Warning, these procedures are simple guidelines. Evidian is not an expert of Milestone migration procedures. They must be validated by Milestone support according your Milestone versions.

3 migration scenarios are considered:

1. Management and SQL are in the same SafeKit cluster,
2. Management and SQL are in 2 different SafeKit clusters,
3. Management is in a SafeKit cluster with an external SQL not in a SafeKit cluster.

Note: here is described the Milestone Management solution with SafeKit for high availability and redundancy.

Decide with the customer a service interruption to make the migration.
Check in the Windows registry of both management nodes that the connection to the SQL databases is really local to each node. According this Milestone KB, the registry key for SQL connection is HKEY_LOCAL_MACHINE\SOFTWARE\VideoOS\Server\ConnectionString.
Make a backup of the SQL databases on MGT+SQL1-PRIM for security. Default databases are according this Milestone KB: Surveillance, Surveillance_IDP, SurveillanceLogServerV2, Surveillance_IM.
Put the cluster in (MGT+SQL1-PRIM, MGT+SQL2-SECOND). Thus, the Milestone SQL databases are the same on both nodes (if they are correctly configured for replication in the SafeKit module).
Protect the nodes from an automatic start of the SafeKit module at boot during the migration (if nodes are rebooted for any reason during the migration).
Remove the automatic start of the module at boot: in a command prompt under c:\safekit, type "safekit boot -m AM off" where AM is the module name.
Do it for on both nodes.
Put the cluster in (MGT+SQL1-ALONE, MGT+SQL2-STOP): there is no more replication from SQL1 to SQL2.
Suspend the monitoring of processes during the migration on MGT+SQL1. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT+SQL1 from Milestone version N to Milestone version N+1 with migration of the databases on node 1.
Note: the migration requires that the management services are running, that’s why the migration is made in the ALONE state without SafeKit ckeckers.
Register the virtual IP of the SafeKit management cluster with the Server Configurator GUI.
At this step, MGT+SQL1 is migrated to Milestone version N+1 and MGT+SQL2 is in version N.
DO NOT START MGT+SQL2 as SECOND during the previous steps else it will resynchronize the migrated databases from SQL1 (that’s why we remove the automatic start at boot and make a backup for security reasons).
Stop the ALONE SafeKit module: the cluster is in (MGT+SQL1-STOP, MGT+SQL2-STOP).
Force start as prim the SafeKit module on MGT+SQL2 with the version N. Use the "Force start" menu in the SafeKit web console to do that.
The cluster is in (MGT+SQL1-STOP, MGT+SQL2-ALONE).
Suspend the monitoring of processes during the migration on MGT+SQL2. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT+SQL2 from Milestone version N to Milestone N+1 with migration of the databases on node 2.
Register the virtual IP of the SafeKit management cluster with the Server Configurator GUI.
At this step all nodes are migrated.
Stop the SafeKit module on MGT+SQL2.
The cluster is in (MGT+SQL1-STOP, MGT+SQL2-STOP).
Force start as prim the SafeKit module on MGT+SQL1 (if you want SQL1 to be the reference for the databases).
The cluster is in (MGT+SQL1-ALONE, MGT+SQL2-STOP).
Force start as second the SafeKit module MGT+SQL2.
The cluster is in (MGT+SQL1-PRIM, MGT+SQL2-SECOND); the SQL2 databases are resynchronized from SQL1.
Re-enable Automatic start at boot of the SafeKit module and resume the errd and checker monitoring.
The cluster is restarted and migrated.

