JP2003067266A - Server system and fault detection method for client server system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a high fault-tolerant server system with simple and inexpensive configuration and a failure detection method thereof. SOLUTION: A control part 30 transfers a request for processing from a client 40 to servers 21, 22 mounted on an information processor 91 and a server 23 mounted on an information processor 92, determines the validity of the response results from respective servers, and transfers one of the valid response results to the client 40. The information processors 91, 92 are provided with server monitors 71, 72 monitoring actions of servers, and system monitors 81, 82 monitoring actions of the information processors themselves respectively. The control part 30 isolates the fault server from the system based on the output results from respective monitors.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server system for an Internet business system such as a mail server, a Web server, an EC server, or a node system of a communication network, which requires continuous operation for a long time.

[0002]

2. Description of the Related Art In this type of server system, it is necessary to detect a failure of the server itself or an information processing apparatus in which the server is mounted, and prevent the entire server system from becoming a failure. Here, “failure” means loss of system function. Specific examples of the cause of the "fault" include bugs and failures in hardware, and bugs in software. The cause of these "faults" is called "fault". Temporarily "fault" the system
The existence of a "," does not necessarily cause an "impairment" immediately, but it may be latent. "Error" means that anomalous surface is caused by "fault"
Say. When the system in which the "error" has occurred deviates from the normal state, the "failure" occurs. "Error"
Is not only caused by a narrowly defined “fault” such as a bug or failure, but also an “error” is caused by, for example, an intermittent failure, operator's setting error or operation error.

Conventionally, as an example of a highly reliable system having excellent fault tolerance, a "fault tolerance server FT61" is used.
High reliability technology of 00 ”, IEICE, FTS93
The one described in -56, 1996 is proposed. An example of this high reliability system will be described with reference to FIG.

As shown in FIG. 18, this high-reliability system has three MPUs (M
micro Processing Unit) 101
0, 1020, 1030 and each MPU 1010, 102
0,1030 connected to the MPU monitoring device 1110,
And a clock supply circuit 1210.

The MPU 1010 is connected to the memory 1011 and the hard disk 1012 via a system bus 1013, and these devices form one system. Similarly, the MPU 1020 has a system bus 102 for the memory 1021 and the hard disk 1022.
3 are connected to each other, and these devices form one system.

A buffer 1310 is provided on the MPU 1010 side of the system bus 1013. The buffer 1310 is brought into a high impedance state (that is, a logically disconnected state) when the MPU 1010 becomes a fault. As a result, the system bus 1013 is disconnected from the MPU 1010. Similarly, a buffer 1320 is provided on the MPU 1030 side of the system bus 1023. This buffer 1320 is the MPU 10
When 20 becomes a fault, it is brought to a high impedance state (that is, a logically disconnected state). As a result, the system bus 1023 is disconnected from the MPU 1020.

The system bus 1013 of one system and the system bus 1023 of the other system are connected to each other via a buffer 1330. The buffer 1330 is for taking in a normal signal from the other system when a fault occurs in one of the two systems.

Hard disk 1012 belonging to one system
Is connected to the system bus 1023 of the other system,
It is accessible from the MPU 1020. Similarly, the hard disk 1022 belonging to the other system is connected to the system bus 1013 of the one system, and the MPU 1
It is accessible from 010.

The clock supply circuit 1210 is provided for each element of this system, that is, the MPUs 1010, 1020, 1030,
MPU monitoring device 1110, memories 1011, 1021,
Hard disk 1012, 1022, system bus 10
13, 1023, buffers 1310, 1320, 133
0, etc., and supplies a common signal to operate these elements in synchronization. Note that in FIG. 18, wirings for distributing a clock signal from the clock supply circuit 1210 to each of the other elements are not shown in order to avoid complication of the drawing.

The operation of this high reliability system will be described. The MPUs 1010, 1020, 1030 operate based on the clock signal from the clock supply circuit 1210,
They are synchronized with each other and perform the same processing.

