JP2010231257A - High availability system and method for handling failure of high availability system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a high availability system that uses a cluster to perform backup and recovery using the latest data without stopping the cluster by organically connecting the two technologies of the cluster and the backup. <P>SOLUTION: The high availability system is provided with: an active server 101; a cluster 103 including a backup server 102 for always storing up-to-date data in synchronization with the active server; and a virtual server 122 for synchronizing the data with the active server 102. The synchronization between backup server 102 and the virtual server 122 is interlocked with synchronization between the active server 101 and the backup server 102. The virtual server 122 is backed up while the synchronizing function between the backup server 102 and the active server 101 and the synchronizing function between the virtual server 122 and the backup server 102 are stopped. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

    The present invention relates to a high availability system using a cluster, and more particularly, to a countermeasure method against a failure in a high availability system.

  Clustering is a general technique and is a technique for realizing high availability. On the other hand, backup is widely used as a technique for realizing quick failure recovery.

  Although these clustering and backup technologies are different in approach, they are all anti-failure technologies, and if these two technologies are organically combined, availability can be further increased. However, a technology that organically combines clustering and backup has not been established.

  For example, in the related technology described in Patent Document 1, a technology for constructing a server having the same function on a virtual machine and operating it as a cluster is proposed, but no consideration is given to backup for disaster recovery measures. It has not been.

JP 2005-173751 A

  As described above, although both clustering and backup technologies are aimed at countermeasures against failure, no technology has been established for further combining these technologies to further increase availability.

  The related art described in Patent Document 1 and the like has a problem that the cluster must be stopped in order to safely back up the cluster system. This is because it is necessary to provide a quiesce point in order to maintain data consistency, and it is necessary to perform backup in this state. Therefore, backup cannot be performed without stopping the cluster in a system that cannot stop the business.

(Object of invention)
An object of the present invention is to provide a high-availability system in which two technologies of a cluster and a backup are organically combined in a high-availability system using a cluster, and backup and recovery with the latest data can be performed without stopping the cluster. Is to provide.

  The high availability system of the present invention includes an active server, a cluster including a standby server that keeps data up-to-date in synchronization with the active server, and a virtual server that synchronizes data with the standby server In synchronization with the synchronization processing of the active server and the standby server, the standby server and the virtual server are synchronized. The synchronization function between the standby server and the active server and the standby server of the virtual server Backup the virtual server with the synchronization function stopped.

  The method for countermeasures against failure of the high availability system of the present invention includes a step of performing synchronization processing between a standby server and a virtual server in addition to synchronization processing between an active server and a standby server constituting a cluster, There is a step of backing up the virtual server in a state where the synchronization function of the server with the active server and the synchronization function of the virtual server with the standby server are stopped.

  According to the present invention, in a high-availability system using a cluster, the two technologies of cluster and backup are organically combined to enable backup and recovery with the latest data without stopping the cluster.

It is a block diagram which shows the whole structure of the high availability system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the active system server which concerns on 1st Embodiment. It is a block diagram which shows the structure of the standby system server which concerns on 1st Embodiment. It is a block diagram which shows the function structure of the virtual server which concerns on 1st Embodiment. It is a block diagram which shows the function structure of the management server which concerns on 1st Embodiment. It is a time chart figure which shows the backup process of the high availability system which concerns on 1st Embodiment. It is a time chart figure which shows the recovery process of the high availability system which concerns on 1st Embodiment. It is a block diagram which shows the structure of the operation meter server which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the standby system server which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the management server which concerns on the 2nd Embodiment of this invention. It is a flowchart figure which shows operation | movement of the management server which concerns on 2nd Embodiment. It is a block diagram which shows the hardware structural example of the server in 1st and 2nd embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the first embodiment, the basic configuration and characteristics of a high availability system using virtual machine servers and clusters, and operations of backup and recovery processing will be described in detail. In the second embodiment, an automatic recovery method when a failure occurs in the active server will be described in detail. In the third embodiment, an example in which a cluster is constructed in a virtual machine on a virtual machine server in order to cope with cost reduction will be described in detail.

