{"id":6740,"date":"2018-05-07T06:55:27","date_gmt":"2018-05-06T20:55:27","guid":{"rendered":"http:\/\/nsrd.info\/blog\/?p=6740"},"modified":"2018-12-11T07:30:53","modified_gmt":"2018-12-10T21:30:53","slug":"i-never-doubted-my-protection","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2018\/05\/07\/i-never-doubted-my-protection\/","title":{"rendered":"I Never Doubted My Protection"},"content":{"rendered":"

Network Attached Storage \u2013 NAS. It’s such an interesting beast, because it provides an easy solution for file storage within an enterprise that can scale into the petabytes and beyond<\/a> with relative ease, while keeping administrative work down, particularly compared to traditional midrange operating systems. Yet, for so long, the thought was that the trade-off was in backup and recovery for NAS storage. To address backup and recovery of platforms that didn’t have traditional operating systems on them (or traditionally accessible<\/em> operating systems on them), the Network Data Management Protocol (NDMP) was developed as an industry standard protocol to allow enterprise backup software to protect data stored on NAS appliances.<\/p>\n

Back in the early 00s when Tape Ruled The Datacentre<\/em>, NDMP could be a bit fiddly to work with. Yet, as NDMP went through generational improvements, the original wrinkles in the protocol were ironed out, and real success with NDMP came first with the notion of a 3-way backup, freeing up backup software such as NetWorker to mingle NDMP data with other backup data, and eschew the classic NDMP notion of having to dedicate backup resources just<\/em> for NDMP. While a traditional NDMP backup to tape drives directly attached to a NAS filer might be single-threaded and therefore suffer all the potential risk of shoe-shining a tape, 3-way NDMP could be routed onto a tape with other savesets, getting the benefits of parallelism and tape streaming. This also made tape management easier \u2013 library sharing, and dynamic drive sharing are great solutions to a problem we don’t need to have any more<\/em>. Yet, debugging NAS backups with tape was a serious head-spin so often. Backup administrators frequently didn’t have administrative access to the NAS appliances, and each NAS vendor has its own way of logging information. Debugging a hardware-induced SCSI protocol IO hang for tape was bad enough on Windows, Linux or Solaris … but adding a NAS system into the mix was a real headache.<\/p>\n

Then came disk \u2013 staging disks, VTL, and yes, eventually, Purpose Built Backup Appliances (PBBAs), and particularly Data Domain.<\/p>\n

So where does that leave us?<\/p>\n

\"Relaxed<\/a><\/p>\n

These days, NDMP is a pretty relaxing adventure compared to the 00s. Like, sit-by-a-pool-while-configuring relaxing. (In fact, it’s kind of funny that you get odd little startups claiming they do ‘data protection’ who eschew NDMP completely, insisting on doing multiple network transfers via a Windows or Linux filesystem mount, killing off any chance of securely backing up and recovering ACLs on multi-protocol shares. That’s like saying you’re a chef but then ordering everything on the menu from Uber Eats any time a customer asks for anything.)<\/p>\n

Now that I’m in presales I talk<\/em> NAS data protection a lot more than I deal with it as an implementation activity, and I thought it was high time I stepped back through the process of an NDMP configuration. It also gave me a great opportunity to check out the free (for non-prod) evaluation version of Unity \u2013 UnityVSA<\/a>. I’d have liked to kick the tyres on a virtual Isilon solution as well, but I don’t quite have the home lab resources for that setup.<\/p>\n

UnityVSA is pretty forgiving of a lightweight lab environment though, so I downloaded it and deployed it on an ESX server with 2 x 6-core CPUs, 80GB of RAM and a bunch of standalone SSDs. (The actual UnityVSA virtual machine uses 12GB of vRAM, 2 x vCPU, and using thin provisioning, around 20GB of storage after install.)<\/p>\n

I’ve got to say, too \u2013 Unisphere is damn pretty these days:<\/p>\n

\"Unisphere\"<\/a><\/p>\n

Deploying UnityVSA was really straight forward, I have to say. And, given everything that had to happen in the back-end for the initial boot and service activation, reasonably fast, too.<\/p>\n

Creating a client<\/h2>\n

So, what’s involved in setting up NDMP? Well, on the UnityVSA front, it started by creating a NAS server, Filesystem and share, and enabling NDMP on the NAS server. I’m going to assume you’re wanting to start from the point you’re hitting the NetWorker console. Once you’ve got your NAS server details \u2013 hostname, NDMP credentials, etc., you’ll start by using the new client wizard in NetWorker.<\/p>\n

In my setup, my UnityVSA install was ‘unimatrix’, so I created a NAS server on it called ‘unimatrix001’, and I’ll step you through the configuration, backup and recovery for a share on it called ‘Species8472’.<\/p>\n

