JP2001175545A - Server system, fault diagnosing method, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a highly reliable server system, which can diagnose a fault by checking all data to be processed by a server. SOLUTION: This system has at least three servers 1-3 to respectively synchronously perform the same operation. The respective servers 1-3 respectively have data monitoring mechanisms 15, 25 and 35 for monitoring data sent onto the host bus of the present server. The respective data monitoring mechanisms 15, 25 and 35 can mutually transmit/receive data and can judge the presence/ absence of fault occurrence in comparison with data sent into the host buss of each of servers at the same timing.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a server system for providing a specific service to a client (user machine). Further, the present invention relates to a failure diagnosis method performed in such a server system and a recording medium on which a program for executing the failure diagnosis method is recorded.

[0002]

2. Description of the Related Art As a server system for providing a specific service to a client (user machine), there is a server system operated by one server.
However, in this server system, since there is one server, there is a problem that data reliability when a failure occurs in the server is lacking. In addition, when a failure occurs, it is necessary to suspend the operation of the system until the failure is recovered.

As a system that solves the above problem, there is a server system including two servers that perform the same operation. In this server system, each server performs the same operation in synchronization with each other, and when a failure occurs in any one of the servers, the server in which the failure has occurred is separated and the remaining servers operate the system. However, this server system does not have a function of comparing data between servers, so that it was not possible to accurately determine the occurrence of a failure. Therefore, recently, various measures have been taken to improve the reliability of the system.

FIG. 3 shows an example of a conventional server system.
Fig. 1 shows a server system in which the reliability of the system is improved by comparing data between the servers. This server system has two servers 100 and 200 that perform the same operation in clock synchronization. The server 100 has a CPU 10
1, 102, memory controller 103, memory 10
4. I / O controller 105, data check mechanism 1
06, the server 200 includes the CPUs 201 and 20
2, memory controller 203, memory 204, I / O
It comprises a controller 205 and a data check mechanism 206. Since the servers 100 and 200 have the same configuration, only the configuration of the server 100 will be described here, and description of the configuration of the server 200 will be omitted.

The CPUs 101 and 102 are connected via a bus to a memory controller 103 for controlling writing and reading of data in the memory 104. The output terminal (OUT) of the memory controller 103 is connected to the I / O
Connected to the input terminal (IN) of the O controller 105,
The input terminal (IN) of the memory controller 103 is an I / O
It is directly connected to the output terminal (OUT) of the controller 105. The I / O controller 105 controls a plurality of PCI / ISA devices connected via a PCI (Peripheral Component Interconnect) bus or an ISA (Industry Standard Architecture) bus which is an expansion bus.

In this server system, the data check mechanism 106 on the server 100 side uses the memory controller 1
03 to the I / O controller 105 is sent to the data check mechanism 206 of the server 200, and the data check mechanism 206 of the server 200 sends the data A from the memory controller 203 to the I / O controller 205.
Is sent to the data check mechanism 106 on the server 100 side. Data check mechanism 106
Is the data A output from the memory controller 103
Is compared with the data B received from the data check mechanism 206. If the two data are the same, it is determined that a normal operation has occurred. If the two data are different, it is determined that a failure has occurred in one of the servers.
Similarly, the data check mechanism 206 compares the data B output from the memory controller 203 with the data A received from the data check mechanism 106. If the two data are the same, the data check mechanism 206 operates normally. Is determined to have failed. If any one of the servers has an error, each data check mechanism 10
6, 206 recognizes a server failure by data comparison and disconnects the failed server from the system. Which server has a failure is determined based on the past operation history.

[0007]

However, in the above-described conventional server system, the comparison of data by the data check mechanism is performed only for data output from the memory controller to the I / O controller, and the
Data output from the O controller to the memory controller cannot be checked. For this reason, the occurrence of a failure on the I / O controller side cannot be accurately determined, and in that respect, reliability is lacking. An object of the present invention is to solve the above problem and provide a highly reliable server system capable of diagnosing a failure by checking all data processed by the server. Another object of the present invention is to provide a failure diagnosis method capable of realizing such a server system and a recording medium on which a program for executing the failure diagnosis method is recorded.

