JP2010282326A - Information processing system, failure countermeasure mechanism for the same, and failure countermeasure method for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the following problem: in a countermeasure against a failure by a hot standby system fail-over technology of an information processing system configured of a multiplexed computer device, when a currently-operated computer device cannot replay while mounted with a logical disk and a spare computer is tried to be mounted with a logical disk, the try is recognized as a double mounting request, and the mounting is disturbed, consequently the spare computer cannot take over the processing from the faulty computer. <P>SOLUTION: A failure countermeasure mechanism by a hot standby system fail-over technology in an information processing system connected to a common external storage device, and configured of a multiplexed computer device includes: a monitoring means for individually monitoring the occurrence of the failure of the computer device; an access interruption means for, when the occurrence of the failure is detected, interrupting input/output access from the computer device in which the failure has occurred with respect to the external storage device; and a notification means for notifying the other computer device of the information of the occurrence of the failure. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an information processing system configured by connecting a computer device and a disk array device, and more particularly to a failure handling mechanism and a failure handling method for a computer device.

  Today, information processing systems constituting computer networks are becoming more socially important and require high availability and reliability. For example, in a server system, when a failure occurs in a server, it is necessary to promptly respond to the administrator, stop the failed server, and take recovery measures to prevent malfunction.

  In recent years, the introduction of a failover function has become common as a countermeasure for failure of server systems. Failover is a function in which an alternative server automatically takes over processing and data when a failure occurs in the server. Specifically, for example, a plurality of servers including spares are connected to a common disk array device, and each server has a system configuration in which a logical disk in the disk array device is mounted and processing can be executed. When a failure occurs in the operating server, the spare server can mount the logical disk and take over the processing of the operating server.

  Note that there are methods called failover and hot standby for failover.

  In cold standby, an equivalent server is prepared in addition to the operation server that is normally operated, and the standby server is not operated as a spare server. If a failure occurs in the operation server, the spare server automatically operates and starts processing in place of the operation server. This method takes some time to switch servers, and the system stops during switching. Patent Document 1 discloses an example of a technique for shortening the system stop time until the failover is executed in the cold standby method. The cold standby failover of Patent Document 1 is configured such that a management server is prepared separately from the operation server and the spare server, and the management server performs information management and control for system switching.

  On the other hand, unlike the cold standby, the hot standby is a system in which the spare server is always operated together with the operation server, and when a failure occurs in the operation server, the spare server is immediately switched as the operation server. Hot standby costs more than cold standby, but can provide higher availability and reliability. Patent Document 2 discloses an example of hot standby type failover. The technology disclosed in Patent Document 2 is such that the operation server and the spare server always monitor each other's operating state and share processing status information, so that even if a failure occurs in the operation server, the operation is performed without interruption. It is a system that takes over.

JP 2008-293245 A JP-A-11-259326

  However, the above-mentioned hot standby method failover technology is mainly handled by the server side, such as failure monitoring and system switchover in the event of a failure. It sometimes caused problems.

  The first problem is that when a failure occurs in the operation server and the response becomes impossible while the logical disk in the disk array device is mounted, the system switching to the spare server may not be performed successfully.

  The reason is that if the spare server tries to mount the logical disk mounted by the primary server to take over the processing, this appears to the disk array device as a double mount request and may prevent the mount. It is. Therefore, although the spare server detects a failure of the operation server, the logical disk in the disk array device cannot be mounted and the service cannot be continued.

  The second problem is that even if the system switchover is performed normally, if the original operation server that had been switched over as a failure suddenly recovers after a reboot, the logical disk data may be destroyed. That is.

  The reason is that the original operation server is stopped without releasing the mounted state of the logical disk in the disk array device when a failure occurs, and starts to access the logical disk again after recovery. That is, when the restored original operational server accesses the logical disk mounted by the current operational server again, double mounting may occur, and data may be destroyed.

  SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems and provide a failure handling mechanism and a failure handling method for a computer device in which prevention of double mounting of logical disks is managed in an information processing system constituted by multiplexed computer devices. It is.

