Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Just wanted to share my stats, on compression and encryption. I am using NetBackups kms (not mseo) application managed tape encryption. I have one full tape that is encrypted. All the other full's are NOT encrypted. I seem to be getting about the same in the amount of data on the tapes. Less than D0 but more the D00022 - it all depends on the data. So to me it appears that as the tape drive is doing both the compression and the encryption it is working well. I am using LTO4's in an IBM TS3310 library. With NetBackup 6.5.5 that allows 2 encrypted volume pools. I also have not noticed any change in my backup times ( but this is my smaller site) and no overhead on the media server. Media IDRetention PeriodImages Valid Images Kilobytes Status D0 2 weeks 350 350 1906511824 Full MPX D1 2 weeks 338 338 1844456169 Full MPX D8 2 weeks 432 432 1896950470 Full MPX encrypted D00018 2 weeks 343 343 1935539291 Full MPX D00022 6 months225 225 1549978248 Full MPX D00032 2 weeks 366 366 1973503009 Full MPX D00034 2 weeks 403 403 1711366221 Full MPX D00037 2 weeks 344 344 1937260418 Full MPX -Original Message- From: Judy Hinchcliffe Sent: Tuesday, March 02, 2010 10:42 AM To: 'Shekel Tal'; jpis...@lucidpixels.com Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Again, that is why I went with KMS, (kms is NOT MESO) it is application managed encryption that tells the tape drive to do the encryption NOT the media server, kms just has the keys on the master server and NB talks to the tape drive with the keys. Again so the tape drive does the encryption with no over head on the media server. I have not seen an any impact on my master or media server when I started using KMS. -Original Message- From: Shekel Tal [mailto:tal.she...@uk.fujitsu.com] Sent: Tuesday, March 02, 2010 9:26 AM To: Judy Hinchcliffe; jpis...@lucidpixels.com Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption From the research I have done on the CPU requirements: It takes roughly 73 clock cycles on a Windows or Linux server or about 87 clock cycles on UNIX server to perform MSEO compression/encryption per BYTE of data backed up. Backing up 100 MB/sec of data through a Solaris media server requires 8.7 GHz of CPU processing for MSEO alone, plus whatever processing is needed for other tasks. To move 200 MB/sec through the media server would require 17.4 GHz of CPU for MSEO. So it's a very cpu intensive process. You would probably require a large multicore process system depending on your throughput requirements Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 15:20 To: jpis...@lucidpixels.com; Shekel Tal Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Thanks why I went for kms (tape drive encryption) no overhead on the media server or the clients -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: Tuesday, March 02, 2010 8:57 AM To: Shekel Tal Cc: Judy Hinchcliffe; kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Hi, I have read others' reviews on MSEO-- from what I understand it will peg the CPU and reduce throughput dramatically to high-speed drives. Has anyone not seen that? Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Tal, I can only speak of the IBM LTO4 tape drives, I assume the others are the same. IBM says that each block of data to be written to the tape is compressed or not then encrypted. They do not compress blocks that would grow if compressed. Regards len -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 8:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
On Tue, 2 Mar 2010, Shekel Tal wrote: I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Yes. LTO-4 TAPE = 800GB IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Well that looks pretty good Not sure if you are comfortable sharing info like this but what kind of data does that represent? Normal User File data? Database data? Media Files? -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: 02 March 2010 14:49 To: Shekel Tal Cc: Kevin C; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Tue, 2 Mar 2010, Shekel Tal wrote: I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Yes. LTO-4 TAPE = 800GB IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Sorry, I just noticed now the one data set is encrypted and the other is not. Quite a noticeable difference -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: 02 March 2010 14:49 To: Shekel Tal Cc: Kevin C; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Tue, 2 Mar 2010, Shekel Tal wrote: I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Yes. LTO-4 TAPE = 800GB IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Hi, A mixture of DB/FS data. Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Well that looks pretty good Not sure if you are comfortable sharing info like this but what kind of data does that represent? Normal User File data? Database data? Media Files? -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: 02 March 2010 14:49 To: Shekel Tal Cc: Kevin C; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Tue, 2 Mar 2010, Shekel Tal wrote: I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Yes. LTO-4 TAPE = 800GB IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Hi, I have read others' reviews on MSEO-- from what I understand it will peg the CPU and reduce throughput dramatically to high-speed drives. Has anyone not seen that? Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Thanks Len Did you see Justin's stats? They seem to show quite a difference between using encryption and not while using IBM LTO4 Regards, Tal IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Len Boyle Sent: 02 March 2010 13:53 To: Shekel Tal; Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption Tal, I can only speak of the IBM LTO4 tape drives, I assume the others are the same. IBM says that each block of data to be written to the tape is compressed or not then encrypted. They do not compress blocks that would grow if compressed. Regards len -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 8:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Thanks for the info Justin Definitely would like to test in our environment and compare . . . very interesting -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: 02 March 2010 14:56 To: Shekel Tal Cc: Kevin C; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Hi, A mixture of DB/FS data. Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Well that looks pretty good Not sure if you are comfortable sharing info like this but what kind of data does that represent? Normal User File data? Database data? Media Files? -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: 02 March 2010 14:49 To: Shekel Tal Cc: Kevin C; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Tue, 2 Mar 2010, Shekel Tal wrote: I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Yes. LTO-4 TAPE = 800GB IBM LTO-4 ENCRYPTED (RATIO = ~1.5:1) ABCD25 3 67 02/17/2010 20:00 02/23/2010 00:00 hcart 1188618163 0 MPX 03/26/2010 00:00N/A FULL ENCRYPTION ABCD36 3101 02/18/2010 00:12 03/02/2010 00:00 hcart 1239789810 0 MPX 04/02/2010 00:00N/A FULL ENCRYPTION IBM LTO-4 NO ENCRYPTION (RATIO = ~3.1:1) ABCD49 2 1144 02/23/2010 02:43 02/26/2010 01:32 hcart 2451541654 0 MPX 03/19/2010 02:49N/A FULL ABCD50 2 1350 02/26/2010 01:32 03/01/2010 01:05 hcart 2377975447 0 MPX 03/22/2010 02:05N/A FULL ABCD51 2 1275 02/24/2010 20:01 02/27/2010 10:40 hcart 2575741349 0 MPX 03/20/2010 11:40N/A FULL Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Thanks why I went for kms (tape drive encryption) no overhead on the media server or the clients -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: Tuesday, March 02, 2010 8:57 AM To: Shekel Tal Cc: Judy Hinchcliffe; kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Hi, I have read others' reviews on MSEO-- from what I understand it will peg the CPU and reduce throughput dramatically to high-speed drives. Has anyone not seen that? Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
From the research I have done on the CPU requirements: It takes roughly 73 clock cycles on a Windows or Linux server or about 87 clock cycles on UNIX server to perform MSEO compression/encryption per BYTE of data backed up. Backing up 100 MB/sec of data through a Solaris media server requires 8.7 GHz of CPU processing for MSEO alone, plus whatever processing is needed for other tasks. To move 200 MB/sec through the media server would require 17.4 GHz of CPU for MSEO. So it's a very cpu intensive process. You would probably require a large multicore process system depending on your throughput requirements Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 15:20 To: jpis...@lucidpixels.com; Shekel Tal Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Thanks why I went for kms (tape drive encryption) no overhead on the media server or the clients -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: Tuesday, March 02, 2010 8:57 AM To: Shekel Tal Cc: Judy Hinchcliffe; kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Hi, I have read others' reviews on MSEO-- from what I understand it will peg the CPU and reduce throughput dramatically to high-speed drives. Has anyone not seen that? Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
Again, that is why I went with KMS, (kms is NOT MESO) it is application managed encryption that tells the tape drive to do the encryption NOT the media server, kms just has the keys on the master server and NB talks to the tape drive with the keys. Again so the tape drive does the encryption with no over head on the media server. I have not seen an any impact on my master or media server when I started using KMS. -Original Message- From: Shekel Tal [mailto:tal.she...@uk.fujitsu.com] Sent: Tuesday, March 02, 2010 9:26 AM To: Judy Hinchcliffe; jpis...