JP2005025289A - Data protecting program and method in external storage device shared by plural computer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for protecting data resources in order to prevent the competition of processing requests under the exclusive control of an external storage device when the interconnect of a communication path breaks down between a plurality of computers equipped with a shared external storage device. <P>SOLUTION: This system is configured so that an external storage device can be shared by a plurality of computers, and that those respective computers can be communicatively connected through a communication path. This method for protecting data resources is characterized to temporarily inhibit access to the external device by using exclusive control set in the external storage device when the computer group configuring this system is divided into two or more computer groups due to the failure of the communication path, and to arbitrate requests from the plurality of computer groups, and to decide the computer group which continues the operation of business by a certain method, and to newly permit access to the computer group which continues the operation. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an exclusive control technique when a shared disk is accessed from each node in a system (hereinafter referred to as a cluster system) configured to share an external storage device among a plurality of computers (hereinafter referred to as nodes).
[0002]
[Prior art]
A program that operates by accessing shared data in an external storage device on each node in a cluster system (hereinafter referred to as a “data utilization program”) must be accessed simultaneously from multiple nodes. Therefore, if the data for the external storage device is simultaneously updated from the data use program of each node, there is a risk of data destruction.
[0003]
To prevent this, an exclusive control mechanism that checks whether data can be accessed before accessing data from the data usage program at each node and denies access from other nodes while the data is being accessed. Is required.
Conventionally, as a method of arbitrating exclusive control between multiple nodes and protecting data on a shared disk, a quorum disk method (for example, Non-Patent Document 1) that records and arbitrates information on a disk of an external storage device, or between multiple nodes There is a private LAN (Local Area Network) method (for example, Patent Document 1) that uses a private communication path to communicate with each other and arbitrate, and arbitration is performed by an exclusive control program installed in each node. .
[0004]
[Non-Patent Document 1]
Windows 2000 World, February 2001, p. 25-26
[0005]
[Patent Document 1]
JP-A-7-306837 (pages 2 and 3)
[0006]
[Problems to be solved by the invention]
However, in the case of the quorum disk method described above, if the quorum disk itself fails, the shared disk resource itself of the external storage device has no problem, but the shared data resource cannot be used. .
Further, in a conventional system that employs the above-described inter-node communication format, arbitration between a plurality of nodes becomes impossible if a private LAN (inter-node communication path) fails. Communication via the private LAN cannot be performed and the state is divided (split brain), and arbitration cannot be performed so that business processing requests do not compete. Therefore, it is necessary to select a node to continue operation so that processing requests do not compete, and forcibly stop other competing nodes.
[0007]
In other words, if there is no forced stop function, or if there is a failure, resuming the operation causes data destruction. For this reason, as a whole cluster system, arbitration between nodes does not occur, and the business is stopped.
In order to solve the above problem, in the present invention, when a split brain state occurs due to a failure of a communication path between nodes in a cluster system, processing requests compete using exclusive control in the external storage device. It aims to provide a technology that protects shared data resources.
[0008]
[Means for Solving the Problems]
According to a first aspect of the present invention, there is provided a cluster system including an exclusive control mechanism in an external storage device shared between a plurality of computers connected to each other via a communication path, wherein two or more computers are included in the system due to the communication path failure. A data protection program for protecting shared data in an external storage device when it is divided into a group of computers using the exclusive control provided in the external storage device to temporarily access the external storage device An access prohibiting step to be prohibited, an operation determining step for arbitrating processing requests from a plurality of divided computer groups, and determining a computer group for continuing business operations based on a predefined rule; and The present invention relates to a data protection program for causing a computer to execute an access release step for renewing an access right to continue operation.
[0009]
That is, according to the first invention, when a failure occurs that disconnects a communication path connecting a plurality of computers, the exclusive control unit in the external storage device receives an access prohibition instruction issued from the computer. The computer group to which access should be prohibited for all computers and the operation decision unit should arbitrate in response to the processing request for business continuation from the computer group and continue operation according to the defined setting rules. Therefore, in the group of computers whose communication paths are divided in the split brain state, even if there is an accidental simultaneous access from multiple computers, the shared data resources held in the external storage device Destruction can be prevented.
[0010]
According to a second aspect of the present invention, in the operation determining step for determining a computer group to continue business, the business is continued with the computer group that has been requested earliest among requests from a plurality of computer groups. The present invention relates to a data protection program described in the invention.
