Adaptive quiesce for efficient cross-host consistent CDP checkpoints

Abstract

A disaster recovery system, including a target datastore for replicating data written to source datastores, and a checkpoint engine (i) for transmitting, at multiple times, quiesce commands to a plurality of host computers, each quiesce command including a timeout period that is adjusted at each of the multiple times, (ii) for determining, at each of the multiple times, whether acknowledgements indicating that a host has successfully stopped writing enterprise data to the source datastores, have been received from each of the host computers within the timeout period, (iii) for marking, at each of the multiple times, a cross-host checkpoint in the target datastore and reducing the timeout period for the quiesce commands at the next time, if the determining is affirmative, and (iv) for increasing, at each of the multiple times, the timeout period for the quiesce commands transmitted at the next time, if the determining is not affirmative.

Description

FIELD OF THE INVENTION

The present invention relates to data protection.

BACKGROUND OF THE INVENTION

Data lies at the heart of every enterprise, and is a core component of data center infrastructure. As data applications become more and more critical, there is a growing need to ensure complete business continuity.

Disaster recovery systems provide data protection and application recovery. Some disaster recovery systems use virtual data replication within a hypervisor architecture, and are able to recover any point in time.

Disaster recovery systems are typically operative to maintain disk replicas of enterprise data disks. Some disaster recovery systems, referred to as continuous data protection (CDP) systems, enable restoring a disk replica to a previous point in time. CDP systems log each command to write data into a designated address of a dedicated data disk, into one or more write journals. Each journaled set of commands that together constitute a consistent disk image, is stamped with a date and time. At various times, the journaled commands are promoted to the replica disks, to update the replica disk images to a more recent time, and the write journals are then purged and restarted from the more recent time. The purged journal commands are converted to undo journal entries, for use in rolling back data to a time prior to the promotion time.

As such, disk images at any desired recovery point in time may be determined from the replica disk images, the write journals and the undo journals. If the desired recovery point in time is later than the most recent promotion time, then the disk images corresponding to the desired recovery point in time are obtained by applying the write commands that were journaled prior to the desired recovery point in time, to the replica disk images, to roll forward the replica disk data to the desired recovery point in time. If the desired recovery point is earlier than the most recent promotion time, which is generally the case, then the disk images corresponding to the desired recovery point in time are obtained by applying the undo commands that are time stamped after the desired recovery point in time, to the replica disk images, to roll back the replica disk data to the desired recovery point in time.

In a multi-host enterprise environment, continuous data protection (CDP) disaster recovery systems need to perform consistent cross-host journal checkpoints. In order to ensure a consistent enterprise recovery, it is required to checkpoint the write journals when the enterprise disk images correspond to a common point in time. For such marking to be possible, all hosts must be operative to quiesce writes at a common point in time. Quiesce writes for synchronization generally impact performance, and thus must be carefully applied.

Alternatively, some disaster recovery systems synchronize clocks across hosts and timestamp each write operation, to ensure that the writes are properly sequenced in the write journals. Such systems are complicated to deploy with consistency, because it is difficult to synchronize independent clocks to the millisecond.

Other conventional disaster recovery systems send a quiesce command to all hosts, receive acknowledgements of successful quiescence, take a consistent snapshot image of all disks, and then send release quiesce commands. Such systems are exposed to a risk of reducing performance of enterprise data applications.

It would thus be of advantage to enable cross-host consistent CDP checkpointing, without requiring synchronized clocks and without reducing performance of data applications.

SUMMARY OF THE INVENTION

Aspects of the present invention overcome drawbacks of conventional disaster recovery systems, and provide efficient adaptive quiesce cross-host consistent checkpointing. In one embodiment, the present invention transmits write quiesce commands to each of a plurality of hosts, with a specified timeout period. The write quiesce commands are transmitted at a sequence of times. After transmission of the write quiesce commands, a determination is made whether acknowledgements of quiesce have been received from each of the hosts within the designated timeout period. If so, a cross-host checkpoint is marked in the write journals, and the timeout period is decreased for the next quiesce command transmission time. If not, then a cross-host checkpoint is not marked, and the timeout period is increased for the next quiesce command transmission time. Thus the timeout period is fine-tuned so as to minimize reduction of performance of the data applications that are running on the plurality of hosts. Moreover, synchronization of clocks is not required.

The sequence of times at which quiesce commands are transmitted is controlled so as to satisfy a pre-designated production constraint, and thereby ensure that application performance is not adversely impacted. The production constraint represents a trade-off between CDP granularity and quiesce timeouts. The production constraint may specify inter alia that at most a designated percentage X % of production time be lost, and that there are at most a designated number, N, of service interruptions per hour or per day. As such, when the timeout period is increased, the frequency of quiesce is generally reduced, i.e., when the quiesce timeout is long, less quiesce requests are made, and the desired level of application performance is maintained.

