data domain cloud tier for modernized data center

Data Domain Cloud Tier for Modernized Data Center

Manasa MallikarjunaAssoc. SE AnalystDell [email protected]

Madhavi Latha HAssoc. SE AnalystDell [email protected]

Knowledge Sharing Article © 2017 Dell Inc. or its subsidiaries.

2017 Dell EMC Proven Professional Knowledge Sharing 2

Table of Contents

1. Introduction..………………………………………………………………….. 4

2. Data Domain Cloud Tier…………........................................................... 5

2.1. Overview………………………………………………………………... 5

2.2. Use cases for Data Domain Cloud Tier………………………........ 6

2.3. Customer Opportunity for Data Domain Cloud Tier…………… 6

2.4. Supported Data Domain Systems on Data Domain Cloud Tier 7

2.5. Cloud Systems Supported with Data Domain Cloud Tier……... 7

2.6 Hardware Required for Data Domain Cloud………................... 8

2.7 Metadata for Cloud Tier……………………………………………... 8

2.7.1. Metadata Cloud Shelves……………………………........ 8

2.8. Cloud Units……………………………………………………………… 9

3. Data Movement to Cloud.………………………………………………… 7

3.1. Data Movement Cloud Policies…………………………….……… 7

4. Cloud Encryption with Data Movement ………………………………... 8

4.1 Data Re-encryption in Cloud Tier………………………………….. 8

5. Data Restore & Recovery………………………………………….……….. 9

5.1 Data Invulnerability Architecture for data on DD Cloud Tier… 9

5.2 Workflow for restores from DD Cloud Tier………………………… 10

5.3. Batch Recall of Backups…………………..………………………… 10

5.4. Backup applications Supported with DD cloud Tiering……….. 10

6. Cleaning and Garbage Collection on Data Domain Cloud Tier….. 11

7. Protocols Supported with Data Domain Cloud Tier…………………… 12

8. Management & Reporting in Data Domain Cloud Tier………………. 13

9. Data Migration & Replication on Data Domain Cloud Tier…………. 14


9.1. MTree Replication………………………………..…………………… 14

10. Other Highlights of Data Domain Cloud Tier…………………………… 16


1. Introduction

There are many stories about how data is changing the world regardless of the industries we

work in. They might be about ideas that boost company revenue, discover a cure to a disease,

or ensure national security or global peace. Broadly, data is simply an uncooked form of

information. But, in business terms, data can be personal data, transactional data, web data or

sensor data or Internet of Things (IOT) collected together for reference or analysis. Customers

need the means to exercise their fundamental right to privacy and protect their data from cyber

abuse every time a service is used or product is bought online. The only way customers can be

confident in business is through strong data protection policies set by data storage service

providers like Dell EMC.

DellEMC Backup and Recovery Solutions is a next-generation back up, recovery and data

protection solution where we can retain backups onsite, replicate data offsite, recover data

reliably ensuring data integrity, and optimize the benefits of server consolidation. Dell EMC

provides backup, disaster recovery and archiving solutions through various products like

Avamar, Data Domain, NetWorker, RecoverPoint, and Mozy. Data Domain (DD) system makes

it possible to complete more backups in less time, providing faster and more reliable restore.

Data Domain systems leads the protection storage market providing an edge over both market

share and technical competence. The Data Domain Operating Systems (DD OS) is the

intelligence behind Data Domain systems that makes them the industry’s most reliable and

cloud-enabled protection storage.

2. Data Domain Cloud Tier

Legacy tape-based data backup systems combined with explosive data growth, strict retention

policies and pressure to reduce costs have created a big challenge for IT. To help customers

simplify and automate their path to the cloud, Data Domain is introducing new cloud capabilities

with Data Domain Cloud tier.

2.1 Overview

Data Domain is an in-built feature of Data Domain Operating System (DD OS) for moving data

from the active Data Domain tier to low cost, high capacity object storage in the public, private

or hybrid cloud for long-term retention of data with a subscription-based object storage service.

No separate cloud gateway or virtual appliance is required. Customers do not have to worry

about additional physical footprint or management overhead. DD Cloud Tier provides best-of-

breed technology that will allow businesses to gain the advantages of cloud while lowering

overall TCO.

