JP2012043445A - Operation handover method, computer system, and management server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fail-over method capable of reducing an manhour and an introduction cost for an initial construction of a system by dispensing with selection work of a server, or a handover destination of the operation out of systems having nonuniform hardware configuration and partition constitution work, when a failure occurs in a server booted using an external disk device.SOLUTION: When a failure occurs in a current server 102 executing an operation and the operation is handed over to a server 102 which is not operating in a computer system, the operation handover method hands over the operation by: detecting the occurrence of the failure in the current server 102; searching a server 102 which has a same hardware configuration to that of the current server 102 and is not operating in the computer system; allowing the server 102 found as the search result to access to an external disk device 103; and booting the server 102 from the external disk device 103.

Description

The present invention relates to a failover method in a computer system including a server booted from an external disk device.

  In general, the server boots an OS installed in a built-in disk device. In this configuration, when taking over the business of a failed server, a redundant configuration is adopted in which the same OS and business application are installed on the disk of a plurality of servers as a conventional method. In this method, when a server that is executing a business (active server) fails, the business can be taken over by starting another server (spare server) in which the same OS or business application is installed. However, this method requires a pair of spare servers for one active server, which increases initial installation cost and initial construction man-hours.

In contrast to the above, there is a form in which the server boots using an external disk array device as a disk device. In this case, since the disk array device can be connected to a plurality of servers via a fiber channel or a fiber channel switch, the boot disk of a server connected to the disk array device can be referenced from another server. . In this configuration, if a failure occurs on the active server that is executing a job, the job can be taken over by starting the spare server using the boot disk of that server. In this method, the contents of the boot disk are transferred to the spare server as they are, so that the OS and business applications can be transferred as they are. Furthermore, since it is not necessary to prepare a spare server to be paired with the active server, it is possible to take over business from any active server to any spare server. However, if the hardware configuration differs between the active server and the spare server, the OS or business application in the boot disk may not operate normally.

To deal with this problem, the conventional method assumes a system having a homogeneous hardware configuration, and the user takes a method of setting a spare server having the same hardware configuration for an active server having a certain hardware configuration. It was. However, this method increases the user's initial construction man-hours. Furthermore, there is a case where it is not always necessary to prepare servers having the same hardware configuration because the business can be taken over even if the hardware configuration such as CPU speed and memory capacity is slightly different.

Furthermore, when the partition function for virtually configuring a plurality of servers as one logical server is used, it is necessary to match the partition configurations of the current logical server and the spare logical server. However, if the partition configuration of a spare logical server is matched to a certain active logical server, the spare logical server will not take over operations from other active logical servers that do not match the configuration. I can't. For this reason, since it is necessary to prepare a spare logical server that is paired with the current logical server, the initial installation cost and the initial construction cost increase.

The problem to be solved by the present invention is to have a heterogeneous hardware configuration in a method for realizing business takeover by taking over a boot disk when a failure occurs in a server that boots using an external disk device. By eliminating the need to select a server that will take over work from the system and partition configuration work from the system, it is possible to reduce the man-hours and installation costs for initial system construction.

When the spare server is set manually, there is no problem even if any server is set as the spare server in a system having a homogeneous hardware configuration. However, in the case of a system with a heterogeneous hardware configuration, when setting as a spare server, the user checks the hardware configuration information of the active server, and further checks the hardware configuration of the server that is a candidate for the spare server, Since it is necessary to select a matching server, it is troublesome.

In general, one spare server is set for a plurality of active servers in business takeover. Therefore, when the partition function is used, the configuration of the spare logical server is determined when a failure occurs in the active logical server. For this reason, the user must monitor the occurrence of a failure and manually perform partition configuration work when the failure occurs, resulting in a significant increase in operating costs. Furthermore, depending on the configuration of the spare server group, such as a shortage of spare servers, a spare logical server having the same configuration as the current logical server may not be configured.

In a computer system in which multiple servers are connected to an external disk device on the network, and the server boots the operation system from the external disk device, when a failure occurs in the active server that is operating the business, the business in the computer system is not active When taking over business processing to the server, it detects the failure of the active server, searches the computer system for a server that is not running a job that has the same hardware configuration as the active server, and externally searches the server that is found as a result of the search. Access to the disk device is made possible, and the server takes over by booting the server from the external disk device.

The present invention provides a method for realizing business takeover by taking over a boot disk when a failure occurs in a server that boots using an external disk device, and takes over business from a system having a heterogeneous hardware configuration. By eliminating the need for server selection and partition configuration work, a failover method that can reduce the man-hours and initial costs for initial system construction is realized.

It is a block diagram which shows the whole structure of Example 1 of this invention. It is a block diagram which shows the structure of the server of the said Example. It is a functional block diagram which shows the structure of the management server of the said Example. It is a format figure which shows the server management table of the said Example. It is a functional block diagram which shows the structure of the server management module of the said Example. It is a functional block diagram which shows the disk mapping change module of the said Example. It is a functional block diagram which shows the disk mapping mechanism of the said Example. It is a conceptual diagram which shows the disk mapping structure to the server of the said Example. It is a sequence diagram which shows operation | movement of the said Example. It is a flowchart which shows the processing flow of a server management module. It is a flowchart which shows the processing flow of a server search module. It is a sequence diagram of a disk mapping change module and a disk mapping mechanism. It is a block diagram which shows the whole structure of Example 2 of this invention. It is a functional block diagram which shows the structure of the management server of the said Example. It is a format figure which shows the partition configurable table of the said Example. It is a format figure which shows the partition management table of the said Example. It is a sequence diagram which shows operation | movement of the said Example. It is a flowchart which shows the processing flow of the server search module of the said Example. It is a sequence diagram of the partition configuration change module and the partition management mechanism of the above embodiment. It is a functional block diagram which shows the structure of the server search module of Example 3 of this invention. It is a flowchart which shows the processing flow of the server search module of the said Example. It is a format figure which shows the server management table of Example 4 of this invention. It is a flowchart which shows the processing flow of the server search module of the said Example. It is a block diagram which shows the whole structure of Example 5 of this invention. It is a functional block diagram which shows the structure of the management server of the said Example. It is a format figure which shows the server management table of the said Example.

FIG. 1 shows an overall view of an embodiment of the present invention. The system of this embodiment includes a plurality of servers 102. Each server has a network interface card (NI
C) connected to a network switch (NW SW) 105 via 121 and connected to a fiber channel switch 104 via a fiber channel host bus adapter (HBA) 120. The fiber channel switch 104 is also connected to the disk array device 103 and can be accessed from the server 102. The network switch 105 is also connected to a management server 101 that manages the system. Each server 102 has a BM
A C (Baseboard Management Controller) 122 is incorporated. The BCM 122 is connected to the management server 101 via a network. This makes it possible to monitor the hardware status of each server and control the power supply. Further, the server 102 has a partition mechanism 14.
0 is provided. In the illustrated embodiment, the partition mechanism 140 has two servers as one.
Switch between one logical server and each logical server. Specifically, in the former case, each server in the same partition can access each other's memory mounted on other servers in the same manner as the memory mounted on itself.

If the maximum number of servers grouped in the same partition is set to a larger number instead of two, it becomes possible to switch the logical server configuration in more various ways. The management server 101 monitors the state of the server 102, the disk array device 103, the network switch 104, and the fiber channel switch 105 via the network and controls them as necessary. The management server 101 is provided with a failover mechanism 110. Failover mechanism 1
Reference numeral 10 denotes a mechanism for receiving a failure notification from the BMC 122, controlling power to the BMC 122, controlling the disk mapping mechanism 130 of the disk array device 103, etc. when a server failure occurs, and is one of the features of the present invention. The disk mapping mechanism 130 in the disk array device 103 associates the HBA 120 mounted on the server 102 with the disk 131. Specifically, the security function is realized by limiting the servers that can access the disk 131. In the first embodiment, the server 102 uses the disk 131 in the disk array device 103 as a boot disk, and the OS and business application are stored in the disk 131.

