Complexity ate my budget

Transcription

1 Complexity ate my budget How multiple point data protection solutions in multiple environments are adding chaos and cost. Every week we hear from our channel partners, or our joint customers, about their latest data protection challenges. Not that the end of the world happened (who would be left to care anyway?), or that their data center, office building or facility is now a smoking gaping hole. No, it s usually about the complexity of doing something every organization has been doing forever boring and un-sexy backup. Against a backdrop of sustained and apparently uncontrollable data growth, no wonder it s hard! But wait, there s more! It s not so much about backup as it is about the ability to recover under a variety of circumstances. From simple logical data corruption, data loss due to user error (you wouldn t believe what I can do to my laptop), migrations, and yes unplanned outages. We created a monster What is becoming a significant, if not the main, operational problem today is the complexity of the data protection infrastructure. At any moment in time you can have multiple data protection schemas running in your IT environment. Better safe than sorry? Wrong! Better consistent than sorry. And keep it simple? Please. Let s do a quick self-evaluation test (a ploy to make you read on, but please go along with it): 1. There s too much data and it s hard to backup 2. I have different vendors/apps/processes 3. My applications have different recovery requirements 4. Nobody agrees on what is a critical application anyway 5. I don t know my RPO for everything 6. I sort of know my RTO 7. I have many VMs and it s killing me 8. I have no budget/money/people 9. Nobody likes me (let s not go there ) 10. I haven t tested my BC plan in a while, and frankly, I don t want to. If you answered yes to most of these questions you are normal! But not necessarily out of the woods. The evolution of your infrastructure has added layer upon layer of hardware, software and half-baked data protection solutions - may I ironically suggest problems? In addition, the maturity and adoption of server virtualization technology has created a whole new world that requires its own set of rules for effective data protection. Some vendors would like to propose that only virtual environments matter anymore, because they run the infrastructure wrong! As a data protection steward your job is to protect everything that matters, virtual and physical. Not everything is virtual or in the cloud! The cloud, this nebulous and amorphous thing that you should run everything in/on can be pretty hazy. And at what cost? Where does it fit in your planned data protection strategy, because it may actually have a role to play. Having fun yet? We/you created a monster with layers of great data protection technologies when taken individually, but a real mess when you add it all up. Complexity Ate My Budget 1

2 Let s take a simple example from a recent mid-size customer: 1. Desktop backup: online solution (maybe 2... we re not sure) 2. Exchange backup: disk and tape with vendor A. 3. NAS backup: legacy backup B (NDMP) 4. Oracle: Oracle utilities with replication 5. VMs: vendor C 6. Laptop backup: we tell users to copy critical files to a box service (cloud) 7. Some clustering on Linux and Windows, but not for all 8. One backup appliance for one department (on-site) 9. And data retention policy varies by department/user and there are some tapes offsite for compliance purposes anyway, you get the idea. Despite the use of APIs and some level of industry standards, it s impossible to expect to have a good and clear picture of what is really happening, more importantly, what s the data currency across the board? Why should I care? Disaster strikes. Let s say an outage hits you and you need a good point in time to get back on your feet. How do you determine what this point will be? How do you manage consistency across the board? Money. The islands of data protection are costing you greatly in efficiency losses and you may not be able to maintain the expertise needed to successfully run multiple data protection applications. Visibility. No one cares about backup and it s a cost. But they do care about availability and recovery and guess whose fault it will be? Hype. Many one trick ponies out there do very well at one OS, or one area, but few can truly handle all of your needs. Money again. It s your budget and if you re spending, rather than investing, then you re not going to get returns. All this is enough to disrupt a good night s sleep, but this would be like looking at the proverbial half empty glass. There is more than meets the eye. RPO, SLA and the alphabet soup One might argue that having many different technologies is just a fact of IT life. Ultimately one solution will emerge and natural technology attrition will get the better of the lesser data protection technologies. In the meantime, you re fixing an old car while it is still running and it is not going to get better. I know. I ve been there with a car not a backup infrastructure luckily. This is all about application criticality dimensioned against application/data recovery SLAs in the context of an optimized budget. Sounds really good I know, but practically what does this mean and how do you get there? Complexity Ate My Budget 2

