Cognitive data backup

A method, system and computer program product for data backup based on a workload behavior includes a first computer identifying, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer. The first computer processes the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload, and compares the list of frequently accessed files to backup policy rules active on the first computer. Based on the comparison, the first computer identifies a mismatch between the list of frequently accessed files and the backup policy rules, and specifies a new backup rule to update the backup policy rules for each identified mismatch between the list of frequently accessed files and the backup policy rules.

BACKGROUND

The present invention generally relates to the field of data storage, and more particularly to a system, method and computer program product for cognitive backup of computer data.

Data is typically stored on computing systems and/or attached storage devices. The data may include operating system data, file system data, and application data. Data may be lost due to system failure or human error. Frequently, a backup copy of data is made to enable a data restore from the backup copy if the primary copy data is lost, corrupted or becomes inconsistent. Typically, the backup utility of current computing systems operates according to a policy-based management system that includes a number of operating rules based on which data is transferred to storage devices during backup operations. However, in some cases, data can be loss during the backup operations due to inaccurate include/exclude lists, finger checks, incorrect or outdated filename lists, or other reasons. This can negatively impact the backup of important and/or frequently accessed files. Thus, there can be a need for data backup operations alternative to those of existing policy-based management systems.

SUMMARY

An embodiment of the present disclosure provides a method for data backup based on a workload behavior, the method includes identifying by a first computer, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer, processing, by the first computer, the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload, comparing, by the first computer, the list of frequently accessed files to backup policy rules active on the first computer, based on the comparison, identifying, by the first computer, a mismatch between the list of frequently accessed files and the backup policy rules, and for each identified mismatch between the list of frequently accessed files and the backup policy rules, specifying, by the first computer, a new backup rule to update the backup policy rules.

Another embodiment of the present disclosure provides a computer program product for data backup based on a workload behavior, based on the method described above.

Another embodiment of the present disclosure provides a computer system for data backup based on a workload behavior, based on the method described above.

DETAILED DESCRIPTION

In information technology (IT), the process of backing up computer data refers to copying, via an executable backup program, data from a first repository to a second repository for a variety of purposes. One purpose for backing up data is to enable data recovery from the second repository in the event of data loss in the first repository. Data loss can occur via data deletion, data corruption, or the destruction of data bearing computer readable storage media as a result of human actions and/or natural disasters. Another purpose for backing up data is to recover previous versions of files, computer programs, operating systems, and the like. In general, the second repository (i.e., a backup system) can include one or more types of computer readable storage media on which backups are stored. For example, magnetic tape, hard disk(s), optical storage device(s), solid-state storage media can be used alone or in any combination as part of a backup system. Additionally, the second repository can be an on-line repository, a near-line repository, or an off-line repository based on various redundancy, security, and/or accessibility requirements.

Typically, executable backup programs run and end with a successful condition code of 0, that indicates the data has been stored in an answer area provided by the calling backup program. However, in some cases, frequently accessed files, for which backup is essential, are not included in the backup process due to inaccurate include/exclude lists, finger checks, incorrect or outdated filename lists, or other reasons. This can be avoided by selecting the data to be backup based on file access statistics obtained from hardware components, operating system and databases, thereby guaranteeing the backup of frequently accessed or important files.

Embodiments of the present invention generally relates to the field of data storage, and more particularly to a system, method and computer program product for cognitive backup of computer data. The following described exemplary embodiments provide a system, method, and computer program product to, among other things, combine data from machine learning tools and policy data to ensure backup of heavily used files is successfully performed. Therefore, the present embodiments have the capacity to improve the technical field of data storage by effectively moving the backup utility of a computer system from a policy-based management system (i.e., all files including *.PROD.*) to a behavior-based management system (i.e., all files accessed by at least 50 transactions per day, or all files with accumulated Input/Output Operations Per Second (IOPS)>x). By doing this, data backup(s) are guaranteed to be performed and not just marked with a complete (or not complete) status due to syntax or other errors.

Referring now toFIG. 1, an exemplary networked computer environment100is depicted, according to an embodiment of the present disclosure. The networked computer environment100may include a client computer102with a processor104and a data storage device106. The networked computer environment100may also include a server computer114with a processor118and a data storage device120and a communication network110. The networked computer environment100may include a plurality of client computers102and server computers114, only one of which is shown. It should be appreciated thatFIG. 1provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements.

