Setting The Fence Level; Transferring Sense Information Between Sites - HP xp12000 User Manual

Data. When S-VOL Data is selected, the P-VOL is fenced if an update copy operation fails. This P-VOL
fence level setting ensures that the S-VOL remains identical to the P-VOL after the Continuous Access XP
volume pair is synchronized, but makes the P-VOL inaccessible for updates whenever Continuous Access
XP remote copy operations fail. This setting should be considered for the most critical volumes for disaster
recovery. This setting reduces the amount of time required to analyze the currency of the S-VOL during
disaster recovery efforts. This setting is also designed for applications that can continue operating with
another device pair.
Status. When S-VOL Status is selected, the P-VOL is fenced only if the MCU cannot change the S-VOL pair
status to PSUE. If the MCU successfully changes the S-VOL pair status to PSUE, subsequent write I/O
operations to the P-VOL are accepted, and the MCU tracks updates to the P-VOL. This allows the volume
pair to be resumed quickly using the pairresync operation (out-of-sync-cylinders only). This setting also
reduces the amount of time required to analyze the S-VOL currency during disaster recovery.
Never. When Never is selected, the P-VOL is never fenced when the pair is suspended. This P-VOL
fence-level setting ensures that the P-VOL remains available to applications for updates, even if all
Continuous Access XP copy operations failed. The S-VOL might no longer be in sync with the P-VOL, but the
MCU tracks updates to the P-VOL while the pair is suspended. Host failover capability is essential if this
fence-level setting is used. For disaster recovery, the currency of the S-VOL is determined using sense
information transferred via host failover or comparing the S-VOL contents with other files confirmed to be
current.

Setting the fence level

When a take-over by the S-VOL occurs as shown in
remains in the rollback process at the secondary host, and full recovery cannot be performed. To avoid this
situation, define the fence level of the Redo log file as Data, so the P-VOL returns an error if a data
disagreement concerning a write request issued from the host is expected to occur. The Data fence-level
setting maintains full consistency between the Redo log file and data file because no data is written to the
data file due to the write error at the log file. However, when the fence level is defined as Data, a write I/O
causes an error even when processing is suspended due to an error at the S-VOL. In this case, a take-over
by the S-VOL occurs, and the significance of the duplex system is lost. Therefore, if you define the fence
level as Data, applications must be able to handle write I/O errors. Systems allowing disk errors by means
of multiplication can function with the Data fence-level setting. For example, Oracle multiplies the Redo log
file by itself (default = three times).
Figure 56 Relationship between log file and data file in PAIR status
Because most UNIX file systems (excluding JFS and VxFS) have no journal files, the P-VOL fence level should
be defined as Never. When a take-over by the S-VOL occurs, fsck is executed on the volume and the file
system is cleaned up, even if the S-VOL is undefined at the secondary host. Data lost depends on how
much differential data is contained in the P-VOL when the S-VOL is suspended. During operation, error
recovery should be performed when the suspended status (PSUE) is detected (when one error occurs).

Transferring sense information between sites

When the MCU (or RCU for Continuous Access XP Async) suspends a Continuous Access XP pair due to
an error condition, the MCU/RCU sends sense information with unit check status to the appropriate hosts.
This sense information is used during disaster recovery to determine currency of the S-VOL, and must be
transferred to the remote site via the host failover software.
110 Continuous Access XP for the XP12000/XP10000
Figure 56 (two errors have already occurred), Data(V)