3 Step 1: Identify Critical Apps Warning: you may have to resort to group therapy with your peers or someone close to get there. My point is this: Not every application was born equal and there is a dynamic dimension to the criticality of business apps. In other words, things change all the time and different stakeholders will focus on what they care about most. At the end of the day, whether they are hosted on virtual servers or not, listing your top 5 critical applications is key. These are the apps that likely run your business and therefore the investment in data protection you need to deliver in terms of technology, people, process and money is going to be different from a back office application (where RPO can be many hours or days vs. minutes or seconds). Critical applications typically are inter-dependent and have feeder applications. You need these protected too. By the way, these may be on your plain old physical servers. If you think you can get away by protecting only the virtual stuff, good luck to you! Step 2: Identify the RPO It s a numbers game and your ability to clearly identify your key data protection numbers will make all the difference. They won t come in a fortune cookie, as tempting as this may sound. Remember, management loves numbers and you can t control or improve something you can t measure. Assessing data loss or data loss exposure will come down to a few key metrics. RPO is a key one. How much data can you truly afford to lose? I was recently reading Data Protection for Virtual Data Centers by IT expert, author, and analyst Jason Buffington. I really liked his definition, so let me share it with you: If your business goals say that you don t want to lose more than two hours of data, that is your RPO your objective or goal for how frequently you need a reliable recovery point. This definition truly highlights why we should care about controlling RPO: it s a business objective. In the final analysis, the technology (or technologies) you put in place to implement your RPO strategies have to deliver for all the critical apps and beyond, in a consistent and predictable fashion. Complexity Ate My Budget 3

4 Step 3: Identify the RTO dependencies RTO is the time it takes to get your systems back up and running, data, applications etc. It s the time it takes to get back on your feet. It is an objective not a guarantee! I got into a very interesting discussion the other day about why I personally believe RTO is not really a technology question. The definition above supports this. Of course I am pushing the envelope a bit in that many technologies will come into play to get an organization or department back on its feet. Like RPO, RTO is all about objectives, but in this case the dependency on technology lessens because of.people. It s people, processes and technology at play vs. just having designed the right infrastructure and picked the right data protection technologies. This topic has been covered to death by many very smart people so I will just net out for you what the business person in me thinks: 1. RTO is an objective not a reality. 2. Testing your BC/DR plan and validating your RPO in the process is key 3. Testing your actual RTO plan is absolutely critical 4. People get in the way 5. Technologies like virtualization have further complicated the process. People tend to rush home in a disaster so you d better fail over to another region where people will be at work. Just think about what you would do. Can I sell you some high availability now? Virtualization has made my life really complex Server and desktop virtualization has become very pervasive in most organizations, and not just the enterprise. While adoption rates may vary by industry, company size and affinity to deploy IT technologies, the fact is that long gone are the days of virtualization for test/dev on the server side. Desktop virtualization is also growing rapidly, offering many new options to IT. Everybody agrees that server virtualization offers many advantages, saves money, offers more flexibility, etc. Also, it can help in disaster recovery scenarios and can offer some level of high availability even. Many analyst reports validate these points, and customer examples abound. However, when it comes to data protection, we need to remember a few important factors that add a serious amount of complexity to your equation. Whilst this may appear counter-intuitive to the notion that virtualization is a good thing for data protection/dr, it isn t. I m just saying it obfuscates a lot of complexity which in turn complicates your data protection infrastructure. Here goes: 1. You have applications running on these VMs and they need to be protected. So you have critical apps but you also have critical VMs Complexity Ate My Budget 4

5 2. There is a proliferation of VMs and applications (massive amounts) 3. The business-driven metrics of RPO and RTO do still apply 4. Application restore/data restore granularity is needed 5. Not everything has been migrated from Physical to Virtual 6. You need serious expertise to deploy and manage the environment 7. The physical components that support virtualization are not immune to failure on the contrary. Lose one system you can lose dozens of virtual machines: operating system, applications and user access. So you can potentially lose more at one time 8. You need to optimize the storage needed by all of these images of OS s storage is not that cheap after all! Of course you can and should cluster for higher availability. So now you have some critical clusters that run critical VMs that run critical apps just saying. With all these applications, some critical (and associated data), you still need a DR site so everything needs to be replicated in case your primary site becomes unavailable. One more thing Do you have more than one virtualization technology? VMware? Hyper-V? XenServer? RedHat KVM? Protection techniques are not the same they actually vary quite a bit. You still have some physical servers that you either have not migrated or do not want to migrate and (oh yes) there s the cloud thing too. Some data and VMs are in the cloud, which makes operational recovery harder to plan. Again, not a bad technique necessarily, but it adds complexity. Remember that you still need point in time backups in case of logical data corruption (data integrity/consistency); so what is the granularity of your backup? Are there tiers? How do you integrate new VMs in your schema? Who decides? My point here is there is a significant added data protection complexity with virtualization deployments. It s not necessarily bad, it just needs to be understood and planned. Otherwise you lose control. The bigger question is what type of data protection infrastructure do you need to simplify this complexity while still maintaining your SLAs? Having multiple data protection point solutions is not the answer as it has a compounding effect on complexity. In order to maintain control of a virtualized data center, administrators need to approach the planning and execution of data protection from a holistic perspective. The net net is that existing policies need to be reviewed and adapted to secure what is likely a hybrid infrastructure of virtual and physical and cloud. Where is the Money Going? Now that I have reminded you of stuff you already knew but probably chose to ignore until you really have to deal with them (which will likely be too late) let s talk about the depressing topic of what we don t have enough of these days in IT budgets: budget. Complexity Ate My Budget 5