FIG. 2 shows a detailed configuration of the server 102 in this embodiment. The server 102 has a memory 201 for storing programs and data, and a CPU 2 for executing the programs in the memory.
02, HBA 120, NIC 121, and BMC 122. The HBA 120 stores a unique device identifier called a WWN (World Wide Name) 204 necessary for specifying a communication partner in Fiber Channel communication in a memory. The BMC 122 mainly monitors and controls the hardware of the server 102. When an abnormality occurs in the hardware of the server 102, the failure detection mechanism 205 can detect and notify the outside. Further, the server 102 can be turned on / off remotely through the BMC 122.

FIG. 3 shows a program module configuration of the failover mechanism 110. The failover mechanism 110 performs server activation and server power control when a failure occurs by monitoring the server status and server management table 301 that stores server hardware and partition configuration status and server usage status. It consists of a server management module, a server search function that searches for a spare server that will take over business at failover, and a disk mapping change module that changes disk mapping from the active server to the spare server at failover.

FIG. 4 shows details of the server management table 301 in FIG. The server management table 301 stores a list of servers managed by the failover mechanism 110 and configuration information and status of each server. A table column 401 stores server identifiers. The server identifier 401 may be information that can identify the server. This is the server serial number or, for blade servers, the blade number. Column 402
Column 402 indicates the CPU type of the server. Even if the product name is the same CPU, it contains information that can be distinguished if the stepping is different. A column 403 indicates the CPU frequency of the server. A column 404 indicates the memory capacity installed in the server. A column 405 indicates a server partition configuration. The numbers in the column indicate the number of servers constituting the partition to which the server belongs, and the parentheses indicate the identifier of the partition to which the server belongs. The partition identifier is assigned corresponding to the logical server.

For example, if the servers with server identifiers S2 and S3 constitute one logical server, both S2 and S3 have two partition configuration servers and belong to the same partition identifier P2. . In some cases, a logical server is configured by only one server. In this case, it is equivalent to a server having no partition function. In this embodiment, all active servers and spare servers are shown as logical servers. However, in a system that does not have a partition function, the physical server may be an active server or a spare server.
A column 406 shows the state of the server. If it is in use, the job is being executed. When it is not used, it can be used for another job immediately. Further, when a failure occurs and cannot be used, information indicating that the failure is occurring is stored.

FIG. 5 shows details of the server management module 302 in FIG. The server management module monitors the status of the server, monitors the server operating status and faults, and controls the power supply. When a server failure occurs, if the BMC 122 shown in FIG. 1 or an agent program running on the server detects a server failure, the server management module 302 is notified of the occurrence of the failure. The failure information notified at this time includes the type of failure. The server management module 302 has a failure operation table in order to determine whether or not to execute failover according to the type of failure. A column 501 indicates the type of failure that has occurred, and a column 502 indicates whether or not to execute failover when the failure occurs. The storage information of the failure operation table can be arbitrarily set by the system user.

FIG. 6 shows details of the disk mapping change module 304 in FIG.
The disk mapping change module 304 unmaps all the mapped disks of the active server where the failure has occurred, and requests to map the disks to the spare server that is the business takeover destination. This disk mapping change is requested to the disk mapping mechanism 130 in the disk array apparatus 103 shown in FIG. The disk mapping mechanism 130 allocates a disk to the WWN that is the identifier of the HBA mounted on the server. Therefore, the disk mapping change requires information on the disk mapped with the WWN of the active server and the WWN of the spare server. The disk mapping change module 304 stores these pieces of information in the server disk mapping table. A column 601 indicates a server identifier. A column 602 indicates the WWN of the HBA mounted on the server. A column 603 indicates a virtual disk number of a disk assigned to the WWN. A column 604 indicates the physical disk number of the disk. The virtual disk number is a virtual disk number shown to the server and can be set regardless of the physical disk number. The server disk mapping table also records information about servers to which disks are not mapped. In this case, the information in the column 603 and the column 604 is blank.