The MPU monitoring device 1110 compares the outputs of the MPUs 1010, 1020, 1030 for each machine cycle, and performs so-called "majority decision processing". In this majority decision processing, a plurality of signals are compared with each other, and the most output signal is treated as a normal signal. Here, the MPU monitoring device 1110 is configured so that the MPUs 1010, 10
When the outputs of 20 and 1030 are all the same, it is determined that there is no fault in each MPU, and the processing is continued. On the other hand, the output of the MPU 1010 is the other two MPU 102.
If it is different from 0, 1030, the MPU monitoring device 1110 determines that the MPU 1010 has failed, and the buffer 1310
Is set to high impedance and the buffer 133
0 is released. On the other hand, when the output of the MPU 1020 differs from the other two MPUs 1010 and 1030, the MPU monitoring device 1110 determines that the MPU 1020 has failed, sets the buffer 1320 to high impedance, and
The buffer 1330 is released. Furthermore, MPU1030
, The MPU monitoring device 1110 determines that the MPU 1030 has failed. However, since the MPU 1030 is an MPU operating only for majority processing, the buffer 1310,
The control of 1320 and 1330 is not performed.

[0012]

As described above, in the conventional high-reliability system, a plurality of MPUs are installed, they are synchronously operated by using the same clock supply circuit, and each output is monitored. A method of detecting a failure by a device has been adopted. Further, when a failure is detected, the system bus is provided with a high impedance so that only the normal system can operate. That is, the conventional high-reliability system needs to realize a hardware configuration that is completely different from that of a general-purpose computer, and therefore it is necessary to construct a dedicated system in consideration of the purpose and purpose.

For this reason, the conventional high-reliability system is (1) high in cost (2) high-performance and high-reliability utilizing new products (high-performance processor, large-capacity memory, etc.) appearing in the market one after another. (3) Since it is necessary to distribute the clock signal throughout the high-reliability system, wiring delay due to an increase in the clock wiring length becomes a bottleneck, and high performance of the high-reliability system is realized. Is difficult. In addition, a clock phase shift may occur between systems depending on the position where the clock supply circuit is mounted, and thus a circuit for phase matching is required. As a result, the circuit design becomes difficult and the configuration becomes complicated. (4) Since the failure detection is performed only by the hardware level information, there is a problem that it is difficult to find the software failure.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a server system having a simple and inexpensive structure and high fault tolerance, and a fault detection method therefor.

[0015]

In order to achieve the above object, according to the present invention, in a server-side system of a client-server type system, one or more servers mounted on one or more information processing devices, and a server Server monitoring means for monitoring the operation of the server, processing request transfer means for transferring a processing request from the client to the server between the client and the server, and a response result received from the server in response to the processing request. Mediation means having a response result holding means, a validity judgment means for judging the validity of the held response result, and a response result transfer means for transferring only the response result judged to be correct to the requesting client. It is characterized by having done.

According to the present invention, the mediation means transfers the processing request from the client to the server. And
The validity of the response result from the server is determined, and only the valid response result is transferred to the client. This makes it possible to hide the “error” in the server from the client. Further, since the operation of the server can be monitored by the server monitoring means, even if a failure occurs in the server, by performing processing such as disconnecting the server from the system, the entire system becomes excellent in fault tolerance. In this way, since errors can be concealed without requiring a special configuration in the server, it is possible to construct a system with excellent fault tolerance using an inexpensive general-purpose computer. In addition, the performance of the server can be improved by improving the performance of software and hardware, and thus the performance of the entire system can be easily improved. Further, since the clock wiring delay problem and the phase matching problem described above can be solved, a high performance system can be constructed.

Here, the server means a program that causes the information processing apparatus to function as means for providing a client with a predetermined service.

As an example of a preferred aspect of the present invention, the server monitoring means monitors whether or not the server is operating normally in the information processing device, and when there is an abnormal operation of the server, the server failure is detected. It is proposed to have a first monitoring means for notifying the intermediary means.

