DISASTER - BEFORE AND AFTER

BEFORE DISASTER STRIKES | AFTER THE DUST SETTLES

"Be Prepared" - the Boy Scout Motto -

There is probably no greater service that anyone can do for you as a System Administrator then to impress upon you just how important an 'in-place', functioning plan for disaster recovery can be to your future and the future of your enterprise.

Disasters come in many flavors and are relative to each Administrator - to some, data loss is a complete disaster, to others it's recoverable hardware failure, and for a few (hopefully, a very few) it's the loss of everything (hardware, software, and a bit self esteem) - by fire, flood, or other acts of nature. Are you prepared of any or all of the above? Right now, if it happened today, right this minute -

Are you ready?

BEFORE DISASTER STRIKES

BACKUP | HARDWARE REDUNDANCY | MIRRORING


Data - back it up, archive it, make it redundant. Everyone has some sort of data recovery system in case of data loss, hopefully it's real, it works, and you're using it.

BACKUP

HARDWARE | JOB SCHEDULING | EDITING THE CRONTAB FILE


I think (interject personal opinion here), that the most popular way to protect against disastrous data loss is by using some sort of tape backup system, it's straight forward and easy to understand. Make a copy of your data on a regular basis, store it in a safe place, and hope you never have to use it.

NOTE: Backup and Mirroring are two different animals. There is also a major difference between data loss and data corruption - think about it.

If something - anything - happens to your system or data you will want to be able to fix the problem with no data loss or corruption with the shortest possible down time. Simple, right?

Well, it takes time to back up data
It takes an interminable amount of time to restore that data
And, it takes time to repair or replace that damned useless hardware
and yet -
You are required to keep the system 'functional' at all times - it's written in your job discription - I saw it.

I know as surely as I'm sitting here pecking on this computer, on my way home from a Texas assignment, that you are going to get caught in the SAVC (System Administrators Vicious Circle) - which is ......

The more work the users/clients do the more data they build up. The more data they build up the longer it takes to back it up. The longer it takes to back it up the less time they have to do work. The less time they have to work the less time it takes to backup. The less time it takes to backup the more time they have to work. The more time they have to work the longer it takes to backup ...... and so on, and so on.

Your job, at times, is a fancy juggling act. The things that have to be accomplished seem to be opposed to each other. Know this, the better prepared you are, the more protective devices you have in place, the less time it will take for backup, restoration and/or repair.


Hardware -
The backup system which is in place (and working) during production should provide a fast and accurate archive of all or selected data without shutting the system down for any period of time or having any users logout. It should also be able to run backups from several different computer platforms and use a variety backup of software (the boss knows this but just try to get him to give you some money to make it work).


Existing -
The tape drive delivered in the SuperMini Contract with the T520s is a 4MM Digital Data Storage (DDS) tape drive. It was not intended for use as a backup system. It was supplied in order to facilitate installation of software which was delivered in DDS format.

However, if you intend to use it temporarily until the a backup system is in place and functional - DO NOT use any tape cassettes which are not SPECIFICALLY LABELLED as DDS format or any tapes larger than 90 Meter! Use of DAT-format (Digital Audio Tape) cassettes, which look exactly like DDS cassettes except for the label, can damage the drive and will void the device warranty. Hewlett-Packard says so - so there.

Data can be input incorrectly.
Data can get changed - accidentally or on purpose.
Data can get overwritten.
Data can get lost or erased.
Data can become corrupted - usually through mechanical/electrical means.

Typical tape backups of the data can help in all of the above cases. The better your backup scheme, the more frequently you backup, the better off you will be. Standard practice is an incremental backups every night and full backups on the weekends. Store the data for 4 weeks then begin reusing the tapes. Remember, DDS tapes have a 50 use limit before they start becoming unstable.

To restore the data - restore from the last 'full backup' tape and then every 'incremental backup' until the data is restored to the desired condition.

If time permits - it is a good idea to backup 'full' each time. It would save time and confusion. If time is not on your side incremental backups are faster to do but take much more time to restore. It's your choice, sort of.

Because of the proliferation of computers, and the need for insuring the safety of data, several 'computer terms' have become interchangable, and they are not ... Backup and Mirroring.

Backup is good for data loss, corruption, accidental or intentional erasures, bad input, which overwrites good data, etc. - Mirroring is good for hardware loss because data is instantly copied somewhere else and restored and updated automatically when the hardware is repaired. Mirroring is NOT a good data backup tool because it propagates bad data input, accidental or intentional erasures, data corruption, etc. We'll get to both shortly. But first ...

A true story -
I found a System Administrator on Usenet with a very common problem. He had a large Oracle database - 40 Gigabytes. It took him 15 hours to back it up using the single drive 4MM DAT (DDS2) tape. It took 9 - 90 Meter tapes. During that time the database was unusable, clients couldn't enter or extract data. To further the problem somebody had to be there during the 15 hour period to physically change the tapes. He was asking for help. Clients were becoming irritated, backups were time consuming and costly.