Decide with the customer a service interruption to make the migration.
Check in the Windows registry of both management nodes that the connection to the SQL databases is really external and connected to the virtual IP of the SafeKit SQL cluster. According this Milestone KB, the registry key for SQL connection is HKEY_LOCAL_MACHINE\SOFTWARE\VideoOS\Server\ConnectionString.
Make a backup of the SQL databases on SQL1-PRIM for security. Default databases are according this Milestone KB: Surveillance, Surveillance_IDP, SurveillanceLogServerV2, Surveillance_IM.
Put the cluster in (MGT1+SQL1-PRIM, MGT2+SQL2-SECOND). Thus, the Milestone SQL databases are the same on both SQL nodes (if they are correctly configured for replication in the SafeKit SQL module).
Protect the nodes from an automatic start of the SafeKit module at boot during the migration (if nodes are rebooted for any reason during the migration).
Remove the automatic start of the module at boot: in a command prompt under c:\safekit, type "safekit boot -m AM off" where AM is the module name.
Do it for on both nodes.
Put the cluster in (MGT1+SQL1-ALONE, MGT2+SQL2-STOP): there is no more replication from SQL1 to SQL2.
Suspend the monitoring of processes during the migration on MGT1. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT1+SQL1 from Milestone version N to Milestone version N+1 with migration of the databases on SQL1.
Note: the migration requires that the management services are running, that’s why the migration is made in the ALONE state without SafeKit checkers.
Register the virtual IP of the SafeKit management cluster (NOT the SQL virtual IP address) with the Server Configurator GUI.
At this step, MGT1+SQL1 are migrated to Milestone version N+1 and MGT2+SQL2 are in version N.
DO NOT START SQL2 as SECOND during the previous steps else it will resynchronize the migrated databases from SQL1 (that’s why we remove the automatic start at boot and make a backup for security reasons).
Stop SafeKit on ALONE servers: the clusters are in (MGT1+SQL1-STOP, MGT2+SQL2-STOP).
Force start as prim the SafeKit modules on MGT2+SQL2 with the version N. Use the "Force start" menu in the SafeKit web console to do that.
The cluster is in (MGT1+SQL1-STOP, MGT2+SQL2-ALONE).
Suspend the monitoring of processes during the migration on MGT2. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT2+SQL2 from Milestone version N to Milestone N+1 with migration of the databases on SQL2.
Register the virtual IP of the SafeKit management cluster (NOT the SQL virtual IP address) with the Server Configurator GUI.
At this step all nodes are migrated.
Stop the SafeKit modules on MGT2+SQL2.
The clusters are in (MGT1+SQL1-STOP, MGT2+SQL2-STOP).
Force start as prim the SafeKit modules on MGT1+SQL1 (if you want SQL1 to be the reference for the databases).
The clusters are in (MGT1+SQL1-ALONE, MGT2+SQL2-STOP).
Force start as second the SafeKit modules on MGT2+SQL2.
The clusters are in (MGT1+SQL1-PRIM, MGT2+SQL2-SECOND); the SQL2 databases are resynchronized from SQL1.
Re-enable Automatic start at boot of the SafeKit modules and resume the errd and checker monitoring.
The clusters are restarted and migrated.

Decide with the customer a service interruption to make the migration.
Check in the Windows registry of both management nodes that the connection to the SQL databases is really external and the same for each node. According this Milestone KB, the registry key for SQL connection is HKEY_LOCAL_MACHINE\SOFTWARE\VideoOS\Server\ConnectionString.
Make a backup of databases on the external SQL for security and also for step 11. Default databases are according this Milestone KB: Surveillance, Surveillance_IDP, SurveillanceLogServerV2, Surveillance_IM.
This step is mandatory for step 12.
Put the cluster in (MGT1-PRIM, MGT2-SECOND).
Protect the SafeKit nodes from an automatic start of the SafeKit module at boot during the migration (if nodes are rebooted for any reason during the migration).
Remove the automatic start of the module at boot: in a command prompt under c:\safekit, type "safekit boot -m AM off" where AM is the module name.
Do it for on both nodes.
Put the cluster in (MGT1-ALONE, MGT2-STOP).
Suspend the monitoring of processes during the migration on MGT1. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT1 from Milestone version N to Milestone version N+1 with migration of the databases on the external SQL.
Note: the migration requires that the management services are running, that’s why the migration is made in the ALONE state without SafeKit checkers.
Register the virtual IP of the SafeKit management cluster (NOT the SQL IP address) with the Server Configurator GUI.
At this step, MGT1+SQL are migrated to Milestone version N+1 and MGT2 is in version N.
Stop the ALONE SafeKit module: the cluster is in (MGT1-STOP, MGT2-STOP) with the external database migrated to version N+1.
To succeed the MGT2 migration, restore the backup of the database taken at step 3 (as a precaution before restoring, you can take a backup of the newly migrated SQL to version N+1). The cluster is in (MGT1-STOP, MGT2-STOP) with the external database restore to version N.
Force start as prim the MGT2 SafeKit module with the version N. Use the "Force start" menu in the SafeKit web console to do that.
On MGT2, if the management services do not restart after the databases restore, you may have to reset the Milestone IDP on MGT2 (reset it with the cmd iisreset /restart and register the virtual IP of the SafeKit management cluster (NOT the SQL IP address) with the Server Configurator GUI). Check with Milestone support.
The cluster is in (MGT1-STOP, MGT2-ALONE).
Suspend the monitoring of processes during the migration on MGT2. Use the "Disable/enable" menu in the SafeKit web console to do that. Suspend also checkers with the same menu.
Migrate MGT2 from Milestone version N to Milestone N+1 with migration of the databases on the external SQL.
Register the virtual IP of the SafeKit management cluster (NOT the SQL IP address) with the Server Configurator GUI.
At this step all nodes are migrated.
Stop the SafeKit module on MGT2.
The cluster is in (MGT1-STOP, MGT2-STOP).
Force start as prim the SafeKit module on MGT1.
The cluster is in (MGT1-ALONE, MGT2-STOP).
Force start as second the SafeKit module on MGT2.
The cluster is in (MGT1-PRIM, MGT2-SECOND).
Re-enable Automatic start at boot of the SafeKit module and resume the errd and checker monitoring.
The cluster is restarted and migrated.

