KR20040075174A - Method for preventing data damage in high availability system - Google Patents

Abstract

PURPOSE: A method for preventing the data loss of a high availability system is provided to prevent the data loss generated by the duplicated execution of a server on several nodes when the network is divided, and secure the maximum availability on the divided network through the diversification of a heartbeat channel and an algorithm for managing node membership and deciding a sub group. CONSTITUTION: An obstacle state of the system is checked through the heartbeat. The obstacle state and the information for the sub groups respectively divided by the heartbeat state are stored in a shared disk by using the predetermined heartbeat. The stored information and the service state information are transmitted by selecting the optimal heartbeat excluding the predetermined heartbeat. The requested service is performed by selecting the sub group and the heartbeat guaranteeing the maximum availability based on the transmitted information.

Description

Method for preventing data damage in high availability system

The present invention is to prevent data corruption due to network partition in a high availability system composed of multiple nodes.

FIG. 1 illustrates an example of a configuration of a general high availability (HA) system 100 including a plurality of server systems (nodes), and the HA system 100 of FIG. Two services are performed at Node A and Node C, respectively, and Node B is configured to fail over when a failure occurs in Node A or Node C.

FIG. 2 is a diagram illustrating a service recovery process of the HA system 100 when a failure such as a system down or a kernel panic occurs. When a failure occurs in Node A, Node B detects a failure of Node A through a heartbeat. Thus, the service performed by Node A is executed instead.

As such, the HA system 100 recovers a service from another system when the system stops completely due to a failure such as a system down or a kernel panic to perform a requested service. Make the process quick.

Meanwhile, the HA system 100 exchanges state information through a heartbeat channel, which is an important communication channel for detecting a failure of each node, and a type of heartbeat mainly used by the HA system 100 includes an Ethernet card ( Two or more private network heartbeats connected via an Ethernet card, a public network heartbeat used to provide services, and a serial heartbeat connected to a serial port. There is a disk heartbeat that connects a disk. If the HA system 100 uses only one kind of heartbeat among the four types of heartbeat, the system may operate abnormally due to inaccurate judgment. have.

FIG. 3 illustrates a case in which the HA system 100 using only the Ethernet heartbeat is abnormally operated due to the disconnection of the heartbeat among the four types of heartbeats. If it is impossible, Node B determines that Node A is down and performs the service that Node A performed. At this time, as the service (Task1) is executed on both nodes at the same time, data on the disk used by the application may be damaged. This phenomenon occurs when the network is partitioned due to a failure in the heartbeat used by the HA system 100. In this case, the HA system 100 of one group forms a plurality of subgroups.

FIG. 4 illustrates a case in which the HA system 100 using the Ethernet heartbeat and the disk heartbeat among the four types of heartbeats prevents the simultaneous execution of a service by using the disk heartbeat, and the HA daemon of Node A. (Daemon) records the status information of Node A in a specific area of the shared disk through the disk heartbeat when the Ethernet Herbit fails, and Node B uses Node A status information of Node A on the shared disk. If it is alive, Node A will not execute Task1.

However, the prior art described above is to prevent the HA daemon from malfunctioning by monitoring between a node performing a service and a standby node, and there is a limit in solving a problem that occurs when a network is divided in a plurality of nodes. have.

In addition, in the above-described conventional technology, a solution for simple network partitioning with a small number of nodes is mainly used. If the HA system is divided into a plurality of subgroups due to network partitioning in an environment where a large number of nodes is present, the state of nodes and services is increased. There is a problem that can not prevent information corruption and data corruption.

Accordingly, the present invention was devised to solve the above problems, and prevents data corruption caused by redundant service execution at multiple nodes in network partitioning, and diversifies the heartbeat channel and nodes in a high availability system. Its purpose is to provide a method for data corruption prevention of high-availability systems through membership management and subgroup decision algorithms to ensure maximum availability on partitioned networks.

1 illustrates an example of a configuration of a general high availability (HA) system 100 including a plurality of server systems (Nodes),

2 illustrates a service recovery process according to a failure of the HA system 100,

FIG. 3 illustrates a case in which the HA system 100 using only the Ethernet heartbeat operates abnormally due to disconnection of the heartbeat.