He got a lot of suggestions. Most of which centered around compressing the data even further than it already was and explaining to the client that it just couldn't be done any faster. Same old 'stick-in-the-mud', short-sighted answers.

Only one person offered real relief. Change backup systems. The DDS2 has a native transfer rate of about 24MB per hour - about 28 hours for 40GB or 15 if compressed. The new DDS3 has a native/compressed transfer rate of 60/120MB per hour or about 10 hours to backup his 40GB database on 6 tapes.

8MM tape systems would be about 3 times faster than the DDS3 or 2.5 hours - two tapes, no operator.

DLT7000 Tape Library - 1.5 hours or less, one tape, no operator.

My question to you is ......... How much is it worth to you and/or your company?


If you want to cut your backup/recovery time, get away from a lot of operator intervention and from having to have people around for hours waiting to change the tapes in your drive, you a going to have to move away from the old, familiar DDS drive devices into jukeboxes and robot libraries.


DLT -
DLT tape technology uses multi-track linear recording of digital data on metal particle media to provide very high transfer rates and extraordinary reliability (WOW! - such big words).

DLT tape libraries can backup at speeds of 575GB per hour and scale up to 5TB of storage capacity on tapes that hold 35 to 70 GB.

They are also designed to be able to backup databases that are in use (called 'hot backups'). This means no down time for backing up. It also means that your restores will be faster and easier. All together it means happier clients and less wasted money.

Most of these systems are 'scalable' - they can start small and be added to as your needs grow.

There are a multitude of DLT tape libraries on the market. Look for one that is expandable and purchase the minimum configuration, scaling up as the client base increases. If you want more information do a search on DLT through your favorite web browser. If your search engine allows, don't forget to search the Usenet also.


CD-ROM - robot library - jukebox - towers.

CD-ROMs hold about 600MB each. They are easy to store. Shelf life is long. You can daisy chain towers for control of up to 150 CD's.

I don't know that much about them but I know that they are another viable choice - not to be overlooked.

Search for 'CD-ROM backup' on the Internet and Usenet.


Optical Disk - robot library - jukebox - towers.

An alternative to tape or CD-ROM storage. They can store up to 2.6 Gig on one optical disk with full read/write capability. Disks have 1 and amazing 100Yr shelf life but are fairly expensive. I understand that one major advantage is the ability to expand the size of the system very quickly and easily.

I don't know that much about these things either but I do know that they are another viable choice.

Search the Internet and Usenet - 'Optical Disk backup' for more information.

NOTE: Make sure that your hardware/software combination can support 'hot backups' of all the RDBMSs that you are currently using and intend to use.


Third Party Backup/Restore Software -
There is not much to say here because I don't want to turn this into an advertising page. The software you pick must run on the hardware you have or are about to get. One piece of advice - make sure whatever you get runs on your chosen hardware -

There is an old joke - What's the difference between a used car salesman and a computer salesman? - The used car salesman knows when he's lying ...

Unfortunately, in many cases it's the truth, of course (insert sarcasm here) we all know it's because technology is moving so fast they have trouble keeping up.

Just make sure the software works with the hardware AND that they both do what you expect with respect to your clients and their programs.

There is nothing worse than spending lots of bucks on promises and 'airware' whose needed functions (insert more sarcasm here) 'are being worked on right now and should be out before the end of the month'.

Yes, I used to be a computer salesman.

If you need a few backup program names to start with - and these are not product endorsements - look into "Alexandria", "Legato Networker", "SQL-BackTrack", "Backup Exec", and "HP OpenView OmniBack" to name a few.


HP-UX Backup/Restore Software -
Listed below are the standard HP-UX commands for backing up and restoring files and file systems. Check their man pages for use and options.

fbackup/frecover - combines features of dump and ftio to provide a flexible, high-speed system backup. It selectively transfers files to an output device. It is used by sam to perform backups. frecover - the counterpart of fbackup, it puts the files back. It is used by sam to do restores.

ftio - a tool designed specifically for copying files to tape drives. It performs faster than either cpio or tar in comparable situations.

cpio - copy in out - saves and restores archives of files on magnetic tape, other devices, or regular files, and copies files from one directory to another while replicating the directory tree structure.
examples -

find / -hidden -print | cpio -ovxdB > /dev/dds - copies the whole system to the DDS
WW tape /dev/dds. For devices that use Block transfers like magnetic tape.
ls /* | cpio -ovxdB > /dev/dds - same as the above command, copies the whole system
WWto the DDS tape /dev/dds. For devices that use Block transfers like magnetic tape.
cpio -ivxdB < /dev/dds - copies all files from the DDS tape to the current directory.
WWFor devices that use Block transfers like magnetic tape.
cpio -ivxdB [filename] < /dev/dds - copy a specific file from the DDS tape /dev/dds.
WWFor devices that use Block transfers like magnetic tape.
cpio -ivxtB < /dev/dds - give a table of contents of the DAT tape /dev/dds. For devices
WW that use Block transfers like magnetic tape.