@lucidpixels.com Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption From the research I have done on the CPU requirements: It takes roughly 73 clock cycles on a Windows or Linux server or about 87 clock cycles on UNIX server to perform MSEO compression/encryption per BYTE of data backed up. Backing up 100 MB/sec of data through a Solaris media server requires 8.7 GHz of CPU processing for MSEO alone, plus whatever processing is needed for other tasks. To move 200 MB/sec through the media server would require 17.4 GHz of CPU for MSEO. So it's a very cpu intensive process. You would probably require a large multicore process system depending on your throughput requirements Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 15:20 To: jpis...@lucidpixels.com; Shekel Tal Cc: kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Thanks why I went for kms (tape drive encryption) no overhead on the media server or the clients -Original Message- From: Justin Piszcz [mailto:jpis...@lucidpixels.com] Sent: Tuesday, March 02, 2010 8:57 AM To: Shekel Tal Cc: Judy Hinchcliffe; kc.on.the@gmail.com; veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption Hi, I have read others' reviews on MSEO-- from what I understand it will peg the CPU and reduce throughput dramatically to high-speed drives. Has anyone not seen that? Justin. On Tue, 2 Mar 2010, Shekel Tal wrote: Okay, thanks for the information. I have also been looking at NetBackup Media Server Encryption. It looks quite neat, compresses before encryption and has very nice key management which is a big tick in the box for me. The only caveat is that is software based and has fairly heavy host CPU requirement. Regards, Tal -Original Message- From: judy_hinchcli...@administaff.com [mailto:judy_hinchcli...@administaff.com] Sent: 02 March 2010 14:42 To: Shekel Tal; jpis...@lucidpixels.com; kc.on.the@gmail.com Cc: veritas-bu@mailman.eng.auburn.edu Subject: RE: [Veritas-bu] Sun/StorageTek based LTO4 encryption I am now using kms, and because the tape drive does the compression and the tape drive does the encryption, I have not noticed any loss in compression yet ( only have had it running for about 1 week) that was something I was also concerned about. You have to compress before you encrypt, and as far as I could find out the tape drive knows that. -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Shekel Tal Sent: Tuesday, March 02, 2010 7:39 AM To: Justin Piszcz; Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption I have also been looking at this as an option. One of the considerations is the effect encryption has on compression. I have heard you loose the ability to compress effectively when using compression. Have you noticed an effect on your tape drive compression when using tape drive based encryption? Regards, Tal -Original Message- From: veritas-bu-boun...@mailman.eng.auburn.edu [mailto:veritas-bu-boun...@mailman.eng.auburn.edu] On Behalf Of Justin Piszcz Sent: 01 March 2010 21:26 To: Kevin C Cc: veritas-bu@mailman.eng.auburn.edu Subject: Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
On Mar 2, 2010, at 10:26, Shekel Tal wrote: It takes roughly 73 clock cycles on a Windows or Linux server or about 87 clock cycles on UNIX server to perform MSEO compression/encryption per BYTE of data backed up. Backing up 100 MB/sec of data through a Solaris media server requires 8.7 GHz of CPU processing for MSEO alone, plus whatever processing is needed for other tasks. To move 200 MB/sec through the media server would require 17.4 GHz of CPU for MSEO. The smallest SPARC server that Sun/Oracle sells is the T5120. Those have built-in encryption right on the CPU die, which I would hope Symantec would take advantage of it by linking against libpkcs11.so. Benchmarks have a single UltraSPARC-T2 doing 38.9 Gbit/s of AES-128: http://blogs.sun.com/bmseer/entry/ultra_fast_cryptography_on_the Of course Fujitsu sells M3000, with SPARC64 processors, but they don't have crypto AFAIK. So it's a very cpu intensive process. You would probably require a large multicore process system depending on your throughput requirements It's kind of hard to find a server that is /not/ multi-core nowadays. :) ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
[Veritas-bu] Sun/StorageTek based LTO4 encryption
Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
Re: [Veritas-bu] Sun/StorageTek based LTO4 encryption
On Mon, 1 Mar 2010, Kevin C wrote: Sorry if this topic is been discussed before. Looking for members who have implemented LTO4 based encryption on Sun/StorageTek/Oracle platforms, any useful comments/journeys/guidance. We are on HP LTO4 drives with SL500/SL3000 libraries. From what I understand, this pretty much limits us to the StorageTek Crypto Key Management System w/ KMA appliances at each library site. The other option, today, is NetBackup's KMS software. Thank you. I have using the IBM LTO-4 drives with STK libraries, works great, as long the firmware is version 7BG2, I have seen the drive reset itself if the firmware is any other version (more recent ones). Also using NBU KMS. It works good, note you can only have 2 volume pools that use encryption. Justin. ___ Veritas-bu maillist - Veritas-bu@mailman.eng.auburn.edu http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu
