InfoScale™ 9.0 Replication Administrator's Guide - AIX
- Section I. Getting started with Volume Replicator
- Introducing Volume Replicator
- Understanding how Volume Replicator works
- How VVR uses kernel buffers for replication
- Replication in a shared disk group environment
- Using SmartTier with VVR
- Understanding the VVR snapshot feature
- About VVR compression
- Planning and configuring replication
- Before you begin configuring
- Choosing the mode of volume replication
- Planning the network
- Sizing the SRL
- Understanding replication settings for a Secondary
- Configuring VVR in a VCS environment
- Using the primary-elect feature to choose the primary site after a site disaster or network disruption
- Requirements for configuring VVR in a VCS environment
- Example setting up VVR in a VCS environment
- Configuring the agents for a bunker replication configuration
- Section II. Setting up and administering VVR
- Setting up replication
- Creating a Replicated Data Set
- Creating a Primary RVG of an RDS
- Adding a Secondary to an RDS
- Changing the replication settings for a Secondary
- Synchronizing the Secondary and starting replication
- Starting replication when the data volumes are zero initialized
- Displaying configuration information
- Displaying RVG and RDS information
- Displaying information about data volumes and volume sets
- Displaying information about Secondaries
- Displaying statistics with the vrstat display commands
- Collecting consolidated statistics of the VVR components
- Displaying network performance data
- Administering Volume Replicator
- Administering data volumes
- Associating a volume to a Replicated Data Set
- Associating a volume set to an RDS
- Associating a Data Change Map to a data volume as a log plex
- Resizing a data volume in a Replicated Data Set
- Administering the SRL
- Incrementally synchronizing the Secondary after SRL overflow
- Administering replication
- Administering the Replicated Data Set
- Administering Storage Checkpoints
- Creating RVG snapshots
- Using the instant snapshot feature
- About instant full snapshots
- Preparing the volumes prior to using the instant snapshot feature
- Creating instant full snapshots
- About instant space-optimized snapshots
- Creating instant space-optimized snapshots
- About instant plex-breakoff snapshots
- Administering snapshots
- Using the traditional snapshot feature
- Using Veritas Volume Manager FastResync
- Verifying the DR readiness of a VVR setup
- Backing up the Secondary
- Administering data volumes
- Using VVR for off-host processing
- Transferring the Primary role
- Migrating the Primary
- About taking over from an original Primary
- Failing back to the original Primary
- Choosing the Primary site after a site disaster or network disruption
- Troubleshooting the primary-elect feature
- Replication using a bunker site
- Introduction to replication using a bunker site
- Setting up replication using a bunker site
- Using a bunker for disaster recovery
- Replication using a bunker site in a VCS environment
- Configuring and administering VVR using System Management Interface Tool
- Accessing Volume Replicator interface in SMIT
- Setting up a simple Volume Replicator configuration using SMIT
- Displaying configuration information using SMIT
- Administering Volume Replicator using SMIT
- Taking instant snapshot of data volumes of an RVG using SMIT
- Associating a volume to a Replicated Data Set using SMIT
- Transferring the Primary role using SMIT
- Troubleshooting VVR
- Recovery from configuration errors
- Errors during an RLINK attach
- Errors during modification of an RVG
- Recovery on the Primary or Secondary
- Recovering from Primary data volume error
- Primary SRL volume error cleanup and restart
- Primary SRL header error cleanup and recovery
- Secondary data volume error cleanup and recovery
- Tuning replication performance
- SRL layout
- Tuning Volume Replicator
- VVR buffer space
- Tuning VVR compression
- VVR buffer space
- Setting up replication
- Section III. Analyzing your environment with Volume Replicator Advisor
- Introducing Volume Replicator Advisor (VRAdvisor)
- Collecting the sample of data
- About collecting the sample of data
- Collecting the sample of data on UNIX
- Collecting the sample of data on Windows
- Analyzing the sample of data
- About analyzing the sample of data
- Analyzing the collected data
- Understanding the results of the analysis
- Viewing the analysis results
- Recalculating the analysis results
- Installing Volume Replicator Advisor (VRAdvisor)
- Section IV. VVR reference
- Appendix A. VVR command reference
- Appendix B. Using the In-band Control Messaging utility vxibc and the IBC programming API
- Using the IBC messaging command-line utility
- Examples - Off-host processing
- In-band Control Messaging API
- Appendix C. Volume Replicator object states
- Appendix D. Alternate methods for synchronizing the Secondary
- Using the full synchronization feature
- Using block-level backup and Storage Checkpoint
- Using difference-based synchronization
- Examples for setting up a simple Volume Replicator configuration
- Appendix E. Migrating VVR from IPv4 to IPv6
- Migrating VVR to support IPv6 or dual stack
- About migrating to IPv6 when VCS global clustering and VVR agents are not configured
- About migrating to IPv6 when VCS global clustering and VVR agents are configured
- About migrating to IPv6 when VCS global clustering and VVR agents are configured in the presence of a bunker
- Migrating to IPv6 when VCS global clustering and VVR agents are configured in the presence of a bunker
- Appendix F. Sample main.cf files
Setting up the certificate authority (CA) certificates in /etc/vx/vvr/cacert.pem
The /etc/vx/vvr/cacert.pem
file must include the CA certificate.