That is, according to the second invention, since the operation determining unit determines the computer group that has issued the processing request earliest to access the shared disk, anyway, it is possible to cope with the recovery of the business with an emphasis on urgency. It becomes possible.
[0011]
In the third aspect of the invention, the operation determining step for determining a computer group to continue the operation adds the number of computers of each computer group as a parameter to a request from a plurality of computer groups, and the number of computers is the largest. The present invention relates to the data protection program according to the first invention, wherein the business is continued in a computer group.
That is, according to the third invention, since the operation determining unit determines the number of divided computer groups as a parameter, the determination is made from the viewpoint of emphasizing the volume in proportion to the number of computer groups. Priority will be given to clusters with multiple computers, and the solution will be focused on scalability.
[0012]
According to a fourth aspect of the present invention, in the operation determining step for determining a computer group to continue the business, a priority is added to the business being executed on each computer at the time of starting the business operation, and the business is continued. When deciding which computer group to use, the total priority of tasks in operation is added as a parameter to requests from multiple computer groups, and the business continues with the computer group with the highest total priority. The present invention relates to the data protection program described in the first invention.
[0013]
That is, according to the fourth invention, the operation determining unit adds the priority of the operation operated by each computer as a determination element as a parameter and determines the computer group having the highest priority, thereby Judgment is made taking into account the importance, and urgent and high-impact work is taken into account, giving the user greater convenience.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows the basic system configuration of the present invention. This system shows an example in which two computers share one external storage device. The system is composed of computers (nodes) 1a and 1b and an external storage device 2. The computers (nodes) mutually monitor the status of each node, and use a private LAN for control such as switching when an abnormality occurs. (LAN: Local Area Network, internal communication path) 5, and between the computers (nodes) 1 a, 1 b and the external storage device 2, there is a storage network (SAN: 6 Storage Area Network) environment.
[0015]
The computers (nodes) 1a and 1b have cluster control including data utilization programs 10a and 10b that use the shared disk 4, such as various business applications, and I / O access control units 21a and 21b that access the external storage device 2 from each computer. Parts 20a and 20b.
The control device 3 in the external storage device 2 has firmware 30, and the exclusive control unit 40 in the firmware 30 has a function of prohibiting / releasing I / O (Input / Output) access. The exclusive control unit 40 includes an access prohibition unit 41, an operation determination unit 42, and an access release unit 43.
[0016]
In the function of arbitrating the I / O release request in the firmware 30 in the external storage device 2, the I / O release request issued from two or more computers (nodes) 1a and 1b is one based on a certain rule. Accept requests only.
Note that the control device 3 in the external storage device 2 is a computer, and a preinstalled program is executed on the computer, and the access prohibition unit 41, the operation determination unit 42, and the access release unit 43 of the exclusive control unit 40 are executed. Each processing is realized. The program is recorded on a computer-readable recording medium such as a floppy disk, a compact disk, or a CD-ROM. Although not shown in the figure, the program is installed in a built-in or externally connected medium reader. It is good also as an executable state.
[0017]
FIG. 2 shows a configuration of a cluster system according to the embodiment of the present invention. In FIG. 2 and subsequent figures, the computer is expressed as a node, and the connection state of the communication path between the plurality of nodes and the external storage device 2 is schematically shown. Although not shown in particular, each node has the same components as each computer in FIG. 1, that is, a data use program, a cluster control unit, and an I / O access control unit.
[0018]
The cluster system is shown as an example composed of five nodes 1a to 1e. Similarly to FIG. 1, the external storage device 2 has an I / O access prohibition / release mechanism. The nodes 1a to 1e are interconnected by a private LAN 5, and are connected to the external storage device 2 via a storage network 6.
In the private LAN 5, when the inability to communicate between nodes due to some cause is detected and the split brain state is established in which the communication between the nodes is divided, each of the nodes 1a to 1e sends an I / O access prohibition request to the external storage device 2. To issue. In response to the I / O access prohibition request, the external storage device 2 prohibits access from all the nodes 1a to 1e.
[0019]
As a result of the split brain, the nodes 1a to 1e are divided into two or more node groups. At this time, in each of the divided node groups, the cluster control unit requests the external storage device 2 to prohibit access from all the nodes 1a to 1e.
