Under the copyright laws, this document may not be copied, photocopied, reproduced, translated, or reduced to anyelectronic medium or machine-readable form, in whole or in part, without the prior written consent of LotusDevelopment Corporation.

© Copyright 2000 Lotus Development Corporation55 Cambridge ParkwayCambridge, MA 02142

All rights reserved. Lotus and Lotus Notes are registered trademarks and Domino is a trademark of LotusDevelopment Corporation. All other marks are property of their respective owners. Printed in the United States.

Table of Contents

9Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8The Domino R5 backup API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7Transaction logging styles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6How R5 backups work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6Domino R5 Backup and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5Configuring Domino for transaction logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4Disk storage requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4Implementing Transaction Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3Fault recovery with transaction logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2Fault recovery without transaction logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1How transaction logging works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1Why You Need Transaction Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Why You Need Transaction Logging

Most Lotus Notes® and Domino™ administrators have heard about transactionlogging, the new data storage technology that significantly enhances Domino R5Server availability and vastly improves the reliability and efficiency of data recoveryand backup operations. Used in combination with R5’s new backup capabilities, trans-action logging enables you to deploy fully recoverable, higher performing servers at alower cost of operation. But it only works if you turn it on.

That’s the goal of this paper — to convince you that transaction logging and recoveryare features you can’t wait to turn on and start leveraging. The pages that followexplain very briefly what transaction logging is, how it’s implemented, and what youneed to do to make it work. We hope that once you’ve seen these facts you’ll want tomake transaction logging and recovery part of your long-term strategy for maximizingthe efficiency, availability and performance of your Domino infrastructure.

How transaction logging worksWhen transaction logging is enabled, the Domino R5 Server captures all the changesthat users make to databases and writes them to a transaction log, rather thanimmediately writing them directly to the various databases. This allows Domino todefer write operations to databases during times of high server activity. Whenresources are available, or at periodic intervals, logged transactions are written to diskin a batch. Should a failure occur in the interim, the transaction log is used to recoverthe affected databases.1

The great advantage of transaction logging is that it allows Domino to automaticallyrecover data lost through system failures simply by replaying the deferred database changesfrom the transaction log. The principal benefits of this highly efficient data recoverycapability are:

• Simplified backup procedures. On a daily basis, most sites will need to backup only the transaction logs for that day.

• Improved data integrity, because the recovery process detects any missingchanges and replays them, while “undoing” any changes that wereincomplete at the time of the failure. Thus, Domino can start with “clean”databases.

• Much faster server restart times, which means enhanced system availability.

• No more long Fixup sessions! With transaction logging, you will rarely needto run Fixup on a logged database, except in the very rare event that Dominodetects errors following recovery.

Domino Release 5 Transaction Logging 1

1 Depending on the nature of the failure, a restored copy of the database might also be required.

Transaction logging is anew data storagetechnology that boostsserver availability anddata integrity, whilecutting weekly backupvolume by over 90%.

Transaction loggingallows Domino torecover from a systemfault simply by replay-ing the transaction log.The need to run Fixupis eliminated.

Another benefit of transaction logging is a measurable increase in overall systemperformance. Yes, the logging process creates more total overhead. But Domino morethan makes up for it, throughput-wise,2 by writing to the log sequentially, rather thanto the databases randomly. Less physical disk arm movement at critical times meansfaster writes.

But is transaction logging proven? You bet. Though new to Domino, transactionlogging is mature technology that represents the state of the art in reliable datastorage. It is based on ARIES (Algorithm for Recovery and Isolation Exploiting Semantics), developed by Almaden Computer Science at IBM and implemented inDomino by a joint team of developers and researchers from IBM and Iris Associates.3

The ARIES algorithm has been in production since 1988, and versions are used notonly in Domino R5 but also in IBM DB2 mainframe and workstation products and IBMMQSeries, among numerous other products.

Fault recovery without transaction loggingRecovery times were lengthy with Domino R4, because it did not provide directsupport for incremental backup or media recovery. With R4, a typical backup was afull backup. This used large amounts of time and tape. And you could only restore tothe previous night’s backup; full recovery required the use of database replicas, andthe need to minimize possible data loss results in frequent replication. Moreover,restored databases that were open during backup usually needed to have Fixup run onthem. Many administrators circumvented these issues by making copies of key appli-cations at the operating system level.

In the absence of transaction logging, full backups were required because everydatabase transaction — like creating, modifying or deleting documents, or changingdatabase attributes — must be committed to disk before it could be consideredsuccessful. This “careful” strategy enabled the Fixup task to restore data integrity fromany possible database state in the event of a failure.

Unfortunately, Fixup could not know what might have changed, so it must check“everything.” System failures therefore entailed running Fixup on every affecteddatabase, and then waiting while it checked every document.