FIG. 7 shows details of the disk mapping mechanism 130 in the disk array apparatus 103 in FIG. The disk mapping mechanism 130 performs mapping between the disk 131 in the disk array device 103 and the WWN of the server-mounted HBA 120 connected to the disk array device 103 via the fiber channel. Disks cannot be referenced from servers with WWNs that are not in this mapping relationship. As a result, it is possible to perform security settings that allow a certain disk to be accessed only from a certain server. For this security setting, in this embodiment, the disk mapping mechanism 130 has a disk mapping table shown in FIG. A column 701 indicates the WWN of the HBA mounted on the server. A column 702 indicates a virtual disk number mapped to the WWN. A column 703 indicates the logical disk number mapped to the WWN.

FIG. 8 shows a disk mapping change example in the present embodiment. Active server 801
The HBA 810 mounted on the server has WWN1 (811), and the HBA 820 mounted on the spare server 802 has WWN2 (821). These are connected to the disk array device 103 via the fiber channel switch 104. The disk mapping is controlled by the disk mapping mechanism 130, and a virtual disk group 803 including virtual disks 831, 832, and 833 is mapped to WWN 1 (811) of the active server 801. Virtual disks 831, 832, and 833 are logical disks 804, 805, and 806, and include a boot disk in which an OS and business applications are installed. If a failure occurs in the active server 801, the disk mapping is changed to the spare server 802. At this time, the mapping between WWN1 (811) of the active server 801 and the virtual disk group 803 is canceled and mapped to WWN2 (821) of the spare server 802. As a result, the spare server 802 can take over the disk including the OS and business application used by the active server 801. By starting the spare server 802 in this state, the failover of the work from the active server 801 is realized.

FIG. 9 is a sequence diagram of the failover operation of this embodiment. The sequence diagram shown shows the cooperative operation of the active server 801, the failover mechanism 110 of the management server 101, the disk mapping mechanism 130, and the spare server 802. Step 910 indicates that a failure has occurred in the active server. The BMC installed in the active server 801 or the agent program running on the active server detects the occurrence of a failure and notifies the failover mechanism 110 of the failure. In step 920, the failover mechanism 110 detects the notified failure. Then, in step 921, the failover mechanism 110 acquires information such as the hardware configuration and partition configuration of the active server. This information is acquired from the server management table shown in FIG. In step 922, the active server is shut down. If the active server is still running, the OS and business applications may be running in an unstable state, which may issue illegal I / O.

Furthermore, if the active server is still in operation when the spare server takes over the business, the same
Servers with IP addresses will coexist. To prevent this, the active server must be shut down. However, if the active server is in the dump process, the shutdown is not executed until the dump process is completed. Further, the failover mechanism 110 has the active server 80.
1 may be requested to start dump processing. In step 911, the active server 801 receives a shutdown request and executes a shutdown process. If the shutdown process is impossible, the failover mechanism 110 executes the forced power OFF of the active server 801. Forced power-off is executed by instructing the BMC installed on the server. In step 923, the failover mechanism 110 searches for a spare server that can take over the business based on the information of the active server acquired in step 921. This search is executed by searching for a server whose information in the server management table shown in FIG. 4 matches the active server. A server found as a result of the search is set as a spare server 904. In step 924, the mapping of the disk mapped to the active server 901 is canceled, and a disk mapping change request for mapping to the spare server 802 is requested to the disk mapping mechanism 130. In step 930, the disk mapping mechanism 130 of the disk array device performs the requested disk mapping change. In step 925, the activation of the spare server 802 is requested. In step 940, the spare server 802 is activated. As a result, the OS and the business application are started, and the business is resumed in step 941.

