JP2005258947A - Duplexing system and multiplexing control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent the occurrence of split brain in a duplexing system. <P>SOLUTION: Server computers 10-1 and 10-2 respectively decide the failure of the other when it is impossible to recognize the other by heart beat mechanisms 12-1 and 12-2. In this status, a server connecting part 32 of a client computer 30 is connected to either the server computer 10-1 or 10-2, for example, the operating system server computer 10-1, and a client connection flag 130-1 of the computer 10-1 is turned ON. When the flag 130-1 is turned ON, a multiplexing control part 13-1 of the server computer 10-1 makes a server processing part 11-1 of the server computer 10-1 execute processing by deciding that a majority of groups in this system are formed of the server computer 10-1 and the client computer 30. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention is composed of two server computers that can communicate with each other, and one of the two server computers operates as an active system and the other operates as a standby system and multiplexing control. Regarding the method.

  In recent years, the improvement of computer technology and network technology has been remarkable, and along with this, computerization of business has been widely performed. However, depending on the contents of the business, there are many cases where interruption due to a failure or the like is not allowed. Therefore, recently, it is becoming common to construct a distributed system in which a plurality of computers are connected by a network.

  As one method for operating a distributed system, multiplexing of computer processing is known. In a distributed system, each computer may fail independently. In a system in which the entire system does not function just because one computer fails, the system operation rate is lower than the operation rate of one computer. In order to prevent such a situation, it is necessary to multiplex processes related to the entire system. Conversely, by multiplexing, it is possible to make the operating rate of the distributed system higher than the operating rate of one computer. For example, if a distributed system composed of two computers having an operation rate of 99% is not multiplexed (duplexed) at all, the operation rate of the distributed system is about 98%. If this is duplicated, the operation rate is about 99.99%. Such a duplex system is described in Patent Document 1, for example. The duplex system described in Patent Document 1 is a duplex server system including two server units. Further, in Patent Document 1, a master server unit (active server computer) is connected to a slave server unit (standby server computer) in the system from all of a plurality of client terminals using the duplex system. It is described that the slave server unit is switched to the master server unit only when there is a notification that the service cannot be provided. In such a duplex system, even if communication cannot be performed between two server units, it is possible to prevent the two server units from becoming a main system at the same time.

<Failover method>
As a method of multiplexing computer processing in a distributed system, a method of taking over the processing by another computer when a computer failure is detected is conventionally known. This method is called a failover method.

  In the failover method, in order to detect a failure of a computer, a method of regularly communicating between computers and checking each other's operation status is generally performed. This communication is called “heartbeat”. Computer outages are detected by heartbeat timeouts. In other words, a computer that has not sent a heartbeat for a certain period of time is considered to have failed.

  In a distributed system to which the failover method is applied, the occurrence of split brain becomes a problem. Split brain means that the execution context (state) is divided into two or more. Split brain occurs when fault detection is mistakenly performed. For example, when the computers constituting the distributed system become unable to communicate with each other between two computer groups (network partitioning), both computer groups detect each other's failure. In this case, since both computer groups start to operate independently, they fall into a split brain. Or, due to an abnormally high load, the transmission of a heartbeat of a computer may be temporarily interrupted, and a failure may be detected. Then, even after the computer resumes operation, it may fall into a split brain.

  Multiplexed processes are generally important processes in a distributed system. Therefore, when split brain occurs, the processing becomes inconsistent and has a fatal effect on the entire system.

<Majority method>
As a system for fundamentally solving the problem of split brain in the failover system, a system using a majority vote (major vote system) is known. In this majority method, if the same processing is executed on all the multiplexed computers and the operations of the computers occupying the majority are matched, the processing is performed regardless of the operations of other computers. It will continue. The majority voting method is one of the quorum methods. In the quorum method, if the same processing is executed on all the multiplexed computers and the operations of the computers that occupy the quorum (quorum) can be matched, the processing is performed regardless of the operation of other computers. It will continue. A method in which the quorum is a majority of the whole is a majority method, and is described in, for example, Patent Document 2.

  In the majority method, split brain can be avoided in principle. For example, when processing is multiplexed (triple) by three computers X, Y, and Z, the network is divided into group A of two computers X and Y and group B of one computer Z Suppose that Even in this case, the processing in the group A continues to move. On the other hand, the process in group B is interrupted. The interruption here means a state in which the processing cannot be advanced until the number of computers that can match the operation including itself becomes a majority.

If the computer Z is hung up due to an abnormally high load, the processing in the computer group (here, group A) occupying the remaining majority continues to operate regardless of the computer Z. When the computer Z recovers, the processing in the computer Z does not start on its own because it cannot constitute a majority. That is, the computer Z resumes the operation after resynchronizing with the processing of the computer group that occupies the other majority.
JP 2000-330814 (paragraph 0013, FIG. 1) JP 2001-117895 (paragraph 0007, paragraphs 0018 to 0022, FIGS. 1 to 5)

  In the majority system described above, at least three computers are required. Therefore, the majority voting method cannot be used in the simplest multiplexing system constituted by two computers, that is, a duplex system constituted by duplicated computers.

  On the other hand, in the duplex system described in Patent Document 1, all of a plurality of client terminals that use the system are notified to the slave server unit that they cannot receive service from the primary server unit. If there is, the main system and the sub system are switched between the redundant server units (server computers) in the system. In this duplex system, even if communication is not possible between two server units, it is possible to prevent the two server units from falling into a kind of split brain, which simultaneously becomes a main system.

  However, in this duplex system, even if all the client terminals cannot receive service from the primary server unit, if one client terminal fails, the faulty client terminal changes to the secondary server unit. On the other hand, since there is no notification that the service cannot be provided from the primary server unit, switching between the primary and secondary is not performed. In this case, each client terminal cannot receive service from either the primary system or the secondary system.

  The present invention has been made in view of the above circumstances, and its purpose is to prevent a situation where a service is not provided to a client computer while preventing a split brain from occurring between duplicate server computers. It is an object of the present invention to provide a duplex system and a multiplexing control method that can prevent this from occurring as much as possible.

  According to one aspect of the present invention, two server computers configured to provide services to N client computers (N is an integer equal to or greater than 1) can communicate with each other. A duplex system is provided in which either one of the computers operates as an active system and the other operates as a standby system. Each of the two server computers of the duplex system has a client connection for managing a connection state between the server processing means for executing the server processing for providing the service and the N client computers. Multiplexing control for controlling whether or not to execute server processing by the server processing means by a majority decision based on the connection state between the state management means and the N client computers managed by the client connection state management means Means.

  In the above configuration, in order for the client computer to receive the service from the duplex system, it is necessary to connect to the server computer that can provide the service at that time, out of the two server computers in the system. is there. Usually, the client computer is connected to the active server computer of the two server computers. If the active server computer fails and cannot communicate with the active server computer, that is, if the active server computer cannot be recognized, the client computer connects the connection destination of the active server computer. Switch from the server computer to the standby server computer. Therefore, the fact that the client computer is connected to one of the two server computers means that the client computer can recognize the connection destination server computer. Here, if the number of client computers connected to the server computer is n, it can be said that one group is formed by the server computer and the n client computers. Therefore, if each of the two server computers manages the connection state with the N client computers, the server computer itself occupies a large number with respect to the total number of computers including the client computer. It can be determined whether or not it belongs to a group.

  Therefore, in the above configuration, each of the two server computers constituting the duplex system executes server processing from the connected state by a kind of majority vote including client computers that use the server computer. Whether or not can be determined correctly. As a result, even if it is determined that the other party cannot recognize each other between the two server computers and the other party has failed, that is, even if network partitioning occurs, each of the two server computers Whether or not to execute server processing can be correctly determined from the above connection state.

  According to the present invention, even if a network partition occurs between two server computers (active server computer and standby server computer) constituting a duplex system, each of the two server computers Can determine whether to execute server processing by a majority vote including the client computers from the connection state with the N client computers. As a result, it is possible to prevent the occurrence of split brain and to prevent the occurrence of a situation where the service is not provided to the client computer as much as possible.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
FIG. 1 is a block diagram showing the configuration of a duplex system according to the first embodiment of the present invention. The duplex system shown in FIG. 1 includes two server computers 10-1 and 10-2. The server computers 10-1 and 10-2 are configured to be able to communicate with each other via the network 20. The server computers 10-1 and 10-2 (a duplex system composed of these) can be used from the client computer 30 via the network 20. In the present embodiment, the server computers 10-1 and 10-2 are database server computers on which a database server operates, and the client computer 30 is an application server computer that uses the database server computer. On the application server computer, an application server that provides a service to a client terminal that uses the application server computer operates.

  The server computers 10-1 and 10-2 include server processing units 11-1 and 11-2, heartbeat mechanisms 12-1 and 12-2, and multiplexing control units 13-1 and 13-2, respectively. ing. The server processing units 11-1 and 11-2 function as servers that execute server processing (server programs). In the present embodiment, the server computers 10-1 and 10-2 are database server computers, and the server processing units 11-1 and 11-2 function as database servers. The heartbeat mechanisms 12-1 and 12-2 confirm that each other is normal by exchanging heartbeats with each other.

  The multiplexing control units 13-1 and 13-2 operate the server processing units 11-1 and 11-2 with the corresponding server computers 10-1 and 10-2 as the active system or the standby system. Controls whether to wait for the processing of the server processing units 11-1 and 11-2. For this control, the multiplexing controllers 13-1 and 13-2 connect client connections as client connection state management means for managing the connection state between the corresponding server computers 10-1 and 10-2 and the client computer 30. The flags 130-1 and 130-2 are held. Flags 130-1 and 130-2 indicate whether or not the client computer 30 is connected to the server computers 10-1 and 10-2. Here, “the client computer 30 is connected to the server computers 10-1 and 10-2” means that a session is set between the server computers 10-1 and 10-2 and the client computer 30. Represents.

  If the multiplexing controllers 13-1 and 13-2 recognize that the heartbeat mechanisms 12-1 and 12-2 of the corresponding server computers 10-1 and 10-2 are normal, If it is an active system, the server processing units 11-1 and 11-2 continue to execute processing, and if it is a standby system, the server processing units 11-1 and 11-2 continue to be stopped. In addition, the multiplexing control units 13-1 and 13-2 perform server processing if the client connection flags 130-1 and 130-2 are ON when the heartbeat mechanisms 12-1 and 12-2 do not recognize the partner. The processing by the units 11-1 and 11-2 is executed. If the processing is OFF, the processing by the server processing units 11-1 and 11-2 is stopped.

  On the other hand, the client computer 30 includes a client processing unit 31 and a server connection unit 32. The client processing unit 31 functions as a client that executes client processing (client program). The server connection unit 32 manages the connection with the server computers 10-1 and 10-2. The server connection unit 32 turns on the client connection flag 130-i of the server computer 10-i (i is 1 or 2) to which the client computer 30 is connected. When the server computer 32 switches the connection destination of the client computer 30 from the server computer 10-j (j is 1 or 2, where j ≠ i) to the server computer 10-i, the server computer 10 of the original connection destination -j client connection flag 130-j is turned OFF.

Next, the operation in the system of FIG. 1 will be described.
<Normal operation>
First, the normal operation in which both the server computers 10-1 and 10-2 are normal will be described with reference to the system state diagram of FIG. Assume that the server computer 10-1 operates as an active system and the server computer 10-2 operates as a standby system. The heartbeat mechanisms 12-1 and 12-2 of the server computers 10-1 and 10-2 communicate with each other through the network 20 through periodic communication called “heartbeat”, thereby Check the operating status, that is, whether the other party is operating normally.

