Method and system for verifying files for garbage collection

According to one embodiment, fingerprints of segment trees are scanned, each segment tree representing one of the files in a filesystem namespace. For each of the fingerprints representing a segment, setting a corresponding bit in a live reference vector (LRV) to indicate that the segment has been referenced by a file in the filesystem namespace. A file index mapping fingerprints to storage locations of segments is scanned, including, for each fingerprint found in the file index, setting a corresponding bit in a live index vector (LIV) to indicate that the fingerprint exists in the file index. The LR vector and the LI vector are compared to determine whether there is any mismatch. A garbage collection operation is performed in response to determining that the LR vector and the LI vector are matched.

FIELD OF THE INVENTION

Embodiments of the present invention relate generally to deduplicated data storage systems. More particularly, embodiments of the invention relate to verifying files for garbage collection.

BACKGROUND

In a deduplicated storage system, files are stored in a form of deduplicated segments. Segments are stored inside containers, segment references are stored inside the metadata segments and index stores the mapping from fingerprints to container identifiers (IDs) identifying the containers. A segment is called a live segment and a segment reference is called a live reference if they can be reached from the file system's directory name space. The two conditions must hold: 1) the file system maintains a one to one mapping between the (segment, container) pair and the index; and 2) by virtue of the definition of live reference, the segment should exist if there is a live reference to that segment, otherwise there is data loss.

Inconsistency between the index, segments, and their references can occur in the file system due to hardware or software bugs. The file system automatically performs logical file verification whenever a file is closed after write operations. It traverses the metadata (e.g., segment tree) in a depth first manner to verify the above conditions. In addition to the logical file verification procedure, the file system also periodically computes the entire index checksum and compare against the segment checksum. The file system also computes the checksum of all the live references at each segment tree and then it compares against the checksum of all the segments referenced in the next segment tree level (e.g., child level). However, the file system does not have enough memory to include the actual data segments in this procedure.

There are also other means to catch data corruption, e.g. replication, locality repair, or direct user access. These are not 100% reliable mechanisms as they might not even be enabled at all and we cannot rely on them. Logical file verification traverses the segment tree of a file and verifies the consistency in a file by file basis. This segment tree depth first approach can result in very slow random disk input and output (TO). Furthermore, duplication can cause file verification to walk the same segments over and over again. Because of these issues, the current file verification can lag behind by weeks or even months.

To verify the second condition above, it is possible to enumerate all the live segment references and the segments but they might not all fit into available memory. This document describes an in-memory only solution that can fulfill requirement #2 with high probability.

DETAILED DESCRIPTION

According to some embodiments, instead of comparing the live reference against the segments, the index is utilized. It is much faster to read from the index than reading from the segment containers. There should be a one to one mapping between the (segment, container) pair and the index. A bloom filter (referred to as a live reference bloom filter) is created to track all the live references and another bloom filter (referred to as a live index bloom filter) is created to track the live fingerprints in the index. The live reference bloom filter is also called the live vector and the live index bloom filter is also called the live index vector. They will be sized equally for fast comparison and use same hash functions. Accordingly, they will have the same bits if the live references and the live fingerprints in the index are the same. The error rate of a bloom filter is determined by the number of bits used to represent each sample data, e.g. if there are 6 bits for each sample and 4 hash functions are used, the error rate (false positive rate) of the bloom filter is about 7%. If there is not enough memory to track the entire sample set and keep the error rate below some desirable threshold at the same time, the only alternative is to verify only a subset of the fingerprints called the sample set. Anything not in the sample set will be discarded. Once the sample set is determined, the live segment references are read in a breadth first manner, starting from the top level of a segment tree. All the live references are inserted into the live vector. Then the index is read in a sequential manner. If the index is also found in the live reference, it will be inserted into the live index bloom filter.

According to one embodiment, fingerprints of segment trees are scanned, each segment tree representing one of the files in a filesystem namespace. For each of the fingerprints representing a segment, setting a corresponding bit in a live reference vector (LRV) to indicate that the segment has been referenced by a file in the filesystem namespace. A file index mapping fingerprints to storage locations of segments is scanned, including, for each fingerprint found in the file index, setting a corresponding bit in a live index vector (LIV) to indicate that the fingerprint exists in the file index. The LR vector and the LI vector are compared to determine whether there is any mismatch. A garbage collection operation is performed in response to determining that the LR vector and the LI vector are matched.