(First embodiment)
FIG. 1 is a block diagram showing the overall configuration of the high availability system according to the first embodiment of the present invention. Referring to FIG. 1, the high availability system according to the first embodiment includes a cluster 103 constructed by an AP (application) server 101 and an AP server 102, a cluster 113 constructed by a DB (database) server 111 and a DB server, a virtual A machine server 121, a virtual AP server 122, a virtual DB server 123, and a management server 131 constructed on the virtual machine server 121 are included.

  As described above, the AP server 101 and the AP server 102 constitute the cluster 103, and the DB server 111 and the DB server 112 constitute the cluster 113, and one of the servers in the cluster provides a service to the user. The other active server is operating as the standby server. The clusters 103 and 113 have a mirror type clustering function. The AP server 102 and the DB server 112 that are standby servers always keep the latest data in synchronization with the AP server 101 and the DB server 111 that are active servers.

  In the cluster 103 and the cluster 113, the service network 141 is connected to a service network 141 used for business and a management network 142 used for synchronization and backup in the cluster.

  As shown in FIGS. 2 and 3, the active AP server 101 and the standby AP server 102 include cluster synchronization means 202 and 302 and data synchronization means 202 and 302. The cluster synchronization means 202, 302 can be implemented as an agent that executes cluster synchronization, for example. Similarly, the data synchronization means 203 and 303 can also be implemented as agents that execute data synchronization.

  The active AP server 101 and the standby AP server 102 have a function of synchronizing data within the cluster 103 using the cluster synchronization means 202 and 302. Further, it has a function of synchronizing data with the virtual AP server 122 using the data synchronization means 203 and 303.

  Note that the active DB server 111 and the standby DB server 112 constituting the cluster 113 have the same configuration as the active AP server 101 and the standby AP server 102, and the cluster synchronization means 202 and 302 are used. Data synchronization is performed within the cluster 113. Further, the data synchronization means 203 and 303 are used to synchronize data with the virtual DB server 123.

  The management network 142 includes a virtual AP server 122 that synchronizes with the standby AP server 102 of the cluster 103, a virtual DB server 123 that synchronizes with the standby DB server 112 of the cluster 113, and a management server 131.

  The virtual AP server 122 and the virtual DB server 123 are virtual servers constructed on the virtual machine server 121, and include data synchronization means 402 as shown in FIG. The data synchronization unit 402 synchronizes data with the standby AP server 102 and the standby DB server 112. The virtual AP server 122 and the virtual DB server 123 serve as backup target servers.

  As shown in FIG. 5, the management server 131 includes a cluster control program 502, a backup program 503, and a recovery program 504.

  The cluster control program 502 has a cluster control function for switching between active and standby servers in the cluster 103 and cluster 113.

  The backup program 503 has a function of backing up the virtual AP server 122 and the virtual DB server 12.

  The recovery program 504 has a recovery function for migrating a virtual server that is a backup target server to the active server and the standby server in the cluster 103 and the cluster 113 to recover the system.

  The feature of this embodiment is that backup of the AP server 101 and the AP server 102 can be realized without stopping the cluster, and the load on the AP server 101 and the AP server 102 for backup can be reduced. . In order to realize these, backup is performed from the virtual AP server 122. In order to reduce the load, only the difference data of the AP server 102 is transmitted to the virtual AP server 122 to perform the synchronization process.

(Description of the operation of the first embodiment)
Next, processing operations of the high availability system according to the present embodiment will be described with reference to FIGS.

  FIG. 6 is a sequence diagram illustrating an example of backup processing of the high availability system according to the present embodiment. An example will be described in which the AP server 101 of the cluster 103 is an active server and the AP server 102 is a standby server.

  The management server 131 instructs the active AP server 101, the standby AP server 102, and the virtual AP server 122 to perform a synchronization process (step 601).

  When the data update occurs, the active AP server 101 activates the cluster synchronization unit 202 and transmits the difference data changed from the previous synchronization to the standby AP server 102 (step 602). The standby AP server 102 operates the cluster synchronization means 302, receives the difference data from the active AP server 101, writes it to the disk, and performs synchronization processing (step 603).

  When the synchronization process is completed, the standby AP server 102 stops the cluster synchronization unit 302, and thereafter changes the setting so as not to synchronize with the active AP server 101 (step 604).

  Next, the standby AP server 102 activates the data synchronization unit 303 and transmits the difference data received from the active AP server 101 to the virtual AP server 122 (step 605). The virtual AP server 122 activates the data synchronization unit 402, receives the difference data, writes it to the disk, and performs synchronization processing (step 606).