  Here, the heartbeat mechanisms 12-1 and 12-2 can recognize each other's server computer by sending and receiving the heartbeat, and therefore the other server computer is operating normally as shown in FIG. It shall be confirmed that In this case, the server computer 10-1 continues to operate as an active system, and the server computer 10-2 continues to operate as a standby system.

  In such a situation, even if the server connection unit 3 of the client computer 30 sends a connection request to the standby server computer 10-2 of the server computers 10-1 and 10-2, the request is not received. Rejected. Therefore, the client computer 30 cannot connect to the server computer 10-2. On the other hand, a connection request from the server connection unit 3 of the client computer 30 to the active server computer 10-1 is accepted. Accordingly, the client computer 30 is connected to the active server computer 10-1 as indicated by an arrow 201 in FIG. In this state, the server connection unit 3 of the client computer 30 turns on the client connection flag 130-1 of the server computer 10-1.

  When the client connection flag 130-1 is ON, the multiplexing control unit 13-1 of the server computer 10-1 causes the server processing unit 11-1 of the server computer 10-1 to execute processing. That is, of the server computers 10-1 and 10-2, the active server computer 10-1 executes server processing and provides a service to the client computer 30. On the other hand, in the standby server computer 10-2, the server processing unit 11-2 is in a stopped state.

<Operation when the active system stops>
Next, the operation when the active server computer 10-1 is stopped will be described with reference to the system state diagram of FIG. When the active server computer 10-1 stops due to a failure or the like, the heartbeat from the heartbeat mechanism 12-1 of the server computer 10-1 stops after a certain time. In this case, since the heartbeat mechanism 12-1 of the standby server computer 10-2 cannot recognize the active server computer 10-1, the failure of the server computer 10-1 is determined for the time being. In this situation, the client computer 30 cannot communicate with the active server computer 10-1, and cannot receive service from the server computer 10-1. Therefore, the server connection unit 32 of the client computer 30 switches the connection destination from the active server computer 10-1 to the standby server computer 10-2 as indicated by an arrow 301 in FIG. The -2 client connection flag 130-2 is turned ON. This indicates that the client computer 30 has recognized the failure of the active server computer 10-1.

  Therefore, the fact that the server connection unit 32 of the client computer 30 has turned on the client connection flag 130-2 of the server computer 10-2 means that the two server computers 10-1 and 10-2 and one client computer 30 are connected. In a system composed of a total of three computers, both the server computer 10-2 and the client computer 30 are aware of the failure of the remaining server computer 10-1. That is, the state of the system in FIG. 3 forms a group in which the standby server computer 10-2 and the client computer 30 occupy a large number with respect to the total number of computers including the client computer 30. Represents.

  Therefore, when the client connection flag 130-2 is turned ON, the multiplexing control unit 13-2 of the standby server computer 10-2 has a large number (the majority number) of the server computer 10-2 with respect to the total number of computers in the system. ). In this case, since the server computer 10-2 is a standby system, the multiplexing control unit 13-2 of the server computer 10-2 has an active system by the server processing unit 11-2 of the server computer 10-2. The processing performed in the server processing unit 11-1 of the server computer 10-1 is taken over (failed over). As a result, the server computer 10-2 is switched from the standby system to the active system.

<Operation during network division>
Next, referring to the system state diagram of FIG. 4 for the operation when the network is divided between the active server computer 10-1 and the standby server computer 10-2 in the state of FIG. I will explain.

  Now, although the active server computer 10-1 and the standby server computer 10-2 are operating normally, for example, as shown in FIG. -1 heartbeat mechanism 12-1 and the heartbeat mechanism 12-2 of the server computer 10-2 cannot exchange heartbeats with each other, that is, network division occurs. In this state, the heartbeat mechanisms 12-1 and 12-2 of the server computers 10-1 and 10-2 cannot recognize each other, and determine each other's failure of the other server computer. At this time, the server connection unit 32 of the client computer 30 can be connected to either the active server computer 10-1 or the standby server computer 10-2.