  The failure handling mechanism of the information processing system of the present invention is configured by connecting at least two computer devices including a spare computer device to a common external storage device, and the spare computer device is always in operation. A failure handling mechanism in an information processing system constituting a multiplexed computer device that is waiting while maintaining the same operating state as the monitoring device, wherein the monitoring unit individually monitors the occurrence of a failure in the computer device, and the monitoring unit includes: An access block that blocks the input / output access to the external storage device from the computer device in which the failure has occurred upon detecting the occurrence of a failure in any of the computer devices And the monitoring means indicate that one of the computer devices has failed. Upon detecting a, it receives the detection of the failure, having, a notification unit that notifies the computer system that is not a failure of the computing device information of the failure.

The failure handling method for an information processing system according to the present invention is configured by connecting at least two computer devices including a spare computer device to a common external storage device, and the spare computer device is always in operation. A failure handling method in an information processing system that constitutes a multiplexed computer device that is on standby while maintaining the same operating state as the device,
Individually monitoring the occurrence of a fault in the computer device;
When the monitoring unit detects that a failure has occurred in any of the computer devices, the monitoring unit receives the detection of the failure and performs input / output access to the external storage device from the computer device in which the failure has occurred. A blocking step;
When the monitoring means detects that a failure has occurred in any of the computer devices, the computer device that has received the detection of the failure and uses the information on the occurrence of the failure as a computer device in which no failure has occurred. And notifying to.

  According to the present invention, in the information processing system constituting the multiplexed computer apparatus, even if the operation computer apparatus becomes unable to respond with the logical disk mounted, the spare computer apparatus is prevented from mounting the logical disk. Nothing will happen. In addition, even if the operation computer apparatus in which the failure occurs suddenly recovers, the data is not destroyed due to the double mount.

FIG. 1A is a block diagram showing the basic configuration of the embodiment of the present invention. FIG. 1B is a flowchart showing the basic operation of the embodiment of the present invention. FIG. 2 is a system configuration diagram of the redundant server system according to the embodiment of this invention. FIG. 3 is a flowchart showing an operation procedure of the redundant server system according to the embodiment of this invention.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  1A and 1B are a block diagram showing a basic system configuration and a flowchart showing a basic operation of a failure handling mechanism and a failure handling method of an information processing system according to an embodiment of the present invention.

  Referring to FIG. 1A, the fault monitoring mechanism of this system includes a fault monitoring unit, an access blocking unit, and a fault notification unit. The failure monitoring means individually monitors the occurrence of a failure in each computer device connected to the external storage device. The access blocking means blocks input / output access to the external storage device from the failed computer device when the failure monitoring means detects that a failure has occurred in any of the operating computer devices. The failure notification means also notifies failure information to each computer device that is operating normally.

  FIG. 1B shows a basic operation in an information processing system constituted by a plurality of computer devices in which a plurality of computer devices including an operating computer device and a spare computer device are connected to a common external storage device. Each computer apparatus in operation mounts a predetermined area of the external storage device, accesses operation data, and executes processing. The spare computer device is on standby for failure of the operating computer device while maintaining the same operating state as the operating computer device.

  The failure monitoring means individually monitors the occurrence of a failure in each computer device connected to the external storage device. When it is detected that a failure has occurred in one of the operating computer devices, the access blocking means blocks the input / output access to the external storage device from the failed computer device. Further, the failure notification means notifies the failure occurrence information to each normally operating computer device.

  Through the above steps, the following effects can be obtained when the spare computer device that should take over the processing of the computer device in which the failure has occurred receives notification of the failure occurrence information, switches the system, and takes over the processing. In other words, the spare computer device needs to mount a predetermined area of the external storage device used by the computer device in which the failure has occurred in order to take over the processing and access the operation data. Even if the computer device in which the failure has occurred is stopped with the external storage device mounted, the input / output access from the computer device is blocked when the external storage device is stopped. Therefore, even if the spare computer device mounts the same area of the external storage device for taking over the procedure, the problem due to the double mounting does not occur. For this reason, the external storage device does not need to prevent mounting by the spare computer device, and can switch the system smoothly.

  Even if a computer that has been stopped due to a failure occurs unexpectedly and resumes operation after the spare computer takes over processing, access to the external storage device is already blocked, so the operation data is processed again. Can not do it. Therefore, in this case as well, there is no problem that data is destroyed by double mounting.

