Tape: what it is still good at

The throughput arithmetic in the previous lesson treated the restore path as a pipe with a width, and every term in it was a rate. Tape does not fit that model, and the reason it does not fit is the reason it survives. A tape tier is mostly not a rate problem: it is a problem of where a physical object is, who can reach it, and what still exists that can read it. This lesson takes tape seriously as an engineering choice, which means treating it neither as a relic nor as a solution to problems it has never solved.

No tape hardware was available while this lesson was written, so nothing below is measured output. Every property comes from the published LTO specification, the SNIA format standard or the kernel driver documentation, and each number is arithmetic on a published figure with its assumptions stated.

A cartridge on a shelf has no address

Every online backup target is reachable by something. An object store with a retention lock is reachable over HTTPS, and the lock is a rule a running service evaluates before it honours a delete. An append-only repository is reachable over SSH, and the restriction is a mode the server-side process chooses to enforce. In both cases the separation between an attacker and the data is a decision made by software that is listening, and the failure mode has one shape: the software was reconfigured, the policy was changed, the privileged identity was borrowed.

A cartridge unloaded from the drive and carried to a shelf is not protected by a decision. It is protected by the absence of a path. There is no port, no endpoint and no daemon; there is a plastic shell in a rack. A stolen administrator credential is neither weak nor strong against it, because there is nothing on the other side to present a credential to. This is the physical air gap of Part XI, and the separation is a fact about geometry rather than about configuration.

The property has an exact boundary. The air gap exists while the cartridge is out of the drive and out of the robot’s reach — not while it is being written, and not while it sits in a library slot a picker can retrieve on command.

Where the cost of a tape tier actually sits

The number quoted in favour of tape is media cost per terabyte: the price of a cartridge divided by its capacity. Two things have to be right for that figure to mean anything.

The capacity must be the native figure, not the compressed one. The LTO Program publishes 18 TB native for LTO-9 and quotes a compressed figure at a 2.5:1 ratio. Compression ratio is a property of your data, not of the medium, and backup data is a poor candidate: a restic or Borg repository has already been deduplicated and compressed, and a stream of encrypted chunks compresses at essentially 1:1.

And media is only one of four terms, and the only one that scales with retained data. Drives, a library and floor space are capital that does not shrink when you retain less. Vaulting, courier movements and the operator who handles cartridges are proportional to handling rather than to bytes. The fourth term, which almost nobody includes at the point of decision, is the cost of moving the data onto newer media before the drives that read it disappear.

That gives the tier a shape rather than a price. Below some retained volume the capital term dominates and object storage is cheaper; above it the media term dominates, because the marginal cost of the eighth year of retention on tape is a shelf, while on an online tier it is another twelve invoices. Where the crossover sits depends on your own prices and handling model, which is why a per-terabyte figure from a vendor deck is not an input to this decision.

Sequential access is a property of the medium

A tape is one long strip of film. Data is laid down along it, and there is no addressing scheme that lets a head arrive at an arbitrary byte without the medium physically travelling past it. On a disk a seek is a small arm moving a short distance; on tape a seek is a wind, in which reels turn and hundreds of metres of film move.

The consequence is that retrieving one file and retrieving a large directory from the same cartridge can cost nearly the same, because both are dominated by getting the head to the right place rather than by the transfer that follows. A four-kilobyte configuration file restored from mid-tape costs what the wind costs.

The scale follows from published figures. The LTO Program states 18 TB native capacity and 400 MB/s native transfer for LTO-9. Reading a full cartridge end to end at that rate, assuming the drive never stops and ignoring compression, is 18,000,000 MB divided by 400 MB/s: 45,000 seconds, or twelve and a half hours. Streaming to the midpoint is therefore over six hours. High-speed search is much faster than read speed, but it is still a mechanical traverse of the same film, and its duration is a drive specification you must read rather than assume.

Nor is that the whole delay. Before the first byte moves, someone must identify which cartridge holds the data, get it to a drive, mount and thread it, and position — and if the cartridge is in an offsite vault, one of those steps is a vehicle. None of these terms appear in a MB/s figure, and all are paid in full for a single-file restore.

“LTO-9 drives can read and write to LTO-8 and LTO-9 media only”

The rule most operators carry in their heads is that a tape drive reads two generations back and writes one. That was true, and it stopped being true. The LTO Program’s compatibility statement is worth quoting rather than paraphrasing: “LTO drive generations 1-7 are able to read tapes from two generations prior and are able to write to tapes from the prior generation.” Then, “LTO-8 drives can read and write to LTO-7 and LTO-8 media, including LTO-7 Type M.” Then, “LTO-9 drives can read and write to LTO-8 and LTO-9 media only.” And for the current generation, “LTO-10 drives can only read and write to LTO-10 media.”

The read window narrowed from three generations to two, and then to one — which is why this belongs in a document re-read at purchase time rather than in institutional memory.