The client computer102may communicate with a cognitive backup program112running on server computer114via the communications network110. The communication network110may be a local area network (LAN), a wide area network (WAN), such as the Internet, the public switched telephone network (PSTN), a mobile data network (e.g., wireless Internet provided by a third or fourth generation of mobile phone mobile communication), a private branch exchange (PBX), any combination thereof, or any combination of connections and protocols that will support communications between client computer102and server computer114, in accordance with embodiments of the present disclosure. Communication network110may include wired, wireless or fiber optic connections. As known by those skilled in the art, the networked computer environment100may include additional computing devices, servers or other devices not shown.

As will be discussed with reference toFIG. 4, server computer114and client computer102may include a plurality of internal and external components. Client computer102may be, for example, a mobile device, a telephone (including smartphones), a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing devices capable of accessing a network, including Internet of Things (IoT) devices. An IoT refers to an overall infrastructure (hardware, software, and services) supporting the seamless integration of physical things (e.g., everyday objects) into information networks. In some embodiments, server computer114may be a management server, a web server or any other electronic device capable of receiving and sending data. In other embodiments, server computer114may represent a server computing system utilizing multiple computers as a server system, such as in a cloud computing environment.

Referring now toFIG. 2, an exemplary block diagram200depicting components of a system for cognitive backup of computer data is shown, according to an embodiment of the present disclosure. Specifically, the system components ofFIG. 2provides a way of determining a workload behavior and, based on such behavior, identifying data associated with frequently accessed files by the workload being processed. In this embodiment, the proposed system for cognitive backup of computer data includes a performance data storage subsystem202, a metadata file subsystem204, a file storage subsystem206, an application logging subsystem208, and an IoT device210.

The performance data storage subsystem202collects performance data associated with performance characteristics of block storage device logical volumes (also referred to as “storage volumes”), typically presented over a SAN fabric using Internet Small Computer Systems Interface (iSCSI) or fiber channel(s). The performance data indicates an activity level corresponding to a plurality of applications (hereinafter “applications”) reading and/or writing data to the storage volumes. As may be known by those skilled in the art, performance data can be obtained by measuring, using statistics tools, key performance indicators that provide the necessary information to make management decisions about improvements, adjustments or modifications to current processes and systems.

According to an embodiment, the performance data storage subsystem202acts as a repository for information that is collected about the workload behavior, particularly regarding the workload access to system files. The term “workload” generally refers to an amount of processing that a computer has been given to do at a given time. In some instances, the workload may consist of some amount of applications running in the computer and some number of users connected to and interacting with the computer's applications.

The performance data storage subsystem202can collect statistics about most frequently accessed files by the workload using a database management tool. For example, in some embodiments, the performance data storage subsystem202captures performance data to a first database management tool such as IBM® Spectrum Control™ or IBM® Spectrum Discover™. IBM® Spectrum Control™ and IBM® Spectrum Discover™ are registered trademarks of International Business Machines Corporation, Armonk, N.Y., US.

It should be noted that any workload data collection is done with a user consent via, for example, an opt-in and opt-out feature. As known by those skilled in the art, an opt-in and opt-out feature generally relates to methods by which the user can modify a participating status (i.e., accept or reject the data collection). In some embodiments, the opt-in and opt-out feature can include available software application(s). User(s) can stop the data collection at any time. In some embodiments, user(s) can be notified each time data is being collected. The collected data is envisioned to be secured and not shared with anyone without consent.

The metadata file subsystem204creates timestamps for each (frequently accessed) file identified by the performance data storage subsystem202. According to an embodiment, the metadata file subsystem204has, in each server instance, a file system storage (not shown) for application data. A time at which a file was last modified can be stored as a timestamp of the file. The file system storage can store a file creation time, a time the file was last accessed, a time file metadata was changed, or a time the file was last backed up. Collecting this data allows for it to be compared to or cross checked against the current backup policy rules. Stated differently, the metadata file subsystem204creates timestamps identifying last accessed, last read, and/or last changed file(s).

The file storage subsystem206collects data associated with performance characteristics of (file) storage volumes typically presented over a network (e.g., communication network110inFIG. 1) using Network File System (NFS) or Server Message Block (SMB) protocols. According to an embodiment, the file storage subsystem206captures timestamped data to a second database management tool such as, for example, Arxscan®.

The application logging subsystem208provides a transaction log including a file containing a record of communications (i.e., transactions) between a system and its users. In some embodiments, the application logging subsystem208may include a data collection functionality that automatically captures a type, content, or time of transactions made by a user from a terminal with that system. In an exemplary embodiment, the application logging subsystem208captures data locally to a database log file such as the database log file of the IoT device210. The captured data may include event logs or syslog collection associated with user's activity on the IoT device210.