FIG. 4 illustrates a case in which the HA system 100 using the Ethernet heartbeat and the disk heartbeat prevents simultaneous execution of a service by using the disk heartbeat.

5 illustrates an example of a configuration of an HA system 100 in which a method for preventing data corruption in a high availability system according to the present invention is implemented.

FIG. 6 illustrates an example for explaining an algorithm for preventing data corruption due to network partitioning through management of heartbeat and membership of each node in the HA system 100 of FIG. 5.

7 and 8 illustrate an example for explaining an algorithm for managing membership information when a network partition occurs.

9 shows an HA system 100 divided into two subgroups.

※ Explanation of code for main part of drawing

100: high availability system (HA system)

Data corruption prevention method of a high availability system according to the present invention for achieving the above object, in a high availability system consisting of a plurality of server systems (nodes) to perform the requested service using a plurality of hert bits. A first step of checking a failure state of the system through the heartbeat; A second step of storing information on each subgroup divided according to a fault state of the system according to the test result and a state of the heartbeat on the shared disk using a specified specific heartbeat; A third step of selecting an optimal heartbeat other than the specified specific heartbeat and transmitting the stored information and service state information; And a fourth step of performing a requested service by selecting a subgroup and a heartbeat that guarantee maximum availability based on the transmitted information.

Hereinafter, an embodiment of a data corruption prevention method of a high availability system according to the present invention will be described in detail with reference to the accompanying drawings.

FIG. 5 illustrates an example of a configuration of a high availability system (HA system) 100 in which a method for preventing data corruption in a high availability system according to the present invention is implemented. The present invention provides an HA system 100 including a plurality of nodes. As aim. The HA system 100 of FIG. 5 according to the present invention uses three types, that is, a dedicated network heartbeat, a public network heartbeat, and a disk heartbeat.

Information transmitted through the three types of heartbeats is as shown below.

The heartbeat is basically a channel for checking a system failure of each node constituting the HA system 100 and transmitting state information of the HA system 100. However, the disk heartbeat is a heartbeat having a different property from the network heartbeat and is used only as a channel for checking a system failure of a node.

FIG. 6 is an example for explaining an algorithm for preventing data corruption due to network partitioning through management of heartbeats and membership of each node in the HA system 100. The HA daemon of each node is a network of HB0, HB1, and HB2. Broadcast and ping the heartbeat to check the system's failure status, and the HA daemon uses HB3 (disk heartbeat) to record the system failure status in a specific disk area or other system. Determine the fault condition of

In addition, the HA daemon of each node records group information divided into memory and a specific disk area in the form shown in FIG. 6 according to the fault state of the system and the state of the heartbeat identified through the heartbeat. Transmit node and service status information by selecting the first Herbit bit (HB0) of 'GOOD' status except (HB3).

7 and 8 are examples for explaining an algorithm for managing membership information when a network partition occurs. As shown in FIG. 7, the HA system 100 composed of six nodes is connected to the heartbeat network in the order of HB0, HB1, and HB2. A failure occurs and a state in which communication is impossible between some nodes occurs, and when the failure of the heartbeat network occurs, the change of membership information is illustrated in FIG. 8.

The HA daemon records the state of HB0 as 'Invalid' when a failure occurs in HB0, selects the next heartbeat (HB1) that operates normally, and causes the HA system 100 to operate normally. The divided subgroups 'ABC' and 'DEF' are identified and recorded in the memory.

In addition, the HA daemon repeats the same process as above when HB1 and HB2 fail, and when the network heartbeat fails and the node and service state information of the HA system 100 cannot be exchanged. As shown in (4) of FIG. 8, nodes A, C, D, and F, which are representative nodes of each subgroup, record subgroup information of all network heartbeat bits in a specific area of a shared disc through HB3. The following conditions shall be met when identifying and recording.

1. A representative node of each subgroup is in charge of a node registered first in the HA system 100 among members of a subgroup.

