MSEO CPU impact?

[epsilon22222]

Hey all,

I am currently looking into Media Server Encryption Option (MSEO) for our media servers and I am finding it difficult to find ample documentation related to its impact on hardware.  Particularly, CPU performance has me concerned and all documentation for Netbackup 7.5 does not provide any details concerning the performance impact that is specified.  I contacted Netbackup support and they claimed that as long as your hardware can support Netbackup operations normally, MSEO should be fine and there are no specific requirements for CPU if this is the case.

All software version for master/media servers is 7.5.0.1 currently. 

Does anyone have any experience using MSEO?

[The_Skip]

It is hard to say how much impact MSEO would have on a media server. Generally the biggest impact is on CPU. Variations in CPU types, number of cores and algorithm selection will impact the performance. Look at the percent of the CPU usage prior to encryption to get a current baseline. This at least will give you a starting point where you could add percentage increase of overhead based on your configuration.

If you enable compression and encryption there will be additional overhead.

Here is a link to the MSEO 6.1.8 version. (the MSEO versions do not match the NBU versions). This documentation may help with some of the configuration choices.

http://www.symantec.com/docs/DOC6159

[epsilon22222]

Thanks for the link, I am looking into that document now.  As of now we are not using the compression parameter in our policies and I don't believe we will be in the near future.  Our logical tape library will be doing the compression although I wonder if that would have an impact on restoring an encrypted tape if the content was further altered after encryption for compression?

[StefanosM]

I do not have an answer for CPU impact but my experience with MSEO says that your backup time will be doubled and if you use the compression option will be x4.

What tapes you have?
If you have LTO4,5,6 then you can use netbackup KMS which is hardware based, is free, does not lose the tape compression and it is free.

If you have LTO1,2,3 consider the posiblity to buy new tapes or new library.

[epsilon22222]

Thanks for the input.  The job times being doubled scares me.  Our backup window as most is really getting full and I'm not sure if we would want to add onto that.

We are using LTO4 tapes and we are currently looking into our remote site tape drive encryption capabilities.  KMS I believe requires compatible tape drives for encryption, correct?

[StefanosM]

LTO4 is a compatible drive.

What Libraries you have? You may have to configure the library to use "application key managment" (IBM for instance).

The only limitation with netbackup KMS is that you are limited to 20 volume pools and 20 (or 10, I do not remember) keys per volume pool. For the majority of installations, big deal....

[Dyneshia · Accepted solution]

Please see : http://www.symantec.com/docs/HOWTO56061 - Encryption and NetBackup performance

Media Server Encryption Option (MSEO)

Data encryption (and compression) can be performed on the NetBackup media server, by means of the Media Server Encryption Option (MSEO).

Note the following:

• In most cases, to avoid the need for additional tapes, you should compress the data before encrypting it. MSEO can both compress the data and encrypt it.

• MSEO compression increases the amount of data that the media server must process in order to keep the tape drive streaming.

• MSEO is usually most effective when only a limited amount of the backup data needs encryption.

• The greater the amount of data to be encrypted, the greater the CPU load that is placed on the media server. If MSEO also compresses the data before encrypting it, the CPU demands are even greater. For example, to compress and encrypt 100 MB/second of data with a Solaris media server requires roughly an additional 8.7 GHz of CPU processing for MSEO.

For more information on MSEO performance, see "A guide to best practices when using the NetBackup Media Server Encryption Option:"

http://www.symantec.com/docs/TECH73132