Primary Storage

 View Only
Expand all | Collapse all

FlashCopy Snapshots impact

  • 1.  FlashCopy Snapshots impact

    Posted Fri April 15, 2022 06:18 AM
    Hi,

     I want to create around 100 flashcopy mappings (snapshot type) on a few v7000 gen2 and gen3 controllers in order to restore the volumes faster in case of a ransomware attack on the hosts. All the controllers have already another 50-100 remote-copy relationships with global change volumes (so another snaphots). 
    What is the impact for the controllers in terms of CPU and RAM usage when having a (somewhat) large number of flashcopy snapshots ?

     Thanks.

    ------------------------------
    Adrian Nicolae
    ------------------------------


  • 2.  RE: FlashCopy Snapshots impact

    User Group Leader
    Posted Fri April 15, 2022 09:42 AM
    no high cpu and ram usage differencies expected under normal conditions. But if real ransomware attack hits the volume, original volume changes faster and CoW copies the original data to snapshot target. If there is multiple targets it will be time, resource and capacity consuming process and it's hard to determine performance impact. If ransomware hits multiple volumes at the same time and you might need double capacity. If the pool goes %100 it might be not good as you expected.

    ------------------------------
    Nezih Boyacioglu
    ------------------------------



  • 3.  RE: FlashCopy Snapshots impact

    Posted Mon April 18, 2022 07:23 AM
    Adrian,
    I'm actually looking into the same thing.  Coming up with a solution to help protect against ransomware attack.  I'm working with IBM to evaluate their tool called CyberVault with Safe Guarded Copy.  Initially, I thought that I could just write a script to take snapshots similar to what you mentioned but the difference with the CyberVault tool is that it creates immutable copies.  You may want to look into CyberVault.

    ------------------------------
    Norman Owens
    Open Systems Architect
    Mohawk Industries
    ------------------------------



  • 4.  RE: FlashCopy Snapshots impact

    User Group Leader
    Posted Mon April 18, 2022 09:50 AM
    Edited by Nezih Boyacioglu Mon April 18, 2022 09:51 AM
    Yes, SafeGuarded copy takes immutable snapshots. These snapshots undeletable, unchangeable by any user or system. It's works on FlashSystem 5200, 7300 and 9500. Recommended to use with IBM FlashCore Modules. It provides faster recovery by design (2 GB/s per volume) and you can recover multiple volumes at a time (recovery performance different on each model). But you can recover 20 TB/hour approx with fully populated 5200. 

    Capacity sizing also important with SafeGuarded Copies. 

    Protected Primary Volumes Sizes + (Daily Change Rate x Retention Day) + Recovery Volume (same as PPVS) 

    Note: FCM compression rate can change during ransomware attack. If data encrypted, compression rate will drop and it's recognized by Storage Insights and create an alert for you.

    ------------------------------
    Nezih Boyacioglu
    ------------------------------



  • 5.  RE: FlashCopy Snapshots impact

    Posted Mon April 18, 2022 10:15 AM
    Unfortunately  CyberVault is only available on the latest software versions 8.4.1x / 8.4.2.x and probably only on their latest FlashSystem hardware. I'm using 5100  and v7000 gen2/gen3 so I cannot deploy it.
      
      For the moment I'm using a basic script which takes hourly snapshots via ssh during the working hours.

    ------------------------------
    Adrian Nicolae
    ------------------------------



  • 6.  RE: FlashCopy Snapshots impact

    User Group Leader
    Posted Mon April 18, 2022 10:22 AM
    FlashSystem 5100 (2077-4H4 / 2078-4H4 and 2078-UHB) supports 8.4.2 and 8.5 
    ( https://www.ibm.com/support/pages/hardware-interoperability-matrix-flashsystem-5x00-software-levels )

    v7000 Gen3 (2076 724) also supports 8.4.2 which SafeGuarded Copy works well. ;)

    ------------------------------
    Nezih Boyacioglu
    ------------------------------



  • 7.  RE: FlashCopy Snapshots impact

    Posted Mon April 18, 2022 10:33 AM
    Interesting. On my 5100 2078-4H4 running 8.4.0.6 I'm getting "you're running the most up-to-date software" when checking updates from GUI.  

    the v7000 Gen3 controller is part of a cluster with some older systems (v7000 2076-624) so I will probably not getting any further than 8.3.1.6 or 8.4.0.6.

    ------------------------------
    Adrian Nicolae
    ------------------------------



  • 8.  RE: FlashCopy Snapshots impact

    Posted Tue April 19, 2022 10:13 AM

    Hi - 

    5100 is definitely supported on 8.4.2, however, 8.4.0 is the LTS, and 8.4.2 is a non-LTS, so the recommendation scheme has changed to reflect that. 

    V7000G3 is also capable of running 8.4.2, but you are correct in that the V7000 G2/2+ are terminal released on 8.4.0.

    SafeguardedCopy is supported on all Spectrum Virtualize Appliances that support volumegroups (everything except the 50XX) and are capable of running on 8.4.2.

    I hope that helps!



    ------------------------------
    Evelyn Perez
    ------------------------------



  • 9.  RE: FlashCopy Snapshots impact

    Posted 17 days ago
    thank you for your great help

    ------------------------------
    ta7milat
    ------------------------------



  • 10.  RE: FlashCopy Snapshots impact

    Posted 17 days ago
    Hi,

    I 've upgraded my 5100 to the latest LTS (8.5.0.2) which has support for
    Safeguarded Copy. I also need a VM with the latest Copy Service Manager
    in order to manage the orchestrate the snapshots. It's working fine so
    far but 8.5.0.2 looks a little buggy for now - I had an issue with the
    management ports after upgrade.




  • 11.  RE: FlashCopy Snapshots impact

    User Group Leader
    Posted 17 days ago
    what kind of issue? I'm using 8.5.0.2 on 5200, 9500 and 7300 without any problems.

    ------------------------------
    Nezih Boyacioglu
    ------------------------------



  • 12.  RE: FlashCopy Snapshots impact

    Posted 17 days ago
    ?? both 10ge management ports from one node are working only using 1ge
    spf modules.???? The same ports were working in 10ge before the upgrade
    and I didn't have any issue when I did the upgrade to 8.3.1.5, 8.3.1.6
    and 8.4.0.6 in the past. There is no connectivity issue with them, I
    changed cables, sfp modules, switch ports.

    ?? I opened a case to IBM support with this issue last week.




  • 13.  RE: FlashCopy Snapshots impact

    User Group Leader
    Posted 17 days ago
    iSER support deprecated on newer models (7300 and 9500). But it's still supporting for older models with 8.5.0.2. 
    it might be an conflict related with it. Support will say what's going on :)

    ------------------------------
    Nezih Boyacioglu
    ------------------------------