  When the synchronization is completed, the virtual AP server 122 stops the data synchronization unit 402 and changes the setting so as not to synchronize with the standby AP server 102 thereafter (step 607). That is, the synchronization process between the AP server 102 and the virtual AP server 122 is temporarily stopped.

  Subsequently, the management server 131 performs backup of the virtual AP server 122 by the backup program 503 (step 608). In this backup, if the backup includes the system, the backup is performed offline, but if only the data backup is performed, the backup can be performed online. Further, until the backup is completed, the AP server 102 cannot transmit the difference data to the virtual AP server 122, and therefore retains the difference data therein.

  When the backup of the virtual AP server 122 is completed, the management server 131 resumes the operations of the cluster synchronization unit 302 of the standby AP server 102 that has been stopped and the data synchronization unit 402 of the virtual AP server 122 (steps 609 and 610). ). As a result, the synchronization process between the active AP server 101 and the standby AP server 102 and the synchronization process between the standby AP server 102 and the virtual AP server 122 are resumed.

  In the above description, the backup processing when the AP server 101 of the cluster 103 is the active server and the AP server 102 is the standby server has been described. However, the DB server 111 of the cluster 113 is the active server and the DB server 112 is standby. Even in the case of a system server, the backup process is executed by the same procedure as described above.

  FIG. 7 is a sequence diagram showing an example of recovery processing of the high availability system in the present embodiment. Here, a description will be given of processing in a case where a system abnormality occurs in the active AP server 101 and recovery is performed when the active server is the AP server 101 and the standby server is the AP server 102.

  When a failure occurs in the active AP server 101, the management server 131 switches the active server from the AP server 101 to the AP server 102 by the cluster control program 502, and disconnects the AP server 1101 from the cluster 103 (steps 701 and 702). 703). As a result, the AP server 102 continues the operation as an active server.

  The management server 131 instructs the virtual AP server 122 to stop the data synchronization unit 402 (step 706). The virtual AP server 122 stops the synchronization process with the AP server 102 and provides a stationary point when a system abnormality occurs.

  Thereafter, the management server 131 executes the recovery program 504, migrates the virtual AP server 122 to the AP server 101 where the failure has occurred, and restores the system (705, 707).

  Since technology for migrating machines with different hardware configurations has been realized as a function of the virtual machine server, problems such as driver compatibility due to different hardware of the virtual AP server 122 and the AP server 101 have occurred. do not do.

  When the AP server 101 is recovered to the stationary point by the migration, the management server 131 restarts the cluster synchronization unit 202 of the AP server 101 and the data synchronization unit 402 of the virtual AP server 122 (709, 710). As a result, the synchronization process between the active AP server 102 and the AP server 101 and the synchronization process between the AP server 101 and the virtual AP server 122 are resumed.

  In the above description, the recovery process is described in the case where the AP server 101 of the cluster 103 is an active server and the AP server 102 is a standby server. However, the DB server 111 of the cluster 113 is standby and the DB server 112 is standby. Even in the case of a system server, the recovery process is executed by the same procedure as described above.

(Effects of the first embodiment)
Next, effects of the first embodiment described above will be described.
First, backup can be performed without stopping the service while realizing high availability by the cluster. That is, it is possible to provide a highly available system that organically combines the two technologies of cluster and backup.

  Second, instead of backing up the active server directly, by executing the backup from the virtual server holding the same operating system, application, and data, the service of the active server and the standby server can be stopped without interruption. Load reduction can be realized. In addition, since the backup is based on the differential data, the load on the active server and the standby server can be reduced.

  Third, it is possible to comprehensively consider the cluster synchronization function and differential backup. That is, it is possible to realize the fusion of the cluster and the backup by writing the difference data generated in the clustering to the virtual server.

  Fourth, since the disk state of the virtual machine server is always synchronized with the cluster synchronization process and always backed up by differential data, backup and recovery in the latest state can always be provided.

  Fifth, by constructing a virtual server on the virtual machine server 121 and using the virtual server as a backup target server, merits such as reduction in installation cost of the backup target server, energy saving, and space aggregation can be obtained.

