Linux recovery window

In the wake of the 9/11 terror attacks in the US, disaster recovery suddenly became THE indispensable business process. Of course, disaster recovery wasn't exactly a luxury before--making back-up copies of company data was a routine procedure for most data-dependent enterprises in preparation of other kinds of disasters, from fire and electrical blackouts to earthquakes and extreme weather.

But 9/11 was different. Blame it on the sheer scale and notoriety of the event and the emotional impact worldwide, not to mention the human cost. In any case, 9/11 proved to be a major test for businesses worldwide from a business continuity standpoint, whether they had an office in the World Trade Center or not. The question for enterprises everywhere, quite simply, was this: could your business have survived something like this?

Meanwhile, storage technologies had been rapidly advancing with the rise of storage area networks (SANs) and SAN switches, broadening options for disaster recovery plans--link storage servers in different cities together across the network, with automatic back-up of data in real time at different sites, and your company can be up and running again in no time even if one site is destroyed in a catastrophic event. Don't have the expertise to set up a multi-site SAN? Call up your local storage service provider (SSP) or data center operator--they can set it up for you for a monthly fee.

That, at least, was the idea. Two years later, however, for the majority of businesses, the disaster recovery paradigm hasn't advanced very far.

"It's quite strange--right after 9/11 everyone was focused on disaster recovery, but after a year or two, 9/11 has slipped from memory for most people," says Rod Chan, regional program manager for Greater China at storage vendor EMC. "Meanwhile, in so many Asian markets, there are so few reminders that you need something like this. You could set up a back-up site and possibly never have to use it for years."

This naturally varies from one industry segment to the next. The financial industry, for example, has certainly taken disaster recovery far more seriously than most. It has led the private sector in disaster recovery spending since 9/11, and will collectively spend $3.56 billion on such projects this year alone--a 26% increase from 2001, according to figures from US-based financial-services industry consultancy TowerGroup. Spending from governments is also on the rise.

But overall, the majority of enterprises aren't spending very much on disaster recovery at all. One report from Sagitta Performance Systems claims that 54% of enterprises surveyed devote less than 1% of their IT budget to disaster recovery, and 75% rely mainly on back-up tapes as the core pillar of their disaster recovery strategy.

"Every enterprise, whether they're in the banking business or manufacturing or a small-medium business, if you ask them if they have prepared a disaster recovery plan, 100% of them will say yes, but the degree varies as to how comprehensive or well thought-out their plan is," says Chan. "Maybe all they do is back up their data tapes every day--is that a disaster recovery plan?"

Part of the problem is cost-comprehensive disaster recovery plans can get expensive, and the impact of the global economic downturn has forced many companies to cut back spending on all fronts.

Another problem, however, is that the growing number of options available is bogging down the decision-making process for many IT managers and CIOs who are either still learning the ropes in terms of new DR technologies and services, or are still hashing out which solutions will give them the most protection for the least amount of money.

Levels of protection

For a start, there's the question of just how much protection the enterprise needs in a disaster-type situation.

"For example, how fast do you need to restart everything?" says Chan. "You can buy equipment today where the restart time is quite fast, but it's also the most expensive."

DR protection levels these days can be generally grouped in three categories: cold, warm and hot back-up sites.

In the cold site scenario, the back-up site sits unstaffed and virtually empty until disaster hits, after which the company rents and installs the necessary equipment, brings the back-up tapes from the primary site and loads all the data into the machines--a process which takes days. A warm site has dedicated equipment and staff on standby until disaster strikes and the back-up tapes arrive shortly thereafter, allowing for the company to be back up and running within 24 hours. A hot site involves actually linking the sites and carrying out data replication in real time or near-real time, which can have you up and running again within an hour or two.

The hot site is the most expensive of the three, naturally, which is why warm sites are the most popularly implemented among enterprises with advanced DR strategies.

Unsurprisingly, then, cost balancing is the name of the game in DR planning, says James Hung, manager of zSeries and TotalStorage for IBM Systems Group in Hong Kong.

"The whole decision of whether a company should subscribe to DR service or perform its own DR arrangement is mainly an investment and benefits statement based on cost effectiveness," he says.

Hung says that the place to start in designing a cost-effective solution that balances cost and recoverability is to determine just what objectives the enterprise needs to achieve in terms of RTO (recovery time objective: how fast you need to recover), RPO (recovery point objective: what amount of data needs to be re-created within the RTO timeframe) and the NRO (network recovery objective: how long it should take to switch the entire network over to the back-up data center).

"Obviously there is no need to purchase a 30-minute RTO solution if the network provider requires two hours to switch the network," Hung says. "Management will always want to know how much faster or slower the solution will be if they invest a little more or less."

However, even determining a cost-effective DR plan is a complex task, says Billy Basu, senior business development manager for optical networks at Nortel Networks.

"It depends on a number of things," he says. "How big is the enterprise? Are they looking to network their servers in a SAN? Do they want to link multiple SANs? Do they just need to outsource the network side, and if so, how much? And how do you handle growth of the SAN? As the SAN gets bigger and the back-up window shortens, how do you manage your IT budget and make sure the SAN can meet those requirements?"

The choices don't end there. For example, enterprises can save costs by reserving real-time connections for only the most critical data while saving the rest on back-up tapes.

"You're not actually losing data," says EMC's Chan. "You can still back up everything on tapes, you just don't have to send every single piece of data over the net work. This can lower bandwidth requirements, and therefore the cost."

Another option, if you have clustered servers at both sites, is to have a lower number of servers at the back-up site, suggests P.W. Pong, Greater China region president of storage specialist Veritas. "You'll lose some performance, but if it's only a couple of seconds' difference, that doesn't matter," he says.

Pong points out that enterprises can also outsource server space with an availability SLA from the service provider, or try newer approaches like grid computing to ensure that mission-critical apps have sufficient CPU resources to keep running normally, though interoperability across server OSs is a key element there. "Whether the app runs on HP-Unix or Windows or Linux, should be irrelevant," Pong says.

Who do you trust?

Even the decision of outsourcing DR processes to an SSP or doing it in-house isn't as simple as it sounds, Pong observes.

"In China, for example, enterprises are only just now looking at outsourcing [DR] as a serious option," Wong says. "One reason is that they don't understand all of the options that are available to them. The other is that the education level on disaster recovery is still quite poor. They just see it as backing up data--they don't consider things like storage networks. It's not really the technology that matters--the customers must understand their options."

It doesn't help that many service providers offering disaster recovery services are really just offering a place to put your equipment, Pong adds. "A lot of ISPs and telcos can say, 'Hey, I've got an outsourcing service for disaster recovery', but often it's really just a co-location service--you rent some rack space and a telephone line in their data center."

Still, there are more feature-rich SSP offerings to be had, says Amer Khouri, VP of strategy and global marketing at Intelsat, which includes disaster recovery among its growing value added service portfolio.