Resilient data storage in the presence of replication faults and rolling disasters

A method for data protection, comprising:

• in a first operational mode, sending data items for storage in a primary storage device and in a secondary storage device, while temporarily caching the data items in a disaster-proof storage unit and subsequently deleting the data items from the disaster-proof storage unit, wherein each data item is deleted from the disaster-proof storage unit upon successful storage of the data item in the secondary storage device;
• receiving an indication of a fault related to storage of the data in the secondary storage device;
• responsively to the indication, switching to operating in a second operational mode in which the data items are sent for storage at least in the primary storage device and are cached and retained in the disaster-proof storage unit irrespective of the successful storage of the data items in the secondary storage device;
• and
• after switching to operating in the second operational mode, receiving a notification related to memory unavailability in the disaster-proof storage device, and switching back to the first operational mode responsively to the notification.

A method for data protection, comprising:

• in a first operational mode, sending data items for storage in a primary storage device and in a secondary storage device, while temporarily caching the data items in a disaster-proof storage unit and subsequently deleting the data items from the disaster-proof storage unit, wherein each data item is deleted from the disaster-proof storage unit upon successful storage of the data item in the secondary storage device;
• receiving an indication of a fault related to storage of the data in the secondary storage device;
• responsively to the indication, switching to operating in a second operational mode in which the data items are sent for storage at least in the primary storage device and are cached and retained in the disaster-proof storage unit irrespective of the successful storage of the data items in the secondary storage device;
• and
• continuing to operate in the first operational mode irrespective of the indication responsively to determining that the fault is associated with an identifiable software failure.

A data protection apparatus, comprising:

• an interface, which is configured to receive data items from one or more data sources;
• and
• a processor, which is configured to operate in a first operational mode by sending the data items for storage in a primary storage device and in a secondary storage device, while temporarily caching the data items in a disaster-proof storage unit and subsequently deleting the data items from the disaster-proof storage unit, wherein each data item is deleted from the disaster-proof storage unit upon successful storage of the data item in the secondary storage device, and which is configured, responsively to receiving an indication of a fault related to storage of the data in the secondary storage device, to switch to operating in a second operational mode, in which the data items are sent for storage at least in the primary storage device and are cached and retained in the disaster-proof storage unit, by instructing the disaster-proof storage unit to retain the data items irrespective of the successful storage of the data items in the secondary storage device,
• wherein the processor is configured, after switching to operating in the second operational mode, to receive a notification related to memory unavailability in the disaster-proof storage device, and to switch back to the first operational mode responsively to the notification.

A data protection apparatus, comprising:

• an interface, which is configured to receive data items from one or more data sources;
• and
• a processor, which is configured to operate in a first operational mode by sending the data items for storage in a primary storage device and in a secondary storage device, while temporarily caching the data items in a disaster-proof storage unit and subsequently deleting the data items from the disaster-proof storage unit, wherein each data item is deleted from the disaster-proof storage unit upon successful storage of the data item in the secondary storage device, and which is configured, responsively to receiving an indication of a fault related to storage of the data in the secondary storage device, to switch to operating in a second operational mode, in which the data items are sent for storage at least in the primary storage device and are cached and retained in the disaster-proof storage unit, by instructing the disaster-proof storage unit to retain the data items irrespective of the successful storage of the data items in the secondary storage device,
• wherein the processor is configured to continue to operate in the first operational mode irrespective of the indication responsively to determining that the fault is associated with an identifiable software failure.