Veritas InfoScale™ 7.4 Replication Administrator's Guide - AIX
- Section I. Getting started with Volume Replicator
- Introducing Volume Replicator
- Understanding how Volume Replicator works
- How VVR uses kernel buffers for replication
- Replication in a shared disk group environment
- Using SmartTier with VVR
- Understanding the VVR snapshot feature
- About VVR compression
- Planning and configuring replication
- Before you begin configuring
- Choosing the mode of volume replication
- Planning the network
- Sizing the SRL
- Understanding replication settings for a Secondary
- Configuring VVR in a VCS environment
- Using the primary-elect feature to choose the primary site after a site disaster or network disruption
- Requirements for configuring VVR in a VCS environment
- Example setting up VVR in a VCS environment
- Configuring the agents for a bunker replication configuration
- Section II. Setting up and administering VVR
- Setting up replication
- Creating a Replicated Data Set
- Creating a Primary RVG of an RDS
- Adding a Secondary to an RDS
- Changing the replication settings for a Secondary
- Synchronizing the Secondary and starting replication
- Starting replication when the data volumes are zero initialized
- Displaying configuration information
- Displaying RVG and RDS information
- Displaying information about data volumes and volume sets
- Displaying information about Secondaries
- Displaying statistics with the vrstat display commands
- Collecting consolidated statistics of the VVR components
- Displaying network performance data
- Administering Volume Replicator
- Administering data volumes
- Associating a volume to a Replicated Data Set
- Associating a volume set to an RDS
- Associating a Data Change Map to a data volume
- Resizing a data volume in a Replicated Data Set
- Administering the SRL
- Incrementally synchronizing the Secondary after SRL overflow
- Administering replication
- Administering the Replicated Data Set
- Administering Storage Checkpoints
- Creating RVG snapshots
- Using the instant snapshot feature
- About instant full snapshots
- Preparing the volumes prior to using the instant snapshot feature
- Creating instant full snapshots
- About instant space-optimized snapshots
- Creating instant space-optimized snapshots
- About instant plex-breakoff snapshots
- Administering snapshots
- Using the traditional snapshot feature
- Using Veritas Volume Manager FastResync
- Verifying the DR readiness of a VVR setup
- Backing up the Secondary
- Administering data volumes
- Using VVR for off-host processing
- Transferring the Primary role
- Migrating the Primary
- About taking over from an original Primary
- Failing back to the original Primary
- Choosing the Primary site after a site disaster or network disruption
- Troubleshooting the primary-elect feature
- Replication using a bunker site
- Introduction to replication using a bunker site
- Setting up replication using a bunker site
- Using a bunker for disaster recovery
- Replication using a bunker site in a VCS environment
- Configuring and administering VVR using System Management Interface Tool
- Accessing Volume Replicator interface in SMIT
- Setting up a simple Volume Replicator configuration using SMIT
- Displaying configuration information using SMIT
- Administering Volume Replicator using SMIT
- Taking instant snapshot of data volumes of an RVG using SMIT
- Associating a volume to a Replicated Data Set using SMIT
- Transferring the Primary role using SMIT
- Troubleshooting VVR
- Recovery from configuration errors
- Errors during an RLINK attach
- Errors during modification of an RVG
- Recovery on the Primary or Secondary
- Recovering from Primary data volume error
- Primary SRL volume error cleanup and restart
- Primary SRL header error cleanup and recovery
- Secondary data volume error cleanup and recovery
- Tuning replication performance
- SRL layout
- Tuning Volume Replicator
- VVR buffer space
- Tuning VVR compression
- VVR buffer space
- Setting up replication
- Section III. Analyzing your environment with Volume Replicator Advisor
- Introducing Volume Replicator Advisor (VRAdvisor)
- Collecting the sample of data
- About collecting the sample of data
- Collecting the sample of data on UNIX
- Collecting the sample of data on Windows
- Analyzing the sample of data
- About analyzing the sample of data
- Analyzing the collected data
- Understanding the results of the analysis
- Viewing the analysis results
- Recalculating the analysis results
- Installing Volume Replicator Advisor (VRAdvisor)
- Section IV. VVR reference
- Appendix A. VVR command reference
- Appendix B. Using the In-band Control Messaging utility vxibc and the IBC programming API
- Using the IBC messaging command-line utility
- Examples - Off-host processing
- In-band Control Messaging API
- Appendix C. Volume Replicator object states
- Appendix D. Alternate methods for synchronizing the Secondary
- Using the full synchronization feature
- Using block-level backup and Storage Checkpoint
- Using difference-based synchronization
- Examples for setting up a simple Volume Replicator configuration
- Appendix E. Migrating VVR from Internet Protocol version 4 to Internet Protocol version 6
- About migrating to IPv6 when VCS global clustering and VVR agents are not configured
- About migrating to IPv6 when VCS global clustering and VVR agents are configured
- About migrating to IPv6 when VCS global clustering and VVR agents are configured in the presence of a bunker
- Migrating to IPv6 when VCS global clustering and VVR agents are configured in the presence of a bunker
- Appendix F. Sample main.cf files
Enabling security certificate
Perform this task only if your plan to configure data encryption over wire.