Sound familiar? Then read on to learn how you can make long restarts a thing of thepast.

2 Domino Release 5 Transaction Logging

3 Lotus Domino R5 is the first semi-structured data store that implements transaction logging.

2 Performance is also enhanced because fewer file/disk operations mean the OS kernel spendsless time in “kernel mode” or “privilege mode” and more time in “user mode,” that is, doingthe work requested by applications. The end result is fewer overall CPU cycles to complete thesame work, potentially allowing a server to support more users.

Transaction loggingrecords database writeoperations sequentially,reducing I/O activitywhile optimizing dataintegrity and reducingserver restart times.

Database recovery withR4 entailed full dailybackups and runningFixup (which can meanlong restart times).

Fault recovery with transaction loggingWith transaction logging enabled, Domino R5 posts all database transactions to the logfile, without waiting for the actual write/commit process just described. The systeminstead considers the successful posting of an operation to the log to be a commitment topersistent storage. Transactions either succeed (commit) or fail (rollback). So, databaseoperations can “complete” before the physical write process to the databases occurs.

Transaction logging speeds recovery not only from your basic system failures, but alsofrom media failures:

• Anytime a system failure necessitates a server restart, Domino R5automatically restores affected databases! Domino automatically “replays”the transaction logs, performing only those transactions not written to thedatabases at the time of the failure. No need to run Fixup as part of a systemrestart, period.

• When disk drives fail, databases can be corrupted or lost. To recover with R5,you use a third-party backup utility to restore database backups andarchived transaction logs, and then apply current transaction logs to recreatethe affected databases.

When Domino uses transaction log data to restore or recover databases, it performsthese basic steps:

1. Analyzes the contents of the transaction log.

2. Performs all unrecorded changes for committed transactions (redo).

3. Removes all recorded changes for uncommitted transactions (undo).

This leaves the affected database in a clean and consistent state that reflects all opera-tions performed on it. No generalized “state checking” of databases is required, sorestore/recovery times are much shorter.

The exact procedures involved in database restoration and recovery depend on thebackup utility used. But whatever your production environment looks like, serverrestart will be orders of magnitude faster with transaction logging enabled. For example,a server that currently takes three hours to restart will generally restart in under fiveminutes. The majority of servers will restart in under two minutes, even those that hostvery large numbers of databases, or very large databases, or both.

Count on it.

And don’t forget about the performance benefits of transaction logging. You can lookforward to a minimum 10% increase in server performance for database transactions,even under high server load. The fewer the number of databases involved, the greaterthe relative increase in performance that transaction logging yields.4

Domino Release 5 Transaction Logging 3

4 Though not guaranteed to be true in every environment, this level of improvement has beenseen in all Domino servers used for performance testing.

With transactionlogging enabled, faultrecovery is automaticand server restart isorders of magnitudefaster.

Since database resto-ration can take placedirectly from the transaction logs, theuse of Fixup on logged databases isunnecessary.

Implementing Transaction Logging

Transaction logging is straightforward to implement. These are the basic steps, withdetails following:

• Allocate a space for the transaction logging directory. For optimalperformance and data integrity, Lotus® requires that the log files reside on aseparate, high-volume disk drive.

• Place all databases to be logged in the Domino data directory, or one of itssub-directories. (Domino can also log databases referenced viadatabase/directory links).

• Upgrade databases to R5 format, by running Compact on them. When youenable transaction logging on a Domino R5 Server, all databases in R5 formatare automatically logged.

• Configure transaction logging on the server. You can disable it for individualdatabases if you need to, though this is rarely advantageous.

To really get the maximum payback from transaction logging and recovery, you willalso need a third-party backup utility that supports Domino R5 and transactionlogging. More on that below.

Disk storage requirementsIn order to radically increase the speed of write operations, and ensure industrialstrength data integrity, Lotus requires that you store transaction log files on a separate,dedicated disk drive with the following characteristics:

• The size of the separate disk used for transaction logs must be at least 1GB,and probably much more for enterprise scale implementations — enough togive you adequate space for at least a day’s worth of log storage under themost demanding conditions. (For most installations, Lotus recommends thatyou allocate at least two days’ worth of space for transaction logs. This willhelp you cope with problems related to backups, or excessive serverutilization.)

• To guarantee the absolute integrity of your mission-critical Domino data,Lotus requires that your log disk employ a RAID 1 disk configuration. Amirrored drive ensures that you never lose your transaction logs, even if onelog disk fails. It’s important to point out in this context that when youimplement transaction logging your databases are no longer your mostcritical data — your transaction logs are! With transaction logging, you canlose all your active, logged databases and lose no data, because your logs canreplay every last transaction against your database backups.

• The dedicated log disk must have a separate controller. This is not only acost-effective way to boost write performance significantly, but it also furtherimproves reliability.