Thereafter, the cluster control unit of each node selects one representative node by communicating with each other in the divided node group. From the viewpoint of the entire cluster system, representative nodes are selected by the number of divided node groups. The representative node requests the external storage device 2 to release I / O for the nodes constituting the node group to which the representative node belongs. As will be described later, in the exclusive control unit 40 in the firmware 30 on the external storage device 2, access rules for some I / Os are set in advance, and processing for access release requests is performed according to the setting rules. Is done.
[0020]
For example, the following setting rule can be considered.
1) Of the I / O release requests from a plurality of representative nodes, only the first request is accepted, and the other requests are errors.
2) The information on the number of nodes in the I / O release request is added and issued so that only the request having the largest number of nodes is accepted and other requests are regarded as errors.
3) By adding the priority sum given in advance to the data utilization program executed in each node group and issuing it, the request with the highest priority sum is accepted, and other requests are in error. And
Access rules such as are applied.
[0021]
In addition to these, a setting rule in which the priority and the node weight are combined may be used.
As described above, only one node group among the plurality of divided node groups can access the external storage device 2, and the suspended work can be resumed.
[0022]
At this point, if the data utilization program of the node is in a stopped state, the cluster control unit activates the data utilization program in order to resume the business.
FIG. 3 shows the state of the cluster when the private LAN between nodes according to the embodiment of the present invention is divided. This figure shows a state where a split brain has occurred due to a partial failure of the private LAN 5, and shows an example in which the node group [1a-1c] and the node group [1d-1e] are divided. .
[0023]
FIG. 4 shows the state of the counterpart node as seen from the local node when a fragmentation occurs in the private LAN according to the embodiment of the present invention. In the figure, a node in which communication with the counterpart node is lost due to the disconnection from the own node is described as LEFT, a node capable of normal communication is described as UP, and the mutual communication state is represented. .
FIG. 5 shows the state of the counterpart node relative to the own node when the access to the shared disk according to the embodiment of the present invention is restored. When the cluster control unit of each node detects the LEFT state in FIG. 4, the I / O access that suppresses access to the I / O from all the nodes 1 a to 1 e for the firmware 30 of the external storage device 2. Issue a prohibition order.
[0024]
In the state of the spread brain of the embodiment, the node group is divided into two node groups, a node group [1a-1c] and a node group [1d-1e]. After that, among each divided node group, the cluster control unit of each node selects one representative node by communicating with each other, and the representative node selects the node constituting the node group to which it belongs. An I / O release request is issued to the external storage device 2.
[0025]
In this embodiment, the representative node of the node group [1a-1c], for example, the cluster control unit of the node 1a releases the I / O access to the nodes 1a, 1b, 1c toward the firmware 30 of the external storage device 2. An instruction is issued, and at this time, the number of nodes “3” is passed as a parameter.
On the other hand, also in the representative nodes of the other node group [1d-1e], for example, an I / O access release request for the nodes 1d and 1e is issued from the cluster control unit of the node 1d together with the node number parameter “2”.
[0026]
Upon receiving these I / O access release requests, the exclusive control unit 40 on the firmware makes the issued I / O access release requests from the representative nodes of each group succeed, for example, the one with the larger number of nodes. , Process to make other requests an error. Thereby, the I / O access of the node group [1a-1c] can be restored.
[0027]
FIG. 6 shows an example of the structure of node data transmitted to the external storage device according to the embodiment of the present invention. In this embodiment, an example in which the number of nodes constituting the cluster before the failure is taken into consideration is shown.
Each node of the cluster system passes node data stored in advance to the external storage device 2 at the time of failure. As shown in the figure, the node data transmitted to the external storage device 2 is composed of the following fields a, b, c, d, and e.
a: I / O access prohibition or release instruction.
b: Node ID (identifier) of the transmission source of this data. For example, it is expressed by a character string such as node1a.
c: A node with which the node having the ID in the field b can communicate. For example, node1a, node1b, node1c, etc.
d: The number of original nodes in which the node having the ID in the field b constitutes the cluster.
e: Represent user's business information in 0/1. Indicates whether or not a user job is operating on the node defined in b. It is also possible to set the weight.
[0028]
FIG. 7 shows an access priority rule for a request from a node group according to the embodiment of the present invention. The following three definition examples are shown as setting rules.
Rule 1: With reference to the I / O access prohibition / release command of field a from a plurality of nodes in the transmission data of the node, the node 1 whose access time is earlier is determined to release the access.