This paper explores cloud migration process of moving an organization’s onsite business

components to the cloud or from one cloud to another. There are several scenarios illustrating

the promising benefits of cloud migration that help to meet increasing demand for resources,

reduce operational costs while increasing IT effectiveness, high-speed deployment and

implementation of applications while reducing infrastructure overhead, improving challenging

geographical scalability with the implementation of simple Cloud Disaster Recovery (DR)

systems economically.


This paper explains the supported cloud providers for DD OS 6.0 Cloud Tier and approaches of

DD replication – M-tree and Directory replications. Directory replication determines what needs

to be replicated from source to destination and M-tree leverages snapshots to ensure DD

system’s destination will always be a-point-in-time image of the source DD system. The paper

explains the features of Data Domain cloud tier for modernized data center briefing the use

cases, supported systems, replication methodologies, DD cloud tier policies that enable

customers to pay less for the cloud storage. To summarize, DD cloud tier is designed to

seamlessly and cost-effectively move data from Data Domain to the cloud enabling long-term

retention for the modern data center that is simple, efficient and open.

2.2 Data Domain Cloud Tier Use Cases

Long-term retention and protection of data mandates systematic analysis to identify, clarify and

organize system requirements in order to:

Meet regulatory and compliance policies

Reduce costs with low cost object storage in the cloud.

Migrate data from tape to cloud

Cold storage archiving with limited retrieval of data

2.3 Customer Opportunity for Data Domain Cloud Tier

Customer opportunity suitable for Data Domain Cloud Tier is qualified based on…

Customers looking to reduce their tier space and move data that needs to be recovered

on a regular basis to the cloud are not targeted.

Customers’ tape spend is captured and this is the revenue Dell EMC is not currently

capturing and is the intended target for DD CT SW.

The ideal data for DD Cloud Tier is data that is past its normal recovery window. Data

that is being held for legal hold, long term retention or other needs is rarely recovered if

at all but needs to be held to meet requirements.

Position DD Cloud Tier for long-term retention with very little need to recall data, if ever.

We are going after long term stale data that typically goes to tape today. We are not

looking to shrink the active tier space and generate a large number of operational recalls

from object in an attempt to reduce costs (this would decrease performance of the

solutions).

2.4 Supported Data Domain Systems on Data Domain Cloud Tier

Data Domain Cloud Tier is supported on systems with expanded memory configuration:

DD4200, DD4500, DD7200, DD990, DD9500, DD6800, DD9300 and DD9800. Data Domain

Cloud Tier is also supported with Data Domain Virtual Edition (DD VE). Data Domain systems

can run DD Cloud Tier or DD Extended Retention but not both on the same Data Domain. DD

Cloud Tier is not supported with DD2200 and DD2500 as these systems don’t have the

necessary system resources. For DD2200 and DD2500, Dell EMC CloudBoost can be used if

tiering to cloud for long-term retention is desired.


2.5 Cloud Systems Supported with Data Domain Cloud Tier

Data Domain Cloud Tier can tier data to Dell EMC Elastic Cloud Storage (ECS) for on prem

object storage and Virtustream Storage Cloud as well as third party public clouds – Amazon

Web Services and Microsoft Azure. For AWS, DD Cloud Tier only supports Amazon S3

Standard Storage. Glacier is not supported because of its high latency. For Azure, only Block

Blobs is supported.

2.6 Hardware Required for Data Domain Cloud Tier

DD Cloud Tier requires metadata shelves for storing cloud metadata (segment index for

fingerprints). These are needed for performance since accessing the cloud for each metadata

access is expensive and slow. We need to have sufficient metadata locally to perform dedupe

and cleaning activity without having to go to cloud. The design goal is to minimize cloud access

to read back.

2.7 Metadata for Cloud Tier

The metadata shelves store the metadata for the cloud units. The number of metadata shelves

needed depends on the cloud unit’s physical capacity being sized for. Each cloud unit has its

own segment index and metadata and thus has separate dedupe pools with no overlap. The

metadata shelf is shared between the two cloud units. We are creating multiple dedupe pools

(here it is only metadata portion) within a single volume created out of the metadata shelves.