tcio - Command Set 80 - for those of you who still use the CS/80 Cartridge Tapes. Designed to optimize the data transfer rate between cartridge tapes and the computer. Works best in conjunction with cpio.

tcio -i /dev/dds | cpio -icvd [filename or directory/*] - archives files or directories from
WW the DAT tape /dev/dds.
tcio -i /dev/dds | cpio -icvt - gives a table of contents from the DAT tape /dev/dds.

dump/restore/rdump - copy to magnetic tape (or another device or system) all files in the named filesystem that have been changed after a certain date. They work only with HFS filesystems. restore - dumps counterpart - puts it back.

dd - copies the specified input file, filesystem, or device to the specified output with possible conversions. See also 'dd' in the Mirroring section

dd if=/dev/dsk/c3t6d0 of=/dev/dsk/c3t9d0 bs=512k - copies disk c3t6d0 to disk
WWc3t9d0.

Never dd all or part of a non LVM disk to a LVM disk. It will destroy LVM information. Use regular backup/restore techniques on LVM disks.

tar - saves and restores archives of files to and from magnetic tape, floppies, or regular files on the hard drive.

tar -xvf /dev/dds - get all files from the tape device /dev/dds.
tar -xvf /dev/dds [filename] - specify a single file from tape device /dev/dds. Use
WWwildcards for multiple files.
tar -ft /dev/dds - gets a table of contents form the tape device /dev/dds.
tar -cvf /dev/dds - copy to an archive on device tape /dev/dds.

vgcfgbackup/vgcfgrestore - vgcfgbackup makes a backup of the systems Volume Group configurations and saves them in a default file /etc/lvmconf/volume_group_name.conf (a file for each Volume Group). It does not backup the data within the Logical Volumes, just the LVM disk configuration. You can optionally run vgcfgbackup at any time from the command line.

vgcfgbackup -f /etc/lvmconf/vg00.conf - writes Volume Group 00 LVM disk
WWconfiguration information to the vg00.conf file, overwriting existing information.

Use vgcfgrestore to restore the Volume Group information to a Physical Volume or when creating a Physical Volume to replace a failed disk -
vgcfgrestore -n vg00 -l - lists the LVM configuration for Volume Group 00.

Make sure that the disk you want to restore to is connected and working.

Deactivate the Volume Group -

vgchange -a n /dev/vg00 - deactivates Volume Group vg00. When deactivated the
WWVolume Group does not exist as far as the system is concerned.

Restore the Volume Group configuration data to the Physical Volume -
vgcfgrestore -n /dev/vg00 /dev/rdsk/c3t14d0 - restores the LVM configuration from the
WWfile in /etc/lvmconf/.

Reactivate the Volume Group -
vgchange -a y /dev/vg00 - puts Volume Group 00 back online.


Job Scheduling -
UNIX systems run a scheduler which is designed to allocate processor (CPU) time to runable processes (jobs) according to their relative priority. This priority is changed by the scheduler through a complex algorithm based on individual processes’ CPU utilization, elapsed time since the process last ran, the user-assigned priority, and other factors. Generally, a process which is issued from the command line runs so quickly that the user is barely aware of the delay for scheduling, unless system loads are extremely high. Consequently, user or operator intervention in job "scheduling" is seldom required, although the nice command is provided for doing so.

It is common practice to establish a "scheduled" run time for a user-specified job, or process (like an incremental or full backup). This is useful in cases where a repetitive task needs to be run on a scheduled basis, e.g. every weekday morning, or where a one-time task needs to be run during non-peak hours because of its size or other special requirements.

The cron program executes commands at specified dates and times according to instructions placed within a crontab file. It is the UNIX job scheduling utility for repetitive tasks.

The at program executes a command at a specified date and time, on a one-time-only basis. It is the UNIX job scheduling utility for non-repetitive background jobs. The advantage is; the user need not be present, or even logged onto the system, for the job to execute.

To help you as System Administrator, a policy should be established to restrict use of job scheduling programs to those who can show a legitimate need, and only for the period during which that need exists. This policy should be implemented by creation and management of a cron.allow file containing the user ID’s of those users having approval to run scheduling programs. Existence of this file denies scheduling program use to all users not listed in the file (except the "root" user). Users needing this capability should notify the Production System Administrator, providing their user id, a description of the need, and the duration of the need. You should validate the request then add the userid to the cron.allow file. Upon termination of the period of need, you need to immediately remove the userid from the cron.allow file and notify the user.