  Here, the server connection unit 32 of the client computer 30 is connected to the active server computer 10-1 as shown in FIG. 4, and the client connection flag 130-1 of the server computer 10-1 is turned ON. And This operation is not performed when the client computer 30 is already connected to the active server computer 10-1. The multiplexing control unit 13-1 of the server computer 10-1 determines that the other party (server computer 10-2) has failed, and if the client connection flag 130-1 is ON, the server computer 10-1 Judged to belong to a group that occupies a large number (a majority) of the total number of computers in the system. In this case, the multiplexing control unit 13-1 of the server computer 10-1 executes the processing by the server processing unit 11-1 of the server computer 10-1 because the server computer 10-1 is an active system. Let it continue.

  On the other hand, even if the multiplexing control unit 13-2 of the server computer 10-2 determines that the partner (server computer 10-1) has failed, if the client connection flag 130-2 is OFF as in this example, It is determined that the server computer 10-2 does not belong to a group that occupies a large number with respect to the total number of computers in the system. In this case, the multiplexing control unit 13-2 of the server computer 10-2 continues the stopped state of the server processing unit 11-2 of the server computer 10-2 because the server computer 10-2 is a standby system. Let

  As described above, in the present embodiment, even if network division occurs between the server computers 10-1 and 10-2, each of the server computers 10-1 and 10-2 has the client connection flag 130-1 and Whether or not to execute server processing can be correctly determined from the state of 130-2, that is, the connection state with the client computer 30. Thereby, generation | occurrence | production of split brain can be prevented.

<Operation when heartbeat transmission is congested due to a heavy load on the operating system)
Next, the operation when the heartbeat transmission from the heartbeat mechanism 12-1 of the server computer 10-1 to the server computer 10-2 is congested will be described with reference to the system state diagram of FIG.

  Now, the active server computer 10-1 in the state of FIG. 2 becomes heavily loaded, and the heartbeat transmission from the heartbeat mechanism 12-1 of the server computer 10-1 to the server computer 10-2 is congested. Shall be. The heartbeat mechanism 12-2 of the standby server computer 10-2 cannot recognize the active server computer 10-1, as shown in FIG. In this state, even if the client computer 30 is connected to the server computer 10-1, service provision from the server computer 10-1 to the client computer 30 is also congested.

  Therefore, the server connection unit 32 of the client computer 30 switches the connection destination from the active server computer 10-1 to the standby server computer 10-2 as indicated by an arrow 501 in FIG. The client connection flag 130-2 of 10-2 is turned ON. At this time, the server connection unit 32 turns off the client connection flag 130-1 of the active server computer 10-1.

  In the multiplexing control unit 13-2 of the standby server computer 10-2, when the client connection flag 130-2 is turned ON, the server computer 10-2 occupies a large number with respect to the total number of computers in the system. It belongs to a certain group. In this case, since the server computer 10-2 is a standby system, the multiplexing control unit 13-2 of the server computer 10-2 has an active system by the server processing unit 11-2 of the server computer 10-2. The processing performed in the server processing unit 11-1 of the server computer 10-1 is taken over. As a result, the server computer 10-2 is switched from the standby system to the active system.

  On the other hand, when the client connection flag 130-1 is turned off, the multiplexing control unit 13-1 of the active server computer 10-1 determines that the server computer 10-1 has a larger number than the total number of computers in the system. Judge that it does not belong to the group it occupies. In this case, the multiplexing control unit 13-1 of the server computer 10-1 stops the operation of the server processing unit 11-12 of the server computer 10-1 because the server computer 10-1 is an active system. . As a result, the server computer 10-1 is switched from the active system to the standby system.

