3

For some reason it seems to me that at least one failover should be in the same building. But really I have no idea. Could there be an issue with routing delays for users during a failure? I'm just imagining reasons at this point.

Let me know, should at least one failover node be at the same geographic location as the other?

I am trying to prevent what appears to be a poor decision so any feedback or life experience you can share would be grand.

Will mostly be running Windows Server 2008 with SQL Server 2008 as our guest OS.

Edit: I'm talking about two physical machines, either right next to each other or on opposite ends of the country. One of them will be always in use virtualizing many servers, the other will be a replication of the first and only be used directly in the event that the first one goes offline.

2 Answers 2

3

Well, you really need to answer two questions:

  1. What's your budget?
  2. What is your RPO/RTO?

Yes, ideally you'd have some type of off-site infrastructure for DR, but implementation of that type of system gets complicated and expensive very quickly. If you have the money and corporate will to do this then by all means, do it. You'll likely need a SAN device at both sites, with volume replication running (probably asynchronously) from your protected site to your recovery site. Then you need to think about IP addressing, what DNS changes need to happen on failover, what firewall rules need to be changed, what LUNs need to be re-mapped to the recovery server, how clients will get access, do BGP advertisements need to change, etc.

As you can probably surmise, there are a lot of factors that play into this decision. With the information you've given, there's no way we can give you a "right" answer. You just really need to look at your budget, your uptime requirements, and management's expectations and make your own decision. There are consultants that specialize in exactly this sort of thing - if you're feeling overwhelmed by things, I'd recommend hiring someone to at least get you pointed in the right direction.

6
  • When I say node I mean the hardware machine that is running all of the VM servers. I figure if just a single guest VM goes down we could have another VM to kick in. But if we had the whole hardware go down another hardware would need to kick back in with all of the VMs available. What do you mean by site failure? You don't mean website right, do you mean site as something larger and encapsulates many hardware nodes?
    – MetaGuru
    Feb 24, 2011 at 15:56
  • By "site failure", I mean "geographic site falls off the map". Usually this is caused by extended power outage, backhoe+fiber accidents, fire, flood, etc. You need to decide what you want to protect against and then clarify your question accordingly.
    – EEAA
    Feb 24, 2011 at 16:19
  • With your recent update, I see that you are indeed trying to protect against a (geographic) site failure. As such, the points I raised in my answer are things you need to consider.
    – EEAA
    Feb 24, 2011 at 16:28
  • @ErikA the main thing I am wondering is if having one single hardware machine in one datacent and one single hardware machine in another datacenter as the fail over is a feasible thing at all, regardless of if it is possible, wouldn't it be better for a hardware fall over to be in the next room? I'm mainly looking for any reasoning why it is or isn't OK to do have the only fail over machine in another state.
    – MetaGuru
    Feb 24, 2011 at 18:45
  • @Ryan - as I've said multiple times. Failover infrastructure can be set up in any one of a thousand different ways. How yours needs to be set up is completely dependent on your needs. If all you're trying to do is protect from a single host failure, then yes, keeping the protected and recovery hosts in the same building is just fine. If you're trying to protect from the building getting burned down, though, then you'll need to look at implementing something off-site.
    – EEAA
    Feb 24, 2011 at 20:40
0

How much money do you have and how much do you need the services on these boxes to be functional?

If you must have this service up at all times, then you need to have the two boxes 500+ miles apart and you need to have diverse gig connections between the two to keep them synchronized. And, of course, you have to have appropriate safeties in effect to prevent a master/master scenario (nobody likes 2 captain kirks).

Looking at the various failure scenarios, they're roughly in order:

  1. you botch things and the application goes down.
  2. some component on one of the boxes fails (power supply, disk, power cable, network cable, etc).
  3. some environmental factor affects the room it is in (this can be a fire or a network cable cut, or just a failed AC unit).
  4. some environmental factor affects the city it is in.

Each disaster is less likely than the one before it, and each protection against that disaster is itself both expensive and more likely to cause failure scenario 1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .