Backup is important, recovery is everything - Storage Automation

Computer Technology Review, March, 2002 by Fred Moore

Digital data is now widely perceived as a mission critical and core part of a company's value, and data itself has now become the currency of the information age on a global basis. The requirement for continuous availability systems applies to a larger number of business applications than ever before as it has become essential for survival in most businesses today. The attacks of 9/11 now have most companies reviewing, revising, and enhancing their disaster recovery plans and strategies. More importantly, they are focused on how fast their critical systems can be made available in the event of an outage of any type. The most important aspect of disaster recovery is now recovery.

Continuously available systems consist of hardware and software designed to protect against component and system-level failures. Recent data indicates that 44 percent of data loss is caused by either hardware or systems failure, 32 percent is caused by human error, and 14 percent from software and program error. The complexity and cost of these solutions depends on the number of users, the types of services provided, and the definition of what is an acceptable versus an unacceptable outage. The value in terms of lost revenue for an hour's outage for selected applications is listed in Table 1.

Higher availability comes at a higher cost. Every step taken beyond the traditional centralized data center has offered the potential of greater productivity functionality, and convenience for IT organizations. Along with these advantages, however, distributed computing has exposed companies to a ranch greater vulnerability. It is estimated that less than 5% of single-user or desktop/PC systems data is adequately managed, if at all, meaning that the data is unlikely to be recovered in the event of any outage. For server and multi-user systems (excluding the mainframe computer market where storage management techniques are more advanced), as much as 80% of the business data is not managed. From local area networks to distributed computing platforms, and now the Internet and intranets, the level of exposure has increased while disaster preparation has decreased. The newest areas of risk are the Internet and corporate intranets with little preparation given to disaster recovery for these increasingly important systems. The estimated average costs of system failures would be nearly fatal to some companies and can range to nearly $3 million of lost revenue per hour of downtime. A server that is 99 percent available may seem highly available but will actually be unavailable 5,000 minutes per year! Availability figures range from 95-plus percent for NT-based servers to 99.999-plus percent for enterprise OS/390 and z/OS Parallel Sysplex servers. Five nine's are important, nine to five isn't. The number of minutes per year of unavailability can be misleading (Table 2).

Beyond the number of nines as a measure for availability, a new set of metrics has emerged defining the impact of lost availability on the level of service delivered. Often referred to as "QoS" for Quality of Service, we now have a way to look at the type of service being delivered when a failure actually occurs. QoS takes the availability percentages to the next level and begins to add meaning to the impact of an outage. The path to the "high nines" describes new computing architectures that will ultimately become self-healing.

For years the question of "what is your backup strategy" was frequently asked. Recent events indicate that the new critical question is "what is your recovery strategy?" Do many businesses actually know the answer to the question of how long it will take to recover and make an application fully operational again? How much is a business willing to pay for data protection capabilities? The answer to this question is usually based on the importance of data to a particular business (Table 3). However, spending more on IT functionality goes directly against mandates from many companies to reduce their budget, thus putting management in a difficult position. Some applications can tolerate a delayed recovery time whereas others require immediate availability in the event of an outage. Table 1, once again, provides revealing and general guidelines into industry averages for a loss of data per hour in several vertical markets but each business may want to determine the specific business value of their applications.

Compass America, an independent consulting firm, conducted detailed analyses of approximately 150 midrange Unix data centers in Fortune 1,000 organizations from March 2000 to September 200l. They found that only 25% have any type of disaster recovery plan in place. Moreover, one-third of those midrange environments that do have recovery plans have never tested them.

In the event of a disaster, it was estimated that:

* Only 15% of midrange data centers would be able to recover more than 30% of their applications in any time frame.

* Just 3.8% could recover their applications within the same day.