\"01<\/a>
01 Create New Client<\/figcaption><\/figure>\n

When the new client wizard appears, you enter the hostname and select the client type. In my case, that looked like the following:<\/p>\n

\"02<\/a>
02 Create NDMP Client<\/figcaption><\/figure>\n

For the setup I’m working through, I just entered the client name as the NAS server created on the UnityVSA, and chose a client type of ‘NDMP’.<\/p>\n

Note: The NAS option lets you create a NAS client that you intend to do snapshots with. I’m going to cover that in a later blog post. For now we’re going to do NDMP. Particularly for large NAS systems you’ll likely do a mix of NAS snapshot and NDMP backups.<\/span><\/p>\n

When you’ve got those details entered, you can click Next><\/strong> to continue.<\/p>\n

\"03<\/a>
03 Specify NDMP User and Password<\/figcaption><\/figure>\n

This panel is pretty straight forward \u2013 if you’re going to be working with NDMP, you need to give authorised credentials to NetWorker to communicate with the NAS system. A lot of systems will hard-code that as ‘ndmp’, but if you don’t have access to the NAS server, a storage administrator will have to get the enabled details to you. After filling those in, click Next><\/strong> to continue.<\/p>\n

\"04<\/a>
04 Specify NDMP Client Backup Options<\/figcaption><\/figure>\n

This dialog is split into two sections \u2013 the top gives you some identification details that have been pulled from the NAS system. Under, you can choose what of NDMP backup option you want \u2013 a lot of conventional NDMP backups will be of type dump<\/em>, so if you’re not sure, that’s a pretty good starting point.<\/p>\n

The DIRECT<\/strong><\/span> option is enabled by default. That’s for 2-way NDMP backup where the NAS server is sending data directly to locally connected tape \u2013 that’s not what I wanted, so I turned it off. The ‘NDMP Array Name’ is effectively a way of defining multiple NDMP backups for the same NAS server while ensuring they’re all indexed under the same hostname. (Useful in cluster situations, too.) So I entered ‘unimatrix001’ in that field as well. Once that was done, it was time for Next<\/strong>><\/strong> again.<\/p>\n

[Correction<\/strong>: Please see Michael Peyerl’s comment on this blog post for clarification on the DIRECT option. I stuffed that description up!]<\/p>\n

\"05<\/a>
05 Specify NetWorker Client Properties<\/figcaption><\/figure>\n

In the above dialog, we’re setting values for the NetWorker client \u2013 now, remembering there’s no client software on an NDMP host, you have to be careful to disable client direct<\/em>, which is by default enabled by the wizard. Also, if you want block based backup<\/em>, you can’t enable it there, you have to set the NDMP backup type on the previous page appropriately (e.g., ‘vbb’).<\/p>\n

Note: This has a hint towards the other great feature of doing an NDMP backup via 3-way processing: traditional NDMP direct to tape from the NAS server does not support multiplexing. So if you have a dozen savesets, the only way you’re going to get multiple savesets writing simultaneously is one per tape drive. On the other hand, when a NetWorker storage node\/server is receiving streams via a 3-way NDMP backup, it’s more than fine with multiplexing\/writing all streams concurrently.<\/span><\/p>\n

With client direct disabled, it was Next><\/strong> to continue.<\/p>\n

\"06<\/a>
06 Specify Savesets<\/figcaption><\/figure>\n

In this dialog of the wizard, you select the shares you want to backup. Even if the NAS system doesn’t permit deep-dive browsing of the filesystem, NetWorker will typically still discover the individual shares that have been presented out, and therefore contain content that you may want to backup. In my case, it was just the \/Species8472<\/strong><\/span> share. This is effectively the list of savesets that NetWorker will backup. So I left it as it was, and clicked Next><\/strong> to continue to the summary.<\/p>\n

\"07<\/a>
07 Confirm NDMP Client Config Details<\/figcaption><\/figure>\n

The summary pane is your chance to check and confirm details prior to actually completing the client. I was happy with the selected options, so I clicked Create<\/strong>.<\/p>\n

\"08<\/a>
08 Client Created<\/figcaption><\/figure>\n

With the client created, the wizard’s dialog can be closed by clicking Finish<\/strong>.<\/p>\n

Now, the other thing to consider with NDMP is where the backup will go through \u2013 i.e., what storage node? NDMP data can’t go directly to Data Domain via a Boost API, so it will typically get routed to a storage node that’ll handle all the segmentation and deduplication. I wanted to hard set this to my backup server, so I quickly modified the NDMP client properties to force it:<\/p>\n