Note: For Domino customers planning an upgrade to Domino R5, Lotus recommendsthat you make any changes to your disks and controllers first, and then upgrade to R5.That way you can isolate issues with the new hardware on an otherwise familiarinfrastructure.

4 Domino Release 5 Transaction Logging

For Domino customersupgrading to R5, Lotusrecommends upgradingdisk hardware tosupport transactionlogging before upgrad-ing your servers to R5.

To ensure optimalperformance and dataintegrity, log files mustreside on a separate,high-volume disk drive.

Configuring Domino for transaction loggingOnce you’ve set up a dedicated disk for the log files, and moved and/or upgraded thedatabases you want to log, all that’s left to do is configure transaction logging on yourDomino servers. Table 1 describes the settings to be configured, using the DominoAdministrator:

Choose Circular (the default) only if you do not have anR5 compatible backup utility in place. Otherwise chooseArchive. See the next section for more information.

Logging style

Controls how often Domino records a recovery check-point in the transaction log. Checkpoints entail systemoverhead, but they are important for restart perform-ance. You can choose the default (recommended), orskew the frequency of checkpoints to favor serverperformance (fewer checkpoints) or to shorten recoverytime (more checkpoints). The fewer the checkpoints, thelonger restart will take if a system failure occurs.

Runtime/Restartperformance

Enabled by default. This means that, if a database isfound to be corrupt after restart, in which case the trans-action log cannot be used to recover it, Domino runs theFixup task automatically. If disabled, Domino notifiesthe administrator to retrieve a backup and recover thedatabase from the logs, or to run Fixup manually.

Automatic Fixup ofcorrupt databases

Choose Yes once you’ve set up a dedicated disk. Use all available spaceon log device

The maximum size, in megabytes, for the transactionlog. Domino formats from three to 64 log files, depend-ing on the space allocated. Used only for Circular stylelogging.

Maximum log space

Specify the location of the dedicated log disk, or a pathname. The default, which is simply a placeholder, isLOGDIR in the Domino data directory.

Log path

The default is Disabled; choose Enabled.Transactional Logging

DescriptionSetting

Table 1: Domino Server settings for transaction logging.

See the Domino R5 Administration Help (help5_admin.nsf) for more information onconfiguring your servers for transaction logging.

Domino Release 5 Transaction Logging 5

Configuring a Dominoserver for transactionlogging is a simplematter of choosingsettings in the ServerConfigurationdocument.

Domino R5 Backup and Recovery

Though transaction logs protect you from system failures, regular backups are stillessential for recovery from media failures, where one or more disks fail or arecorrupted. Fortunately, Domino R5 provides a new and vastly improved backup API,enabling third-party vendors to provide you with outstandingly robust and feature-rich tools that dramatically simplify all regular backup procedures, slash the time andadministrative effort required for backup and restoration/recovery, and cost savings.All R5 compatible backup products work in combination with transaction logging.

How R5 backups workOnce you upgrade to Domino R5 and enable transaction logging, those daily fullbackups of all your databases are no longer necessary. The first step is to put a DominoR5 compatible backup solution in place. Once that utility is operational, the criticalbackup jobs you’ll need to perform regularly with transaction logging are:

• Scheduled (typically daily) archiving of the transaction logs, in the form ofincremental backups.

• Periodic (typically weekly) full database backups, so you’re prepared formedia recovery. Unlogged databases should be backed up more frequently; a full backup daily is recommended.

In this scenario, recovery following a system fault simply consists of allowing Dominoto automatically recover all affected databases using the transaction logs. Restorationof a corrupted database due to bad media basically consists of restoring the mostrecent full backup from tape and using the transaction logs to “roll forward” the stateof the data to the time of the failure.

How much time and money will this save you? Consider this: Say you’ve got 10GB ofDomino mail and application data on a server, and about 500MB of that data (typically3% to 5%) changes each day. If you employ a backup strategy that allows no more thantwo days’ worth of data loss for non-logged databases, the volume of data you’ll needto back up without transaction logging is about 250GB per month. With transactionlogging enabled, it’s no more than 35GB per month.

In short, transaction logging cuts your weekly backup volume by over 90%. Figure 1and Figure 2 illustrate backup volumes without and with transaction logging,respectively.

Sun Tues Wed Thurs Fri SatMon

.NSF .NSF .NSF .NSF .NSF .NSF .NSF

Full Backup

Figure 1: Backup volumes without transaction logging.

6 Domino Release 5 Transaction Logging

Simplified backup andrecovery proceduresare probably the singlegreatest benefit oftransaction logging.

When transactionlogging is enabled,most sites can simplyback up log files dailyand databases weekly.Recovery basicallyconsists of Dominoautomatically replayingthe logs.

Transaction loggingcuts your weeklybackup volume by wellover 90%.