There will be a sizing tool to determine the number of metadata shelves needed to support the

physical cloud tier capacity. You need dedicated shelves to hold metadata for the cloud tier.

Metadata capacity cannot be used for anything else once configured with cloud tier such as

sharing with active, storing data, etc.

2.7.1 Metadata Cloud Shelves

DD Cloud Tier requires metadata shelves. All necessary Meta data shelves are shipped upfront

when customer buys cloud Tier capacity. The best practice recommendation is to install and

configure all the Meta data shelves supported by the system (and shipped to the customer) for

optimal performance.

A single DS60 can be shared between active tier data and cloud tier Meta data. For

example, on a DD4500 with 2 meta data shelves, you can install 2 disk drive packs for

cloud tier meta data in the 2 slots of the 4-slot DS60 and use the remaining 2 slots for

active tier shelves.

The list of the DD systems and the Meta data shelves supported

- DD9800 – equivalent of 5 x ES30-60 shelves, however will ship 1 x DS60 and 1 x

ES30-60 shelf

- DD9500 – equivalent of 5 x ES30-60 shelves, however will ship 1 x DS60 and 1 x

ES30-60 shelf

- DD9300 – equivalent of 4 x ES30-60 shelves, however will ship 1 x DS60 shelf


- DD7200 – equivalent of 4 x ES30-60 shelves, however will ship 1 x DS60 shelf

- DD990 – 4 x ES30-45 shelves




2.8 Cloud Units

DD Cloud Tier consists of up to two Cloud Units on each Data Domain system. Each cloud unit

can point to different providers or the same provider. For example, one Data Domain cloud unit

can be moving data to ECS and the second cloud unit to a public cloud. Each cloud unit will

support up to the max active tier capacity of the respective Data Domain system. The active tier

does not have to be at maximum capacity to scale the cloud tier to maximum capacity.

3. Data Movement to Cloud

Use the native Data Domain policy management, which was expanded to include age range for

DD Cloud Tier. Cloud tiering supports age-based, age-range and app-driven policies for moving

data to the cloud.

3.1 Data Movement Cloud Policies

There are two parameters associated with data-movement:

When data-movement runs – one can schedule data-movement to run every day. Every

time it runs, it’ll look for eligible files based on data-movement policy.

Which files are eligible to move – this is based on file age. We’ve a requirement of

minimum of 14 days before a file can be moved to cloud tier.

Data Domain policy requires you to keep data on the active tier for at least 14 days before

moving it to the cloud.

Data movement policies have been enhanced with age range for cloud tier, which also

applies to DD Extended Retention.

Deletion has nothing to do with tiering. Any file can be deleted at any time. The data in DD

Cloud Tier will be cleaned by garbage collection if the data is not referenced by any file in

that dedupe domain.


4. Cloud Encryption with Data Movement

Data movement to the cloud will be encrypted at rest by default. With the Data Domain Encryption

license, you can choose to encrypt all data on the Data Domain system or only the data destined

to the cloud (Embedded, Single Key Management). External key managers are not supported

with DD Cloud Tier. In addition, accessing data in the cloud requires the user to go through the

access mechanism of the cloud provider. In other words, the access key/secret key, etc. is

required to access cloud data. Also note that encryption keys are per system. You will not be able

to access the cloud data of one Data Domain system from another Data Domain system, similarly

data from a DD VE instance can’t be accessed from a different DD VE instance, etc. Additionally,

the knowledge of the buckets is local to the specific Data Domain or DD VE. Anyone getting

access to the data cannot interpret it without the namespace held on the Data Domain/DD VE.

You will need to add the encryption license to the items list you need to purchase separately if

you want the data encrypted.

Encryption is supported at two levels.

Data-at-rest encryption – data is saved on disk (or in cloud) in encrypted format

Over-the-wire encryption – data is transmitted in encrypted form. This is done using

SSL/HTTPS.