Hereinafter, the sequence in FIG. 9 will be described in more detail. FIG. 10 shows an operation flow of the server management module 302. In step 1001, failure information is received from a server in which a failure has occurred. In step 1002, the type of failure is identified from the received failure information. In step 1003, the failure operation table is referred to, and information on whether or not to execute the failover operation for the corresponding failure type is referred to. Step 1004 determines whether or not to execute failover from the contents of the failure operation table. If a failover operation is necessary, the process proceeds to step 1005, and if not necessary, the process is terminated without doing anything. Step 1
In 005, the active server is shut down. In step 1006, the server search module 303 is activated. When the operation of the server search module ends, step 10
Move to 07. In step 1007, the spare server is activated.

FIG. 11 shows a processing flow of the server search module 303. In step 1101, information on the active server is acquired from the server management table. At this time, information is extracted based on the server identifier of the active server and the partition identifier to which the server belongs. In step 1102, the server management table is searched for an unused server having the same hardware configuration and the same partition configuration as the information of the extracted active server. Here, the hardware configuration is the CPU type (column 402) of the server management table shown in FIG.
CPU frequency (column 403) and memory capacity (column 404). The partition configuration is the column 405, but here, only the number of servers constituting the partition is referred to as a condition, and it does not matter which partition it belongs to. Step 1103
Then, it is determined whether the server has been found as a result of the search. If found, go to the next step 1104. If not found, end. However, in general, when a server cannot be found, in order to notify the user of information indicating that fact, a message is displayed or output to a log. In step 1104, the found server is designated as a spare server. In step 1105, the disk mapping change module is activated.

FIG. 12 shows a detailed sequence of the disk mapping change module 303 and the disk mapping mechanism 130103 of the disk array device. Step 1201, 1202,
1203 and 1205 are the processing flow of the disk mapping change module 303, and steps 1204 and 1206 are the processing flow of the disk mapping mechanism 130103. In step 1201, the server mapping table is referenced to obtain the WWN mounted on the active server and the status of the disk mapped there. In step 1202, the server disk mapping table is referred to acquire the WWN mounted on the spare server. These pieces of information are required as arguments when instructing the disk mapping mechanism 130 to make a mapping change request. In step 1203, a request is issued to the disk mapping mechanism 130 to release the mapping of the disk mapped to the WWN of the active server. In step 1204, all mapping of the disk to the WWN of the active server is released. In step 1205, the disk mapping mechanism 130 is requested to map the disk mapped to the active server to the disk in the spare server WWN. In step 1206, the requested disk mapping is performed for the WWN of the spare server.

FIG. 13 shows an overall view of the second embodiment of the present invention. The second embodiment shows an embodiment in which a spare logical server is configured in accordance with the partition configuration of the current logical server. The difference from the first embodiment is the addition of the partition management mechanism 111 to the management server 101 ′ and the structure of the failover mechanism. The partition management mechanism 111 is a mechanism that controls partitions such as creation, configuration change, and deletion of logical servers. The failover mechanism 110 ′ realizes a function of automatically configuring the spare logical server partition in cooperation with the partition management mechanism 111.

FIG. 14 shows the configuration of the management server 101 ′ of the second embodiment. In addition to the management server 101 of the first embodiment, a partition management mechanism 111 is added. Failover mechanism 11
In the structure of 0 ′, a partition configuration change module 305 and a partition configurable table 306 are added in addition to the failover mechanism 110 of the first embodiment. The partition configuration change module 305 is a functional module that requests the partition management mechanism 111 to change the configuration of the backup logical server so that the partition configurations of the current logical server and the backup logical server match. Here, “matching the partition configuration” means matching the number of servers constituting the current logical server with the number of servers constituting the spare logical server. For example, if the active server is a logical server composed of two servers, the spare server is also a logical server composed of two servers. The partition configurable table 306 is a table that lists combinations of servers that can be configured as logical servers in the system. The partition configuration change module 305 refers to the partition configurable table 306 and searches for a combination of servers that can configure a logical server having the same partition configuration as the current logical server. Partition management mechanism 1
11 includes a partition management table 311. Partition management mechanism 111
Manages the current partition configuration with reference to the partition management table 311.

