Notes from an Upgrade

[Craig A]

Jon

>If your concern is that he is overwriting >his "fallback", yes, that is true, but he >will still have the original in its >unmodified condition.

Agreed. He will still have it but whether it will be usable is another thing. If I have to go back to a tape backup as part of a recovery prcoedure for a piece of work inititated by me, then I would consider that
a failure.

In 1995 I remember a client who had ran a database backup to tape. It was only when they needed to restore it did it reveal that there was a severe crease in tape 8 of 10. Apparently a /VERIFY (which they didn't do) would have flagged the crease.

It took something like a month to get a database expert to rebuild the database to a known safe point.

Now backup technology has moved on considerably since then BUT it does kind of stick in one's memory.

I guess the other thing to mention is that there will be some sites that operate as near to 24 x 7 as possible so some downtime to defrag the system disk might be a useful exercise as part of a system upgrade.

Much of itm, I admit, is down to personal preference and whether one is happy with the [perceived[ level of risk.

Craig

[Volker Halle]

Jon,

assume you do a BACKUP/IMAGE DSAx: mbr2. Then DISM/CLUS DSAx: and MOUNT/SYS DSAx:/SHAD=(mbr1,mbr2). In which direction would you expect (and want) the shadowcopy to go ?

Time for a little experiment with LD devices, maybe ...

Volker.

[Kevin Raven (UK)]

I will detail what we had ....

1 -Disk mounted /Nowrite as source of backup to second disk.
2- Tape backup - production site copy
3- Tape backup sent to DR site and restored to DR cluster

So If for some reason ....
The server crashed ...or both HSZ70 crashed ...or all the power supply and UPS and Generators failed and VMS backup corrupted a Disk mounted /NOWRITE ....
Then restore from tape ...
If tape crunched ...then recall second tape from DR site ....

If whole datacentre in flames ...then we have upgraded server in DR site and current DR system in DR site.
We upgraded DR server and prepared DR server week prior ....

Still would like to know if anyone has ever had a server crash , cause OpenVMS Backup to corrupt a write locked source disk.

[Jon Pinkley]

Volker,

I would expect the DSA to be restored to the state of the DSA at the time it was dismounted. In other words, I would expect the mbr2 to be overwritten. If I wanted to use the backup image target (mbr2) as the master member, then I should dismount the DSA virtual unit and remount with the single member, then add the other members. Even if all I did was dismount the DSA and remount with MOUNT/SYS DSAx:/SHAD=(mbr2), mbr2 will now have the highest generation number, and mbr2 should be used as the master of a shadowset created with a MOUNT/SYS DSAx:/SHAD=(mbr1,mbr2). It the system crashes while the BACKUP/IMAGE DSAx: mbr2 is active, the SCB on mbr2 will not reflect that it was a member of a shadowset, and I believe its generation number will be 0 (17-nov-1858).

I would consider a backup/phy of a shadowset member to be more dangerous than a backup/image, as it the SCB had been copied to the target before the crash, it is very possible that the mount would succeed without a copy operation.

I agree that a test with LD would be the definitive answer.

Jon

Raven,

Given your scenario, I can think of no way that the disk mounted/nowrite would be modified, with the exception of a hardware failure or a bug in kernel mode code (I am not sure what would happen if Dump Off System Disk was active and pointed at mbr2, but that's a stretch. If the unit were write protected at the HSZ level, then the probability of corruption would be about as close to zero as possible.

The biggest problem I have seen with power outages are disks that fail to spin up once they spin down and cool off.

[Craig A]

I've worked at some sites whereby I've been up against the clock in terms of the downtime window permitted to do certain work.

This is even more relevant when there is little contingency time built into a plan.
Sometimes it is simply impossible to argue that more donwtime is needed when the business says "No!".

When the time comes to abort, all I want to do is halt the current activity and reobot the system from an untouched system disk.

I do not want to have to second guess whether that volume is going to be OK or restore from another place (tape or elsewhere).

Craig

[Kevin Raven (UK)]

Craig....

Yes ...I know the situation well.
Thats why all our plans have roll back time built into them and cut off points.

I could tell you some war stories from what I have seen in the past ....lol

Anyone remember HSC backup ?
Got called to a customer site once ...where they had done a HSC backup of a disk.
Backup to Tape ....4 volumes
Volume 1 ....remove mount Volume 2....remove mount Volume 3...remove mount volume 2 again !!!!!!!!
They then restored the disk ....
Mount volume 1 ...restore .....mount volume 2 ....bang ....
When I got to site ....errr what you expecting me to do ?
I have a magic wand ...hold on a moment ....

They had to restore from last good backup ...a year ago...

[Bengt Torin]

Hi,
As a funny thing, I have seen the problem with insufficient disk space in an 8.3 system where I did apply UPDATE patches. As You know You get some questions in the start phase If You want files to be renamed to *.*OLD. I Answered NO to that question but it did do the renaming ! so I run out of disk space. I did not put any more effort in why it was done this way.


Regards