As another example of a preferred aspect of the present invention, the server monitoring means is a second monitoring means which is mounted on the information processing apparatus and which notifies the intermediary means of a survival confirmation message at a predetermined cycle. Propose one with.

[0020]

BEST MODE FOR CARRYING OUT THE INVENTION A highly reliable server system according to an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing the overall configuration of a high reliability server system. In this embodiment, the W
A system for providing an eb service will be exemplified. In addition, in the present embodiment, the system configuration OS is Li
nux was used. In addition, Apache Software is a server program that provides Web services.
e Foundation's http server was used.

As shown in FIG. 1, the server system 10 includes information processing devices 91 and 92 for constructing a highly reliable server 20, a highly reliable server 20 and a client 4.
The information processing device 93 relays a request / response with respect to 0.

The high reliability server 20 is composed of one or more servers. In the example of FIG. 1, the high reliability server 20 is
It is composed of three servers 21, 22, 23. Each server 21, 22, 23 returns the same response to the same request.

The high reliability server 20 is composed of one or more information processing devices. In the example of FIG. 1, the high reliability server 20 is composed of two information processing devices 91 and 92. The servers 21 and 22 are mounted on the information processing apparatus 91, and the server 23 is mounted on the information processing apparatus 92.

In addition to the server, each information processing apparatus that constitutes the high reliability server 20 has a server monitor for checking the existence of the server and a periodical operation for checking the existence of the information processing apparatus in which the server is installed. A system monitor that sends an alive message is implemented. In the example of FIG. 1, a server monitor 71 and a system monitor 81 are mounted on the information processing device 91, and the server monitor 7 is mounted on the information processing device 92.
2 and a system monitor 82 are mounted.

A control unit 30 and a message receiving unit 31 are arranged in the information processing device 93. The control unit 30 includes a server management table 60, and the state (eg, “normal” or “fault”) of each server is registered in the server management table 60. FIG. 2 shows an example of the server management table. As shown in FIG. 2, the server management table 60 is composed of a server ID for identifying the server, an IP address of the server, a port number, an identifier of an operating information processing device, operating state information of the server, and the like. . The control unit 30 refers to the server management table 60 to determine which server should process the request from the client. When there is a request from a client, the control unit 30 and the servers 21, 22, 23 are connected by TCP according to the procedure described later.

The message receiving section 31 periodically receives an alive message from the system monitors 81 and 82. The message receiving unit 31 also receives a failure notification message sent from the server monitor 71 or 72 when a failure occurs in the server. Between the message receiving unit 31 and the server monitors 71 and 72, and between the message receiving unit 31 and the system monitors 81 and 82, TCP is used in advance.
Keep connected.

The client 40 uses the appropriate browser to access the high reliability server 20 via the network 50.
Request a Web page or the like.

Next, the operation of the control unit 30 will be described with reference to FIG. FIG. 3 is a processing flow of the control unit 30.

The control unit 30 checks whether there is a failure notification from the message receiving unit 31 (step SA
1) If there is a failure notification, it is further determined whether the message is from the server monitor 71 or 72 (step SA2). When the message is from the server monitor 71 or 72, the server is registered as a failure in the server management table 60 and the server is disconnected (step SA).
3). If the message is not from the server monitor 71 or 72, the alive from the system monitor 81 or 82
Since the message is lost, the server on the information processing device is registered as a failure in the server management table 60, and the server is disconnected (step SA5).

When the control unit 30 determines that there is no failure notification from the message receiving unit 31 (step SA1), w
ell-known port (80 because it is a Web service)
Port number) to check whether there is a request from the client (step SA6).

When there is a request from the client (step SA6), the control unit 30 makes a TCP connection and creates a child control process (step SA7). When the generation of the child control process is completed, the fault notification is checked again (step SA1).

