includes a list of available backup sets to retrieve files from. One of ordinary skill in the art will appreciate that the access to the backup files can be limited based upon the network/computer rights of a particular user.

[0082] As will be appreciated by one of ordinary skill in the art, the present invention may be embodied as a computer implemented method, a programmed computer, a data processing system, a signal, and/or computer program. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program on a computer-usable storage medium having computer-usable program code embodied in the medium. Any suitable computer readable medium may be utilized including hard disks, CD-ROMs, optical storage devices, carrier signals/waves, or other storage devices.

[0083] Computer program code for carrying out operations of the present invention may be written in a variety of computer programming languages. The program code may be executed entirely on at least one computing device, as a stand-alone software package, or it may be executed partly on one computing device and partly on a remote computer. In the latter scenario, the remote computer may be connected directly to the one computing device via a LAN or a WAN (for example, Intranet), or the connection may be made indirectly through an external computer (for example, through the Internet, a secure network, a sneaker net, or some combination of these).

[0084] It will be understood that each block of the flowchart illustrations and block diagrams and combinations of those blocks can be implemented by computer program instructions and/or means. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowcharts or block diagrams.

[0085] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means or program code that implements the function specified in the flowchart block or blocks.

[0086] The computer program instructions may also be loaded, e.g., transmitted via a carrier wave, to a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0087] As is known to those of ordinary skill in the art, network environments may include public networks, such as the Internet, and private networks often referred to as “Intranets” and “Extranets.” The term “Internet” shall incorporate the terms “Intranet” and “Extranet” and any references to accessing the Internet shall be understood to mean accessing an Intranet and/or an Extranet, as well unless otherwise noted. The term “computer network” shall incorporate publicly accessible computer networks and private computer networks.

[0088] The exemplary and alternative embodiments described above may be combined in a variety of ways with each other. Furthermore, the steps and number of the various steps illustrated in the figures may be adjusted from that shown.

[0089] It should be noted that the present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, the embodiments set forth herein are provided so that the disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. The accompanying drawings illustrate exemplary embodiments of the invention.

[0090] Although the present invention has been described in terms of particular exemplary and alternative embodiments, it is not limited to those embodiments. Alternative embodiments, examples, and modifications which would still be encompassed by the invention may be made by those skilled in the art, particularly in light of the foregoing teachings.

[0091] Those skilled in the art will appreciate that various adaptations and modifications of the exemplary and alternative embodiments described above can be configured without departing from the scope and spirit of the invention. Therefore, it is to be understood that, within the scope of the appended claims, the invention may be practiced other than as specifically described herein.