(Second Embodiment)
Next, a high availability system according to the second embodiment of the present invention will be described. In the second embodiment, by using the failure monitoring function, when a failure occurs in the server, the cluster is automatically switched and the failed server is recovered.

  Since the overall configuration of the high availability system according to the second embodiment is the same as the configuration of the first embodiment shown in FIG. 1, the description thereof is omitted here.

  8 to 10 are block diagrams showing functional configurations of the active AP server 101, the standby server 102, and the management server 131 according to the second embodiment of the present invention.

  The active AP server 101 includes cluster synchronization means 202, data synchronization means 203, and failure monitoring means 204. Similarly, the standby AP server 102 includes cluster synchronization means 302, data synchronization means 303, and failure monitoring means 304.

  The failure monitoring means 204 and 304 of the active AP server 101 and the standby AP server 102 are programs that monitor and detect server failures, and are implemented by programs implemented based on a known protocol such as SNMP. . When the failure monitoring means 204, 304 detects a system failure or the like in the server, the failure monitoring means 204, 304 sends a failure occurrence notification to the management server 131.

  The management server 131 includes a cluster control program 502, a backup program 503, a recovery program 504, and a failure monitoring program 505.

  The failure monitoring program 505 monitors failure occurrence notifications from the failure monitoring means 204 and 304. When the failure occurrence notification is received, the management server 131 uses this as a trigger to perform cluster switching and failure server recovery processing. Execute.

  The functions of the cluster synchronization means 202 and data synchronization means 203 and 303 of the active AP server 101 and the standby AP server 102, the functions of the cluster control program 502, backup program 503, and recovery program 504 of the management server 131 are described below. Since this is the same as the first embodiment, the description thereof is omitted here.

  8 and 9, the configurations of the active AP server 101 and the standby AP server 102 have been described. The active DB server 111 and the standby DB server 112 are similarly provided with failure monitoring means. .

  The operation of the recovery process in the high availability system according to this embodiment will be described.

  FIG. 11 is a flowchart showing the operation of the management server 131 in this embodiment.

  In the management server 131, the failure monitoring program 505 is running, and the failure detection notification from the failure monitoring means 204 or 304 is monitored (step S901). When a failure detection notification is received, this is used as a trigger to start cluster switching and failure server recovery processing. In the following description, the active server is the AP server 101, the standby server is the AP server 102, and a case where a failure occurs in the active AP server 101 will be described as an example.

  When the management server 131 receives a failure notification from the failure monitoring unit 204 of the active AP server 101, the cluster control program 502 automatically operates to switch the active server from the AP server 101 to the AP server 102 ( In step S902), the faulty AP server 101 is disconnected from the cluster 103 (step S903).

  Subsequently, the management server 131 instructs the virtual AP server 122 to stop the data synchronization unit 402 and stops the synchronization process (step S904). Here, the virtual AP server 122 provides a stationary point when a system abnormality occurs.

  Then, the management server 131 executes the recovery program 504, migrates the virtual AP server 122 to the AP server 101 in which the failure has occurred, and restores the system (step S905). When the AP server 101 is recovered to the stationary point by migration, the management server 131 restarts the cluster synchronization unit 202 of the active AP server 101 and the data synchronization unit 402 of the virtual AP server 122 (step S906).

  Note that the backup processing in the second embodiment is executed in exactly the same way as in the first embodiment.

(Effects of the second embodiment)
According to this embodiment, when a failure occurs in either the active server or the standby server in the high availability system, recovery can be automatically realized with the latest data. The reason why the latest data can always be recovered is that the disk state of the virtual AP server is always backed up by differential data in conjunction with the cluster synchronization process. That is, automatic switching and automatic recovery can be realized by combining with the failure monitoring function.

  In the first embodiment and the second embodiment, the clusters 103 and 113 shown in FIG. 1 can be constructed by virtual machines on a virtual machine server.

Here, a hardware configuration example of each server according to the first embodiment and the second embodiment will be briefly described. FIG. 12 is a block diagram illustrating a hardware configuration example of the AP server 101. Here, the AP server 101 will be described as an example, but the other servers have the same configuration.