For data-at-rest encryption, it’s the same license irrespective of which tier it is enabled on. The

following are supported:

Enable at system level (both tiers)

Enable only for cloud tier

For Cloud tier-enabled systems, only Embedded Key Manager is supported; the external key

manager (DPM / RKM) is not supported. Also, re-encryption of existing data is not supported in

cloud tier. Once data is written to cloud tier, its encryption cannot be changed.

During data migration to cloud tier:

If data was encrypted on active tier, it will decrypted first. If encryption is enabled on cloud

tier, it will be re-encrypted with the active key. It is possible that the data on active tier was

encrypted some older key.


We need to perform this decryption/re-encryption, because of the deduplication. We send

only the unique data to the cloud tier, which needs to repackaged and recompressed.

Reading the data from active tier includes decryption (if encryption enabled on active tier) and

decompression. The data is then recompressed and re-encrypted before writing it to cloud tier.

Is the data protected by the same encryption key as data in the active tier?

At any given point in time, there’s one active key at system level. This key is used to write data to

both tiers (assuming encryption is enabled on both tiers). There’s no mechanism to use different

active keys for two tiers.

Does key rotation function in the same way as with the active tier?

When key rotation is performed, the current active key is marked as read-only key, and a new

active key is established. This new active key is now used for all future writes to both tiers until

the active key gets changed again.

4.1 Data Re-encryption in Cloud Tier

Reading the data from active tier includes decryption (if encryption enabled on active tier) and

decompression. The data is then recompressed and re-encrypted before writing it to cloud tier.

5. Data Restore & Recovery

5.1 Data Invulnerability Architecture for data on DD Cloud Tier

The data written to the cloud will have basic integrity checks and transportation checksums

validate the data read/written to cloud, i.e. we are checksumming the data we write to the cloud

and checking for object existence. The same integrity checks extend for all cloud providers,

nothing different is done for ECS in the current release. ECS will triple mirror if configured

(recommended). All Data Domain internal structures are protected in the same manner as active.

RAID6 protections are replaced with object store mirroring.


5.2 Workflow for restores from DD Cloud Tier

To restore data from the cloud, you have to recall a file back to the active tier. Once data lands

on the active tier, you can issue a restore from the backup application to restore the data to the

client. Recall will fail if there is no space to move the file (decision made before any movement is

started).

5.3 Batch Recall of Backups

Use scripting to batch recalls. Data Domain will do only a fixed number of recalls concurrently and

return error if there are no resources in the backend. Run CLI filesys report generate to find all

files in the cloud. Then, run CLI data-movement recall. This process is scriptable and we can

provide a sample script.

5.4 Backup applications Supported with DD cloud Tiering

Data Movement to DD Cloud Tier is supported with all backup applications such as Avamar,

NetWorker, NBU, DDBEA, Oracle RMAN direct, Veeam, etc. that are using supported protocols

including DDBoost, NFS and CIFS. We do not support VTL with Cloud Tier. There are two

scenarios to consider.

In the non-integrated case (where there is no API integration between the backup application and

DD Cloud tier), customers are able to tier data from active to the cloud tier using the native DD

policies that are age-based. The backup application and its service catalog will not be cloud tier-

aware in this case (i.e. they won’t know whether the file is in active or in the cloud tier). When

restoring this means customers have to use DD provided CLIs to recall the files to active and then

issue restore from the backup application for it to succeed.

In the integrated case (where there is API integration between the backup application and DD

Cloud tier), the backup application is able to create, edit and manage policies from its console

and is able to restore files and backups seamlessly from the cloud in a catalog-aware manner

and report on cloud tier metrics. In 2017, the plan is make the cloud tier APIs public and

consumable by all the 3rd party backup vendors. All existing backup applications such as Avamar,

NetWorker, NBU, DDBEA, Oracle RMAN direct, and Veeam, etc. that are using supported

protocols including DDBoost, NFS and CIFS are supported with DD cloud tiering using the native

DD policies that are age-based.


6. Cleaning and Garbage Collection on Data Domain Cloud Tier

Cloud data movement can run concurrently with garbage collection on the active tier. Active tier

workloads take precedence. Cleaning will finish on the active tier and then clean one cloud tier

within a week. Cleaning the cloud tier will completely operate on the local metadata and will

remove dead objects in the cloud. With regard to system performance, while cleaning is running,

the impact should be no different than cleaning on the active tier.