  FIG. 2 is a diagram illustrating a system configuration of a duplex server system as an example of a specific system configuration according to the embodiment of this invention.

  Both the operation server 10 and the spare server 20 as computer devices have a general server function, and are connected to a common disk array device 30 as an external storage device via an interface. The operation server 10 mounts the logical disk of the disk array device and executes processing. The spare server 20 stands by in an operating state so that processing can be immediately taken over when the operation server fails. The operation server 10 and the spare server 20 have an interface that can monitor the state of each other, and synchronize data with each other. The operation server 10, the spare server 20, and the disk array device 30 constitute a duplex system having a hot standby type failover function.

  The disk array device 30 includes a logical disk 31 composed of a plurality of hard disks and a monitoring disk 32 on which periodic write processing from each server is performed. The monitoring disk 32 is assigned with dedicated target areas by the operation server 10 and the spare server 20 and can be written individually. Each server periodically accesses the monitoring disk device 32 and writes an access record. The failure handling device 40 installed in the disk array device 30 has a function of checking the operation state of each server by checking that data has been written to the monitoring disk 32 as failure monitoring means. Further, the failure handling apparatus 40 has a function of blocking access to the logical disk 31 from an abnormal server when an abnormality of the server is detected as access blocking means. Furthermore, the failure handling apparatus 40 has a function of notifying occurrence of an abnormality to a normal server and the system management facility 50 as a failure notification means.

  Next, with reference to the flowchart shown in FIG. 3, specific failure handling operations will be described for the operation server 10, the spare server 20, the logical disk 31, the monitoring disk 32, and the failure handling apparatus 40 that constitute this system.

  Each of the operation server 10 and the spare server 20 periodically accesses the monitoring disk 32 in the disk array device 30, and writes, for example, its own heartbeat signal code as failure monitoring data (Step 1).

  The failure handling apparatus 40 confirms the normality of each server by monitoring that the writing process is periodically performed (Step 2).

  When a failure occurs in the operation server and the writing process is interrupted, the failure handling apparatus 40 determines that a failure has occurred in the operation server (Step 3).

  The failure handling apparatus 40 disconnects the operation server 10 by deleting the access right to the logical disk 31 of the operation server 10 determined to be a failure (Step 4). As a result, the spare server 20 can mount the logical disk 31 to take over the processing of the operation server 10. The stopped operation server 10 can no longer access the logical disk 31 even if it is unexpectedly restarted by a reboot or the like.

  The failure handling apparatus 40 notifies the standby server 20 and the system management facility 50 of the occurrence of a failure in the operation server 10 (Step 5).

  The backup server 20 notified of the failure of the operation server 10 by the failure handling apparatus 40 immediately performs a system switching process for itself to become the operation server (Step 6). Then, the spare server 20 mounts the logical disk 31 mounted by the failed operational server 10 and takes over the processing of the operational server 10 (Step 7).

  Note that the block of input / output access to the logical disk 31 of the operation server 10 at Step 4 is a process performed by the failure handling apparatus 40, and even if the operation server 10 is restarted, it is not possible to automatically recover to the access. Absent. After the occurrence of a failure is notified to the system management facility in Step 5, the system administrator arranges an operator for restoration, and the restoration work is always performed with the intervention of the maintenance worker (Step 8).

  As described above, in this embodiment, unlike the case where the server detects each other's state and detects the failure and performs the failover operation, the disk array device mainly detects the failure of each server. Yes. When the disk array device detects the occurrence of a failure, the I / O access to the failed server is cut off immediately, so there is no case where double mounting occurs. Therefore, when the system is switched, the operation that prevents the disk array device from mounting the logical disk by the spare server can be eliminated as unnecessary, and the system switching is always performed smoothly. Even if the operation server where the failure occurred suddenly recovers, the blockage of the input / output access to the disk array device is not automatically recovered, so that the data is not destroyed.