Editing the Crontab File -
A crontab file is created utilizing the crontab command. This command manages the crontab file for the user. A crontab file is used to schedule jobs that are executed automatically by the cron program on a regular basis. In order to create a crontab file, the user’s userid must first be present in the cron.allow file. The crontab command has these options -

crontab [filename] - This creates or replaces the users crontab file by copying the
WWWspecified filename into the crontab directory.
crontab -l [userid] - This lists the existing crontab file [for the specified user].
crontab -r [userid] - This removes the crontab file from the crontab directory [for the
WWWspecified user].
crontab -e [userid] - This edits the existing crontab file [for the specified user].

The crontab file consists of six fields. The fields are separated by spaces or tabs. The fields have the following format -

minute   hour   day   month   weekday   command

where -

minute is the minute of the hour (0-59)
hour is the hour of the day (0-23)
month day is the day of the month (0-31)
month is the month of the year (1-12)
weekday is the day of the week (0-6, 0=Sunday)
command is the command or script that needs to be executed.

Each field (except for the command field) can be either an asterisk "*", meaning all legal values, or a list of elements separated by commas. An element is either a number in the ranges shown above, or two numbers in the range separated by a hyphen (meaning an inclusive range).

The "root" file within the /usr/spool/cron/crontab directory is the file that will be used when executing "crontab" within the root account.

NOTE: If you are is performing backups of RDBMS database files with the existing single DDS tape drive you must shutdown the database engine before the backup and restart the engine after the backup completes.
You would insert before the backup entries-
/sbin/init.d/oracle stop - in the command field. This will shutdown oracle, all of the
WWWdatabases, so they can be backed up.

and after the backup entries-

/sbin/init.d/oracle start - in the command field. This will start the Oracle databases
WWWafter the backup is complete. Remember to give the backup system time to
WWWcomplete the backup before restarting the database.



HARDWARE REDUNDANCY

SINGLE POINTS OF FAILURE | EXTRAS

There is another way to BEAT the disaster monster. Remove all single points of failure by creating hardware redundancy everywhere you can.

A single point of failure is a hardware device, a part of the computer, which, if it fails causes all or part of the system to fail with it.


Single Points of Failure -

Array Power Modules -
The T520 as shipped under the Super-Mini Contract has only one Power supply module in each of the 7 arrays. There should be two in each. If the module fails the array stops. Create a double point of failure by adding a second power supply module to each array.

7ea. - Power Supply Modules
CLIN # 0035AG from PRC
Current Price (1997) $410.56 ea.
Total - $2873.92

SCSI Controllers -
The T520 as shipped under the Super-Mini Contract has 3 - 15 address Fast/Wide SCSI Controllers (not to be confused with the 2 controllers inside each array). Usually the JBOD and one array are hooked to one of the controllers and 3 arrays to each of the others.

To provide double points of failure 3 more 15 address Fast/Wide SCSI controllers need to be added. If any one of the controllers fails data will be re-routed to and from the correct array by means of the other controller. In the last 4 months I have seen 2 controllers fail (separate machines, separate places). They do fail and waiting for PRC/HP support could be costly.

There is not room in the I/O cage for 3 more controllers so you have to get another I/O cage, power supply and cables (there is room in the existing configuration for all this stuff).

3ea. - 15 Address F/W SCSI-2 Controller
CLIN #0013AD from PRC
Current Price (1997) $1,163.49 ea.
************************
1ea. - HP-PB I/O Expansion Module, 14 Slots
with connector cabling (2 cables)
CLIN #0013AK from PRC
Current Price (1997) $5,736.29
************************
1ea. Add-on VAC PDU Power supply
CLIN #0036AB
Current Price (1997) $163.82
*************************
Total: $9390.58 (includes installation)

System Power Supply -
There is only one power supply on the T520. There is room for 2. If you are using an Uninterruptable Power Supply (UPS) you already have a second point of failure.

Another T520 -
What! Yes, in mission critical situations a second T520 can be tied into the system and mirrored so that if something happened to one of them the other could keep going - and the users wouldn't notice the switch.

CPU/Network -
If it is critical to your operation that you protect against network or CPU failures (to name two other potential sources of failure), then you should investigate the purchase of the HP MC/ServiceGuard product.

Some of the above is cheap, some really expensive. The bottom line is - How important is it that your system stay functional? What's it worth to you?


EXTRAS -

Array fan - The T520 system came complete with all necessary fans. However, an array needs all three fans to operate correctly. The T520 as shipped with the Super-Mini Contract came with an extra fan, keep it handy.

Array Hard Drive - The array hard drives are hot swappable. Keep an extra hard drive to immediately swap for a failed disk. As shipped under the Super-Mini Contract, the T520 arrays were equipped with SEGATE ST32550N 2GB hard drives.

/opt/hparray/bin/arraydsp -i - to get a list of array ids
/opt/hparray/bin/arraydsp -a [array id] - for info about the array, including drive
WWWtype, fans, power supplys, and overall state of the array.

Having these parts in stock and ready for immediate replacement depends on several factors -
Will replacement by you void the service contract?
Can you afford to wait for the technicians?