Sun Tues Wed Thurs Fri SatMon

.NSF

Incremental Backup

Transaction Logs

( Full Backup )

( Incremental Backup )

Figure 2: Backup volumes with transaction logging.

Transaction logging stylesAs touched on in the previous section, one of the configuration settings for transactionlogging is the log “style:” circular logging or archive logging. While either style allowsfor the possibility of media recovery without tape mounting, the choice of which style touse is very clear-cut for most organizations.

Though it is the default style, circular logging should typically be used only if the sizeof your daily transaction logs are likely to be less than 4GB (log size is typically 3-5% oftotal data size); or if you do not have an R5-compatible backup tool in place. Whencircular logging is enabled, Domino continually reuses a fixed amount of disk spacefor transaction logs, overwriting old transactions. Log segments are reused in rotation,oldest first. The maximum amount of space you can allocate for circular logging is4GB. The more space you utilize, the less “tail chasing” your log will do. Nevertheless,you’ll be lucky to make it through much more than 24 hours before your log startsoverwriting itself. This means that, with circular logging, daily backups are stillrequired for both logged and unlogged databases. Media recovery is possible only ifall the required logs are still available; hence, this style offers less protection frommedia failure.

Circular logging offers three advantages:

• It can increase server performance somewhat.

• It allows you to continue to use an R4 backup architecture.5

• It obviates the need to back up your transaction logs as they are reused.

Though archive logging is not the default setting, it is strongly recommended becauseit guarantees that media recovery will be possible. However, it requires you to deployan R5 compliant backup solution. (For the latest information on backup vendors andtheir products, see www.lotus.com/itcentral.)

Domino Release 5 Transaction Logging 7

5 Any non-R5 compliant backup program should be tested to verify that it copies only “clean”(i.e., closed) databases. If a logged database is opened when copied, there may be changesmissing from it, and you’d need to run Fixup on it. However, Fixup might have to removemany documents to regain consistency in such a case.

Domino R5 supportstwo log “styles:” circularand archive. Mostorganizations will wantto use archive logging.

With archive logging, log files are created as needed, and are not overwritten untilthey are archived. Thus, the disk space required to support archive logging is dictatedby the amount of time between incremental backups (typically once per day). Asdiscussed above, the daily log size is usually 3% to 5% of the total size of the activedatabases on the server.

Note: Prior to Domino release 5.04, a log file can be archived only when it is inactive;i.e., when it does not contain any transactions necessary for database recovery in theevent of a server restart. You use a third-party backup utility to copy and archive theexisting transaction log.

The Domino R5 backup APIWith Domino R5, Lotus made available a comprehensive and fully integrated set ofapplication programming interfaces (APIs) to support database backup, recovery andrestoration. Previous releases of Domino do not provide such an API, although variousthird-party backup/restore tools do exist.

By providing this API, Lotus has enabled vendors of backup utilities to integrate theirproducts with Domino R5. This gives our customers a choice of high-performancebackup/restore capabilities, which is a much better strategy than expecting customersto use a Lotus solution that attempts to replicate the expertise of these leading backupvendors.

The result is 100% fidelity, assured data integrity and high-speed, online backup andrecovery capability.

The new API has four parts:

1. Online full backup. Enables backup utility to flush the database image todisk, and to capture any changes made during the backup.

2. Online incremental backup. Only available when Archive TransactionLogging is enabled. Backs up all the log segments, including the active logsegment, and reports to Domino when complete. Domino chooses to reusethese or delete them at server shutdown.

Note: Domino release 5.04 only “full” log segments are backed up.

3. Online restore. Takes the database offline, brings both the dirty databaseimage and all “before-images” back from tape, applies the “before image”blocks and puts the database back online.

4. Online media recovery. Enables a backup utility to automatically “rollforward” a restored database using transaction logs. Note that this alsoestablishes an end point in time, should you want to recover to a point beforethe end of the logged activity.

8 Domino Release 5 Transaction Logging

Domino R5’s backupAPI enables ISVs todeliver feature-richbackup solutions.

Summary

We hope we’ve persuaded you that transaction logging will:

• Save you considerable time, trouble and tape over the long run.

• Enable you to deliver a higher level of service.

• Save your organization substantial amounts of money through increasedup-time, reduced backup costs and better server performance.

• Potentially prevent the catastrophic costs associated with losingmission-critical data.

And we’re confident you’ll agree that the magnitude of these benefits far outweighsthe upfront time and expense that may be required to upgrade the disk systems onyour Domino servers.

Enjoy the benefits of transaction logging!

For more information visit www.lotus.com/itcentral.

Domino Release 5 Transaction Logging 9

Enjoy the benefits oftransaction logging:

• 90% reduction inbackup volume, withsimplified backupprocedures.

• Enhanced dataintegrity.

• Increased serverup-time.

• Better serverperformance.