2. In a subgroup identified by each heartbeat unit, one node may be a member of a subgroup.

Next, the HA daemon determines how to reconfigure the partitioned HA system 100 based on the membership information recorded on the shared disk.

In the example of FIG. 8, the HA system 100 has been divided into subgroups of 'AB', 'ABC', 'ABCDEF', 'DEF', 'CDEF', and 'F'. By applying this, it is decided the heartbeat to be used for the transmission of important subgroup and status information.

1. Select the node with the largest number of member nodes in the subgroup and the related heartbeat.

2. If the number of member nodes included in a subgroup is the same, select a subgroup and a heartbeat with a small number of subgroups divided by the heartbeat associated with the subgroup.

3. If the above criteria are the same, select the subgroup and the heartbeat including the node performing the service recorded as having priority in the HA system configuration.

4. If the above criteria are the same, it is determined by the order of the heartbeats associated with the subgroups. In the example according to the present invention, priority is given in the order of HB0, HB1, HB2.

7 and 8 are divided into sub-groups of 'ABCDE' and 'F' as a result of applying the following criteria, and use HB1 as the main heartbeat for status information transmission.

9 illustrates an HA system 100 divided into two subgroups, and since each subgroup operates like a separate HA system, a service configured to recover a service when a failure occurs between two subgroups is performed. When present, upon reconfiguration of the HA system 100, the failover of the service is limited as in Task (Oracle) of FIG.

The above-described preferred embodiments of the present invention are disclosed for purposes of illustration, and those skilled in the art can improve, change, and substitute various other embodiments within the technical spirit and scope of the present invention disclosed in the appended claims below. Or addition may be possible.

Data corruption prevention method of the high availability system according to the present invention made as described above, it is possible to prevent data corruption of the high availability system due to network partitioning, and to ensure the stability of the high availability system by using the redundant heartbeat channel at the same time can do.

In addition, the data corruption prevention method of the high-availability system according to the present invention, by managing the node membership for each heartbeat (bit) to determine a subgroup that guarantees the maximum availability even in the event of a network partition failure High availability system can be operated continuously, and node membership management prevents inconsistency and damage of node and service status information of high availability system in a divided network, and high availability system composed of multiple nodes It is a very useful and efficient invention that works effectively even when divided into a plurality of subgroups due to network partitioning.

Claims (8)

A high availability system comprising a plurality of server systems (nodes) to perform a requested service using a plurality of heartbeats, the system comprising: a first step of checking a failure state of the system through the heartbeat; A second step of storing information on each subgroup divided according to a fault state of the system according to the test result and a state of the heartbeat on the shared disk using a specified specific heartbeat; A third step of selecting an optimal heartbeat other than the specified specific heartbeat and transmitting the stored information and service state information; And And a fourth step of performing a requested service by selecting a subgroup and a heartbeat to ensure maximum availability based on the transmitted information. The method of claim 1, The plurality of heartbeats are dedicated network heartbeats, public network heartbeats, and disk heartbeats. The method of claim 2, And wherein the specified specific heartbeat is the disk heartbeat. The method of claim 1, The first to fourth steps, the data corruption prevention method of the high availability system, characterized in that performed by the high availability system daemon (Daemon) of each node. The method of claim 4, wherein The high availability system daemon of each node, by using a broadcast (broadcast) and ping (Ping) to check the failure state of the system, characterized in that the high availability system data corruption prevention method. The method of claim 1, The third step is a method for preventing data corruption in a high availability system, characterized in that the first heartbeat in the GOOD state is selected as an optimal heartbeat among the heartbeats other than the specified specific heartbeat. The method of claim 1, The fourth step is a method for preventing data corruption in a high availability system, characterized in that the subgroup having the largest number of member nodes included in each subgroup and a related heartbeat are selected. The method of claim 1, In the fourth step, if the number of member nodes included in each subgroup is the same, the subgroup having the smallest number of subgroups divided by the heartbeat associated with the corresponding subgroup and the related heartbeat are selected. How to avoid data corruption in high availability systems.