MIRRORING

OVERVIEW | ARRAY MANAGEMENT SOFTWARE
LOGICAL VOLUME MANAGEMENT | MIRRORDISK/UX | DD | COPYUTIL


Overview -
Mirroring is the immediate storing of identical copies of data in different places in order to increase data safety and availability. Although it is possible to mirror from one section of a disk to another, that practice is not recommended, as it only protects against local media problems.

If you want the ability to recover or correct data use a tape backup scheme. If your primary objective is data recovery after a hardware problem choose mirroring. Your best setup will contain both.

Data Mirroring - which is the faithful reproduction of a defined set of data files on another device. It's primary purpose is to provide data redundancy in the event of device failure.
Disk Image Mirroring - which is the exact creation of a devices files, data, and system structure on another (exactly the same) device. For you as a System Administrator, it's primary purpose will probably be to create a bootable disk which can be exchanged for the original boot disk in the event of disk failure.

NOTE: in both instances hardware failure is the reason for data redundancy creation. Mirroring, of any kind, does not protect against data corruption or file deletion, in fact, it propagates bad data. It is only effective if the first set of data is correct and intact.


If you want data recovery, especially from corruption or bad input, you need to use a backup/recovery system not a mirroring system.

There are at least three different kinds of mirroring schemes available for a system that has arrays attached -


Array Management Software -
ARMServer from Hewlett-Packard (which comes with the arrays) uses a mirroring technique in order to make theactive hot spare option of disk arrays work. This is an automatic thing that occurs when active hot spare is turned on in the array setup. You have very little interaction with it and no control over it. It starts if you choose to use the active hot spare option. It doesn't if you don't.


Logical Volume Management -
LVM provides a fairly simple method for mirroring Logical Volumes. Using lvcreate and lvextend you can create up to 2 mirrored copies (sites) of an original. LVM mirrors each LE to 1 or 2 PE's. By default LVM forces this mirroring to occur on separate disks (which is a good thing). You can over-ride the default and make the mirror occur on the same disk - But, tell me please, why would you do something like that?

LVM’s automatic mirroring capabilities enable you to perform some System Administration tasks, such as backups, without bringing the system down. LVM mirroring is very valuable, but mirroring does not protect your data from system crashes. For maximum availability, eliminate all single points of failure by mirroring your data on separate disk drives on separate I/O channels protected by separate uninterruptable power supplies. Also, make sure that all critical Logical Volumes are mirrored (this includes system Logical Volumes, as well as application Logical Volumes).

If configured for maximum availability, LVM mirroring protects against the failure of a disk drive, cable, or interface card. It does so by providing a second (available) copy of the data. It should be emphasized that mirroring does not protect against intentional system panics performed by the operating system (for data integrity), unintentional panics resulting from hardware failures that HP-UX cannot tolerate, or hangs or other malfunctions resulting from hardware failure.

LVM provides options to the commands lvcreate, lvextend, and lvreduce which will allow you to make 1 or 2 mirror images of selected Logical Volumes - see the appropriate man pages.

To create a NEW, mirrored Logical Volume -

lvcreate -m 1 -n mir1 -L 16 vg00 - this creates a 16MB Logical Volume called mir1 in
WWWVolume Group vg00 with 1 mirrored site.
lvdisplay -v /dev/vg00/mir1 - displays all the information about the Logical Volume mir1.
lvreduce -m 0 /dev/vg00/mir1 - stops mirroring mir1 by reducing it's mirrored sites to 0.
WWWIt breaks the mirror and destroys it making the mirrored site available for other use.

To mirror an EXISTING Logical Volume -

lvextend -m 1 /dev/vg00/mir1 - this creates 1 mirrored site of Logical Volume mir1

By default LVM mirroring puts mirrored sites on different PVs or LUNs.

To force mirroring of an EXISTING Logical Volume on a PV or LUN or your choice -

lvextend -m 1 /dev/vg00.mir1 /dev/dsk/c3t9d0 - this creates 1 mirrored site of Logical
WWWVolume mir1 on PV c3t9d0.

Mirroring allows you to do a 'hot backup' of the data without shutting down the system or logging users off of the database, etc. It's called a 'hot backup' because data can be backed up while new data is being input. You split off one of the mirrored sites and back it up while users work with the original. When you reconnect (merge) it later it will automatically 'catch up' with the original and become exactly the same.

Split off one of the mirrors of a mirrored Logical Volume -

lvsplit /dev/vg00/mir1 - this will split off the mirror site and create a Logical Volume out
WWWof it.

You can see the new Logical Volume -

vgdisplay -v vg00 - you'll see the original Logical Volume - mir1, and a new Logical
WWWVolume mir1b.