Convert that into the form that matters operationally. A drive generation defines a window of media it can read, and a retention period longer than that window is not a storage decision but a scheduled data migration: drives of both generations available at once, time to stream every retained cartridge through a read and a write, and verification that what landed is what left. For a few hundred cartridges, the arithmetic above says what the read side alone costs in drive-hours.

This is also where media shelf life stops being the interesting number. Media life is a manufacturer specification and it is always conditional: a figure in years, valid within a stated temperature and relative humidity envelope and degrading sharply outside it. A shelf-life figure quoted without its conditions is not a specification, and the right source is the datasheet for the exact generation and manufacturer you buy. But a cartridge stored perfectly and well inside its stated life is worthless if nothing in the estate reads its format.

The drive, the library and the software that wrote the tape

Tape concentrates risk in a small number of physical devices, and the honest accounting names each one.

The drive is a mechanism with moving parts, a head that wears and a service life. It is also the concurrency limit of the tier: one drive means one restore at a time, and none while it is being repaired. If the plan assumes several systems restore in parallel, the drive count is that assumption’s ceiling, and a second drive in a separate chassis is the cheapest meaningful redundancy available.

The library is a robot, and robots jam. Most libraries allow manual cartridge handling with the picker disabled, a genuinely useful fallback that nobody has ever performed correctly the first time under pressure. It belongs in a rehearsal.

The catalogue maps content to cartridges, and losing it turns a shelf of labelled plastic into a shelf of opaque plastic. Most tape products can reconstruct one by reading the media, which is a full pass per cartridge — the same arithmetic, multiplied by the library size. Treat it as recovery material, backed up separately from the tapes it describes, exactly as Part IX treats key material.

The last dependency outlives the hardware. The bytes on a cartridge are in whatever container the writing software chose, so a restore needs that software, its version, its licence and its configuration. A tape written by tar is readable by anything that reads tar; a tape written by a proprietary product is readable by that product. This is what the SNIA Linear Tape File System specification exists to remove: it defines a tape format independently of any implementation, which is why it is published as a standard rather than as a product feature. If retention outlives the vendor relationship, the format question decides whether the data survives.

What tape answers, and what it does not

Tape answers two questions well: long retention, because the marginal cost of another year is storage of an object already paid for; and physical separation, because a shelved cartridge presents no surface a compromised credential can act on.

It does not answer a short recovery time, and the reason is instructive: it is not that tape streams slowly. Four hundred megabytes per second native is respectable next to most restore paths in this course. The terms that dominate a tape restore all sit before streaming begins — locating, transporting, mounting, positioning — and the drive count caps how many restores run at once. Those terms belong to your architecture, not to the medium, which is why no recovery time objective in this course is quoted as a property of tape.

The resulting architecture is layered. Recent restore points live where retrieval is fast; long retention and the offline copy live on cartridges, satisfying the third copy of Part III and the offline requirement of Part XI at once. The failure is to collapse the layers — making tape the only copy and then promising tier-one recovery times from a vault. Whichever shape is chosen, the evidence rule from Part XVI does not relax: a restore performed from a cartridge that has actually been in the vault for a year, on the drive and software you own, is the only thing that establishes the tier works.

Production discipline

1. Define the physical air gap by the cartridge’s location, not by owning a tape tier. Name the export step, the process that performs it, and the daily check that the expected cartridges sit outside the robot’s reach.
2. Read the compatibility statement for the generations you own before committing to a retention period. The LTO Program states that LTO-9 drives read and write LTO-8 and LTO-9 media only. Any retention longer than that window is a migration project with a date on it.
3. Price the tier as capital, media, handling and migration, computed separately over the full retention horizon. Use native capacity — 18 TB for LTO-9 — never the 2.5:1 compressed figure, because deduplicated and encrypted backup data does not compress.
4. Treat the drive count as the restore concurrency limit and the catalogue as recovery material. One drive is one restore, and one repair away from none. Back the catalogue up separately from the media it indexes.
5. Publish the tape tier’s recovery time as a named sequence, never a number attached to the medium. Locate, transport, mount, position, stream, verify — with the vault arrangement and drive count stated — and prove it with a restore from a cartridge that has genuinely been offsite.

Cross-course references

• Linux for Production Sysadmins — Part XVIII (Enterprise Storage) covers SAS and Fibre Channel attachment, HBAs and SCSI device handling, the transport a tape drive hangs off; it explains why the single point of failure identified here usually presents as a storage-path fault rather than a media fault.
• Linux for Production Sysadmins — Part XLVII (Backup Strategy) develops the copy-and-tier planning this lesson supplies one input to: physical separation, marginal retention cost and sequential retrieval decide whether tape is the right third copy in that plan.
• Ceph & Distributed Storage for Production Sysadmins — Part CV (Backup Strategy) argues that replication inside a cluster is not a backup, because every replica is online and reachable by the same credentials; that is exactly the gap this lesson’s shelved cartridge fills when a Ceph estate decides where its offline copy lives.

Quiz