[0008]

In order to solve the above problems, a server system according to the present invention has at least three servers which perform the same operation in synchronization, and each of the servers has its own host bus. Data monitoring means for monitoring the data transmitted to the respective servers, the data monitoring means of each of the servers can transmit and receive data to each other, and compare the data transmitted on the host bus of each server at the same timing. Then, it is configured to determine whether or not a failure has occurred.

A failure diagnosis method according to the present invention is a failure diagnosis method performed in a server system having at least three servers that perform the same operation in synchronization, and is transmitted to a host bus in each of the servers. It is characterized in that data is monitored and data transmitted on the host bus of each server at the same timing is compared to determine whether or not a failure has occurred.

[0010] The recording medium of the present invention stores data transmitted on the host bus of its own server as comparison data, and outputs the comparison data to another server operating in the same manner in synchronization with its own server. Processing, receiving the comparison data corresponding to the stored comparison data from the other server, and comparing the received comparison data with the stored comparison data to determine whether a failure has occurred; A failure diagnosis program to be executed is recorded.

(Operation) In the present invention as described above, all the data transmitted on the host bus of each server is compared, so that all the data processed by the server can be checked. Therefore, data from an I / O device connected by an expansion bus, which could not be checked conventionally, can also be checked.

[0012]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of the server system of the present invention. This server system
It has three servers 1 to 3 that perform the same operation in clock synchronization. Here, the number of servers will be described as three, but may be four or more.

The server 1 includes CPUs 11 and 12, a control circuit (chip set) 13, a memory 14, a data monitoring mechanism 15,
PCI device 16, ISA device 17, PCI / I
It comprises an SA bridge 18. The CPUs 11 and 12, the control circuit 13, and the data monitoring mechanism 15 are connected via a host bus. A memory 14 is connected to the control circuit 13, and further, an I / O device in which a PCI device 16 and an ISA device 17 are connected by a PCI / ISA bridge 17 is connected. Here, PCI
The device 16 is a device connected via a PCI bus which is an expansion bus, and the ISA device 17 is a device which is connected via an ISA bus which is an expansion bus. The control circuit 13 controls writing and reading in the memory 14 and also controls the PCI device 16 and the ISA device 1.
7 is controlled. For example, the control circuit 13
Passes an interrupt request from each PCI device 16 to the data monitoring mechanism 15 and permits only those permitted by the data monitoring mechanism 15 to interrupt.

The server 2 has the same configuration as the server 1 described above.
CPUs 21 and 22, control circuit (chipset) 23, memory 24, data monitoring mechanism 25, PCI device 26, IS
A device 27 and a PCI / ISA bridge 28. The server 3 has the same configuration as the server 1 and has a CPU 3
1, 32, a control circuit (chip set) 33, a memory 34, a data monitoring mechanism 35, a PCI device 36, an ISA device 37, and a PCI / ISA bridge 38.

The data monitoring mechanism 15, 25, 3 of each server
5 is configured to be able to mutually transmit and receive data,
It stores the data transmitted on its own host bus and transmits the stored data to the data monitoring mechanisms of the other two servers. In addition, each data monitoring mechanism 1
5, 25, and 35 compare the data transmitted by themselves with the data received from another data monitoring mechanism, determine the presence or absence of a failure based on the comparison result, and identify the server in which the failure has occurred from the system. Disconnect or restore. Furthermore, each data monitoring mechanism 15, 25, 35
It also controls interrupts from CI devices and ISA devices.

In the server system of this embodiment, each server 1
3 perform the same operation in clock synchronization, and provide a desired service in response to a request from a client (not shown). CPUs 11, 21, 31 of each of the servers 1 to 3
Performs processing at the same timing, and sends processing results to the host bus at the same timing. Each CPU 12, 22,
Similarly, the process is performed at the same timing for 32. The timing at which one of the two CPUs (for example, in the case of the server 1, the CPUs 11 and 12) occupies the host bus is the same between the servers 1 to 3.

