Slashdot Mirror
Storage Area Networks vs. Local RAID Arrays?
Noxx asks: "My department is purchasing several new servers for an
intranet website project. We are under pressure to store our content
on an existing Storage Area Network accessed over a fibre connection
rather than on a local RAID-5 array, to cut purchasing costs on the
new hardware. Have any Slashdot readers evaluated the pros and cons
between the two storage technologies, and are there any points of
concern we should address? How does performance compare between
the two, and is this a proper use of the SAN? If multiple servers
access the same content from the SAN, is the possibility of
introducing a single point of failure (ie: the SAN crashes) a valid
concern?"
Generally, you will find that using a SAN is better. The sort of equipment that is deployed in a SAN is typically higher-end than what you would get with a stand-alone RAID array.
You probably also get a number of other advantages. Your SAN is probably already backed up. Your SAN is likely already part of any disaster recovery plan.
And while you could view the SAN as a single point of failure, you could also view your local RAID array as a single point of failure. Any decent SAN implementation has redundancy at every level.
Of course, I'm biased, as I work for EMC, a big SAN company.
You probably need to sit down with your IT people and discuss with them exactly how the SAN is set up. You'll probably find that it has more than enough reliability and performance for any web server application.
Most security designs involve using "concentric circles" of security.
Each ring contains a set of applications and data that have a common security concern or priority. The closer to the center that you get, the data becomes more valuable and therefore the security measures are stronger and more protective.
The outer layers of the circle usually contain internet web servers, incomming mail servers, etc. The inner layers could contain such things as source code, payroll, billing, R&D, etc.
If you share a SAN across layers of security, an intruder could use the SAN to bypass any security measures that protect the inner layer.
And if you think that this is not possible, think again, I have read the results of a SAN security risk assesment performed by a large security firm, and they were able to plug in a laptop into the SAN and gain access to the SAN by making the SAN controller believe that the laptop had the WWUI (world-wide unique identifier) of a critical server that was down for maintenance.
Can't give any more details, since I am under NDA and I cannot reveal the exact method used, or specific company names or brands.
The word "SAN" can mean two very different things: switched access to storage, or shared access to storage.
The simplest kind of SAN has a number of computers and a number of storage devices all connected to a fibre channel switch. Each computer gets some of the storage for its own private use. No two computers ever mount the same filesystem at the same time.
The advantages of that kind of SAN are mostly physical: buy a bunch of storage and put it on the SAN, then allocate it to the computers "softly," by changing LUN mapping and such, rather than by running new cables.
If that's the kind of SAN you're talking about, I'd say go for it. The IS group that manages the SAN will take care of some of your problems for you-- maintaining the RAID hardware, namely-- but in all other ways it'll be just like direct-attached storage.
The other kind of SAN allows multiple computers to mount the same filesystem at the same time and access its data over fibre channel. This is a lot more complex, obviously, because your storage software has a lot of work to do: keeping buffer caches consistent, managing file locking, propogating metadata updates, and on and on.
This kind of SAN requires a special driver, like Sanergy or Centravision or CXFS. (Google 'em.)
They're often more trouble than they're worth, especially if you start talking about large storage clusters (8 nodes or more). I'd avoid these.