[0029]
Rule 2: Refers to the fields a, c, and d in the node transmission data, and is determined by the size of the number of c / number of d (> = 0.5).
Rule 3: Refers to fields a, c, d, and e, and is determined by the magnitude of the value of (number of c + total of e in nodes of c) / (number of d + total of e of all nodes).
As described above, which rule is applied is set in advance.
[0030]
FIG. 8 shows a flowchart of processing in the shared disk at the time of failure according to the embodiment of the present invention.
When the interconnect 5 connecting the nodes of the cluster system is disconnected, first, the access prohibition unit 41 of the exclusive control unit 40 of the external storage device 2 performs I / O access control on the node 1 side in step S11. In step S12, access to the shared disk 4 is temporarily prohibited for all nodes.
[0031]
Next, in step S13, the operation determining unit 42 receives an access release request from the representative node of the divided node group. In step S14, the operation determining unit 42 determines that the preset setting rule condition is met, and the access shown in FIG. By applying the transmitted node data to the priority definition rule, the node group of the access release request that matches the condition is determined. In step S15, as shown in the internal table of FIG. 5, the determined access release request is determined. The value belonging to the node group of UP is set to UP, and the value other than that is set to DOWN. As a result, the continuation of business in the node group is resumed.
[0032]
On the other hand, if the setting rule is not met in step S14, access from the node is denied in step S16.
As described above, in the embodiments so far, the data protection program of the present invention has been described as applied to the external storage device side, but of course, it may be applied to the computer (node) side to have the same effect. Is possible.
[0033]
(Appendix 1) In a cluster system in which an external storage device shared by a plurality of computers connected to each other via a communication path is provided with an exclusive control mechanism, the computer group constituting the system due to a failure in the communication path includes two or more computers A data protection program for protecting shared data in an external storage device when divided into groups,
An access prohibiting step for temporarily prohibiting access to the external storage device using exclusive control provided in the external storage device;
An operation determination step for arbitrating processing requests from a plurality of divided computer groups and determining a computer group for continuing the operation of the business based on a predefined rule;
A data protection program for causing a computer to execute an access release step for renewing an access right for continuing operation to the computer.
[0034]
(Additional remark 2) The said operation determination step which determines the computer group which continues business performs the business by the computer group requested | required earliest among the requests from several computer groups, The additional description 1 characterized by the above-mentioned. Data protection program.
(Additional remark 3) The said operation determination step which determines the computer group which continues business adds the number of computers of each computer group to the request | requirement from several computer groups as a parameter, and the computer group with the largest number of computers The data protection program according to appendix 1, wherein the business is continued at
[0035]
(Supplementary Note 4) In the operation determination step for determining a computer group to continue the business, a priority is added to the business being executed on each computer at the time of starting the business operation, and the computer to continue the business. Addendum characterized in that when determining a group, the sum of the priorities of the tasks in operation is added as a parameter to requests from multiple computer groups, and the task is continued on the computer group with the highest sum of priorities. The data protection program according to 1.
[0036]
(Supplementary Note 5) In a cluster system in which an exclusive control mechanism is provided in an external storage device shared between a plurality of computers connected to each other via a communication path, the computer group constituting the system due to a failure in the communication path includes two or more computers A data protection method for protecting shared data in an external storage device when divided into groups,
An access prohibiting step for temporarily prohibiting access to the external storage device using exclusive control provided in the external storage device;
An operation determination step for arbitrating processing requests from a plurality of divided computer groups and determining a computer group for continuing the operation of the business based on a predefined rule;
An access release step of re-permitting an access right for continuing operation to the computer.
[0037]
(Supplementary Note 6) In a cluster system in which an external storage device shared by a plurality of computers connected to each other via a communication path is provided with an exclusive control mechanism, the computer group constituting the system due to a failure in the communication path includes two or more computers A data protection device that protects shared data in an external storage device when divided into groups,
Using the exclusive control provided in the external storage device, an access prohibition unit that temporarily prohibits access to the external storage device;
An operation determining unit that arbitrates processing requests from a plurality of divided computer groups and determines a computer group to continue the operation of the business based on a predefined rule;
A data protection apparatus, comprising: an access release unit that re-permits an access right for continuing operation to the computer.