Since the PCI devices of each of the servers 1 to 3 have external data access, interrupts of the respective PCI devices do not occur at the same timing among the three servers 1 to 3. Therefore, in order to synchronize the interrupt operation of each PCI device, even if the interrupt of the PCI device is raised in one server, it is necessary to wait until the same interrupt is raised in the other two devices. In the present embodiment, each of the PCI devices 16, 26, 3
6 are assigned by the control circuits 13, 23, and 33, respectively. The control circuits 13, 23, and 33 stop interrupts of PCI devices, and all the servers stop the interrupt. When the interrupt of the PCI device is raised, the use permission of the PCI bus is given to each PCI device. Thereby, the interrupt processing from the PCI device is performed at the same timing between the servers.

As can be seen from the above operation, in the server system of this embodiment, if the system is operating normally,
Data of the same content is transmitted to the host bus of each server at the same timing. Therefore, it is possible to determine whether a failure has occurred by comparing the corresponding data transmitted on the host bus of each server.

Hereinafter, the determination of the occurrence of a failure and the processing for recovery / recovery of the failure will be specifically described.

The data monitoring mechanism 15, 25, 3 of each server
5 stores the data transmitted on the host bus of its own server and transmits the stored data to the data monitoring mechanisms of the other two servers. For example, in the case of the data monitoring mechanism 15 of the server 1, the memory 14, the PCI device 16, and the ISA device 1
7, data from the memory 14, the PCI device 16 and the ISA device 17 to each CPU 11, 1
2 is stored in the data monitoring mechanism 15 and the stored data is sent from the data monitoring mechanism 15 to each of the data monitoring mechanisms 25 and 35 of the other servers.

The data monitoring mechanism 15, 25, 3 of each server
5 compares the data transmitted by itself with the data transmitted from another data monitoring mechanism. If all the compared data are the same, it is determined that no failure has occurred in any of the servers, and the operation of each server is continued as it is. If any of the data is different, it is determined that a failure has occurred in the server having the different data, the server is separated from the system, and a display means (not shown) (not shown) indicates that fact. Notify the operator via such as. As an example, the operation of the data monitoring mechanism 15 when a failure occurs in the server will be described below.

(1) When the data of the data monitoring mechanisms 25 and 35 are the same and only the data of the data monitoring mechanism 15 is different: the data monitoring mechanism 15 notifies the operator that the data of the server 1 is different, and , Own server 1
To stop. In this case, the remaining data monitoring mechanism 25,
Data comparison is performed between 35 and the operation is continued.

(2) When the data of the data monitoring mechanisms 15 and 35 are the same and only the data of the data monitoring mechanism 25 is different: the data monitoring mechanism 15 separates the data monitoring mechanism 25 from the system. Then, the remaining data monitoring mechanism 35
The operation is continued by comparing the data between.

(3) When the data of the data monitoring units 15 and 25 are the same and only the data of the data monitoring unit 35 is different: The data monitoring unit 15 sets the data monitoring unit 35 in the same manner as in the above (2). Disconnect from the system. Then, the data is compared with the remaining data monitoring mechanism 25 to continue the operation.

In the case of the above (1), when the server 1 that has been disconnected from the system due to the occurrence of the failure recovers from the failure and returns to the system, the data monitoring mechanism 15 informs the data that the server 1 has returned to the system. Monitoring mechanism 25, 35
Notify to Upon receiving the notification that the server 1 has returned to the system, the data monitoring mechanisms 25 and 35
U temporarily suspends the operation of U, and the data necessary for the operation after the server 1 returns to the data monitoring mechanism 15, that is, CP
U11, 12 registers, data on memory 14, PC
The internal data of the I device 16 and the ISA device 17 are transmitted (if there is a disk, an update file after the occurrence of a failure is also transmitted). When the necessary data is transmitted to the server 1, each of the servers 1 to 3 restarts the processing in synchronization. When the server 1 returns, the servers 2, 3
In this case, the operation of the CPU is temporarily suspended, but the time required to return the server is short, and the return can be performed during a time when there is no problem in the operation of the system. It doesn't matter.

Although the operation of the data monitoring mechanism 15 has been mainly described, the operations of the data monitoring mechanisms 25 and 35 are the same as those of the data monitoring mechanism 15.

