Processes for managing data protection with IBM Storage Protect

Edit online

The IBM Storage Protect server inventory has a key role in the processes for data protection. You define policies in the IBM Storage Protect server inventory that the server uses to manage data storage.

Data management process

Figure 1 shows the IBM Storage Protect data management process.

Illustration shows data protection management processes — Figure 1. Data management process

IBM Storage Protect uses policies to control how the server stores and manages data objects on various types of storage devices and media. You associate a client with a policy domain that contains one active policy set. When a client creates a backup, archives, or migrates a file, the file is bound to a management class in the active policy set of the policy domain. The management class and the backup and archive copy groups specify where files are stored and how they are managed. If you set up server storage in a hierarchy, you can migrate files to different storage pools.

Inventory components

The following inventory components are key to the operation of the server:

Server database

The server database contains information about client data and server operations. The database stores information about client data, called metadata. Information about client data includes the file name, file size, file owner, management class, copy group, and location of the file in server storage. The database includes the following information that is necessary for the operation of the server:

Definitions of client nodes and administrators
Policies and schedules
Server settings
Records of server operations, such as activity logs and event records
Intermediate results for administrative queries

Recovery log

The server records database transactions in the recovery log. The recovery log helps to ensure that a failure does not leave the database in an inconsistent state. The recovery log is also used to maintain consistency across server start operations. The recovery log consists of the following logs:

Active log: This log records current transactions on the server. This information is required to start the server and database after a disaster.
Log mirror (optional): The active log mirror is a copy of the active log that can be used if the active log files cannot be read. All changes that are made to the active log are also written to a log mirror. You can set up one active log mirror.
Archive log: The archive log contains copies of closed log files that were in the active log. The archive log is included in database backups and is used for recovery of the server database. Archive log files that are included in a database backup are automatically pruned after a full database backup cycle is complete. The archive log must have enough space to store the log files for database backups.
Archive failover log (optional): The archive failover log, also called a secondary archive log, is the directory that the server uses to store archive log files when the archive log directory is full.

Policy-based data management

In the IBM Storage Protect environment, a policy for data protection management contains rules that determine how client data is stored and managed. The primary purpose of a policy is to implement the following data management objectives:

Control which storage pool is the client data initially stored in
Define retention criteria that controls how many copies of objects are stored
Define how long copies of objects are retained

Policy-based data management helps you to focus on the business requirements for protecting data rather than on managing storage devices and media. Administrators define policies and assign client nodes to a policy domain.

Depending on your business needs, you can have one policy or many. In a business organization, for example, different departments with different types of data can have customized storage management plans. Policies can be updated, and the updates can be applied to data that is already managed.

When you install IBM Storage Protect, a default policy that is named STANDARD is already defined. The STANDARD policy provides basic backup protection for user workstations. To provide different levels of service for different clients, you can add to the default policy or create a new policy.

You create policies by defining the following policy components:

Policy domain

The policy domain is the primary organizational method of grouping client nodes that share common rules for data management. Although a client node can be defined to more than one server, the client node can be defined to only one policy domain on each server.

Policy set

A policy set is a number of policies that are grouped so that the policy for the client nodes in the domain can be activated or deactivated as required. An administrator uses a policy set to implement different management classes based on business and user needs. A policy domain can contain multiple policy sets, but only one policy set can be active in the domain. Each policy set contains a default management class and any number of extra management classes.

Management class

A management class is a policy object that you can bind to each category of data to specify how the server manages the data. There can be one or more management classes. One management class is assigned to be the default management class that is used by clients unless they specifically override the default to use a specific management class.

The management class can contain a backup copy group, an archive copy group, and space management attributes. A copy group determines how the server manages backup versions or archived copies of the file. The space management attributes determine whether the file is eligible for migration by the space manager client to server storage, and under what conditions the file is migrated.

Copy group

A copy group is a set of attributes in a management class that controls the following factors:

Where the server stores versions of backed up files or archive copies
How long the server keeps versions of backed up files or archive copies
How many versions of backup copies are retained
What method to use to generate versions of backed up files or archive copies

Security management

IBM Storage Protect includes security features for registration of administrators and users. After administrators are registered, they must be granted authority by being assigned one or more administrative privilege classes. An administrator with system privilege can perform any server function. Administrators with policy, storage, operator, or node privileges can perform subsets of server functions. The server can be accessed by using the following methods, each controlled with a password:

Administrator access to manage the server
Client access to nodes to store and retrieve data

Also includes features that can help to ensure security when clients connect to the server with the following closed registration method:

Closed registration

Closed registration is the default method for client registration to the server. For this type of registration, an administrator registers all clients. The administrator can implement the following settings:

Assign the node to any policy domain
Determine whether the user can use compression or not, or if the user can choose
Control whether the user can delete backed up files or archived files

You can add more protection for your data and passwords by using Secure Sockets Layer (SSL). SSL is the standard technology that you use to create encrypted sessions for servers and clients, and provides a secure channel to communicate over open communication paths. With SSL, the identity of the server is verified by using digital certificates. If you authenticate with a Lightweight Directory Access Protocol (LDAP) server, passwords between the server and the LDAP server are protected by Transport Layer Security (TLS). The TLS protocol is the successor to the SSL protocol. When a server and client communicate, TLS ensures that third parties cannot intercept messages.