Now, create a mount point for the new Logical Volume mir1b -

mkdir /mir1b

If you try to mount mir1b now it will fail. The split off mirror will have to be fsck'ed before it will work.
So, fsck it -
fsck -F hfs /dev/vg00/mir1b

Now you can mount the new Logical Volume -
mount /dev/vg00/mir1b /mir1b

Backup the split copy using tar, cpio, sam, fbackup - whatever

Unmount the split copy -

umount /mir1b

Merge the split copy with the original -
lvmerge /dev/vg00/mir1b /dev/vg00/mir1 - mir1b will become a mirror of mir1 again,
WWWlose it's name, and be updated to be exactly like mir1.
vgdisplay -v vg00 - just to check and see if it really worked.

See the man pages on lvcreate, lvchange, and lvextend for the options available to allow scheduling policies, mirror recovery after a system crash, extent allocation, Physical Volume Group usage, etc.


MirrorDisk/UX -
Hewlett-Packard provides optional software called MirrorDisk/UX which allows you to mirror single files or entire disks.

Currently the software costs about $13,000 per system. Is the data held on the disk and the time lost when the system is down critical enough to justify the cost?

To do the job right the original and mirrored sites need to be on identical but separate SCSI Controllers, cabling, and disks. In most cases you will need to purchase an Expansion Module (cage) for the new controllers because the existing one is full. Don't forget the cabling for for the cage and it's power supply (all separate items). All of this is over and above the cost of the software.

What does all this buy you? Peace of mind and a more efficient system. If either the original or mirror fails the system will continue to operate as usual. Users will never know anything happened. If one of the disks is lost, the system will continue to operate and when the disk (or a replacement disk) is brought back on line it will automatically 'catch up' with any data written during it's absence.

Bad Blocks will be 'spared out' and marked. The data that was on them will be reproduced on another area of the disk by copying it from the mirrored image.

As with LVM Mirroring, backups can be done by splitting off the mirror and backing it up while users continue to work with the original. When the backup is complete the two can be merged. The mirror will automatically 'catch up'.

I'll say it again - mirroring will not protect you from intentional or accidental bad data input, corrupted or lost data. What is on the original is immediately reflected on the mirror site. Sorry.


dd -
- a routine Unix/HP-UX command which (among other things) will copy, block by block, data from one device to another. dd is in the mirroring section because we are going to use it to make exact copies of our two system drives on other drives. If a system drive failure occurs, the system will crash but a quick recovery can be done by swapping the bad drive for the dd copy, and yes, it works.

To make an exact copy of your boot disk on a disk of the same size and type (assume the disk to be copied id c3t6d0 and the new target disk is c3t9d0 -

dd if=/dev/dsk/c3t6d0 of=/dev/c3t9d0 bs=512k - makes an exact copy of the boot disk
WWW(/dev/dsk/c3t6d0) on disk /dev/dsk/c3t9d0.

Should your boot disk fail, the system crash and will have to be downed and rebooted. Users will have to stop work and wait until the system is rebooted with the , remove the bad boot disk and replace it with your copy after changing the SCSI address to 6 on the back of the drive. Reboot the computer. It should reboot normally from the new drive. There will, of course, be downtime but it should be limited to the time it takes you to change disks and reboot.

The T520 JBOD (HP A3312A rackmount high availability storage system) has 4 Seagate Barracuda4 drives (ST15150W) installed when delivered. They are fast/wide differential (DF) SCSI-2 interface drives. Each drive is encased in a molded plastic so the SCSI address jumpers are not accessible. SCSI address switches on the rear of the JBOD (see the diagram below that shows the rear of the JBOD) are used to set the SCSI ID of the slot - not the drive.

I use two of the JBOD drives for binary files and swap space and the other two for dd images of them. I set the disk at SCSI ID #9 to be a copy of the default boot disk (SCSI ID #6) and the disk at SCSI ID #14 to be a copy of SCSI ID #11.


The reason I chose #6 and #11 for the system disks - #6 is the default boot disk address anyway and 6 and 11 are on different internal SCSI busses. The storage system has two wide SCSI busses known as A and B. 6 and 14 are on A and 9 and 11 are on B (see the diagram of the back of the JBOD - below).

If you look at the back of the JBOD you will see 8 dip switches (4 on the A bus and 4 on the B bus) with 4 rocker switches in each . They are numbered from the bottom to the top. Dip switch #1 on bus A is the address for default boot drive or SCSI address #6. It is the first of the JBOD disks to fully spin up to speed on a cold boot.

The 8 dip switches represent the 8 half height drives that can be put into this JBOD. Since the T520 was delivered with 4 full height drives - dip switches #1 and #3 on bus A and #1 and #3 on bus B will be used to address the drives. Dip switches #2 and #4 on both bus A and B will not be used.

Now that you are thoroughly confused, lets look at a moving picture -


The above is representative of one of the dip switches on the back of the JBOD (depicted below). By using combinations of switch settings it can be set from address 1 (0+0+0+1) to address 15 (8+4+2+1).


Copyutil -
Copyutil creates a copy of a disk to a tape which can be used at a later date to copy the data back to a disk. Copyutil does not create a bootable tape.