Next, a specific configuration of the data monitoring mechanisms 15, 25, 35 will be described.

FIG. 2 shows the data monitoring mechanism 1 shown in FIG.
It is a block diagram which shows the specific structure of 5, 25, 35. 2, the data monitoring mechanism comprises a data comparison / processing device 40, a host bus interface 41, a comparison data output unit 42, comparison data input units 43 and 44, an interrupt control interface 45, and a recording medium 46.

All the data transmitted on the host bus are taken into the data comparison / processing device 40 via the host bus interface 41 and stored as comparison data. The data comparison / processing device 40 outputs the stored comparison data from the comparison data output unit 42 to the data monitoring mechanisms of the other two servers.

The comparison data input units 43 and 44 receive comparison data from the data monitoring mechanisms of the other two servers. When the comparison data is input to each of the comparison data input units 43 and 44, the data comparison / processing device 40 compares the comparison data with the comparison data output from the comparison data output unit 42, and the comparison data is the same. If it is, it is determined that it is operating normally, and if any of the comparison data is different, it is determined that a failure has occurred in the server that output the comparison data. When disconnecting the failed server from the system and returning to the system, the data comparison / processing device 4 of each data monitoring mechanism
At 0, the same operation as described above is performed.

The data comparison / processing device 40 monitors an interrupt from an I / O device such as a PCI device or an ISA device via the interrupt control interface 45, and executes the same interrupt processing at the same timing between the servers. To be controlled. The interrupt control in the data monitoring mechanism 15 will be described below.

When an interrupt is raised from any of the I / O devices of its own server, the data comparison / processing device 40 notifies the other data monitoring mechanisms 25 and 35 of the interruption, and the other two servers 2 Until the same interrupt is raised in step 3, the control circuit 13 is instructed to stop the processing for the interrupt for a certain period of time. Thereby, the control circuit 13
Then, even if the interrupt of the I / O device is raised in the own server, the processing for the interrupt is not performed until the same interrupt is raised in the other two servers 2 and 3. Upon receiving a notification from the other data monitoring mechanisms 25 and 35 that the same interrupt has occurred, the data comparison / processing device 40
The control circuit 13 is given permission to interrupt the / O device. When the control circuit 13 receives permission for the interrupt of the I / O device, the control circuit 13 sends a P
Permit use of CI bus or ISA bus.

The above interrupt control operation is similarly performed in the data monitoring mechanisms 25 and 35 of the other two servers. As a result, the interrupt process from the I / O device is performed at the same timing among the servers 1 to 3.

The above-described processing by the data comparison / processing device 40 is performed according to a program recorded in the recording medium 46 in advance. As the recording medium 46, a magnetic disk, a semiconductor memory, or another recording medium can be used.

In the above description, the data monitoring mechanisms 15, 25, and 35 of each server determine the presence or absence of a failure by comparing data transmitted on the host bus. , 35 can determine the presence or absence of a failure by monitoring an interrupt from a PCI device of its own server or an I / O device of an ISA device. The operation in this case will be described below.

When an interrupt is raised from any of the I / O devices of the own server, the data monitoring mechanism 15 notifies the other data monitoring mechanisms 25 and 35 that the interrupt has occurred, and also notifies the other two servers. Until the same interrupt is raised in steps 2 and 3, the control circuit 13 is controlled so that the processing for that interrupt is stopped for a certain period of time. A process similar to this,
This is also performed in the data monitoring mechanisms 25 and 35. Thereby, in the server system, each data monitoring mechanism 15, 2
Interrupts from the I / O device can be monitored by 5, 35.

If the same interrupt occurs in each of the servers 1 to 3 within a predetermined time, the processing for the interrupt is performed in each of the servers 1 to 3 at the same time. If the same interrupt does not rise in the other two servers even after the interrupt is stopped for a certain period of time, the server that raised the interrupt is disconnected from the system assuming that a failure has occurred. If the same interrupt is not raised by only one server, the server whose interrupt is not raised is disconnected from the system as a failure. The disconnection of the failed server from the system and the return to the system are the same as in the case of the above-described data comparison, and a description thereof will be omitted.