As an example, the state in which the client 40 issues a request to the server system 10, the control unit 30 receives the request, and the child control process 32 is created is shown in FIG.
Shown in. In FIG. 4, the server monitors 71 and 72, the system monitors 81 and 82, the information processing devices 91 and 92, and the message receiving unit 31 are not shown in order to avoid complexity of the drawing.

Next, the operation of the child control process 32 generated by the control unit 30 will be described with reference to FIGS. 5 and 6 are process flows of the child control process. 7 to 9 are diagrams for explaining the operation of the high reliability server system. 7 to 9, the server monitor and the like are omitted in the same manner as in FIG. 4 in order to avoid complication of the drawings.

The child control process 32 uses the server management table 60.
To establish a TCP connection with the normal servers 21, 22, 23 (step SB1). The state at this time is shown in FIG.

Next, the child control process 32 checks whether or not there is a processing request from the client 40 (step SB2), and if there is a request, the request is FIFO.
It is stored in the queue (step SB3), and if there is no request, nothing is done and the process proceeds to the next step.

If the child control process 32 is waiting for a response from the server (step SB4) and all the responses are complete (step SB7), the majority of the responses is decided (step SB12). If all the responses are the same (step SB13), it is determined that there is no fault in the server, and one response is returned to the client 40 (step S).
B15). If all the responses are not the same as the result of the majority decision (step SB13), the operating status of the server that returned the minority response to the server management table 60 is changed from "normal" to "failure", and the server is changed. It is disconnected from the system (step SB14). Then, one correct response is returned to the client 40 (step SB15) (see FIG. 9).

After that, the child control process 32 again checks whether or not there is a new request from the client 40 (step SB2).

If the server is not waiting for a response from the server (step SB4) and the FIFO queue is not empty (there is a request) (step SB5), one request is fetched from the head of the FIFO queue to make a copy. Then, the data is transferred to all the connected servers 21, 22, and 23 (step SB6) (see FIG. 8).

If the server is not waiting for a response from the server (step SB4) and the FIFO queue is empty (step SB5), the service provided to the client 40 has ended and the child control process is completed. 32 disappears.

Not all responses are available (step SB
7) When the response is received (step SB8), the response is stored in the buffer and a timeout is checked (step SB10). If the response has not been received (step SB8), the response is not stored and the timeout is checked (step SB10).

If it has timed out in step SB10, the response from the timed-out server is a NULL message (step SB11), and the majority of the responses is decided (step SB12). On the other hand, if it has not timed out (step SB10), it is checked whether a new request from the client 40 has arrived (step SB2).

Next, the operation of the server monitor will be described with reference to FIG.
Will be described with reference to. FIG. 10 is a process flow of the server monitor.

The server monitor acquires the process number of the server to be monitored and creates list 1 (step SC1). For example, if the server is Apache, /
usr / local / apache / logs / htt
pd. Since the process number is registered in the file pid, the server monitor acquires the process number of the monitoring target from the file.

Then, the server monitor sleeps for a certain period of time (step SC2), then acquires the process number of the server currently in operation and creates list 2 (step S).
C3). For example, in the case of Linux, since the process number currently in operation is registered under the / proc directory, list 2 is created from here.

Next, the server monitor checks whether or not there is a server that exists in list 1 but not in list 2 (step SC4). If there is such a server, it will be available for some reason (eg segmentation fault, bus e).
It means that the server has died due to an error in (error, etc.), so the message receiving unit 31 is notified (step SC5), and this server is deleted from the list 1. Then, it sleeps again (step SC2) and checks the server currently in operation (step SC3).

On the other hand, if there is no server that exists in list 1 but not in list 2 (step SC4),
Since there is no faulty server (normal), after sleeping again (step SC2), the server currently in operation is checked (step SC3).

Next, the operation of the system monitor is shown in FIG.
Will be described with reference to. FIG. 11 is a process flow of the system monitor.

The system monitor sleeps for a certain period of time (step SD1), and a
The step of transmitting a live message (step SD2) is repeated. If the message from the system monitor is lost, the information processing apparatus is found to be in trouble, so the server is disconnected from the server management table 60 (step SA5 in FIG. 3).