Redundancy at the application level

In this type of solution, only application data are replicated. And only the application is restared in case of failure.

With this solution, restart scripts must be written to restart the application.

We deliver application modules to implement redundancy at the application level (like the Windows or Linux module provided in the free trial below). They are preconfigured for well known applications and databases. You can customize them with your own services, data to replicate, application checkers. And you can combine application modules to build advanced multi-level architectures.

This solution is platform agnostic and works with applications inside physical machines, virtual machines, in the Cloud. Any hypervisor is supported (VMware, Hyper-V...).

Solution for a new application (restart scripts to write): Windows, Linux

Redundancy at the virtual machine level

In this type of solution, the full Virtual Machine (VM) is replicated (Application + OS). And the full VM is restarted in case of failure.

The advantage is that there is no restart scripts to write per application and no virtual IP address to define. If you do not know how the application works, this is the best solution.

This solution works with Windows/Hyper-V and Linux/KVM but not with VMware. This is an active/active solution with several virtual machines replicated and restarted between two nodes.

Solution for a new application (no restart script to write): Windows/Hyper-V, Linux/KVM

SafeKit Solutions Overview

SafeKit Quick Installation Guides

Key differentiators of high availability at the virtual machine level or at the application level

Key differentiators of SafeKit vs Microsoft Hyper-V cluster and VMware HA

Key differentiators of a mirror cluster with replication and failover

Evidian SafeKit mirror cluster with real-time file replication and failover
3 products in 1 More info >	The SafeKit high availability software saves on Windows and Linux the cost of : external shared or replicated storage, load balancing boxes, enterprise editions of OS and databases SafeKit includes all clustering features: synchronous real-time file replication, monitoring of server / network / software failures, automatic application restart, virtual IP address switched in case of failure to reroute clients
Very simple configuration More info >	The cluster configuration is very simple and made by means of application modules. New services and new replicated directories can be added to an existing application module to complete a high availability solution All the configuration of clusters is made using a simple centralized web administration console There is no domain controller or active directory to configure as with Microsoft cluster
Synchronous replication More info >	The real-time replication is synchronous with no data loss on failure This is not the case with asynchronous replication
Fully automated failback More info >	After a failure when a server reboots, the replication failback procedure is fully automatic and the failed server reintegrates the cluster without stopping the application on the only remaining server This is not the case with most replication solutions particularly with replication at the database level. Manual operations are required for resynchronizing a failed server. The application may even be stopped on the only remaining server during the resynchonization of the failed server
Replication of any type of data More info >	The replication is working for databases but also for any files which shall be replicated This not the case for replication at the database level
File replication vs disk replication More info >	The replication is based on file directories that can be located anywhere (even in the system disk) This is not the case with disk replication where special application configuration must be made to put the application data in a special disk
File replication vs shared disk More info >	The servers can be put in two remote sites This is not the case with shared disk solutions
Remote sites and virtual IP address More info >	All SafeKit clustering features are working for 2 servers in remote sites. Replication requires an extended LAN type network (latency = performance of synchronous replication, bandwidth = performance of resynchronization after failure). If both servers are connected to the same IP network through an extended LAN between two remote sites, the virtual IP address of SafeKit is working with rerouting at level 2 If both servers are connected to two different IP networks between two remote sites, the virtual IP address can be configured at the level of a load balancer with the "healh check" of SafeKit.
Quorum and split brain More info >	The solution works with only 2 servers and for the quorum (network isolation between both sites), a simple split brain checker to a router is offered to support a single execution of the critical application This is not the case for most clustering solutions where a 3^rd server is required for the quorum
Active/active cluster More info >	The secondary server is not dedicated to the restart of the primary server. The cluster can be active-active by running 2 different mirror modules This is not the case with a fault-tolerant system where the secondary is dedicated to the execution of the same application synchronized at the instruction level
Uniform high availability solution More info >	SafeKit implements a mirror cluster with replication and failover. But it imlements also a farm cluster with load balancing and failover. Thus a N-tiers architecture can be made highly available and load balanced with the same solution on Windows and Linux (same installation, configuration, administration with the SafeKit console or with the command line interface). This is unique on the market This is not the case with an architecture mixing different technologies for load balancing, replication and failover
RTO / RPO More info >	SafeKit implements quick application restart in case of failure: around 1 mn or less Quick application restart is not ensured with full virtual machines replication. In case of hypervisor failure, a full VM must be rebooted on a new hypervisor with a recovery time depending on the OS reboot as with VMware HA or Hyper-V cluster