Referring now toFIGS. 3A-3B, a flowchart300illustrating a method for cognitive backup of computer data is shown, according to an embodiment of the present disclosure. The process starts at step302where frequently accessed files are identified based on a workload behavior. Specifically, at step302, automated health check procedures can be executed by the cognitive backup system ofFIG. 2to determine, based on the workload behavior, data associated with frequently accessed (or important) files to be included in behavior-based backup operations. The data associated with frequently accessed files is processed at step303to determine relevant insights on the workload behavior, as described above with reference toFIG. 2.

Once frequently accessed files by the workload are identified, machine learning programs can be used to determine (active) backup policy rules fed by manual or automatic tasks (e.g., brokerage/orchestration), iNode and data blocks information. Based on the identified frequently accessed files and the determined backup policy rules, iNode and data blocks information, a list of files to be considered for the behavior-based backup rules is generated at step304. The list is based on usage and data access statistics obtained from the machine learning programs. The usage and data access statistics may include, for example, a high rate of Input/Output operations per second (IOPS).

Thus, based on usage and data access statistics obtained from multiple sources of data access information, including both machine level data and policy data, a workload behavior can be determined and used to classify the identified data files. The identified frequently accessed files based on workload behavior provides a basis for determining and delivering necessary storage resources for data protection and preservation. Additionally, by analyzing the workload behavior, data access information, and current policy rules using machine learning tools, handling of active data protection can be performed automatically.

In an embodiment, a one-hot encoding can be used to obtain the vectors needed for the machine learning programs (regardless of the type of machine learning programs chosen). The one-hot encoding may rely on rules such as, for example, IOPS>20 in a 24 hours period to identify the files to be considered for behavior-based backup rules.

Additionally, a date created/date accessed can be used as a variable depending on the development, testing, acceptance, and production cycle as criteria for relevance. For example, where date >366 days or access >8 days. Any of the above rules may result in a 0/1 encode for the variable or vector required for the machine learning programs.

In another embodiment, more complex systems can be developed based on integer rather than one-hot encoding. For example, an application can be denoted via an integer-based analysis (e.g., Bob's application=1, Gavin's application=2) and then the machine learning algorithm may then be policy-based as it is derived via the application and not from rule sets.

In yet another embodiment, pattern recognition can be implemented as part of the machine learning techniques for datasets which are regularly modified. For example, a batch process that happens once a month can be a pattern that is identified through machine learning that influences the backup method.

At step306, the generated file list is compared to the policy rules currently active in the system to find mismatches or discrepancies between the generated file list and the determined current policy rules. The terms “mismatch” and “discrepancy” generally refer to one or more differences between current backup policy rules and the generated file list including frequently accessed files by the workload. The term “gap” may also be used to refer to the difference(s) between the current backup policy rules and the generated file list including frequently accessed files by the workload. By finding or uncovering such discrepancies between the current backup policy rules and the generated file list, new policy rules based on the workload behavior can be generated to avoid data loss, particularly, the loss of data associated with frequently accessed files by the workload.

At step308, in response to not identifying any mismatch between active backup policy rules and the generated file list, the process ends.

In response to identifying at least one mismatch between the active backup policy rules and the generated file list at step308, the process continues at step310where for each identified mismatch or gap, at least one new behavior-based policy rule is defined and recommended for implementation. It should be noted that the learning capabilities of the proposed system may have an influence on the newly defined behavior-based policy rules. Further, at step310, an alert is generated and sent to a system administrator to inform about the new behavior-based policy rule. In an embodiment, the alert received by the system administrator includes details regarding compliance issues. In some embodiments, the alert can be received via existing collaboration channels such as, for example, text messaging services, Slack®, and the like.

According to an embodiment, the alert message prompts the system administrator to review the proposed behavior-based policy rule(s). At step312, the behavior-based policy rule(s) are reviewed by the system administrator and a decision is made at step314regarding accepting or rejecting the proposed behavior-based policy rules. Based on the behavior-based policy rule not being accepted by the system administrator, the process returns to step302.

At step316, in response to the system administrator accepting the proposed behavior-based policy rule(s), active or current policy rules (i.e., policy-based management system rules) are updated and replaced by the proposed behavior-based policy rules. According to an embodiment, the active policy rules are logged with (detailed) comments regarding the transaction for audit purposes. Additionally, exceptions to the proposed behavior-based policy rules can be logged with a justification from the system administrator. After updating the active policy rule(s), a message is sent to notify the system administrator of the changes that have been performed. In some cases, the message may contain information regarding failures in the implementation of the proposed behavior-based policy rules, if applicable. At this point, the process may return to step302where a new health check cycle starts.