In case of self-signed node certificates, the /etc/vx/vvr/cacert.pem
file should include the certificates from each of the signing nodes. The signing nodes here include all the nodes from the VVR primary and the secondary.
Self-signed certificates
To set up the certificates in a CVR environment
- Create the certificate on each node of the primary and the secondary.
# openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out /etc/vx/vvr/cert.pem -keyout /etc/vx/vvr/key.pem -subj "/C=CZ/ST=Prague/L=Prague/O=ITS/OU=VVR Encryption/CN=`uname -n`"
- Copy the
cert.pem
file on each node of the primary and the secondary cluster nodes ascacert.pem
file at/etc/vx/vvr/cacert.pem
.When you copy the file to each node, add the following lines before (as a header) and after (as a footer) to the contents of the file:
-----BEGIN CERTIFICATE----- -----END CERTIFICATE-----
Root CA certificates
In case of a root CA-signed certificate, the file should include the certificate that is issued by the root CA. However, there may exist a chain of CAs where one or more intermediate CAs are trusted by the topmost root CA to sign certificates on their behalf. In such cases, you must perform the following procedure.
To set up the certificates under /etc/vx/vvr/cacert.pem
- Obtain the certificates from all CAs in the chain of trust up to the topmost root CA.
- Copy the certificates of the complete chain of CAs.
If a node certificate is signed by an intermediate CA (CA3) under a chain of CAs - for example, Root CA > Intermediate CA1 > Intermediate CA2 > Intermediate CA3 - the certificates should be added or appended to the
cacert.pem
file in the following order:1.
Intermediate CA3 certificate
2.
Intermediate CA2 certificate
3.
Intermediate CA1 certificate
4.
Root CA certificate
Note:
Do not add the node certificate to this list, because it is already included in the
/etc/vx/vvr/cert.pem
file. - Ensure that the certificates of all CAs in the chain, including the root CA, are installed and present under the list of trusted CA certificates on each node.
- Validate the certificates and the basic OpenSSL connections with the updated certificate files using the standard OpenSSL commands.
- Verify that the VVR daemon SSL connections are done by using the messages that are logged into the daemon log files.
VVR daemon
Log file
SSL connection-related log messages
vradmind
/var/vx/vras/log/vradmind_log_A
Primary:
Client IpmHandle:: SSL_new state succeeded
Client IpmHandle:: SSL_connect succeeded
Client IpmHandle:: SSL_show Cert. succeeded
Secondary:
Server IpmHandle:: SSL_new state succeeded
Server IpmHandle:: SSL_accept succeeded
Server IpmHandle:: SSL_show Cert. succeeded
vradmind
/var/log/messages
Primary/Secondary:
vradmind: VVR_SSL_SOCK: SSL initialization succeeded.
vxrsyncd
/var/log/messages
Primary/Secondary:
in.vxrsyncd: VVR_SSL_SOCK: SSL initialization succeeded.