Remote data mirroring having preselection of automatic recovery or intervention required when a disruption is detected

• US 6,044,444 A
• Filed: 03/17/1997
• Issued: 03/28/2000
• Est. Priority Date: 05/28/1996
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Ofek, Yuval
• Primary Examiner(s): Thai, Tuan V.
• Application Number:
  US08/819,672
• Time in Patent Office: 1,107 Days
• Field of Search: 711/162, 711/144, 711/145, 711/161, 707/6, 707/7, 395/182, 371/40, 710/1, 714/5, 714/6, 714/718, 714/763
• US Class Current: 711/162
• CPC Class Codes: G06F 11/2066 Optimisation of the communication load
• CPC Class Codes: G06F 11/2071 using a plurality of controllers
• CPC Class Codes: G06F 11/2079 Bidirectional techniques
• CPC Class Codes: G06F 11/2082 Data synchronisation

Abstract

Two data storage systems are interconnected by a data link for remote mirroring of data. Each volume of data is configured as local, primary in a remotely mirrored volume pair, or secondary in a remotely mirrored volume pair. Normally, a host computer directly accesses either a local or a primary volume, and data written to a primary volume is automatically sent over the link to a corresponding secondary volume. Each remotely mirrored volume pair can operate in a selected synchronization mode including synchronous, semi-synchronous, adaptive copy--remote write pending, and adaptive copy--disk. A number of automatic and non-automatic recovery mechanisms are provided on a logical volume basis for a desired level of data integrity and degree of operator or application program involvement. If a "volume domino" mode is enabled for a remotely mirrored volume pair, access to a volume of the pair is denied when the other volume is inaccessible. In a "links domino" mode, access to all remotely mirrored volumes is denied when remote mirroring is disrupted by an all-links failure. The domino modes can be used to initiate application-based recovery, for example, recovering a secondary data file using a secondary log file. In an overwrite cache mode, remote write-pending data in cache can be overwritten. In a "log-in-cache" mode, multiple versions of write data can be stored in cache in order to recover from a "rolling disaster".

Claims

1. A data processing system comprising:

a first data storage system;

a second data storage system; and

a data link coupled between said first data storage system and said second data storage system for transmission of remote copy data from said first data storage system to said second data storage system;

wherein said first data storage system is operational in a remote copy mode in which data is stored in a primary volume of data storage in said first data storage system and is transmitted over said data link and stored in a respective secondary volume of data storage in said second data storage system; and

said first data storage system includes a controller for detecting an occurrence of a disruption in operation of the data processing system preventing an access to said primary volume, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to said primary volume, checking whether an automatic recovery mode has been preselected for said primary volume, and

when said automatic recovery mode has been preselected for said primary volume, automatically accessing said secondary volume in lieu of said primary volume, and

when said automatic recovery mode has not been preselected for said primary volume, not automatically accessing said secondary volume and instead signaling that intervention is required.

2. The data processing system as claimed in claim 1, wherein the data storage in the first data storage system and the data storage in the second data storage system are configured to define volume pairs, each volume pair including a primary volume in one of the first data storage system and the second data storage system and a corresponding secondary volume in another of the first data storage system and the second data storage system, said volume pairs including primary volumes each having an attribute for selecting or not selecting said automatic recovery mode.

3. The data processing system as claimed in claim 1, wherein said controller has control logic for detecting an occurrence of a disruption in operation of the data processing system preventing an access to said secondary volume, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to said secondary volume, checking whether said automatic recovery mode has been preselected for said secondary volume, and

when said automatic recovery mode has been preselected for said secondary volume, automatically accessing said primary volume in lieu of said secondary volume, and

when said automatic recovery mode has not been preselected for said secondary volume, not automatically accessing said primary volume and instead signaling that intervention is required.

4. The data processing system as claimed in claim 1, wherein the data storage in said first data storage system and in said second data storage system are configured to define volume pairs, each volume pair including a primary volume in one of the first data storage system and the second data storage system and a corresponding secondary volume in another of the first data storage system and the second data storage system, each volume pair having an attribute for selecting or not selecting said automatic recovery mode with respect to the primary volume and the secondary volume in said each volume pair.

5. The data processing system as claimed in claim 1, wherein the controller includes control logic for sending an "intervention required" message to an operating system of a host computer in order to signal that intervention is required.