FIG. 1is a block diagram illustrating a storage system according to one embodiment of the invention. Referring toFIG. 1, system100includes, but is not limited to, one or more client systems101-102communicatively coupled to storage system104over network103. Clients101-102may be any type of clients such as a host or server, a personal computer (e.g., desktops, laptops, and tablets), a “thin” client, a personal digital assistant (PDA), a Web enabled appliance, or a mobile phone (e.g., Smartphone), etc. Alternatively, any of clients101-102may be a primary storage system (e.g., local data center) that provides storage to other local clients, which may periodically back up the content stored therein to a backup storage system (e.g., a disaster recovery site or system), such as storage system104. Network103may be any type of networks such as a local area network (LAN), a wide area network (WAN) such as the Internet, a fiber network, a storage network, or a combination thereof, wired or wireless.

Storage system104may include or represent any type of servers or a cluster of one or more servers (e.g., cloud servers). For example, storage system104may be a storage server used for various different purposes, such as to provide multiple users or client systems with access to shared data and/or to back up (or restore) data (e.g., mission critical data). Storage system104may provide storage services to clients or users via a variety of access interfaces and/or protocols such as file-based access protocols and block-based access protocols. The file-based access protocols may include the network file system (NFS) protocol, common Internet file system (CIFS) protocol, and direct access file system protocol, etc. The block-based access protocols may include the small computer system interface (SCSI) protocols, Internet SCSI or iSCSI, and Fibre channel (FC) protocol, etc. Storage system104may further provide storage services via an object-based protocol and Hadoop distributed file system (HDFS) protocol.

In one embodiment, storage system104includes, but is not limited to, storage service engine106(also referred to as service logic, service module, or service unit, which may be implemented in software, hardware, or a combination thereof), optional deduplication logic107, and one or more storage units or devices108-109communicatively coupled to each other. Storage service engine106may represent any storage service related components configured or adapted to provide storage services (e.g., storage as a service) to a variety of clients using any of the access protocols set forth above. For example, storage service engine106may include backup logic and restore logic (not shown). The backup logic is configured to receive and back up data from a client (e.g., clients101-102) and to store the backup data in any one or more of storage units108-109. The restore logic is configured to retrieve and restore backup data from any one or more of storage units108-109back to a client (e.g., clients101-102).

Storage units108-109may be implemented locally (e.g., single node operating environment) or remotely (e.g., multi-node operating environment) via interconnect120, which may be a bus and/or a network (e.g., a storage network or a network similar to network103). Storage units108-109may include a single storage device such as a hard disk, a tape drive, a semiconductor memory, multiple storage devices such as a redundant array system (e.g., a redundant array of independent disks (RAID)), a system for storage such as a library system or network attached storage system, or any other appropriate storage device or system. Some of storage units108-109may be located locally or remotely accessible over a network.

In response to a data file to be stored in storage units108-109, according to one embodiment, deduplication logic107is configured to segment the data file into multiple segments (also referred to as chunks) according to a variety of segmentation policies or rules. Deduplication logic107may choose not to store a segment in a storage unit if the segment has been previously stored in the storage unit. In the event that deduplication logic107chooses not to store the segment in the storage unit, it stores metadata enabling the reconstruction of the file using the previously stored segment. As a result, segments of data files are stored in a deduplicated manner, either within each of storage units108-109or across at least some of storage units108-109. The metadata, such as metadata110-111, may be stored in at least some of storage units108-109, such that files can be accessed independent of another storage unit. Metadata of each storage unit includes enough information to provide access to the files it contains.

In one embodiment, referring back toFIG. 1, any of clients101-102may further include an optional deduplication logic (e.g., deduplication logic151-152) having at least a portion of functionalities of deduplication logic107. Deduplication logic151-152are configured to perform local deduplication operations, respectively. For example, prior to transmit data to storage system104, each of the deduplication logic151-152may deduplicate the data into deduplicated segments and determine whether a particular deduplicated segment has already been stored in storage system104. A deduplicated segment is transmitted to storage system104only if the deduplicated segment has not been stored in storage system104.

For example, when client101is about to transmit a data stream (e.g., a file or a directory of one or more files) to storage system104, deduplication logic151is configured to deduplicate the data stream into deduplicated segments. For each of the deduplicated segments, client101transmits a fingerprint or representative of the deduplicated segment to storage system104to determine whether that particular deduplicated segment has already been stored in storage system104. A deduplicated segment that has been stored in storage system104may be previously received from the same client101or from another client such as client102. In response to a response from storage system104indicating that the segment has not been stored in storage system104, that particular segment is then transmitted over to the storage system104. As a result, the network traffic or bandwidth and the processing resources required can be greatly reduced.