  Referring to FIG. 12, the AP server 101 can be realized by a hardware configuration similar to that of a general computer device, and includes data such as a CPU (Central Processing Unit) 701 and a RAM (Random Access Memory). The main storage unit 702 used for the work area and data temporary save area, the communication unit 703 that transmits and receives data via the network, the input device 705, the output device 706, and the storage device 707 are connected to transmit and receive data. An input / output interface unit 704 and a system bus 708 for interconnecting the above-described components are provided. The storage device 707 includes, for example, a nonvolatile memory such as a ROM (Read Only Memory), a magnetic disk, and a semiconductor memory.

  The AP server 101 mounts a circuit component that is a hardware component such as an LSI (Large Scale Integration) in which a program is incorporated, so that the operation is realized in hardware. A program that provides functions such as the data synchronization unit 203 is stored in the storage device 707, and the program is loaded into the main storage unit 702 and executed by the CPU 701.

  Although the present invention has been described with reference to the preferred embodiments, the present invention is not necessarily limited to the above embodiments, and various modifications can be made within the scope of the technical idea. .

101, 102: AP server 111, 112: DB server 103, 113, 1007: Cluster 121: Virtual machine server 122: Virtual AP server 123: Virtual DB server 131: Management server 141: Service network 142: Management network 202, 302: Cluster synchronization means 203, 303, 402: Data synchronization means 204, 304: Fault monitoring means 502: Cluster control program 503: Backup program 504: Recovery program 505: Fault monitoring program

Claims (10)

A cluster including an active server and a standby server that always keeps data up-to-date in synchronization with the active server;
A virtual server that synchronizes data with the standby server,
In synchronization with the synchronization processing of the active server and the standby server, the standby server and the virtual server are synchronized, the synchronization function of the standby server with the active server, and the virtual server A high availability system, wherein the virtual server is backed up in a state where the synchronization function with the standby server is stopped. Sending difference data from the active server to the standby server to perform synchronization processing, and sending the difference data from the standby server to the virtual server to perform synchronization processing,
The high availability system according to claim 1, wherein after the backup is completed, the synchronization function of the standby server with the active server and the synchronization function of the virtual server with the standby server are resumed. If a system error occurs on the active server, disconnect the active server from the cluster,
3. The high availability according to claim 1, wherein the system is recovered and the active server is returned to the cluster by executing migration of the disconnected active server and the virtual server. system. With a management server,
The management server is
A control program for controlling synchronization of the standby server with the active server and synchronization of the virtual server with the standby server;
A backup program for performing backup of the virtual server;
The high availability system according to any one of claims 1 to 3, further comprising a recovery program that recovers the system by executing migration of the separated active server and the virtual server. The active server and the standby server include failure monitoring means for monitoring a failure of the own server,
When the management server receives a failure detection notification from the failure monitoring means of the active server or the standby server, the active server or the standby system in which a failure has occurred automatically, triggered by the failure detection notification The high availability system according to claim 4, wherein server detachment and migration with the virtual server are executed. A step of performing synchronization processing between the standby server and the virtual server in series with synchronization processing between the active server and the standby server constituting the cluster;
A high availability system comprising a step of backing up the virtual server in a state where the synchronization function of the standby server with the active server and the synchronization function of the virtual server with the standby server are stopped. Measures against failure. Performing synchronization processing by transmitting difference data from the active server to the standby server, and performing synchronization processing by transmitting the difference data from the standby server to the virtual server;
7. The method according to claim 6, further comprising a step of resuming a synchronization function of the standby server with the active server and a synchronization function of the virtual server with the standby server after the backup is completed. How to deal with failures in availability systems. When a system error occurs in the active server, disconnecting the active server from the cluster; and
8. The method according to claim 6, further comprising a step of recovering a system and returning the active server to the cluster by executing migration of the disconnected active server and the virtual server. For high-availability systems. With a management server,
On the management server,
Controlling the synchronization of the standby server with the active server and the synchronization of the virtual server with the standby server,
Perform a backup of the virtual server,
9. The countermeasure against failure of a high availability system according to claim 6, wherein migration of the separated active server and the virtual server is executed. The active server and the standby server monitor the failure of the local server,
Upon receiving a failure detection notification from the active server or the standby server in the management server, automatically triggered by the failure detection notification, disconnection of the active server or the standby server that has failed, 10. The countermeasure against failure of a high availability system according to claim 9, wherein migration with the virtual server is executed.

Images