Next, a process for incorporating each server (at initialization,
(At the time of failure recovery) will be described with reference to FIG. Figure 1
2 is a processing flow of the server monitor and the control unit when the server is installed. Here, it is assumed that the information processing apparatus and the server monitor and system monitor operating thereon are operating normally.

The information processing device on which the server operates is / usr / loca when the server Apache is started up.
1 / apache / logs / httpd. Since the process number of the server started up is registered in pid, the server monitor recognizes that a new server has started up by referring to this file (step SE
1). Then, the IP address, the port number, the identifier of the information processing device, etc. are transferred to the message processing unit 31 as the information of the newly started server (step SE
2) Add this server to list 1 (step SE
3).

On the other hand, the message receiving section 31 conveys the received information to the control section 30. The control unit 30 adds new server information to the server management table 60 and sets the operating state to "normal" (step SE4).

The incorporation process is completed by the above steps. The server monitor and the system monitor can be started by manually inputting them from a command line after the information processing apparatus is started up or automatically by a script when the information processing apparatus is started up.

Next, the request and response sequence control realized by the child control process will be described with reference to FIGS. 13 and 14. In FIG. 13, the child control process 32 is the client 40.
TCP connection with the
An example of CP connection is shown.

Upon receiving the processing request X1 from the client 40, the child control process 32 first transfers the request X2 to the server 21, and then transfers the request X3 to the server 22. Then, the child control process 32 first receives the response X4 from the server 22, and then the response X5 from the server 21.
Are being received. Finally, the child control process 32 returns a response X6 to the client 40.

As described above, the order in which the child control process transfers the processing request to the server and the order in which the child control process receives the response from the server are arbitrary. For example, the child control process 32 may first transfer the request X3 to the server 22, and then transfer the request X2 to the server 21. Further, the child control process 32 may first receive the response X5 from the server 21 and subsequently receive the response X4 from the server 22.

In FIG. 14, the child control process 32 makes a TCP connection with the client 40, and further the servers 21 and 22.
Another example is shown in which a TCP connection is made. Child control process 3 that received the processing request Y1 from the client 40
2 first transfers the request Y2 to the server 21, and then transfers the request Y3 to the server 22. Next, the child control process 32 receives the response Y4 from the server 22,
The new request Z1 was received from the client 40 before the response Y5 from the server 21 was received.

In this case, it is necessary to wait until the response Y6 to the request Y1 is returned to the client 40 without transferring the request Z1 to the servers 21 and 22. This is because, if a new request Z1 is transferred to each server in this situation, each server 21, 22 may operate differently.

Then, the child control process 32 uses the server 2
When the response Y5 from 1 is received and the response is returned to the client 40, the requests Z2 and Z3 are transferred to the servers 21 and 22, respectively. Then, the child control process 32 sends the server 21
Response Z4 from server 22, followed by response Z5 from server 22
To receive. Finally, the child control process 32 returns the response Z6 to the client 40.

As described above, according to the high-reliability server system according to the present embodiment, the control unit 30 sends the processing request from the client 40 to each of the servers 21, 22, 23.
Transferred to. Then, the validity is determined with respect to the response results from the servers 21, 22, and 23, and only the valid response result is transferred to the client 40. This makes it possible to hide the “error” in the server from the client 40. Further, since the server monitor 71, 72 and the system monitor 81, 82 can monitor the operation of the server, the server is disconnected from the system even when the failure of the server itself or the failure of the information processing device in which the server operates occurs. By performing the processing of 1, the system as a whole becomes excellent in fault tolerance.

By creating another child control process for requests from different clients, it is possible to parallelize the processing and thereby improve the performance. For example, in the example of FIG. 15, the request from the client 40 is processed by the child control process 32, and the request from the client 41 is processed by the child control process 33. Further, in this case, order control of requests / responses between different clients is not performed.