There is thus provided in accordance with an embodiment of the present invention a method for generating cross-host consistent checkpoints, for use in disaster recovery systems, including transmitting, at multiple times, write quiesce commands to each of a plurality of enterprise host computers, each quiesce command including a timeout period that is adjusted at each of the multiple times, wherein the host computers are operative to write enterprise data to the source datastores, at each of the multiple times: determining whether acknowledgements indicating that a host has successfully stopped writing enterprise data to the source datastores, have been received from each of the plurality of host computers within the timeout period, if the determining is affirmative, then marking a cross-host checkpoint in a target datastore for the host computers, and reducing the timeout period for the quiesce commands transmitted by the transmitting at the next time, wherein the target datastore is generated by a continuous data protection disaster recovery system to replicate the data in the source datastores, and otherwise, increasing the timeout period for the quiesce commands transmitted by the transmitting at the next time.

There is additionally provided in accordance with an embodiment of the present invention a disaster recovery system for providing continuous data protection to an enterprise, the enterprise including a plurality of host computers that are operative to read enterprise data from source datastores and write enterprise data to source datastores, including a target datastore for replicating data written to the source datastores, and a checkpoint engine (i) for transmitting, at multiple times, quiesce commands to each of the host computers, each quiesce command including a timeout period that is adjusted at each of the multiple times, (ii) for determining, at each of the multiple times, whether acknowledgements indicating that a host has successfully stopped writing enterprise data to the source datastores, have been received from each of the plurality of host computers within the timeout period, (iii) for marking, at each of the multiple times, a cross-host checkpoint in the target datastore and reducing the timeout period for the quiesce commands at the next time, if the determining is affirmative, and (iv) for increasing, at each of the multiple times, the timeout period for the quiesce commands transmitted at the next time, if the determining is not affirmative.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more fully understood and appreciated from the following detailed description, taken in conjunction with the drawings in which:

FIG. 1 is a simplified block diagram of a disaster recovery system that generates consistent cross-host checkpoints, in accordance with an embodiment of the present invention; and

FIG. 2 is a simplified flowchart of a disaster recovery method for generating consistent cross-host checkpoints, in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION

Aspects of the present invention relate to cross-host disaster recovery. When multiple host computers generate data, either per-host data or shared data, it is essential to provide consistent data replication at points in time when the hosts are synchronized across all hosts, disks and data. Such points in time are referred to as checkpoints, and in order to ensure synchronization a disaster recovery system instructs each host to stop writing data during a common time interval. Such instructions are referred to as write quiesce commands. When each of the hosts has stopped writing data at a common point in time, the journals of write commands for each host are consistent, and a checkpoint is marked in the journals. The hosts may then subsequently be recovered to the common point in time.

When a host quiesces data writing, all data applications running on the host are briefly halted and business application performance is generally impacted. A host may not be able to quiesce writing data at a given instant of time, and thus an attempt to perform consistent data replication across all hosts may require an unduly large amount of time, or may fail.

Reference is made to FIG. 1, which is a simplified block diagram of an enterprise disaster recovery system that generates consistent cross-host checkpoints, in accordance with an embodiment of the present invention. Shown in FIG. 1 are multiple enterprise host computers 110 and 120 that run respective enterprise data applications 130 and 140, which write data to respective enterprise source datastores 150 and 160. A disaster recovery system 170 provides continuous data protection for the enterprise. Disaster recovery system 170 replicates data sources 150 and 160 to a target datastore 180. Target datastore 180 generally includes replication disks and write journals. Disaster recovery system 170 includes a checkpoint engine 171 for generating consistent cross-host checkpoints for the enterprise. Operation of checkpoint engine 171 is described below with reference to FIG. 2. Disaster recovery system 170 also includes a recovery engine 172 which, in case of a disaster, uses target datastore 180 to recover source datastores 150 and 160 to a previous point in time.

Reference is made to FIG. 2, which is a simplified flowchart of a disaster recovery method performed by checkpoint engine 171 (FIG. 1), for generating consistent cross-host checkpoints, in accordance with an embodiment of the present invention. The method of FIG. 2 is performed over a sequence of times. At operation 210 an initial time, T, and an initial timeout period, TIMEOUT, are set. When time T arrives, operation 220 is performed, and the disaster recovery method transmits write quiesce commands to each of a plurality of host computers, such as computers 110 and 120. The write commands include the current value of the timeout parameter, TIMEOUT.

At operation 230 a determination is made whether or not the disaster recovery system has received acknowledgements of data write quiesce from each of the plurality of host computers. If so, at operation 240 a consistent cross-host checkpoint is marked in the write journals, and the timeout parameter TIMEOUT is decreased to a smaller value, for use at the next quiesce. Otherwise, if one or more acknowledgements have not been received from host computers, then a consistent cross-host checkpoint cannot be marked and at operation 250 the timeout parameter TIMEOUT is increased to a larger value, for use at the next quiesce. In either case, each host resumes writing data after a time TIMEOUT has elapsed from receipt of the write quiesce command. As such, interruption of data applications is limited to a period of time of approximately TIMEOUT.