  In the above-described embodiment of the present invention, the case where the heartbeat signal code of each server is used as the failure monitoring data that each server writes to the monitoring disk 32 in Step 1 of FIG. 3 has been described. On the other hand, as another embodiment of the present invention, internal time information managed by each server can be used as the failure monitoring data. In this embodiment, when a failure occurs in the server and the writing of the time information as the failure monitoring data to the monitoring disk 32 is interrupted, the time when the failure occurs is determined to some extent from the last written time data. This has the advantage that it can be identified and used for failure analysis.

  As described above, the redundant server system has been described as an embodiment of the present invention. Of course, the present invention is similarly used in a general server system in which three or more servers are connected and multiplexed. be able to. That is, even if there are a large number of operation servers 10 and spare servers 20 in FIG. 3, the failure handling apparatus 40 may perform a procedure corresponding to the failure occurrence of each server based on the flow of FIG. 1B.

10 operation server 20 spare server 30 disk array device 31 logical disk 32 monitoring disk 40 failure response device 50 system management facility

Claims (13)

It is configured by connecting at least two computer devices, including a spare computer device, to a common external storage device, and the spare computer device is always on standby while maintaining the same operating state as an operating computer device. A failure handling mechanism in an information processing system constituting a multiplexed computer device,
Monitoring means for individually monitoring the occurrence of failures in the computer device;
When the monitoring unit detects that a failure has occurred in any of the computer devices, the monitoring unit receives the detection of the failure and performs input / output access to the external storage device from the computer device in which the failure has occurred. Access blocking means for blocking;
When the monitoring means detects that a failure has occurred in any of the computer devices, the computer device that has received the detection of the failure and uses the information on the occurrence of the failure as a computer device in which no failure has occurred. A failure response mechanism of the information processing system. The failure handling mechanism of an information processing system according to claim 1, wherein the computer device is a server, and the information processing system constitutes a multiplexed server system. The information processing system according to claim 1, wherein the external storage device is a disk array device, and the computer device has a monitoring storage area for individually writing failure monitoring data. Failure response mechanism. The information processing system according to claim 3, wherein the monitoring unit monitors a status of writing the failure monitoring data to the monitoring storage area periodically performed by the computer device. mechanism. 5. The failure handling mechanism of an information processing system according to claim 4, wherein the failure monitoring data is internal time information individually managed by the computer device. When the monitoring unit detects that a failure has occurred in any of the computer devices, the monitoring unit has a unit for notifying the occurrence information of the failure to a pre-registered notification destination. Item 6. An information processing system failure handling mechanism according to any one of Items 1 to 5. An information processing system comprising: the failure handling mechanism according to any one of claims 1 to 6, the at least two computer devices, and the external storage device. It is configured by connecting at least two computer devices, including a spare computer device, to a common external storage device, and the spare computer device is always on standby while maintaining the same operating state as an operating computer device. A failure handling method in an information processing system constituting a multiplexed computer device,
Individually monitoring the occurrence of a fault in the computer device;
When the monitoring unit detects that a failure has occurred in any of the computer devices, the monitoring unit receives the detection of the failure and performs input / output access to the external storage device from the computer device in which the failure has occurred. A blocking step;
When the monitoring means detects that a failure has occurred in any of the computer devices, the computer device that has received the detection of the failure and uses the information on the occurrence of the failure as a computer device in which no failure has occurred. And a step of notifying the information processing system. 9. The information processing system failure handling method according to claim 8, wherein the computer device is a server, and the information processing system constitutes a multiplexed server system. 9. The external storage device according to claim 8, wherein the external storage device is a disk array device, and the computer device individually has a step of writing failure monitoring data in a monitoring storage area of the disk array device. 10. A failure handling method for an information processing system according to 9. The step of individually monitoring the occurrence of a failure of the computer device by the external storage device is by monitoring the state of writing the failure monitoring data to the monitoring storage area periodically performed by the computer device. The information processing system failure handling method according to claim 10, wherein: 12. The failure handling method for an information processing system according to claim 11, wherein the failure monitoring data is internal time information individually managed by the computer device. When the external storage device detects that a failure has occurred in any of the computer devices, the external storage device has a step of notifying the failure occurrence information to a pre-registered notification destination, The failure handling method for an information processing system according to any one of claims 8 to 12.

Images