Can garbage collection on the cloud tier be run concurrent with garbage collection on the active

tier?

No, garbage collection on the active tier will preempt garbage collection on the cloud tier, so that

garbage collection on the active tier is never impacted.

Can I do data migration to cloud while garbage collection is running in the cloud?

Yes, garbage collection can run concurrent with file migration to the cloud.

How is garbage collection done on the different cloud units?

Garbage collection is done on a round-robin basis. One unit at a time is scheduled by default

once every two weeks. This can be modified from the default but each cloud unit is chosen in

round-robin fashion with only one per schedule. Additional control on frequency of cloud GC is

provided via CLI.

7. Protocols Supported with Data Domain Cloud Tier

What protocol will be used to transport the data?

We support whatever protocol is required by the cloud provider for connectivity.

What protocols will be supported with DD Cloud Tier?

Data Movement to DD Cloud Tier is supported on NFS, CIFS and DD Boost MTrees. We do not

support VTL with Cloud Tier.


8. Management & Reporting in Data Domain Cloud Tier

What capability will Data Domain have to report on the data in the cloud tier?

You can use DD System Manager for configuration and DD Management Center for monitoring

and reporting. Data Domain will report the logical and physical capacity consumed in the cloud

tier including the compression ratio. It will also provide historical information on data moved to the

cloud through DD System Manager and DD Management Center. The CLI will be able to report if

a particular file is in active tier or cloud tier. All space/compression reporting will report cloud tier

usage similar to active.

9. Data Migration & Replication on Data Domain Cloud Tier

There are two approaches of DD replication – M-tree and Directory replications. Directory

replication determines what needs to be replicated from source to destination and M-tree

leverages snapshots to ensure DD system’s destination will always be a-point-in-time image of

the source DD system.

Directory replication does not use snapshots, it uses a replication log. It must replicate every

change that has been done to the content of the source directory in the sequence that it was

changed. So for example, if file_1 is created, then modified, and then deleted. The directory

replication will replicate the creation of file_1, the modification, and the deletion steps to the

destination DDR.

DD Extended Retention and DD Cloud Tier are mutually exclusive. You can have one or the other

but not both on the same system. To migrate data from DD Extended Retention on the old system

to a new Data Domain system that is cloud enabled, you should use MTree replication from the

retention tier on the old unit to the active tier on the new unit with DD Cloud Tier enabled and

then, move data out to the cloud.

9.1 MTree Replication

MTree Replication is to replicate all data from the system with DD Extended Retention to a new

Data Domain system with DD Cloud Tier enabled.

The active tier on the new Data Domain system needs to be large enough to hold all the incoming

data, OR the migration needs to be phased in order to keep moving data to that system such that


the active tier doesn’t fill up. Then set policies on the new Data Domain system to move data from

active tier to the cloud. You need to ensure that data on the old system with DD Extended

Retention is partitioned into a sufficient number of MTrees to leverage the maximum concurrency

possible for replication. The system with DD Extended Retention will have to be at either DD OS

5.6.x or DD OS 5.7.x for MTree replication. Systems with versions prior to DD OS 5.6.x will have

to be upgraded before setting up for migration. In-place migration (on the same system) is not

possible since we cannot disable DD Extended Retention without destroying the file system.

When replicating from one Data Domain to another will the data have to be re-hydrated in the

active tier for these functions?

Replication is an ongoing process and in most cases, the data would have been replicated before

it is sent to the cloud. In rare cases where replication is set up after files have been moved to the

cloud, the data will be read from cloud and replicated to the destination. There is no requirement

to store the data on active tier while replicating. To summarize, replication of data that is residing

in the cloud will be read from the cloud only if the same segments do not exist on the replication

destination. It is not brought back to the active on the source.

MTree replication involves the following steps:

A snapshot is created at the source of the MTree replication context. This snapshot is compared

to the last snapshot and the changes are sent across to the destination.

On the destination, the MTree will be updated but the files will not be exposed to the user until

ALL the changes for the latest snapshot are received.