6. A data storage system comprising:

primary data storage; and

a data storage controller programmed to operate in a remote copy mode in which data is stored in a primary volume of the primary data storage and is transmitted over a data link to remote data storage for storage in a respective secondary volume of the remote data storage;

wherein said data storage controller is further programmed to detect an occurrence of a disruption in operation of the data storage system preventing an access to said primary volume, and upon detecting said occurrence of said disruption in operation of the data storage system preventing said access to said primary volume, to check whether an automatic recovery mode has been preselected for said primary volume, and

when said automatic recovery mode has been preselected for said primary volume, to automatically access said secondary volume in lieu of said primary volume, and

when said automatic recovery mode has not been preselected for said primary volume, to not automatically access said secondary volume and instead to signal that intervention is required.

7. The data storage system of claim 6, wherein said data storage controller is programmed to detect an occurrence of a disruption in operation of the data storage system preventing an access to said secondary volume, and upon detecting said occurrence of said disruption in operation of the data storage system preventing said access to said secondary volume, to check whether said automatic recovery mode has been preselected for said secondary volume, and

when said automatic recovery mode has been preselected for said secondary volume, to automatically access said primary volume in lieu of said secondary volume, and

when said automatic recovery mode has not been preselected for said secondary volume, to not automatically access said primary volume and instead to signal that intervention is required.

8. A program storage device readable by a data storage system, said program storage device encoding a program for execution by the data storage system for controlling operation of the data storage system in a remote copy mode in which data is stored in a primary volume of primary data storage of the data storage system and is transmitted over a data link to remote data storage for storage in a respective secondary volume of the remote data storage;

wherein said program is executable by the data storage system to detect an occurrence of a disruption in operation of the data storage system preventing an access to said primary volume, and upon detecting said occurrence of said disruption in operation of the data storage system preventing said access to said primary volume, to check whether an automatic recovery mode has been preselected for said primary volume, and

when said automatic recovery mode has been preselected for said primary volume, to automatically access said secondary volume in lieu of said primary volume, and

when said automatic recovery mode has not been preselected for said primary volume, to not automatically access said secondary volume and instead to signal that intervention is required.

9. The program storage device as claimed in claim 8, wherein said program is executable by the data storage system to detect an occurrence of a disruption in operation of the data storage system preventing an access to said secondary volume, and upon detecting said occurrence of said disruption in operation of the data storage system preventing said access to said secondary volume, to check whether said automatic recovery mode has been preselected for said secondary volume, and

when said automatic recovery mode has been preselected for said secondary volume, to automatically access said primary volume in lieu of said secondary volume, and

when said automatic recovery mode has not been preselected for said secondary volume, to not automatically access said primary volume and instead to signal that intervention is required.

10. A method of recovering from disruptions in a data processing system, said data processing system having a first data storage system, a second data storage system, and a data link coupled between said first data storage system and said second data storage system for transmission of remote copy data from said first data storage system to said second data storage system;

said method comprising the steps of;

(a) configuring the data storage in said first data storage system and in said second data storage system to define volume pairs each including a primary volume in said first data storage system and a corresponding secondary volume in the second data storage system, said volume pairs including primary volumes each having an attribute for selecting or not selecting an automatic recovery mode;

(b) operating said data processing system in a remote copy mode in which data is stored in the primary volumes of data storage in said first data storage system and is transmitted over said data link and stored in the corresponding secondary volumes of data storage in said second data storage system;

(c) detecting an occurrence of a disruption in operation of the data processing system preventing an access to a primary volume having said attribute selecting said automatic recovery mode, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to the primary volume having said attribute selecting said automatic recovery mode, automatically accessing the secondary volume in the volume pair including the primary volume having said attribute selecting said automatic recovery mode; and

(d) detecting an occurrence of a disruption in operation of the data processing system preventing an access to a primary volume having said attribute not selecting said automatic recovery mode, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to the primary volume having said attribute not selecting said automatic recovery mode, not automatically accessing the secondary volume in the volume pair including the primary volume having said attribute not selecting said automatic recovery mode, and instead signaling that intervention is required.

11. The method as claimed in claim 10, wherein said volume pairs include secondary volumes each having an attribute for selecting or not selecting said automatic recovery mode, and wherein said method further includes the steps of:

(e) detecting an occurrence of a disruption in operation of the data processing system preventing an access to a secondary volume having said attribute selecting said automatic recovery mode, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to the secondary volume having said attribute selecting said automatic recovery mode, automatically accessing the primary volume in the volume pair including the secondary volume having said attribute selecting said automatic recovery mode; and

(f) detecting an occurrence of a disruption in operation of the data processing system preventing an access to a secondary volume having said attribute not selecting said automatic recovery mode, and upon detecting said occurrence of said disruption in operation of the data processing system preventing said access to the secondary volume having said attribute rot selecting said automatic recovery mode, not automatically accessing the primary volume in the volume pair including the secondary volume having said attribute not selecting said automatic recovery mode, and instead signaling that intervention is required.

