Administrator's Guide

Levels of Protection

ADSM provides various methods for protecting ADSM data. For the most comprehensive coverage, they should be used together. They are:

• Storage pool backup
• Database and recovery log mirroring
• Database backup

This section describes each method and presents the benefits and costs of each.

Attention: ADSM Version 1 provided database salvage commands to reestablish the server database if a catastrophic error occurred. Although these commands are still available, the current database backup and recovery functions replace them and should be used to ensure the best level of protection for your server. Database salvage commands involve a lengthy process. You should not use them without help from your IBM service representative.

Storage Pool Protection

ADSM stores client data on volumes in storage pools. If one or more storage pool volumes is lost or damaged, the client data may be permanently lost. However, you can back up random or sequential access pools to sequential access copy storage pools and move the volumes offsite. Then if data is lost or damaged, you can restore individual volumes or entire storage pools from the data in the copy storage pools.

How Restore Processing Works

ADSM provides two commands that allow an administrator to recreate files in a primary storage pool using copies in a copy storage pool:

RESTORE STGPOOL

Restores all files in a storage pool that have been previously identified as having read errors. These files are also known as damaged files. This command also restores all files on any volumes that have been designated as destroyed using the UPDATE VOLUME command. See "Restoring Storage Pools" for more detailed information.

RESTORE VOLUME

Recreates files that reside on a volume or volumes in the same primary storage pool. This command can be used to recreate files for one or more volumes that have been lost or damaged. See "Restoring Storage Pool Volumes" for more detailed information.

ADSM uses database information to determine which files should be restored for a volume or storage pool, so restore processing does not require that the original volumes be accessed. For example, if a primary storage pool volume becomes damaged, the RESTORE VOLUME command could be used to recreate files that were stored on that volume, even though the volume itself is not readable. However, if the administrator deletes the damaged files with DISCARDDATA=YES, ADSM removes from the database references to the files on the primary storage pool volume and all references to copies of the files on copy storage pool volumes. It would not be possible to restore those files.

Restore processing obtains files from a copy storage pool and stores these files on new primary storage pool volumes. Database references to files on the original primary storage pool volumes are then deleted. If a primary storage pool volume becomes empty because all files that were stored on that volume have been restored to other volumes, the empty volume is automatically deleted from the database.

To facilitate restore processing of entire volumes, ADSM has a destroyed volume access mode. This mode is used to designate primary volumes for which files are to be restored. If a volume has an access mode of destroyed, ADSM does not mount that volume for either read or write access. You can change the access mode of a volume to destroyed in one of two ways:

• By using the RESTORE VOLUME command. The RESTORE VOLUME command automatically changes the access mode of specified volumes to destroyed using a volume list provided as part of the command.

• By using the UPDATE VOLUME command. Before using the RESTORE STGPOOL command to restore volumes in a storage pool, the administrator must update the access mode of the volumes to destroyed.

The destroyed designation for volumes is important during restore processing, particularly when the RESTORE STGPOOL command is used to restore a large number of primary storage pool volumes after a major disaster:

• You can designate as destroyed only those volumes that need to be restored. If some volumes are known to be usable after a disaster, the access state of the usable volumes should not be set to destroyed, so they will not be restored.

• Once the administrator has identified the primary volumes to be restored, and has changed the access mode of these volumes to destroyed, new volumes can be added to the storage pool. The new volumes are used to contain the files as they are restored from the copy storage pool volumes. The new volumes can also be used for storage of new files that may be backed up, archived, or migrated by the end users.

• The designation of destroyed volumes allows ADSM to keep track of the files that still need to be restored from copy storage pools. If restore processing is ended before completion for any reason, you can start the restore again. Processing would be resumed and only the files that still reside on destroyed volumes would need to be restored.

Database and Recovery Log Protection

In addition to all the information about your ADSM system, the database contains information (including pointers) about all the client data in your storage pools. The recovery log contains records of changes to the database. If you lose the recovery log, you lose the changes that have been made since the last database backup. If you lose the database, you lose all your client data.