According to one embodiment, storage engine106further includes garbage collector or garbage collection module125to perform a garbage collection process to reclaim any storage space that is not utilized or referenced by the file system. Garbage collector125performs a garbage collection process based on segments of a file system namespace on a breadth-first approach. In the breadth-first approach, the segments are traversed on a level-by-level manner, from a top level (also referred to as a root level or top parent level) to a bottom level, physically instead of on a file-by-file basis. Each segment may be traversed once even through such a segment may be referenced or shared by multiple files.

During the traversal of the segments, each segment (represented by a fingerprint) that is deemed to be alive is marked in live reference (LR) vector121indicating that the corresponding segment is alive. In addition garbage collector125scans a file index (not shown). For any segment found in the index, the segment is marked in a live index (LI) vector122to indicate that the segment is referenced by the index. If there is any mismatch or discrepancy between the LR vector and LI vector, there may be at least one segment missing. In such a scenario, a further verification process (e.g., physical scanning of containers) needs to be performed, which may take longer time and consume more resources. However, such a method can quickly determine whether there is any segment missing by comparing the LI and LR vectors. The physical scanning of the containers is performed only if there is a mismatch between the LI and LR vectors.

In one embodiment, since there may be a very large amount of files or segments stored in the storage system, which may be an archive or backup storage system, the file verification process can be performed on a per batch basis (e.g., one set of segments or files at a time). The number of segments or files to be processed at a time can be configured based on the available processing resources (e.g., processor, memory) at the time. For example, a file verification process can be performed a set of predetermined containers at a time to reduce the memory requirement for scanning.

In one embodiment, once the set of segments or files is determined for the current iteration, an LR bloom filter and an LI bloom filter are created, for example, based on the fingerprints of the segments, where the fingerprints may be retrieved from the corresponding container(s). The LR bloom filter and the LI bloom filter are utilized to update or set the LR vector and LI vector, respectively. In general, since the collision rate of a bloom filter is relatively low, by comparing the LR vector and the LI vector manipulated by the corresponding bloom filters, it can be likely certain whether there is any fingerprint and/or actual data segment missing, without having to issue IO requests to the storage containers separately. In other words, if there is a segment indicated in both the LR vector and the LI vector, it is likely that the physical data segment exists.

FIG. 2is a block diagram illustrating a storage system according to one embodiment of the invention. System200may be implemented as part of storage system104ofFIG. 1. Referring toFIG. 2, garbage collector125traverses namespace201via directory manager202, where directory manager202is configured to manage files stored in a file system of the storage system. In a deduplicated file system, a file may be represented in a file tree (also referred to as a segment tree) having one or more levels of segments in a multi-level hierarchy. In this example, there are seven levels L0 to L6, where L6 is the root level, also referred to as a top parent level. More or fewer levels may be applied herein. Each upper level contains one or more references to one or more lower level segments. In one embodiment, an upper level segment contains a fingerprint (e.g., metadata) of fingerprints of its child level segments. Only the lowest level segments are the actual data segments containing the actual deduplicated segments. Thus, L1 to L6 are segments only contain metadata of their respective child segments(s), referred to herein as LP segments.

In one embodiment, when garbage collector125traverses namespace201via directory manager202, it obtains the fingerprints of the root level segments, in this example, L6 segments, as part of content handles from namespace201. Based on the fingerprints of the current level segments, container manager203can identify which of the containers205in which the segments are stored based on indexing information from index204. Index204may be maintained in the system memory (e.g., volatile memory) and/or in a storage device (e.g., non-volatile memory). Index204includes information mapping a fingerprint to a storage location that stores a segment represented by the fingerprint. In one embodiment, index204may be a fingerprint-to-container identifier (FP/CID) index that maps a particular fingerprint to a container that contains the corresponding segment or a compression region (CR) having the segment stored therein.

The metadata (e.g., fingerprints) and the data section of the current level segments can be obtained from the identified container. A container may contain metadata or fingerprints of all segments stored therein, where segments are compressed into a compression region. A segment can be obtained by retrieving the entire container or the corresponding compression region from the storage device or disk. Based on the metadata or the data section of a current level segment, its child segment or segments can be identified, and so on. Throughout this application, for the purpose of illustration, a container contains one or more compression regions and each compression region contains one or more segments therein. However, the techniques may also be applied to other storage layouts.

Referring back toFIG. 2, in one embodiment, there are two components responsible to manage the files in the system. The first one is directory manager202, which is a hierarchical mapping from the path to the inode representing a file. The second one is a content store (not shown), which manages the content of the file. Each file has a content handle (CH) that is stored in the inode that is created by content store every time the file content changes. Each CH represents a file that is abstracted as a file tree (e.g., a Merkle tree or Mtree) of segments. In this example, a file tree can have up to 7 levels: L0, . . . , L6. The L0 segments represent user data (e.g., actual data) and are the leaves of the tree. The L6 is the root of the segment tree. Segments from L1 to L6 are referred to as metadata segments or LP segments. They represent the metadata of the file. An L1 segment is an array of L0 references. Similarly an L2 is an array of L1 references and so on. A segment is considered live if it can be referenced by any live content in the file system.