Key differentiators of a farm cluster with load balancing and failover

Evidian SafeKit farm cluster with load balancing and failover
No load balancer or dedicated proxy servers or special multicast Ethernet address More info >	The solution does not require load balancers or dedicated proxy servers above the farm for imlementing load balancing. SafeKit is installed directly on the application servers in the farm. The load balancing is based on a standard virtual IP address/Ethernet MAC address and is working with physical servers or virtual machines on Windows and Linux without special network configuration This is not the case with network load balancers This is not the case with dedicated proxies on Linux This is not the case with a specific multicast Ethernet address on Windows
All clustering features More info >	The solution includes all clustering features: virtual IP address, load balancing on client IP address or on sessions, monitoring of server / network / software failures, automatic application restart with a quick revovery time and a replication option with a mirror module This is not the case with other load balancing solutions. They are able to make load balancing but they do not include a full clustering solution with restart scripts and automatic application restart in case of failure. They do not offer a replication option The cluster configuration is very simple and made by means of application modules. There is no domain controller or active directory to configure on Windows. The solution works on Windows and Linux
Remote sites and virtual IP address More info >	If servers are connected to the same IP network through an extended LAN between remote sites, the virtual IP address of SafeKit is working with load balancing at level 2 If servers are connected to different IP networks between remote sites, the virtual IP address can be configured at the level of a load balancer with the help of the SafeKit health check. Thus you can implement load balancing but also all the clustering features of SafeKit, in particular monitoring and automatic recovery of the critical application on application servers
Uniform high availability solution More info >	SafeKit imlements a farm cluster with load balancing and failover. But it implements also a mirror cluster with replication and failover. Thus a N-tiers architecture can be made highly available and load balanced with the same solution on Windows and Linux (same installation, configuration, administration with the SafeKit console or with the command line interface). This is unique on the market This is not the case with an architecture mixing different technologies for load balancing, replication and failover

Key differentiators of the SafeKit high availability technology

Software clustering vs hardware clustering More info >
A simple software cluster with the SafeKit package just installed on two servers	Complex hardware clustering with external storage or network load balancers
Shared nothing vs a shared disk cluster More info >
SafeKit is a shared-nothing cluster: easy to deploy even in remote sites	A shared disk cluster is complex to deploy
Application High Availability vs Full Virtual Machine High Availability More info >
Application HA supports hardware failure and software failure with application checkers. Quick recovery time by restarting only the application (RTO around 1 mn or less). Application HA requires to define restart scripts per application and folders to replicate (SafeKit application modules).	Full virtual machines HA supports hardware failure and some software failures like a frozen VM. VM reboot on failure and recovery time depending on the OS reboot. No restart scripts to define with full virtual machines HA (SafeKit hyperv.safe or kvm.safe modules). Hypervisors are active/active with just multiple virtual machines.
High availability vs fault tolerance More info >
No dedicated server with SafeKit. Each server can be the failover server of the other one.Software failure with restart in another OS environment. Smooth upgrade of application and OS possible server by server (version N and N+1 can coexist)	Secondary server dedicated to the execution of the same application synchronized at the instruction level.Software exception on both servers at the same time. Smooth upgrade not possible
Synchronous replication vs asynchronous replication More info >
SafeKit implements real-time synchronous replication with no data loss in case of failure	With asynchronous replication, there is data loss on failure
Byte-level file replication vs block-level disk replication More info >
SafeKit implements real-time byte-level file replication and is simply configured with application directories to replicate even in the system disk	Block-level disk replication is complex to configure and requires to put application data in a special disk
Heartbeat, failover and quorum to avoid 2 master nodes More info >
To avoid 2 masters, SafeKit proposes a simple split brain checker configured on a router	To avoid 2 masters, other clusters require a complex configuration with a third machine, a special quorum disk, a special interconnect
Virtual IP address primary/secondary, network load balancing, failover More info >
No dedicated proxy servers and no special network configuration are required in a SafeKit cluster for virtual IP addresses	Special network configuration is required in other clusters for virtual IP addresses. Note that SafeKit offers a health check adapted to load balancers