FIG. 15 shows details of the partition configurable table 306 of FIG. A column 1501 indicates the number of servers constituting the logical server. A column 1502 indicates a combination of servers that can form a logical server. In the example shown in FIG. 15, a logical server composed of two servers can be a combination of S2 and S3, a combination of S6 and S7, and a combination of S11 and S12. In this embodiment, the server identifier of the logical server configured by one server is not described, but there is no problem even if it is included in this table.

FIG. 16 shows details of the partition management table 311 of FIG. Column 1
Reference numeral 601 denotes a partition identifier. This identifier is given corresponding to the logical server. A column 1602 indicates servers that constitute the logical server.

FIG. 17 is a sequence diagram of the failover operation according to the second embodiment. The sequence diagram shown shows the cooperative operation of the active server, failover mechanism 110 ', partition management mechanism 111, disk mapping mechanism 130, and spare server. The difference from Example 1 is that
This is that the partition configuration request in step 1724 and the partition configuration change in step 1730 are added. Further, details in the search for the spare server in step 1723 are also different. In step 1723, first, a set of unused servers having the same partition configuration as that of the current logical server is searched. If found, the mapping of the disk to the active server is released, and the process proceeds to Step 1725 for requesting mapping of the disk to the found unused server. On the other hand, if a pair of unused servers having the same partition configuration as that of the current logical server is not found, a combination of servers capable of configuring a logical server having the same partition configuration as that of the current logical server is searched. For example, if the active server is a logical server composed of two servers,
Two servers that have the same hardware configuration as the two units and that can be configured as a logical server are searched. If this is found, the process proceeds to step 1724, and the partition management mechanism 1703 is requested to configure a logical server using the found server. In step 1730, the partition management mechanism 1703 receives the request in step 1724 and changes the partition configuration.

FIG. 18 shows a processing flow of the server search function 303 in the second embodiment. In step 1801, information on the active server is acquired from the server management table. At this time, information is extracted based on the server identifier of the active server and the partition identifier to which the server belongs. In step 1802, a combination of unused servers (spare logical server) having the same hardware configuration and the same partition configuration as the servers constituting the active server is searched from the server management table. If the server set does not exist, the next step 18
Proceed to 03. In step 1803, a combination of servers that have the same hardware configuration as that of the active server and that can configure the logical server is searched. For example, when the active server is a logical server composed of two servers, first, a server having the same hardware configuration as each server is searched using the server management table 301, and then the server is searched from among the servers. A set of servers that can be configured with two logical servers is searched using the partition configurable table 306. If found, the process proceeds to the next step 1804 to start the partition configuration change module. In step 1805, the disk mapping mechanism is activated to change the disk mapping. If a spare logical server is found in the previous step 1802, the process advances to step 1805 without starting the partition configuration change module in step 1804.

Here, if neither the step 1802 nor the step 1803 finds a corresponding server set, the failover operation is terminated. However, in general, when a server cannot be found, in order to notify the user of information indicating that fact, a message is displayed or output to a log.

FIG. 19 shows the partition configuration change module 305 and the partition management mechanism 1
11 detailed sequences are shown. Steps 1901 and 1903 are the processing flow of the partition configuration change module 305, and step 1902 is the processing flow of the partition management mechanism 111. In step 1901, the partition configuration change module 305 requests the partition management mechanism 111 to configure a logical server having the same partition configuration as that of the current logical server by using the set of servers. In step 1902, the partition management mechanism 111 implements a logical server configuration. In step 1903, the partition configuration change module 305 sets the configured logical server as a spare server.