In this way, since errors can be concealed without requiring a special configuration in the server, it is possible to construct a system with excellent fault tolerance using an inexpensive general-purpose computer. In addition, the performance of the server can be improved by improving the performance of software and hardware, and thus the performance of the entire system can be easily improved. Further, since the clock wiring delay problem and the phase matching problem described above can be solved, a high performance system can be constructed. Further, not only hardware failure but also software (server) failure can be detected, so that the fault tolerance of the entire system becomes excellent.

Although the embodiment of the present invention has been described above, the present invention is not limited to this. The scope of the invention is indicated by the claims and all the modifications are included in the invention.

For example, each server need not have the same implementation if it returns the same response. That is, the versions, specifications, programming languages, compilers, compiler options, etc. may be different. Further, the server may be composed of one process or a plurality of processes. Furthermore, it may be an object or thread instead of a process.

Furthermore, the child control process and TC of each server
In order to reduce the overhead of P connection, it is possible to create a plurality of child control processes in advance, make TCP connection with them in advance, and wait for a request from the client.

Further, in the above embodiment, the validity of the response is determined by making a majority vote among the three servers, but it may be determined based on the normality of the format of the response result. For example, the validity is determined by whether or not the response result conforms to the http protocol format. Further, the validity of the response may be judged from the matching of the request and the response. For example, in the header of the response to the GET request in http, the Context-Length
Is included, and the response in which the body contains data is determined to be a valid response. Further, these judgment methods may be combined with the majority vote.

Further, as shown in FIG. 16, by providing two control units 30 and 30a, the intermediary device may be made redundant, and thereby the intermediary device may be made highly reliable.

Furthermore, as shown in FIG. 17, the servers that perform the processing corresponding to the processing request may be distributed according to the client that requested the processing. In FIG. 17,
For the client 40, the servers 21, 22, and 23 perform processing, and for the client 41, the server 24,
25 and 26 are processing. Since load distribution can be achieved by such a configuration, the processing capacity of the entire server system can be improved.

Further, in the above embodiment, the OS is U
Although the description has been made on the premise of Linux which is one of the UNIX (registered trademark), other OS may be used.

[0069]

As described in detail above, according to the present invention,
The mediation means transfers the processing request from the client to the server. Then, the validity of the response result from the server is determined, and only the valid response result is transferred to the client. This makes it possible to hide the “error” in the server from the client. Further, since the operation of the server can be monitored by the server monitoring means, even if a failure occurs in the server, by performing processing such as disconnecting the server from the system, the entire system becomes excellent in fault tolerance. In this way, since errors can be concealed without requiring a special configuration in the server, it is possible to construct a system with excellent fault tolerance using an inexpensive general-purpose computer. In addition, the performance of the server can be improved by improving the performance of software and hardware, and thus the performance of the entire system can be easily improved. further,
Since the clock wiring delay problem and the phase matching problem described above can be solved, a high-performance system can be constructed.

[Brief description of drawings]

FIG. 1 is a block diagram showing the overall configuration of a highly reliable server system.

FIG. 2 is a diagram illustrating an example of a server management table.

FIG. 3 is a flowchart illustrating the operation of the control unit.

FIG. 4 is a diagram for explaining the operation of the high reliability server system.

FIG. 5 is a flowchart illustrating the operation of a child control process.

FIG. 6 is a flowchart illustrating the operation of a child control process.

FIG. 7 is a diagram for explaining the operation of the high reliability server system.

FIG. 8 is a diagram for explaining the operation of the high reliability server system.

FIG. 9 is a diagram for explaining the operation of the high reliability server system.

FIG. 10 is a flowchart illustrating the operation of the server monitor.

FIG. 11 is a flowchart illustrating the operation of the system monitor.

FIG. 12 is a flowchart illustrating operations of a server monitor and a control unit when the server is installed.

FIG. 13 is a diagram for explaining order control of processing in a child control process.