Copyutil operates offline as a subprogram of the Offline Diagnostics Environment (ODE).

To create a copy of your boot disk on a DAT/DDS tape - cold boot the computer using the Support tape which came with the system. This may be the place to tell you that you have to use the Support tape for the same version of HP-UX that's installed on the system. You can do major damage to your system by trying to use a version 10.20 Support tape on a version 10.10 system. "Be vaywee, vaywee careful" - Elmer Fudd.

As the computer searches for a system to boot a prompt will appear on the screen giving you 10 seconds to 'press any key' (I usually use the space bar. Years of searching have failed to produce a key marked "any") which will interrupt the autoboot process and allow you to choose a device to boot from.

Choose to boot from the tape drive (make sure that the Support tape is in the drive) usually /dev/rmt/0m by answering n - don't boot from the primary path (device)- and y - to boot from an alternate path (device) - then y to interact with IPL (Initial Program Loader) you should then see a series of messages and then get the ISL (Initial System Loader) prompt ISL>.

From the ISL> prompt type ode copyutil. You should get a ISL_CMD> prompt. You can type HELP at this point to see a list of commands if you wish.

From the ISL_CMD> prompt type copyutil. The system should now tell you that it is scanning the device busses and then present you with a list of available devices, their size, type, addresses, product ID, and an Index number. You should now get a COPYUTIL> prompt.

From the COPYUTIL> prompt type UTILINFO.

To copy everything from your boot disk to the tape drive use the command backup. Use the Index numbers to answer the questions about which device to copy from and which device to copy to. You should then get a message asking you to remove the 'Support' tape from the drive and install a blank tape for backup.

Ready to continue ([y]/n/q/?):y

The program should present you with a '% completed' list. When 100% complete you should get the COPYUTIL> prompt back. You can now exit the program (by typing exit at the prompt) or replace the Support tape in the drive to use program on the Support tape. Make sure to mark the newly created backup tape with the date and time of the backup and that it was done using the copyutil process. Store it in a safe place.

If you exited copyutil you should now have an ODE> prompt.

Type exit at the ODE> prompt to get back to an ISL> prompt.

From the ISL> prompt type -

hpux - to boot into a multi-user mode.
hpux -is boot - to boot into a single user mode.
hpux -lm boot - to boot into the maintenance mode (usually for LVM problems).


THE AFTERMATH
First, don't panic - you'll have plenty of time for that later. Now is the time to keep your cool and put all those wonderful recovery features you've been working on into action. It's time now to fix the problem and you are prepared.
A user can't login
password expired
too many bad logins?
Root can't login
Fire, Flood, and OH My God It's All Gone!
Extreme Emergency
Data loss and/or corruption
Tape backup - put the tape in the
Mirrored data - only if the data loss was caused by hardware failure. Because if data loss/corruption was caused by accidental erasure, or bad data input, etc. all your mirrored data will be the same. If it's gone on the original, it's gone on the mirrored copy - automatic recovery by the system.


Copyutil -
OK, so now you need to restore from the backup tape that you created using copyutil and stored away for just this situation. Let's pretend that the boot drive is bad and has to be replaced.

Remember that there may be a difference between the data on the tape and the data that was on the disk. Just how much of a difference depends on how long ago the tape was made.

Boot or reboot the system with the Support tape in the tape drive. Make sure that the Support tape you use is for the same version of HP-UX that's installed on the computer. Don't use a version 10.10 Support tape on a version 10.10 computer.

Remove the bad disk and replace with a good one of the same size and type.

Follow the instructions in the copyutil section above to get to a COPYUTIL> prompt. From this prompt enter backup and give the index numbers for the tape and disk. Remove the Support tape and replace it with the backup tape. At the Ready to continue? question say y and let the system put everything on the new disk.

When complete you can exit the program and boot into the new drive. It says here, in fine print, that the new boot disk will work perfectly. Believe it or not.


Activating LVM Root Volume Groups -
I have never had the opportunity to do this (and I'm glad), so I had to get the 'how to' information from another source. It is information that may, at some time, be extremely important.

If your system is down, you try a reboot and it doesn't work, you suspect that part of your boot drive is corrupt, and you do boot/reboot using the Support tape in an effort to try to do as much repair as you can without replacing the whole disk. You may need to activate some Logical Volume Groups to work on pieces and parts of the downed system. Since they are not loaded when you boot from the Support tape you will have to load them manually yourself.

Because I never attempted this in real life - I am going to quote from the "Support Media User's Manual" Appendix B - Activating LVM Root Volume Groups from the Support Media.

To Activate an LVM Root Volume Group From The Support Media On a System With 24MB or More

NOTE: The following example includes a kernel regen.