The above steps will be repeated every time a snapshot is created on the MTree

which can occur:

1. When the replication lag is more than 15 minutes and there is no snapshot being currently

replicated (system-generated-periodic-snapshots)

2. At user-specified times (for example after the completion of a backup job) (user-created-

snapshots).

3. After the snapshot is replicated, that connection on the destination is disconnected. A new

connection is established between the source DD and destination DD when the next

snapshot is replicated.


Example 1:

In this example we see how periodic generated snapshots behave.

S1, S2, and S3 are periodic system generated snapshots.

S1 is generated and starts replicating to the destination.

S1 takes more than 15 minutes to finish the replication.

As soon as the S1 replication is completed the connection on destination is disconnected.

Because the time since S1 was created is longer than 15 minutes, a new periodic snapshot

S2 is created and begins replicating. Replication of S2 completes in less than 15 minutes.

The system waits 15 minutes from the creation of S2 have elapsed before the creation of

S3 (and deletion of S1).

Replication of S3 begins immediately.

https://community.emc.com/servlet/JiveServlet/showImage/102-39126-1-95625/1.1.jpg


Example 2:

In this example we can see the interactions of user-generated snapshots and the periodic-

generated snapshots:

S1 is a periodic system generated snapshot. S2, and S3 are user generated snapshots

S1 is generated and starts replicating to the destination.

During the replication of S1 a user generated snapshot S2 is created.

Because S1 is still replicating, the system will continue replicating S1 until it is completed.

Replication of S2 is on hold until S1 completes.

When S1 completes replicating, replication of S2 begins immediately.

If S2 replicates in less than 15 minutes the system goes back to waiting for 15 minutes

since creation of S2 before the next system generated snapshot is created.

However, in this example a new user generated snapshot S3 is created before the 15

minutes are up.

Because there is no replication in progress, the replication of S3 begins immediately after

its creation.

Because S2 and S3 are user generated snapshots, S1 is not deleted until a 3rd system

generated snapshot would be created.

https://community.emc.com/servlet/JiveServlet/showImage/102-39126-1-95626/1.2.jpg


10. Other Highlights of Data Domain Cloud Tier

10.1 Customer Value

To help customers simplify and automate their path to the cloud, Data Domain is enhancing its

cloud capabilities with native tiering to the public, private or hybrid cloud for long-term retention.

Data Domain Cloud Tier will allow businesses to gain the advantages of cloud while increasing

efficiencies and lowering overall TCO. The highlights of DD Cloud Tier are:

Scalable, native cloud tiering: automated tiering directly from Data Domain and store

up to 2x of the maximum active tier capacity in the cloud for long-term retention.

Lower TCO: Send only unique data to cloud storage for reduced storage footprint and

network bandwidth.

Flexible deployment options: Support a broad ecosystem of backup applications and

move data to a variety of public and private clouds including Virtustream Storage Cloud

and Dell EMC Elastic Cloud Storage (ECS)

11. Conclusion

The paper explains the features of Data Domain cloud tier for modernized data center briefing the

use cases, supported systems, replication methodologies, DD cloud tier policies that enable

customers to pay less for the cloud storage. DD cloud tier is designed to seamlessly and cost-

effectively move data from data domain to the cloud enabling long-term retention for the modern

data center that is simple, efficient and open. Taking a data backup to next level, Cloud Data

Replication for EMC Data Domain lets finally retire tape infrastructure and legacy approaches to

backup and offsite data protection. DD cloud tier fully protects the data offsite in a secure

environment, increase network efficiencies, simplifies recovery and protects the data for the long

term and paid only for what you use in a scalable subscription model.


Dell EMC believes the information in this publication is accurate as of its publication date. The

information is subject to change without notice.

THE INFORMATION IN THIS PUBLICATION IS PROVIDED “AS IS.” DELL EMC MAKES NO

RESPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE

INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED

WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Use, copying and distribution of any Dell EMC software described in this publication requires an

applicable software license.

Dell, EMC and other trademarks are trademarks of Dell Inc. or its subsidiaries.

data domain cloud tier for modernized data center

Documents