In the above-described embodiment, in order to accurately determine which server has a failure, the system needs to be operated by at least three servers. When operating the system with three servers,
While one server is disconnected from the system due to a failure, the system is operated by the remaining two servers. If a server fails during this time, either server will fail. It cannot be accurately determined from the comparison data whether or not this has occurred. In this case, the judgment is made based on the past history. Normally, the operation on two servers is temporary until the other server is restored, and the probability of a failure occurring during this time is Low. Therefore, considering costs and the like, it is desirable to operate the system with three servers.

In this embodiment, when a failure occurs, the data monitoring mechanism of the failed server disconnects its own server from the system, and the data monitoring mechanism of another server causes the failure to occur. Server is disconnected from the system, assuming that the data monitoring mechanism of the failed server may not be able to disconnect the server. Server can be reliably disconnected from the system.

[0041]

As described above, according to the present invention,
Since all data processed by the server, including data from I / O devices that could not be checked conventionally, are checked to determine whether a failure has occurred,
There is an effect that the reliability of the system is improved as compared with the conventional one.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of a server system of the present invention.

FIG. 2 is a block diagram showing a specific configuration of a data monitoring mechanism of the server system shown in FIG.

FIG. 3 is a block diagram illustrating an example of a conventional server system.

[Explanation of symbols]

 1-3 server 11, 12, 21, 22, 31, 32 CPU 13, 23, 33 control circuit 14, 24, 34 memory 15, 25, 35 data monitoring mechanism 16, 26, 36 PCI device 17, 27, 37 ISA Device 18, 28, 38 PCI / ISA bridge 40 Data comparison / processing device 41 Host bus interface 42 Comparison data output unit 43, 44 Comparison data input unit 45 Interrupt control interface 46 Recording medium

 ──────────────────────────────────────────────────続 き Continued on the front page F-term (reference)

Claims (8)

[Claims] 1. At least three servers that perform the same operation in synchronization with each other, and each of the servers has data monitoring means for monitoring data transmitted on a host bus of its own server. The data monitoring means of the server can transmit and receive data to and from each other, and are configured to determine whether a failure has occurred by comparing data transmitted on the host bus of each server at the same timing. Characteristic server system. 2. The data monitoring means of each server, when the comparison data of its own server is different, determines that a failure has occurred in its own server, disconnects its own server from the system, and informs that fact. 2. The system according to claim 1, wherein the server is notified to the outside, and when the comparison data of another server is different, it is determined that the server has a failure and the server is separated from the system. A server system according to item 1. 3. When each server returns to the system, the data monitoring unit of each server notifies the data monitoring unit of another server that the server returns to the system, and the server returns from the data monitoring unit of another server. ,
3. The server system according to claim 2, wherein the server system is configured to send predetermined data to a data monitoring unit of the returning server. 4. Each of the servers has an I / O device connected via an expansion bus, and the data monitoring means of each of the servers monitors an interrupt from the I / O device of the server itself. 2. The server system according to claim 1, wherein the server is configured to synchronize interrupt processing operations of the respective servers. 5. The data monitoring means of each of the servers is configured to determine whether or not a failure has occurred by confirming whether or not the same interrupt has occurred in each server within a predetermined time. The server system according to claim 4, wherein 6. A failure diagnosis method performed in a server system having at least three servers performing the same operation in synchronization with each other, wherein each of the servers monitors data transmitted on a host bus, and And comparing the data transmitted at the same timing to the host bus of the server to determine whether a failure has occurred. 7. An interrupt operation of an I / O device provided in each of the servers via an expansion bus is synchronized, and an interrupt of the I / O device of each server is monitored. 7. The fault diagnosis method according to claim 6, further comprising: determining whether the same interrupt has occurred within a time to determine whether a fault has occurred. 8. A process for storing data sent out on the host bus of the own server as comparison data, and outputting the comparison data to another server operating in the same manner in synchronization with the own server. A program for receiving the comparison data corresponding to the stored comparison data from the server and comparing the received comparison data with the stored comparison data to determine whether a failure has occurred or not. A recording medium on which is recorded.