  In the first embodiment, the server connection unit 32 of the client computer 30 turns on the client connection flag of the connection destination server computer only when connecting to the server computer. Further, when the connection destination is switched, the server connection unit 32 turns off the client connection flag of the server computer of the original connection destination. However, the server connection unit 32 may periodically perform an update operation (ON operation) for turning on the client connection flag of the connection destination server computer. In this case, the multiplexing control unit of the server computer has an OFF operation means for turning off the client connection flag, the OFF operation means regularly monitors the client connection flag, and the ON operation is not performed for a certain period of time. In this case, the flag may be turned off. Here, in order to be able to detect that the ON operation has not been performed for a certain time, for example, a time stamp whose time information is updated every ON operation is added to the client connection flag, and the time stamp is set as the current time. Compare.

[Second Embodiment]
FIG. 6 is a block diagram showing a configuration of a duplex system according to the second embodiment of the present invention. In FIG. 6, the same components as those in FIG. 1 are denoted by the same reference numerals for the sake of convenience.

  The duplex system shown in FIG. 6 includes two server computers 10-1 and 10-2 that can communicate with each other via the network 20 in the same manner as the duplex system shown in FIG. 6 differs from the duplex system of FIG. 1 in that the duplex system (server computers 10-1 and 10-2 constituting the duplex system) is N (N is an integer of 2 or more). ) Is used by the client computers 30-1 to 30-N. 6 is characterized in that the number of client computers connected to the server computer 10-i (i = 1, 2) accounts for a majority of the total number of client computers (that is, more than N / 2). The server processing is executed by the server computer 10-i, and the server processing is not executed by the server computer 10-i when the server computer 10-i is less than the majority (that is, N / 2 or less). .

  Therefore, the multiplexing controllers 13-1 and 13-2 of the server computers 10-1 and 10-2 replace the client connection flags 130-1 and 130-2 in FIG. 131-2. The client connection counters 131-1 and 131-2 are client connection state management means for managing the connection state between the server computers 10-1 and 10-2 and the client computer, and the server computers 10-1 and 10-2. The number (number of connections) C1 and C2 of client computers connected to is held.

The client computers 30-1 to 30-N correspond to the client processing unit 31 and the server connection unit 32 in FIG. 1, and correspond to the client processing units 31-1 to 31-N and the server connection units 32-1 to 32-N. Have The server connection unit 32-k of the client computer 30-k (k = 1 to N), when the client processing unit 31-k intends to receive service from the server computer 10-i, the server computer 10-i. The connection request is sent to the server computer 10-i. At this time, the server connection unit 32-k increments the value of the client connection counter 131-i of the server computer 10-i by 1. The server connection unit 32-k switches the connection destination of the client computer 30-k from the server computer 10-j (j is 1 or 2, where j ≠ i) to the server computer 10-i. The value of the client connection counter 131-i of the server computer 10-j is decremented by 1. As a result, the client connection counters 131-1 and 131-2 of the server computers 10-1 and 10-2 hold the numbers C1 and C2 of the client computers connected to the server computers 10-1 and 10-2, respectively. The multiplexing controllers 13-1 and 13-2 of the server computers 10-1 and 10-2 are normal to each other by the heartbeat mechanisms 12-1 and 12-2 of the server computers 10-1 and 10-2. If it is recognized that the server processing unit 11-1 or 11-2 is active, the server processing units 11-1 and 11-2 continue to execute the process. Continue the stop state of -2. In addition, when the heartbeat mechanisms 12-1 and 12-2 do not recognize the partner, the multiplexing controllers 13-1 and 13-2 determine the values of the client connection counters 131-1 and 131-2, that is, the server computer 10-1. 10-2, the number of client computers connected (number of connections) C1, C2 is determined whether it exceeds N / 2. If the number of connections C1 and C2 exceeds N / 2, the multiplexing control units 13-1 and 13-2 execute the processing by the server processing units 11-1 and 11-2, and the number is less than N / 2. If there is, the processing by the server processing units 11-1 and 11-2 is stopped. As a result, even if a network partition occurs between the duplicated server computers 10-1 and 10-2, or if some of the N client computers 30-1 to 30-N fail, While preventing the occurrence of split brain between the server computers 10-1 and 10-2, it is possible to prevent the occurrence of a situation where the service is not provided to the client computer as much as possible.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