The file system packs the segments into containers205which are written to a disk in a log-structured manner. The log-structured container set has a log tail and a log head. New containers are always appended at the head of the log. Each container is structured into sections. The first section is the metadata section and the following sections are compression regions. A compression region is a set of compressed segments. In the metadata section all the references or fingerprints that identify the segments in the container. The metadata further includes information identifying a content type, which describes the content of the container. For instance, it describes which compression algorithm has been used, which type of segments the container has (L0, . . . , L6), etc. Container manager203is responsible to maintain the log-structured container set and provide a mapping from container identifiers (CID) to block offset on disk. This mapping may be maintained in memory. It also contains additional information, e.g., the content type of each container.

In the example as shown inFIG. 2, segment221of segment tree250includes a fingerprint of fingerprints of segments231and233, and segment222includes a representation (e.g., a fingerprint) of fingerprints of segments232-233, and so on. Some of the segments, such as segment233, are referenced shared by multiple parent level segments (e.g., segments221-222). Thus, segments221-222,231-233, and241-243only contain data representing the metadata of their respective child segments. Only segments251-254contain the actual user data.

A conventional garbage collection process typical traverses the segments in a depth-first or a file-by-file manner. For example, assuming segment221is associated with a first file while segment222is associated with a second file, the garbage collector will have to traverses a first file by scanning segment221and then segments231and233, and so on. After the first file has been processed, the garbage collector will process the second file by scanning segment222and then segments232-233, and so on. Thus, segment233will be processed at least twice in this example. If there are more files stored in the storage system, there are more segments that will be shared or referenced by multiple files and the processing of the same segments will be repeatedly performed. Thus, the time to perform the garbage collection depends on the size of namespace201, which depends on the fragmentation of the metadata on disk. The more fragmented the metadata is the more costly it is to read segments from the file from disk.

According to one embodiment, instead of traversing namespace201based on a file-by-file basis or a depth-first manner, garbage collector125traverses the physical segments in a breadth-first or level-by-level basis. Referring now toFIGS. 2-3, garbage collector125starts with the root level, in this example, L6 segments221-222. For each of the segments found in namespace201, regardless which file or files the segment is associated with, LR vector121is updated or marked to indicate that the corresponding segment is alive. In addition, according to one embodiment, index204is scanned by garbage collector125to identify any fingerprint and insert the fingerprints obtained from index204into LI vector122. A fingerprint may be inserted into LI vector122if the fingerprint is found in LR vector.

LR vector121may be a bitmap including multiple bits, each corresponding to one of the live segments found in namespace201. Similarly, LI vector122may be a bitmap having multiple bits, each bit corresponding to one of the segments found in index204. In one embodiment, LR vector121may be updated by applying a corresponding LR bloom filter210to the fingerprints. LR bloom filter210is specifically created for the set of segments or files in the current iteration. Each iteration only covers a set of predetermined number of segments or files dependent upon the available system memory and other processing resources. Likewise, LI vector122may be updated by applying a corresponding LI bloom filter211to the fingerprints. The LI bloom filter211may be specifically created for the set of segments or files in the current iteration.

After LR vector121and LI vector122have been populated for all segments in the current iteration, LR vector121and LI vector122are compared to determine whether there is any mismatch. If there is any mismatch, it is likely that at least one segment is missing. In such a situation, it warrants a physical scan of the containers to identify and verify the missing segments. Any missing files can then be recovered based on the physical scanning.

The error rate of a bloom filter is determined by the number of bits used to represent each sample data, e.g. if there are 6 bits for each sample and 4 hash functions are used, the error rate (false positive rate) of the bloom filter is about 7%. If there is not enough memory to track the entire sample set and keep the error rate below some desirable threshold at the same time, the only alternative is to verify only a subset of the fingerprints called the sample set.

In one embodiment, based on available system memory, the system determines the maximum number of sample data each bloom filter can support for the given iteration. It also computes the sample rate=(max number of sample data)/(total number of data) and round it down if necessary. A mask for the sample set may be generated and only fingerprints in the sample set will be considered for the current iteration. The system then iterates all the files in the name space and insert the L6 references into the live vector. The system then iterate all the L6 containers. If the container fingerprint is set in the live vector, it reads all its contents (L5 segment references) and insert them into the live reference vector and repeats the same process for L5 containers, L4, L3, . . . until L1. The creation of the LR vector is completed. After the LR vector is created, the system iterates the index sequentially. If a fingerprint is present in the live vector, the fingerprint is inserted into the LI vector.