You have several ways to protect this information:

• Mirror the database, or the recovery log, or both

• Back up the database to tape or remote virtual volumes (see Chapter 4. "Storing Data on Another Server")

• Back up the database to tape or remote virtual volumes (see Chapter 4. "Storing Data on Another Server") and in the recovery log save all the changes made to the database since that backup (this is called rollforward mode)

Mirroring

You can prevent the loss of the database or recovery log due to a hardware failure, by mirroring them. Mirroring writes the same data to multiple disks simultaneously. However, mirroring does not protect against a disaster or a hardware failure that affects multiple drives or causes the loss of the entire system. While ADSM is running, you can dynamically start or stop mirroring and change the capacity of the database.

ADSM mirroring provides the following benefits:

• Protection against database and recovery log media failures

• Uninterrupted ADSM operations if a database or recovery log volume fails

• Avoidance of costly database recoveries

However, there are also costs:

• Mirroring doubles the required DASD for the mirrored volumes

• Mirroring results in decreased performance

Database Backup

ADSM can perform full and incremental backups of the database to tape while the server is running and available to clients. With ADSM in normal mode, the backup media can then be stored onsite or offsite and can be used to recover the database up to the point of the backup. You can run full or incremental backups as often as needed to ensure that the database can be restored to an acceptable point in time.

Note:

You can run up to 32 incremental backups between full backups.

You can provide even more complete protection if you specify that ADSM run in rollforward mode. With ADSM in rollforward mode and with an intact recovery log, you can recover the database up to its most current state (the point at which the database was lost).

For the fastest recovery time and greatest availability of the database, mirror both the database and recovery log and periodically back up the database. When operating in rollforward mode, mirroring better ensures that you have an intact recovery log, which is necessary to restore the database to its most current state.

Normal Mode versus Roll-Forward Mode

Rollforward mode offers the highest level of protection for your data. However, there are costs to rollforward mode. The following tables describes the protection afforded by each mode and the requirements for each mode.

Level of Protection
Normal Mode	Rollforward Mode
Recover to a point in time of the latest full or incremental backup only.	Recover to a point in time of the latest full or incremental backup or, with an intact recovery log, to the most current state.
Recover with loss of client data that has been: Backed up since the last database backup. Moved due to storage pool migration, reclamation, or move data operations since the last database backup and then overwritten.	With an intact recovery log, recover to the most current state with no loss of client data.
You must restore the entire database even if only one volume is damaged.	You can restore a single volume.
	Preferable if the server supports HSM clients (space-managed files should be protected as fully as possible from hardware failure).

Storage Requirements
Normal Mode	Rollforward Mode
Does not require a recovery log to restore to a point in time. The recovery log keeps only uncommitted transactions, and its size is not affected by normal mode.	Requires an intact recovery log to restore to the most current state. The recovery log keeps all transactions since the last database backup. In rollforward mode you should significantly increase the recovery log size. However: Frequent database backups reduce recovery log storage requirements (after a backup is completed, recovery log records preceding the backup are deleted). Mirroring the recovery log requires much less space than mirroring the database.
For the greatest availability, you should mirror the database and recovery log or place them on devices that guarantee availability.	You should mirror the recovery log to recover to the most current state. Note: Unlike mirroring the database, rollforward recovery does not provide continuous operations after a media failure. This is because the database must be brought down to perform the recovery.

The following table compares four typical ADSM data recovery configurations, two for rollforward mode and two for normal mode. In all four cases, the storage pools and the database are backed up. The benefits and costs are:

Mirroring

Whether the database and recovery log are mirrored. Mirroring costs additional disk space.

Coverage

How completely you can recover your data. Rollforward recovery cannot be done if the recovery log is not intact. However, rollforward mode does support point-in-time recovery.

Speed to Recover

How quickly data can be recovered