6 As you look at how complex your data protection infrastructure is today, it might be useful to go through a simple taxonomy of the costs that are eating up your resources, time, maintenance budget and more importantly, your ability to deliver SLAs which is what you are paid for (sorry to be blunt). So here s my quick check list of areas (complete with entertaining comments). It s not trying to be comprehensive but rather a starting point to a more in depth discussion. Some of these costs are direct, others are indirect. (I am not CPA so let s not be too academic about this). More importantly, many of these costs are intertwined, and affect you or your data protection organization. So as you look at your TCO, please consider these: 1. Admins/personnel: you re all great! But you need tools to do more with less, and you need a life. 2. Training - so you really took a class? Yeah, right. More seriously, many costs are directly associated to technology complexity/lack of training. 3. Licenses always a touchy subject. Call purchasing. 4. Bandwidth/network: very critical as you look at the amount of data you are copying back and forth, in particular over long distances. This can be a deal breaker for zero RPO SLAs over long distances (fail over; replication). 5. Storage (tape; disk, appliances): love those guys but you need to strike a balance between performance, capacity, cost, future proofing Over-provisioning is not going to be forgotten (or forgiven). 6. Power: unless you really like to bike and make your own, this is an important dimension to factor in. Other data center costs include space and cooling. 7. Compliance: (people, processes, audits, lawyers, additional backups and associated media off-site). 8. Business Disruption: goes back to the RPO question how much is data loss costing you? It can lead to revenue loss, which is both a direct and indirect cost to factor in. 9. Productivity Loss: only happens to others, right? And.compliance failures: fines, jail, legal costs, and how they make you send a letter to ALL your customers that their personal data may have been exposed because someone lost the backup tape. Great marketing. Another way to look at this is to focus on risks. Risk mitigation is critical to business, and if we place the focus on IT risks, there are a few areas well worth looking into. Typically looking at system threats like hardware failures, network issues, software problems, data corruption, glitches, etc. is a great start. There are other areas of risk, such as external threats like hackers and utility-related issues for example, but it s really key to also factor in risks associated with the ever growing interdependency of our applications (think value chain). We all know about acts of nature and they are a very valid source of threats in particular as we increasingly see extreme weather behaviors due to global warming. These threats should be ranked and can be used to develop a full risk assessment of your data protection or IT infrastructure. So, looking at both costs and risk in combination is key, in particular in the context of disaster recovery planning; but more simply to deliver back to the business. Complexity Ate My Budget 6

7 Conclusion IT infrastructures are in constant evolution as they try to adjust to the exponential growth of data we re facing year on year. This is directly affecting the data protection infrastructure, and has made it more complex over time with the emergence of many solutions to cater to the diversity of platforms, applications and data sets. While virtualization has been a fantastic technology to gain further productivity and flexibility, understanding the hidden cost of virtualization and its implications for data protection strategies is critical to keep delivering on your SLAs and get the most out of your budget. It s high time we tamed the monster we created! Having multiple point solutions for data protection is not the answer as it adds to the chaos and impedes on your ability to deliver consistent SLAs. The answer probably lies in a more holistic view of the infrastructure, one that unifies the data protection schemas by starting with your business needs and a thorough understanding of the applications and data sets to be protected. As one industry luminary suggested, backup is broken 1. Let s get it fixed. 1 Gartner: The Broken State of Backup Dave Russell About the author Christophe Bertrand is the VP of Product Marketing at Arcserve. His extensive experience in software and hardware in the storage industry includes product marketing responsibility in companies such as Legato Systems (now part of EMC), VERITAS (now part of Symantec), Maxtor, Hitachi Data Systems, and DataDirect Networks. Christophe is a joint bachelors (with honours) degree holder in Business Administration and an alumnus of Middlesex University (MBA). For more information on Arcserve UDP, please visit arcserve.com Copyright 2016 Arcserve (USA), LLC and its affiliates and subsidiaries. All rights reserved. All trademarks, Arcserve assumes no responsibility for the accuracy or completeness of the information. To the extent permitted by applicable law, Arcserve provides this document as is without trade names, service marks and logos referenced herein belong to their respective owners. This document is for your informational purposes only. Warranty of any kind, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, or non-infringement. In no event will Arcserve be liable for any loss or damage, direct or indirect, from the use of this document, including, without limitation, lost profits, business interruption, goodwill or lost data, even if Arcserve is expressly advised in advance of the possibility of such damage.