The above procedure cannot cover all the segments in the system in one iteration. For example, if the sample rate is ¼, it will take 4 iterations before it can verify all the fingerprints. If the false positive rate of the bloom filters is 7%, only 93% of the data is verified after 4 iterations. Typical data corruption occurs at a much larger granularity than just one specific fingerprint. For example, assuming a sample rate of ¼ and n segments in the same file are corrupted, the probability that at least one of them is in the sample set is =1−(¾)^n. If n=16, this probability is equal to 0.99. As the number of corrupted segments increases, the probability also increases quickly to 1.

If there is a mismatch in the bloom filters, there must be some missing fingerprints in the index. It is not possible to tell which fingerprints are missing from the bloom filter. The containers must be scanned again to check which fingerprints are set in the live filter but not in the live index vector. The missing fingerprints will be inserted into a hash table called the missing segment table. If the missing segment table is not empty, a reverse physical segment level scan (from L1 to L6) will be performed and the LP segment fingerprint will be inserted into the same hash table if that LP segment contains any of the fingerprints in the hash table.

Once all the candidate L6's have been identified, the directory tree will be scanned to locate the missing user files. Missing fingerprints can also collide with live fingerprints in a bloom filter. Not all of them can be detected in this procedure. Other procedure, e.g. logical file verification, can be invoked to do a more comprehensive verification. However, if there are multiple blocks corruption in any file, this probabilistic file verification algorithm will be able to identify those corrupted files with very high probability.

There are several advantages for the techniques described throughout this application. The data structures used in the algorithm all fit into the available memory. Segment trees are scanned level by level which will not suffer any performance issues caused by random IO in certain workloads. The efficiency of the algorithm allows the procedure to complete in a short time. This can be used as the base mechanism of system wide verification for all types of workloads. Even at low sample rate, e.g. ¼, this procedure has very high probability of catching multiple segment corruptions. In a conventional system, once a file has been verified, it is not checked again. It is possible that segments are moved around by the file system which can result in corruption. The probabilistic file verification method described according to certain embodiments can reduce this kind of corruption.

FIG. 4is a flow diagram illustrating a process of verifying files according to one embodiment of the invention. Process400may be performed by processing logic that includes hardware (e.g. circuitry, dedicated logic, etc.), software (e.g., embodied on a non-transitory computer readable medium), or a combination thereof. For example, process400may be performed by garbage collector125ofFIG. 1. Referring toFIG. 4, at block401, processing logic scans fingerprints of a predetermined set of segments or files in a breadth-first approach. For each of the fingerprints, at block402, processing logic applies a LR bloom filter to the fingerprint to set a bit in an LR vector, indicating that the corresponding segment is a live segment. At block403, processing logic scans an index (e.g., fingerprint to container index) and for each fingerprint found in the index, processing logic applies a LI bloom filter to set a bit in an LI vector to indicate that the segment is referenced by the index. At block404, the LR vector and the LI vector is compared to determine whether there is a mismatch.

FIG. 5is a flow diagram illustrating a process of verifying files according to one embodiment of the invention. Process500may be performed by processing logic that includes hardware (e.g. circuitry, dedicated logic, etc.), software (e.g., embodied on a non-transitory computer readable medium), or a combination thereof. For example, process500may be performed by garbage collector125ofFIG. 1. Referring toFIG. 5, at block501, processing logic scans containers to retrieve fingerprints to identify missing segments that are listed in an LR vector, but are absent from an LI vector. At block502, the fingerprints of the missing segments are stored in a missing segment table. At block503, perform a reverse segment scan (e.g., bottom-up, from L1 to L6) to identify any parent segments of the missing segments in the missing segment table and to add those parent segments in the missing segment table. After all segments that are related to the missing segments have been identified in the missing segment table, processing logic scans the directory namespace to locate any missing files corresponding to the missing segments in the missing segment table.

FIG. 6is a block diagram illustrating an example of a data processing system which may be used with one embodiment of the invention. For example, system1500may represents any of data processing systems described above performing any of the processes or methods described above, such as, for example, clients101-102and servers104and160ofFIG. 1.

Module/unit/logic1528, components and other features described herein can be implemented as discrete hardware components or integrated in the functionality of hardware components such as ASICS, FPGAs, DSPs or similar devices. In addition, module/unit/logic1528can be implemented as firmware or functional circuitry within hardware devices. Further, module/unit/logic1528can be implemented in any combination hardware devices and software components.