Microsoft has been busy rebranding some of its major server offerings under the System Center suite, including Microsoft Operations Manager, now under the System Center Operations Manager moniker, and Systems Management Server (SMS), now known as System Center Configuration Manager (SCCM). System Center also includes several other powerful solutions for IT environments; in this article I’ll focus on a solution that addresses—and does so very well—the age-old problem of protecting your most valuable IT asset: data. The solution that does this for you is System Center Data Protection Manager (DPM) 2007.
DPM: What It Does
DPM 2007 is the second version of Microsoft’s data protection solution, and it’s come a long way in a very short amount of time to provide a comprehensive solution for your Microsoft environment. And that’s a key point: DPM isn’t all things to all people; it’s been developed to provide the best data protection for key Microsoft platforms and only those platforms—namely, Windows file shares and directories, Microsoft Virtual Server, Microsoft Office SharePoint Server, SQL Server, and Microsoft Exchange Server; Hyper-V support is expected to be added soon.
By concentrating on these key server applications, Microsoft hasn’t had to dilute DPM’s functionality to cover many different platforms, messaging systems, or databases. Instead, the solution focuses on how the covered services work and store data. In addition, DPM takes advantage of the applications’ native capabilities for restoring data; for example, DPM uses Exchange Recovery Storage Groups for certain types of Exchange restoration. This ability to tap into native restoration processes is a key feature of DPM: Remember, you don’t do backups simply to have a copy of the data; you do backups to facilitate restoration. When you look at data protection solutions, you need to consider how they perform restorations and what capabilities they provide.
A question you might have already is, “Well, what type of data protection does DPM provide—is it continuous data protection (CDP) or is it the same as my nightly backup to tape?” The answer is both. DPM is natively a disk-based backup and recovery solution. Information gathered from its protected clients is stored to disk, but these disk-based snapshots can also be written to tape for archival purposes, which is a new feature in DPM 2007. You can even skip the disk backup and go straight to tape.
I’ve had many clients ask if DPM replaces their existing backup solution. For environments that are pure Microsoft, the answer is that it probably can. If your environment has a mixture of OSs, you’ll need a different backup solution, but you could still leverage DPM’s data protection for the Microsoft portions of the environment.
How It Works
To collect data from protected clients, DPM requests Microsoft Volume Shadow Copy Service (VSS) snapshots. DPM stores the snapshots on its available disks, which can be DAS, iSCSI SAN, or Fibre Channel SAN. This collection method works well for DPM because each of the DPM-protected applications has a VSS writer written by the product’s development team; for example, an Exchange 2007–specific VSS writer is installed as part of Exchange 2007. These VSS writers have the built-in intelligence needed to ensure the snapshot contains all the required information so that its integrity is guaranteed; for example, the writers make sure that transactions have been flushed completely and that a copy isn’t taken halfway through a write to the database.
Also, the snapshots are smart: Only the delta information between the current and previous snapshot is sent to the DPM server. This feature is known as an express full backup. So even though you have 5TB of Exchange storage, for example, the changed data sent to the DPM server for each snapshot might be only a few hundred megabytes. Therefore, DPM bandwidth use is low, so you can perform snapshots frequently. In fact, you can take a snapshot as often as every 15 minutes and can keep as many as 512 snapshots online, allowing highly granular restoration.
DPM can also collect transaction log data. Gathering transaction logs is separate from taking a snapshot, so you could perform a snapshot once a day and collect transaction logs every 15 minutes. If you needed to restore in this example, you would restore the snapshot, then replay all the transaction logs you’d collected since the snapshot—all automatically. By setting a 15-minute snapshot interval, you can be assured the maximum data loss would be less than 15 minutes, assuming a crash occurs just before the next snapshot was to be taken. However, when you combine the snapshot interval with the ability to replay transaction logs from the supported applications, you actually have a zero-loss solution and essentially a CDP environment—assuming you follow best practices by placing the databases and transaction logs on separate disks. Of course, if the transaction logs aren’t available or the protected data doesn’t have transaction logs, it’s still possible to have less than 15 minutes of data loss using snapshots. Figure 1 shows DPM’s VSS-based backup process.
Virtual environments are becoming mainstream, so you might wonder how DPM supports virtual environments. Microsoft Virtual Server 2005 R2 SP1 provided us with a recursive VSS writer, which means that when DPM requests a VSS snapshot of a virtual machine (VM), the Virtual Server VSS writer informs the guest OS that a VSS snapshot will be taken, and the VSS writers in the guest are called to ensure the data within the host is in a consistent state. For example, if a VM is running Exchange, the Virtual Server VSS writer tells the guest OS a snapshot is being taken, which then tells the virtualized Exchange server’s VSS writer to run. If a guest VM is running an OS that doesn’t support VSS, DPM puts the VM in hibernate mode just long enough to get the snapshot, then lets it resume.
DPM Architecture
The deployment topology you use depends on the requirements of your organization—the speed at which you want to be able to restore data, what functionality you plan to offer to end-users, and of course your available hardware and budget. DPM has three main storage combinations you can deploy:
- Disk to disk—This is the preferred option for DPM; it essentially takes the snapshot information from the protected disks and stores the information on storage managed by the DPM server.
- Disk to disk to tape—In this scenario, data from the protected clients is protected primarily on DPM disk storage but is also periodically written to tape.
- Disk to tape—This method is effectively using DPM as a tape backup program; it takes data from the protected clients and writes it directly to DPM-attached tape devices.
If you plan to use any disk-based protection, your DPM server should have at least twice as much disk space as the data it’s protecting. Remember, DPM isn’t just storing the data, but also the changes in the data over a potentially long period of time, which is why you need additional storage space. To get an exact disk space amount, download the DPM 2007 Storage Calculator from Microsoft’s website. The calculator is a Microsoft Excel spreadsheet that provides you with detailed storage requirements based on information you enter about your environment.
In smaller environments, DPM could be used just as the manager for nightly backups to tape. However, because storage can be easily added to DPM, the data protection could later be shifted to disk-based storage, which is commonly far more reliable than tape backups. Also, because the disk-based backup is always on, you can choose to let users restore certain types of information themselves, such as files and folders—a very appealing notion that can reduce administrator overhead incurred searching through tapes.
You need a management license (ML) for each client you wish to protect with DPM. DPM 2007 comes with two types of ML. A standard ML is required for servers on which you wish to perform only file- and folder-level protection (i.e., your file servers and typical servers and desktops); a standard ML also includes protected system state on servers such as domain controllers. You need an enterprise ML for servers that require application-level protection (i.e., servers running SQL Server, Exchange, Virtual Server, or SharePoint). MLs are in addition to purchasing the DPM server product but are provided as part of certain enterprise suites.