[0038]
(Supplementary note 7) In a cluster system having an exclusive control mechanism in an external storage device shared between a plurality of computers connected to each other via a communication path, the computer group constituting the system due to a failure in the communication path includes two or more computers A recording medium recording a data protection program for protecting shared data of an external storage device when divided into groups,
An access prohibiting step for temporarily prohibiting access to the external storage device using exclusive control provided in the external storage device;
An operation determination step for arbitrating processing requests from a plurality of divided computer groups and determining a computer group for continuing the operation of the business based on a predefined rule;
A computer-readable recording medium having recorded thereon a data protection program for causing the computer to execute an access release step for re-permitting an access right for continuing operation to the computer.
[0039]
【The invention's effect】
As described above, according to the present invention, an access prohibition instruction issued from a computer (node) is issued to an external storage device when a failure occurs in which a communication path connecting a plurality of computers (nodes) is disconnected. Defined by the exclusive control unit in the system, once access to all computers (nodes) is prohibited, the operation decision unit arbitrates in response to the processing request for business continuation from the computer group and is defined. A computer group to continue operation is determined according to the setting rule.
[0040]
For this reason, even in the case of simultaneous access to multiple computers (nodes) by mistake in a computer group in which the communication path is divided in the split brain state, it is retained in the external storage device by exclusive control. The shared data resources are not used at the same time, and data destruction can be prevented.
[Brief description of the drawings]
FIG. 1 is a diagram showing a basic system configuration according to the present invention.
FIG. 2 is a diagram showing a configuration of a cluster system according to the embodiment of the present invention.
FIG. 3 is a diagram showing a state of a cluster when a division occurs in a private LAN between nodes according to an embodiment of the present invention.
FIG. 4 is a diagram showing a state of a counterpart node viewed from the own node when a division according to an embodiment of the present invention occurs.
FIG. 5 is a diagram showing a state of a counterpart node with respect to the own node when access to a shared disk according to an embodiment of the present invention is restored;
FIG. 6 is a diagram showing a structure example of node data transmitted to the external storage device according to the embodiment of the present invention.
FIG. 7 is a diagram illustrating an access priority rule for a request from a node group according to the embodiment of this invention.
FIG. 8 is a diagram showing a flowchart of processing in the shared disk at the time of failure according to the embodiment of the present invention;
[Explanation of symbols]
1a, 1b ... 1e Computer (node)
2 External storage device 3 Control device 4 Shared disk 5 Private LAN
6 Storage network 10a, 10b Data utilization program 20a, 20b Cluster control unit 21a, 21b I / O access control unit 30 Firmware 40 Exclusive control unit 41 Access prohibition unit 42 Operation decision unit 43 Access release unit

Claims (5)

In a cluster system having an exclusive control mechanism in an external storage device shared between a plurality of computers connected to each other via a communication channel, the computer group constituting the system is divided into two or more computer groups due to the failure of the communication channel. A data protection program for protecting the shared data of the external storage device,
An access prohibiting step for temporarily prohibiting access to the external storage device using exclusive control provided in the external storage device;
An operation determination step for arbitrating processing requests from a plurality of divided computer groups and determining a computer group for continuing the operation of the business based on a predefined rule;
A data protection program for causing a computer to execute an access release step for renewing an access right for continuing operation to the computer. 2. The data protection program according to claim 1, wherein the operation determining step of determining a computer group to continue the business continues the business with the computer group that has requested the earliest among requests from a plurality of computer groups. . In the operation determining step for determining the computer group to continue the operation, the number of computers in each computer group is added as a parameter to the request from the plurality of computer groups, and the operation is continued in the computer group having the largest number of computers. The data protection program according to claim 1, wherein: In the operation determining step for determining a computer group to continue the business, a priority is added to the business being executed on each computer at the time of starting the business operation, and the computer group to continue the business is determined. 2. The process according to claim 1, wherein a total sum of priorities of operations in operation is added as a parameter to requests from a plurality of computer groups, and the business is continued with a computer group having the largest sum of priorities. Data protection program. In a cluster system having an exclusive control mechanism in an external storage device shared between a plurality of computers connected to each other via a communication channel, the computer group constituting the system is divided into two or more computer groups due to the failure of the communication channel. A data protection method for protecting the shared data of the external storage device,
An access prohibiting step for temporarily prohibiting access to the external storage device using exclusive control provided in the external storage device;
An operation determination step for arbitrating processing requests from a plurality of divided computer groups and determining a computer group for continuing the operation of the business based on a predefined rule;
An access release step of re-permitting an access right for continuing operation to the computer.

Images