12. The method as claimed in claim 10, wherein the first data storage system sends an "intervention required" message to an operating system of a host computer in order to signal that intervention is required.

13. A data processing system comprising:

a first data storage system;

a second data storage system; and

a data link coupled between said first data storage system and said second data storage system for transmission of data from said first data storage system to said second data storage system;

wherein said first data storage system is operational in a remote copy mode in which remote copy data is stored in data storage in said first data storage system and is transmitted over said data link and stored in data storage in said second data storage system; and

said first data storage system includes a controller for detecting a failure of said data link preventing the remote copy data from being transmitted to said second data storage system for storage in the data storage in said second data storage system, and upon detecting said failure of said data link preventing the remote copy data from being transmitted to said second data storage system for storage in the data storage in said second data storage system, checking whether an automatic recovery mode has been preselected for use in case of link failure, and

when said automatic recovery mode has been preselected for use in case of link failure, permitting continued access to the remote copy data in the data storage in the first data storage system without intervention, and

when said automatic recovery mode has not been preselected for use in case of link failure, not permitting continued access to the remote copy data in the data storage of the first data storage system without intervention and instead signaling that intervention is required.

14. The data processing system as claimed in claim 13, wherein the controller includes control logic for sending an "intervention required" message to an operating system of a host computer in order to signal that intervention is required.

15. A data storage system comprising:

primary data storage; and

a data storage controller programmed to operate in a remote copy mode in which remote copy data is stored in the primary data storage and is transmitted over a data link to remote data storage;

wherein said data storage controller is further programmed to detect a failure of said data link preventing the remote copy data from being transmitted to said remote data storage, and upon detecting said failure of said data link preventing the remote copy data from being transmitted to said remote data storage, to check whether an automatic recovery mode has been preselected for use in case of link failure, and

when said automatic recovery mode has been preselected for use in case of link failure, to permit continued access to the remote copy data in the primary data storage without intervention, and

when said automatic recovery mode has not been preselected for use in case of link failure, to not permit continued access to the remote copy data in the primary data storage without intervention and instead to signal that intervention is required.

16. A program storage device readable by a data storage system, said program storage device encoding a program for execution by the data storage system for controlling operation in a remote copy mode in which remote copy data is stored in primary data storage of the data storage system and is transmitted over a data link to remote data storage, wherein said program s executable by the data storage system to detect a failure of said data link preventing the remote copy data from being transmitted to said remote data storage, and upon detecting said failure of said data link preventing the remote copy data from being transmitted to said remote data storage, to check whether an automatic recovery mode has been preselected for use in case of link failure, and

when said automatic recovery mode has been preselected for use in case of link failure, to permit continued access to the remote copy data without intervention, and

when said automatic recovery mode has not been preselected for use in case of link failure, to not permit continued access to the remote copy data without intervention and instead to signal that intervention is required.

17. A method of operating a data processing system, said data processing system including a first data storage system, a second data storage system, a data link coupled between said first data storage system and said second data storage system for transmission of remote copy data from said first data storage system to said second data storage system, and a host computer coupled to said first data storage system for access to data storage in said first data storage system;

said method comprising the steps of;

(a) selecting whether or not an automatic recovery mode should be used in case of link failure; and

then

(b) operating said data processing system in a remote copy mode in which remote copy data is stored in the data storage in said first data storage system and is transmitted over said data link and stored in data storage in said second data storage system; and

(c) detecting a failure of said data link preventing data stored in the data storage in said first data storage system from being transmitted to said second data storage system for storage in the data storage in said second data storage system, and upon detecting said failure of said data link preventing remote copy data stored in the data storage in said first data storage system from being transmitted to said second data storage system for storage in the data storage in said second data storage system, checking whether said automatic recovery mode has been preselected for use in case of link failure, and

when said automatic recovery mode has been preselected for use in case of link failure, permitting said host computer to continue to access the remote copy data in the data storage in the first data storage system without intervention, and

when said automatic recovery mode has not been preselected for use in case of link failure, not permitting said host computer to access the remote copy data in the data storage in the first data storage system without intervention and instead signaling that intervention is required.

18. The method as claimed in claim 17, wherein the first data storage system includes means for sending an "intervention required" message to an operating system of said host computer in order to signal that intervention is required.

19. The method as claimed in claim 17, wherein said automatic recovery mode has not been preselected for use in case of link failure, said failure of the data link occurs preventing data stored in the data storage in said first data storage system from being transmitted to said second data storage system for storage in the data storage in said second data storage system, and the host computer is prevented from accessing the remote copy data in the data storage of the first data storage system for read access and write access.