\"09<\/a>
09 Optional Modify Client Properties<\/figcaption><\/figure>\n

To set the storage node to a specific host, go to the “Globals (2 of 2)” panel and enter the storage node(s) that NetWorker will use for that NDMP host:<\/p>\n

\"10<\/a>
10 Optional Force Storage Node Setting<\/figcaption><\/figure>\n

Now, also keep in mind that the NetWorker performance tuning guide does recommend you be mindful of requirements for NDMP temporary index processing; in my case, with it being a relatively small share, it was fine to leave it as the backup server itself.<\/p>\n

Setting up a Workflow<\/h2>\n

Once the client has been created, we can move on to create a policy if required, and the workflow\/actions that’ll actually do the backup and cloning. I decided to just slot this backup into my Gold<\/em> policy, so engaged the wizard at that point:<\/p>\n

\"11<\/a>
11 Create New Policy<\/figcaption><\/figure>\n

Once you’ve clicked New… you’ll get the policy workflow\/action wizard, as follows:<\/p>\n

\"12<\/a>
12 Group Created<\/figcaption><\/figure>\n

For the purposes of brevity, I didn’t show the creation of the group<\/em> for the workflow, but I have highlighted it in the screen capture above to remind you that you’ll need to do it. (In my case the group just simply had a single client added to it – the unimatrix001<\/em> client created in the previous section).<\/p>\n

We’re going to add a backup<\/em> and a clone<\/em> workflow., so you’ll start that off by clicking the Add<\/em> button. That’ll bring us to our backup workflow dialog:<\/p>\n

\"13<\/a>
13 Backup Action Part 1<\/figcaption><\/figure>\n

At the start of the workflow backup action, you’ll define what sort of schedule it is, whether or not it’s enabled (enabled by default), and so on. I pretty much left all options in their default setup and clicked Next><\/strong> to continue.<\/p>\n

\"14<\/a>
14 Backup Action Part 2<\/figcaption><\/figure>\n

Again here there wasn’t much to change in the second panel of the dialog, other than the destination pool I wanted to write to \u2013 in this case the BoostBackup<\/em> pool rather than the Default<\/em> pool. After making that change, I was able to click Next><\/strong> again.<\/p>\n

\"15<\/a>
15 Backup Action Part 3<\/figcaption><\/figure>\n

The final configuration panel for a workflow’s action lets you set details for retries, workflow parallelism, overrides, etc. I pretty much left everything and clicked Next><\/strong> to continue.<\/p>\n

\"16<\/a>
16 Backup Action Confirmation<\/figcaption><\/figure>\n

Clicking Configure<\/strong> there will create backup action, and let us move on to the clone action.<\/p>\n

\"17<\/a>
17 Backup Action Done Onto Clone Action<\/figcaption><\/figure>\n

With the backup action created, you’re returned to the workflow dialog, and can click Add<\/strong> again to create a clone action. Here the options will be very straight-forward, since for cloning actions that take place after a backup you usually leave most<\/em> of the configuration as-is.<\/p>\n

\"18<\/a>
18 Clone Action Part 1<\/figcaption><\/figure>\n

On the first page of the clone action dialog, I left everything as-is, and clicked Next><\/strong> to continue on.<\/p>\n

\"18<\/a>
18 Clone Action Part 2<\/figcaption><\/figure>\n

On this second panel, you get to choose cloning filters, storage nodes (useful when you want to offload cloning to a specific storage node), and the destination cloning pool \u2013 which was the one option I needed to change before clicking Next><\/strong> to continue.<\/p>\n

\"19<\/a>
19 Clone Action Part 3<\/figcaption><\/figure>\n

I had nothing to change on the advanced options panel and just pushed right on.<\/p>\n

\"20<\/a>
20 Clone Action Confirmation<\/figcaption><\/figure>\n

With everything ready, it was time to click Configure<\/strong> to proceed with the creation of the action, which left me back at the workflow, with its configuration now complete:<\/p>\n

\"21<\/a>
21 NDMP Workflow Complete<\/figcaption><\/figure>\n

With that done, clicking OK<\/strong> closed the workflow and I could see the graphical view:<\/p>\n

\"22<\/a>
22 Workflow Complete<\/figcaption><\/figure>\n

Running the backup<\/h2>\n

To run the backup, I switched over to the Monitoring tab in NMC, drilled down into the Gold policy and started the NDMP Storage workflow. In less than a minute, I was getting backup data transferring:<\/p>\n

\"23<\/a>
23 Backup Running<\/figcaption><\/figure>\n

There was about 8GB of data to backup from the share, which didn’t take long as the speed it was streaming at, before we switched over to the cloning operation:<\/p>\n