Set up the security certificates on all the nodes in the /etc/vx/vvr/
directory to establish SSL socket communication between user space utilities (vxrsyncd
and vradmind
). Secure communication between user space utilities is created using certificate-based SSL socket.
Security Certificate location | Description |
---|---|
/etc/vx/vvr/key.pem | Specifies the location of the node's private key. The user space utilities use the private key in a Privacy Enhanced Mail (PEM) format. |
/etc/vx/vvr/cert.pem | Specifies the location of the node's certificate. The user space utilities use the certificate in PEM format. |
/etc/vx/vvr/cacert.pem | Specifies the location of the certificates issued by the associated Certificate Authority (CA) or a chain of Certificate Authorities. The user space utilities use these certificates for mutual authentication in Privacy Enhanced Mail (PEM) format. For more information, see Setting up the certificate authority (CA) certificates in /etc/vx/vvr/cacert.pem. |
Once the security certificates are copied to the mentioned locations, restart the VVR utilities using the following commands for the security certificate to take effect:
/usr/sbin/vxstart_vvr stop
/usr/sbin/vxstart_vvr start
Note:
Veritas recommends that you set up a separate private key and certificate pair on each node and ensure that it is signed by one or more common trusted certificate authorities.
The /etc/vx/vvr/cacert.pem file must include the CA certificate.
In case of self-signed node certificates, the /etc/vx/vvr/cacert.pem
file should include the certificates from each of the signing nodes. In case of a root CA-signed certificate, this file should include the certificate issued by the root CA.
However, there may exist a chain of CAs where one or more intermediate CAs are trusted by the topmost root CA to sign certificates on their behalf. In such cases, you must perform the following steps to set up the certificates under /etc/vx/vvr/cacert.pem
.
- Obtain the certificates from all CAs in the chain of trust up to the topmost root CA.
- Copy the certificates of the complete chain of CAs.
If a node certificate is signed by an intermediate CA (CA3) under a chain of CAs - for example, Root CA > Intermediate CA1 > Intermediate CA2 > Intermediate CA3 - the certificates should be added or appended to the
cacert.pem
file in the following order:1.
Intermediate CA3 certificate
2.
Intermediate CA2 certificate
3.
Intermediate CA1 certificate
4.
Root CA certificate
Note:
Do not add the node certificate to this list, because it is already included in the
/etc/vx/vvr/cert.pem
file. - Ensure that the certificates of all CAs in the chain, including the root CA, are installed and present under the list of trusted CA certificates on each node.
- Validate the certificates and the basic OpenSSL connections with the updated certificate files using the standard OpenSSL commands.
- Verify that the VVR daemon SSL connections are done by using the messages logged in the daemon log files.
VVR daemon
Log file
SSL connection related log messages
vradmind
/var/vx/vras/log/vradmind_log_A
Primary:
Client IpmHandle:: SSL_new state succeeded
Client IpmHandle:: SSL_connect succeeded
Client IpmHandle:: SSL_show Cert. succeeded
Secondary:
Server IpmHandle:: SSL_new state succeeded
Server IpmHandle:: SSL_accept succeeded
Server IpmHandle:: SSL_show Cert. succeeded
vradmind
/var/log/messages
Primary/Secondary:
vradmind: VVR_SSL_SOCK: SSL initialization succeeded.
vxrsyncd
/var/log/messages
Primary/Secondary:
in.vxrsyncd: VVR_SSL_SOCK: SSL initialization succeeded.