1. Boot from the Support Media.
2. Select Run a Recovery Shell from the menu.
3. Select 1 from the SUPPORT MEDIA MAIN MENU to load files.
4. Request that the following files be loaded, by entering their names at the prompt:

/sbin/ioscan
/sbin/mount
/sbin/fs/hfs/fsck
/usr/sbin/chroot

5. Select c from the SUPPORT MEDIA MAIN MENU, to access instructions for
WW.'chrooting' to an LVM / (root) disk.

The following will be displayed:
WWExit to the shell and run 'chroot_lvmdisk'.
WWType <return> to return to the MAIN MENU

6. Select x from the SUPPORT MEDIA MAIN MENU, to exit to the shell.
7. Type chroot_lvmdisk

Something similar to the following will be displayed:
WWEnter the hardware path associated with the '/' (ROOT) file system
WW(example:7.6.9.37)
8. Type <return> to accept the example (default) as your root file system hardware path;
WW.otherwise, enter the hardware path for the root file system hardware you wish to specify
WW.in its place.
9. If you type <return>, the following will be displayed:
WWWWIS 7.6.9.37 the hardware path of the root/boot disk? [y|n|q]
10. Enter y, and something similar to the following will be displayed:
/sbin/fs/hfs/fsck -c 0 -y /dev/rdsk/c2t1d0s2lvm
** /dev/rdsk/c2t1d0s21vm
** Last Mounted as /
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check reference Counts
** Phase 5 - Check Cyl Groups
6256 files, 0 icont, 1494 used, 1563824 free (928 frags)

/sbin/fs/hfs/mount /dev/dsk/c2t1d0s2lvm /ROOT
/sbin/fs/hfs/mount /dev/dsk/c2t1d0s1lvm /ROOT/stand

loading /usr/sbin/chroot
x ./usr/sbin/chroot 123456 bytes 96 blocks


WWWEnter 'cd /ROOT; chroot /ROOT /sbin/sh' at the shell prompt on the customer's / (root)
WWWdisk.
11. Enter cd ROOT; chroot /ROOT /sbin/sh at the shell prompt.
12. Enter vgchange -a y /dev/vg00
WWWThis will "activate" vg00, so that you can get to your swap area, /usr/ etc.
13. Enter vgdisplay -v at the prompt.
WWW.The logical volumes within the disk corresponding to the various components (/, swap,
WWW./usr, /home, /tmp, /var, /opt) are listed.

WWW.You must know which lvol is for swap (usually lvol2), which lvol is for /usr (usually
WWW.lvol6), etc.
14. Enter the swapon command; for example, swapon /dev/vg00/lvol2.
WWW.Usually, install makes lvol2 your swap area with a default value of 48mb, but you must
WWW.know which lvol is actually your swap area.

WWW.Executing this command will yield the error no room in the system tables to add paging
WWW.to lvol2, but this just means that it couldn't configure all the swap in lvol2; however,
WWW.enough swap is configured to prevent possible memory faults caused by lack of swap.
15. Enter fsck /dev/vg00/rlvol6; that is, use the lvol number where /usr resides.
16. Enter the mount command; e.g., mount /dev/vg00/lvol6 /usr.
17. Enter cd /stand
18. Save your previous vmunix file by entering cp vmunix vmunix.save.
19. Generate a new kernel by typing: mk_kernel -s system.
WWW.Execution of this command creates the file /stand/vmunix_test.
20. Enter cp vmunix_test vmunix
21. Exit the chroot shell by entering exit
22. Reboot by selecting b from the SUPPORT MEDIA MAIN MENU


System Recovery Using the Support Media -
Can't get the system to an ISL> prompt -

If you try to boot your system and can't get to an ISL> prompt from your hard disk (but you can boot from other sources) you will have to rebuild the bootlif section of the disk. There may be times when not only bootlif is corrupt but some or all of the system files are corrupt, or missing, also.

The following will not only rebuild the bootlif section of the disk but will also reinstall the system files. If you feel the system files are OK you don't have to do that part.

Boot from the Support Media by overriding the Autoboot when it asks you to press any key within 10 seconds.

Boot from Primary boot path (Y or N)? n

Boot from alternate boot path (Y or N)? y - make sure the alternate boot path is the address of the tape drive - usually /dev/rmt/0m.

Interact with IPL (Y or N) y

ISL> 800 support
Attempting to load Support Media using the command HPUX (;0) :SRECOVERY - it takes awhile and there will be several status screens but eventually you will be greeted with the HP installation screen -

Welcome to the HP-UX installation process!

Select 'Run a Recovery Shell' from the presented menu - don't start networking.

The system will then load commands into RAM memory and tell you when it is done. It will also present you with a warning that tells you to use the HP-UX maintenance mode hpux -lm to update mirrored disks if that has not been done.


Can get an ISL> prompt but can't boot vmunix -
Need to replace a corrupt kernel -

Prepared by: Everette Smith, Impact Innovations Government Group, Inc.


Back
Home | Index | Startup & Shutdown | SAM | LVM | Devices
| Security | Workbook | Disaster | Information Sources | Glossary


Continue