\"24<\/a>
24 Clone Running<\/figcaption><\/figure>\n

Likewise, the cloning didn’t take too long to run, and after, I was able to view the successful workflow:<\/p>\n

\"25<\/a>
25 Workflow backup complete<\/figcaption><\/figure>\n

Next \u2013 recovering some data!<\/p>\n

Running the recovery<\/h2>\n

NDMP recoveries are straight-forward when using NMC, so that’s what I’ll work through for this recovery. I wanted to pull back a folder which a selection of files in it and drop them back on the NDMP server. Here’s the process that I went through.<\/p>\n

In NetWorker Management Console, you switch over to the Recover<\/strong><\/span> view, then select File > New<\/strong><\/span> to start a new recovery process.<\/p>\n

\"01<\/a>
01 Start Recovery Configuration<\/figcaption><\/figure>\n

For an NDMP recovery, we stick to the Traditional NetWorker Client Recovery<\/em> option, and click Next><\/strong> to continue.<\/p>\n

\"02<\/a>
02 Select Client and Recovery Type<\/figcaption><\/figure>\n

For the recovery, we have to select the client we’re going to recover from, and once you’ve entered the hostname, NetWorker will pull out some details for it and offer the recovery options. In this scenario, there were only NDMP backups in the Recovery Types, and I wanted to recover back to the same host, so I clicked Next><\/strong> to continue.<\/p>\n

\"03<\/a>
03 Select Content to Recover<\/figcaption><\/figure>\n

The next step is to select the files and content you need to recover; in this case, I browsed down to a folder containing NetWorker 9.2 documentation and selected that folder for recovery, then Next><\/strong> to continue.<\/p>\n

\"04<\/a>
04 Provide Recovery Destination<\/figcaption><\/figure>\n

I wanted to recover the files to a slightly different path, so in this case knowing the originating share was \/Species8472<\/strong>, I entered a destination path of \/Species8472\/RecoveryTest<\/strong><\/span>, then Next><\/strong> to continue.<\/p>\n

\"06<\/a>
06 Name and Run Recovery<\/figcaption><\/figure>\n

On the final dialog of the recovery wizard, you get to name the recovery, and choose when to start it, as well as verifying the options you selected during the recovery.<\/p>\n

Tip<\/strong>: If you’re working in a fairly formal enterprise environment where you have to be able to report on recoveries performed, give the recovery name a prefix of the service ticket or incident number associated with the recovery request you’ve received. That’ll make it simpler for auditing\/reporting purposes to articulate the reason behind that recovery.<\/span><\/p>\n

I wanted the recovery to start straight away, so I just named it “NDMP Recovery” and clicked Run Recovery<\/strong> to get things underway. That brings up the recovery monitoring window:<\/p>\n

\"07<\/a>
07 Recovery Running<\/figcaption><\/figure>\n

With a relatively small number of files selected for recovery, the initial setup of the recovery\/initialisation of communication between NetWorker, the Data Domain, and the UnityVSA system took longer than the recovery itself took to complete:<\/p>\n

\"08<\/a>
08 Recovery Succeeded<\/figcaption><\/figure>\n

To verify the recovery was successful, I closed the recovery window by clicking Finish<\/strong>, then on my jump box verified that I could see the recovered files:<\/p>\n

\"09<\/a>
09 Browse to Recovery<\/figcaption><\/figure>\n
\"10<\/a>
10 Recovered Files<\/figcaption><\/figure>\n

And there you have it \u2013 NDMP configuration, backup and recovery from start to finish. As you’d expect these days, it was a smooth and straight-forward experience \u2013 in fact, I Never Doubted My Protection would work.<\/p>\n

If you’re interested in how to best protect NAS systems, in my book<\/a> I talk more about the advantages of multi-tiered<\/em> NAS server protection.<\/p>\n

—
\n(Yes, I know those screen-shots are from a Windows 2003 server. Alas, Microsoft ended Technet just before I was going to start subscribing, and I’m left with my jump box running a Windows 2003, the last permanent license of Windows Server I bought.)<\/p>\n","protected":false},"excerpt":{"rendered":"

Network Attached Storage \u2013 NAS. It’s such an interesting beast, because it provides an easy solution for file storage within…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[16],"tags":[617,1406,1042,1435],"class_list":["post-6740","post","type-post","status-publish","format-standard","hentry","category-networker","tag-nas","tag-ndmp","tag-unity","tag-unityvsa"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pKpIN-1KI","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/6740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/comments?post=6740"}],"version-history":[{"count":10,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/6740\/revisions"}],"predecessor-version":[{"id":7356,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/6740\/revisions\/7356"}],"wp:attachment":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/media?parent=6740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/categories?post=6740"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/tags?post=6740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}