At operation 260 a value of AT is set, based on the current value of TIMEOUT. It will be appreciated by those skilled in the art that the values of AT control the overall frequency of write quiesce commands, and are generally set to ensure that the quiesce timeout periods do not violate a pre-designated production constraint. The production constraint represents a trade-off between CDP granularity and quiesce timeouts, and is enforced to ensure that application performance is not adversely impacted, e.g., the constraint may specify that no more than X % of production time be lost, and that there be no more than N interruptions of service per hour. Accordingly, when the value of TIMEOUT is increased, the value of AT is increased. If the quiesce timeouts are large, the values of AT are set so that quiesce requests are made less frequently, enabling the desired level of application performance to be maintained.

At operation 270, the value of T is increased by AT and the method returns to operation 220, to perform the next quiesce at the next time, T.

In the foregoing specification, the invention has been described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made to the specific exemplary embodiments without departing from the broader spirit and scope of the invention as set forth in the appended claims. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.

Claims

1. A method for generating cross-host consistent checkpoints for disaster recovery systems, comprising: establishing a first time out period;transmitting write quiesce commands to each of a plurality of enterprise host computers, the write quiesce commands including the first timeout period, wherein each of the plurality of enterprise host computers are operative to write enterprise data to source datastores;receiving responses from each of the plurality of enterprise host computers, wherein each response indicates if a respective enterprise host computer has successfully stopped writing the enterprise data to the source datastores within the first time out period; andcomparing a response time from each of the plurality of enterprise host computers to the first time out period; anddetermining a second time out period based on the responses from at least one of the plurality of enterprise host computers.

2. The method of claim 1, comprising: determining the value of the first time out period based on a production constraint.

3. The method of claim 2 wherein the production constraint limits a percentage of total time allocated for at least one quiesce timeout.

4. The method of claim 2 wherein the production constraint limits a number of quiesce timeouts that occur in a designated time period.

5. The method of claim 1, comprising: logging the write quiesce commands to write the enterprise data to the source datastores, issued by one or more of the plurality of enterprise host computers, in at least one of a plurality of write journals of a target datastore, and promoting the logged write quiesce commands to replication disks of the target datastore at a plurality of times, and marking checkpoints in each of the plurality of write journals of the target datastore.

6. The method of claim 5, comprising: recovering the source datastores based on images of the replication disks and on the plurality of write journals and the marked checkpoints.

7. The method of claim 1, comprising: determining the responses have not been received from each of the plurality of enterprise host computers within the first timeout period.

8. The method of claim 7 wherein the second time out period is greater than the first time out period.

9. The method of claim 1, comprising: determining the responses have been received from each of the plurality of enterprise host computers within the first timeout period.

10. The method of claim 9, comprising: marking a cross-host checkpoint in a target datastore for the enterprise host computers, wherein the second time period is less than the first time out period.

11. A disaster recovery system for providing continuous data protection to an enterprise, the enterprise comprising a plurality of host computers that are operative to read enterprise data from source datastores and write the enterprise data to the source datastores, comprising: a target datastore that replicates the enterprise data written to the source datastores; anda checkpoint engine that (i) establishes a first time out period; (ii) transmits write quiesce commands to each of a plurality of enterprise host computers, the write quiesce commands including the first time out period; (iii) receives responses from each of the plurality of enterprise host computers, wherein each response indicates whether or not a respective enterprise host computer successfully stopped writing the enterprise data to the source datastores within the first time out period; (iv) compares a response time from each of the plurality of enterprise host computers to the first time out period; and (v) determines a second time out period based on the responses from each of the plurality of enterprise host computers.

12. The system of claim 11 wherein said checkpoint engine determines the first time out period based on a production constraint.

13. The system of claim 11 wherein the production constraint limits a percentage of total time allocated for quiesce timeouts.

14. The system of claim 11 wherein the production constraint limits a number of quiesce timeouts that occur in a designated time period.

15. The system of claim 11 wherein the target datastore comprises: a plurality of data disks for replication of the enterprise data in the source datastores; anda plurality of write journals for logging the write quiesce commands issued by one or more of the plurality of enterprise host computers for writing the enterprise data into the source datastores, and wherein the checkpoint engine marks a cross-host checkpoint by marking checkpoints in each of the plurality of write journals of the target datastore.

16. The system of claim 15 further comprising a data recovery engine that recovers the source datastores based on images of the replication disks and based on the plurality of write journals and the checkpoints marked by the checkpoint engine.

17. The system of claim 11, wherein the checkpoint engine determines that acknowledgements indicating that at least one of the plurality of enterprise host computers successfully stopped writing enterprise data to the source datastores have not been received from each of the plurality of enterprise host computers within the first timeout period.

18. The system of claim 17, wherein the second time out period is greater than the first time out period.

19. The system of claim 11 wherein the checkpoint engine determines that acknowledgements indicating that at least one of the plurality of enterprise host computers successfully stopped writing enterprise data to the source datastores have been received from each of the plurality of enterprise host computers within the first timeout period.

20. The system of claim 19, wherein the checkpoint engine marks marking a cross-host checkpoint in a target datastore for the enterprise host computer computers, and wherein the second time out period is less than the first time out period.