FIG. 14 is a diagram for explaining order control of processing in a child control process.

FIG. 15 is a diagram for explaining the operation of a highly reliable server system according to another example.

FIG. 16 is a block diagram illustrating an overall configuration of a high reliability server system according to another example.

FIG. 17 is a block diagram illustrating the overall configuration of a highly reliable server system according to another example.

FIG. 18 is a block diagram of a conventional high reliability system.

[Explanation of symbols]

10 ... High-reliability server system, 20 ... High-reliability server, 21, 22, 23 ... Server, 30 ... Control unit, 31 ...
Message receiving unit, 32 ... Child control process, 40 ... Client, 50 ... Network, 60 ... Server management table,
71, 72 ... Server monitor, 81, 82 ... System monitor, 91, 92, 93 ... Information processing device,

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Etsuo Masuda             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Akito Fujita             2-1-1, Nishishinjuku, Shinjuku-ku, Tokyo             Nutty Advance Technology Co., Ltd.             Inside the company (72) Inventor Yoichi Hijikata             2-1-1, Nishishinjuku, Shinjuku-ku, Tokyo             Nutty Advance Technology Co., Ltd.             Inside the company F term (reference) 5B034 BB15 CC01 DD05                 5B042 GA12 GC10 JJ05 JJ23 KK04                 5B045 JJ06 JJ38                 5B089 GA11 GA21 GB02 JB17 JB22                       KA12 KC29 KC30 MC06 MC08                       ME02 ME06

Claims (11)

[Claims] 1. In a server-side system in a client-server system, one or more servers mounted on one or more information processing devices, a server monitoring means for monitoring the operation of the server, and a processing request from a client. Processing request transfer means for transferring to the server, response result holding means for holding the response result received from the server in response to the processing request, legitimacy judging means for judging the correctness of the held response result, and the judgment result. A server system characterized in that an intermediary means having a response result transfer means for transferring only the response result to the requesting client is interposed between the client and the server. 2. The server monitoring means monitors whether or not the server is operating normally in the information processing apparatus and notifies the mediating means of a server failure when there is an abnormal operation of the server. The server system according to claim 1, further comprising a monitoring unit. 3. The server system according to claim 2, wherein the mediating means includes means for disconnecting the server from the system when the server failure notification is received from the first monitoring means. 4. The server monitoring means comprises a second monitoring means which is mounted on the information processing apparatus and which notifies the intermediary means of a survival confirmation message at a predetermined cycle. 3. The server system according to any one of 3 above. 5. The information processing apparatus in which the second monitoring means is mounted when the mediating means does not receive a survival confirmation message from the second monitoring means even after a predetermined time longer than the predetermined cycle has elapsed. 5. The server system according to claim 4, further comprising means for disconnecting the server from the system. 6. The apparatus according to claim 1, further comprising a plurality of the servers, wherein the validity determination means compares the response results from the servers with each other and determines that the largest number of response results is valid. The server system according to claim 1. 7. The server system according to claim 1, wherein the legitimacy determining means determines the legitimacy of the response result from the server that responds within a predetermined time. 8. The server system according to claim 1, wherein the validity determination unit determines that the response result having the predetermined pattern is valid. 9. The server system according to claim 1, wherein the legitimacy determining means determines the legitimacy of the response result based on the correspondence between the processing request and the response result. 10. The device according to claim 1, further comprising means for disconnecting an output source server of a response result, which has not been determined to be valid by the validity determination means, from the system. Server system. 11. One or more servers mounted on one or more information processing devices, and a processing request transfer unit that intervenes between the client and the server and transfers a processing request from the client to the server. A response result holding unit that holds the response result received from the server in response to the processing request, a legitimacy determination unit that determines the legitimacy of the held response result, and only the response result that is determined to be legitimate to the requesting client. A failure detection method in a client-server system, comprising: detecting a failure by monitoring a server operation in a client-server system including an intermediary means having a response result transfer means for transferring.