1 is a block diagram showing a configuration of a duplex system according to a first embodiment of the present invention. The system state figure at the normal time in the same embodiment. The system state figure when the active server computer 10-1 stops in the embodiment. FIG. 3 is a system state diagram when the network is divided between the active server computer 10-1 and the standby server computer 10-2 in the embodiment. FIG. 3 is a system state diagram when the active server computer 10-1 is heavily loaded and the heartbeat transmission is congested in the embodiment. The block diagram which shows the structure of the duplex system which concerns on the 2nd Embodiment of this invention.

Explanation of symbols

  10-1, 10-2 ... server computer, 11-1, 11-2 ... server processing unit, 12-1, 12-2 ... heartbeat mechanism, 13-1, 13-2 ... multiplexing control unit, 20 ... Network, 30, 30-1 to 30-N ... Client computer, 31, 31-1 to 31-N ... Client processing unit, 32, 32-1 to 32-N ... Server connection unit, 130-1, 130-2 ... client connection flag (client connection state management means), 131-1 and 131-2 ... client connection counter (client connection state management means).

Claims (7)

Consists of two server computers that can communicate with each other to provide services to N (N is an integer of 1 or more) client computers, and either one of the two server computers operates as an active system In a duplex system in which the other operates as a standby system,
Each of the two server computers is
Server processing means for executing server processing for providing the service;
Client connection state management means for managing connection states with the N client computers;
And multiplexing control means for controlling whether or not to execute server processing by the server processing means based on a majority decision based on connection states with the N client computers managed by the client connection state management means. A duplex system characterized by this. Each of the two server computers has a heartbeat mechanism for recognizing each other by communicating with each other,
When the heartbeat mechanism cannot recognize the other party, the multiplexing control means uses the server processing means by a majority decision based on connection states with the N client computers managed by the client connection state management means. 2. The duplex system according to claim 1, wherein whether or not to execute server processing according to claim 1 is controlled. The client connection state management means manages the connection state with the N client computers by the number of connections indicating the number of client computers connected to the corresponding server computer among the N client computers. And
The multiplexing control means controls whether or not to execute server processing by the server processing means depending on whether or not the number of connections managed by the client connection state management means exceeds N / 2. The duplex system according to claim 1, characterized in that:   The number of connections managed by the client connection state management means is updated when any of the N client computers switches connection destinations, and the corresponding server computer becomes a new connection destination after switching. 4. The duplex system according to claim 3, wherein 1 is decremented at a time and 1 is decremented when the corresponding server computer becomes an original connection destination before switching. N is 1;
The client connection state management means is flag information indicating whether or not a connection state with the client computer is connected to the server computer corresponding to the client computer, and the client computer corresponds to the server computer corresponding to the client computer. During the period when the client computer is connected to the first state indicating that the client computer is connected to the corresponding server computer, the flag information is periodically updated by the client computer, and the flag information is If not updated to the first state for a certain period of time, the flag information is set to a second state indicating that the client computer is not connected to the corresponding server computer;
The multiplexing control unit causes the server processing unit to execute server processing depending on whether the flag information managed by the client connection state management unit is the first state or the second state. The duplex system according to claim 1, wherein control is performed. Consists of two server computers that can communicate with each other to provide services to N (N is an integer of 1 or more) client computers, and either one of the two server computers operates as an active system In a duplex system in which the other operates as a standby system, a multiplexing control method for controlling server processing that is duplicated between the two server computers,
Each of the two server computers manages a connection state with the N client computers,
Each of the two server computers determines whether or not it executes server processing by a majority decision based on the connection state with the N client computers. Each of the two server computers recognize each other by communicating with each other,
If each of the two server computers fails to recognize the other party, it determines whether or not to execute server processing by a majority decision based on the connection state with the N client computers. The multiplexing control method according to claim 6.

Images