VM HA with the SafeKit Hyper-V or KVM module	Application HA with SafeKit application modules

SafeKit inside 2 hypervisors: replication and failover of full VM	SafeKit inside 2 virtual or physical machines: replication and failover at application level
Replicates more data (App+OS)	Replicates only application data
Reboot of VM on hypervisor 2 if hypervisor 1 crashes Recovery time depending on the OS reboot VM checker and failover (Virtual Machine is unresponsive, has crashed, or stopped working)	Quick recovery time with restart of App on OS2 if crash of server 1 Around 1 mn or less (see RTO/RPO here) Application checker and software failover
Generic solution for any application / OS	Restart scripts to be written in application modules
Works with Windows/Hyper-V and Linux/KVM but not with VMware	Platform agnostic, works with physical or virtual machines, cloud infrastructure and any hypervisor including VMware

SafeKit with the Hyper-V module or the KVM module	Microsoft Hyper-V Cluster & VMware HA

No shared disk - synchronous real-time replication instead with no data loss	Shared disk and specific extenal bay of disk
Remote sites = no SAN for replication	Remote sites = replicated bays of disk across a SAN
No specific IT skill to configure the system (with hyperv.safe and kvm.safe)	Specific IT skills to configure the system
Note that the Hyper-V/SafeKit and KVM/SafeKit solutions are limited to replication and failover of 32 VMs.	Note that the Hyper-V built-in replication does not qualify as a high availability solution. This is because the replication is asynchronous, which can result in data loss during failures, and it lacks automatic failover and failback capabilities.

Milestone Management Migration with SafeKit

Evidian SafeKit

Warning, these procedures are simple guidelines. Evidian is not an expert of Milestone migration procedures. They must be validated by Milestone support according your Milestone versions.

1. Scenario with Milestone Management and SQL in the same SafeKit cluster

Use arrows to see main steps

2. Scenario with Milestone Management and SQL in two different SafeKit clusters

Use arrows to see main steps

3. Scenario with Milestone Management in a SafeKit cluster and an external SQL not in a SafeKit cluster

Use arrows to see main steps

Partners, the success with SafeKit

How the SafeKit mirror cluster works with Windows or Linux?

Step 1. Real-time replication

Step 2. Automatic failover

Step 3. Automatic failback

Step 4. Back to normal

Choose between redundancy at the application level or at the virtual machine level

Redundancy at the application level

Redundancy at the virtual machine level

Typical usage with SafeKit

Why a replication of a few Tera-bytes?

Why a replication < 1,000,000 files?

Why a failover ≤ 32 replicated VMs?

Why a LAN/VLAN network between remote sites?

SafeKit Solutions Overview

SafeKit Quick Installation Guides

Evidian SafeKit Webinar

Webinar (pptx)

5 minutes demonstration

SafeKit Customers in all Business Activities

Best use cases [+]

Video management, access control, building management [+]

TV broadcasting [+]

Finance [+]

Industry [+]

Air traffic control [+]

Bank [+]

Transport [+]

Healthcare [+]

Government [+]

SafeKit High Availability Differentiators

Evidian SafeKit mirror cluster with real-time file replication and failover

Evidian SafeKit farm cluster with load balancing and failover

Packages (8.2)

One-month license key

Technical documentation

Training

Product information