The proposed method and associated system for cognitive data backup combines cognitive data management with current machine learning techniques to determine active data in the environment and automates the data retention with a backup/archive functionality. Metadata from block storage management tools (i.e., IOPS), file storage (i.e., access metadata), application logs (i.e., database logging), and operating file system data can be captured to a central repository. Then, data analytics is used to determine the dataset to be retained and inform a machine learning automaton to act according to that information by pulling a copy of the data with a backup/archive functionality. The behavior-based policies can be utilized throughout the computation space and can be storage-independent (e.g., source can be a container, IoT device, etc.).

Thus, according to an embodiment, the proposed method and associated system utilize a cognitive behavior-based data management approach to backup and archiving data. Multiple points of access information are used to determine data behavior (block storage access, file system access, application log access, etc.). The behavior of the data provides the basis for classifying it and delivering the necessary storage resources, as well as determining appropriate services for data protection and preservation (backup/archive). Machine learning tools are used in the proposed embodiments to analyze the multiple data access sources and take the required action, hence automating the handling of active data protection. In some embodiments, the proposed system can also utilize policy-based rules as well as becoming a secondary control mechanism to avoid any misses during data backup.

For instance, DEV files are frequently converted into a PROD file without updating the manual policy definition of the file. Thus, data is automatically backed up based on access/utilization rather than policy. By doing this, potential process misses, or human error(s) can be avoided.

Therefore, embodiments of the present disclosure provide a method, computer system, and computer program product to backup data files identified as important by the nature of usage behavior. As such, traditional backup processes can be enhanced with a secondary control to avoid backup retention being missed, thereby reducing data loss and improving backup success rates which may help achieving contractual Service Level Agreements (SLA) with customers.

Referring now toFIG. 4, a block diagram of components of client computer102and server computer114of networked computer environment100ofFIG. 1is shown, according to an embodiment of the present disclosure. It should be appreciated thatFIG. 4provides only an illustration of one implementation and does not imply any limitations regarding the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

Client computer102and server computer114may include one or more processors402, one or more computer-readable RAMs404, one or more computer-readable ROMs406, one or more computer readable storage media408, device drivers412, read/write drive or interface414, network adapter or interface416, all interconnected over a communications fabric418. Communications fabric418may be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system.

One or more operating systems410, and one or more application programs411are stored on one or more of the computer readable storage media408for execution by one or more of the processors402via one or more of the respective RAMs404(which typically include cache memory). In the illustrated embodiment, each of the computer readable storage media408may be a magnetic disk storage device of an internal hard drive, CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk, a semiconductor storage device such as RAM, ROM, EPROM, flash memory or any other computer-readable tangible storage device that can store a computer program and digital information.

Client computer102and server computer114may also include a R/W drive or interface414to read from and write to one or more portable computer readable storage media426. Application programs411on client computer102and server computer114may be stored on one or more of the portable computer readable storage media426, read via the respective R/W drive or interface414and loaded into the respective computer readable storage media408.

Client computer102and server computer114may also include a network adapter or interface416, such as a TCP/IP adapter card or wireless communication adapter (such as a 4G wireless communication adapter using OFDMA technology) for connection to a network428. Application programs411on client computer102and server computer114may be downloaded to the computing device from an external computer or external storage device via a network (for example, the Internet, a local area network or other wide area network or wireless network) and network adapter or interface416. From the network adapter or interface416, the programs may be loaded onto computer readable storage media408. The network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers.

Client computer102and server computer114may also include a display screen420, a keyboard or keypad422, and a computer mouse or touchpad424. Device drivers412interface to display screen420for imaging, to keyboard or keypad422, to computer mouse or touchpad424, and/or to display screen420for pressure sensing of alphanumeric character entry and user selections. The device drivers412, R/W drive or interface414and network adapter or interface416may include hardware and software (stored on computer readable storage media408and/or ROM406).

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

While steps of the disclosed method and components of the disclosed systems and environments have been sequentially or serially identified using numbers and letters, such numbering or lettering is not an indication that such steps must be performed in the order recited, and is merely provided to facilitate clear referencing of the method's steps. Furthermore, steps of the method may be performed in parallel to perform their described functionality.