The third embodiment of the present invention shows an example in which a search policy is used when searching for a spare server. Depending on the search policy, it is possible to cope with the case where work can be taken over even when the hardware configuration and partition configuration of the active server and the spare server do not necessarily match completely. For example, the software can handle the CPU frequency and memory capacity even if there are some changes, so it is possible to take over the business even if they do not match.

FIG. 20 shows a server search module 303 ′ according to the third embodiment of the present invention. Example 1
The server search module 303 ′ of the third embodiment adds a search policy table to the server search module 303 of the second embodiment. The search policy table lists policies to be satisfied as spare servers for the active server. Any server that satisfies this policy can be used as a spare server even if the hardware configuration and partition configuration do not completely match the active server. A column 2001 indicates a server identifier of the active server. A column 2002 indicates a search policy.
As the policy, as shown in FIG. 20, a condition that the CPU frequency and the memory are equal to or higher than a certain value, and a condition that it is possible to take over the business even when the partition configurations do not match can be set. The server search module 303 ′ refers to this search policy table when searching for a server to be a spare server. The search policy table can be rewritten by the user. For example, it provides a GUI, commands, and configuration files, and allows you to specify search policies.

FIG. 21 shows a processing flow of the server search module 303 ′ according to the third embodiment of the present invention. The difference from the first embodiment and the second embodiment is that a search policy is used in step 2102. In step 2102, the server search module 303 ′ refers to the policy of the corresponding active server in the search policy table and searches the server management table 301 for a server that is a candidate for a spare server.

In the fourth embodiment of the present invention, even when there is no unused server in the system, a method of taking over a business by accommodating a server from a business having a lower priority than a business in which a failure has occurred will be described.
FIG. 22 is a server management table according to the fourth embodiment of the present invention. The difference from the other embodiments is a column 407 and a column 408. A column 407 indicates the type of business in which the server operates. In addition to this example, a business ID may be used to indicate the type of business. A column 408 indicates the priority of work in the column 407. Here, as an example, they are high, medium and low. High indicates that the priority of the business is high, and low indicates that the priority of the business is low. The job priority is specified by the user. Specification methods include providing GUIs and commands to users and setting files.

FIG. 23 is a processing flow of the server search module according to the fourth embodiment of the present invention. Step 2302 is different from the other embodiments. In step 2302, not only unused servers but also a server including a server in which a task having a lower priority than a task in which the active server is operating is searched. When a server on which another business is operated is a spare server, the server is accommodated from the corresponding business. For example, in the example of FIG. 23, when a failure occurs in the server identifier S5,
Accommodate S4 servers that have lower priority than S5 operations. In addition, when a business that accommodates a server uses another server, scale-in or scale-down may be executed for the business. Furthermore, even when a server is insufficient and a spare logical server cannot be configured, it is possible to configure a logical server by using a server that is versatile from other businesses. There is also a method of taking over the work that was running on the server to which the server is accommodated, to another server before accommodating the server. For example, in FIG. 23, when the spare server of S5 is S4, the business of S4 is first handed over to unused S12, and then the business of S5 is handed over to S4. Here, although the hardware configurations of S4 and S12 are different, it is assumed that the business can be taken over by the search policy shown in the third embodiment. This operation is equivalent to performing the failover processing described in the present invention twice.

FIG. 24 shows an overall view of the fifth embodiment of the present invention. The difference from Example 1 is FCSW1
The NWSW management mechanism 150 is added to the FCSW management mechanism 140 and the NWSW 105 in 04. The FCSW management mechanism 140 is installed on each FCSW connection port or on a server.
By dividing the zone for each WWN of the HBA, the security function is controlled so that a server in another zone cannot access a disk in another zone. The NWSW management mechanism 150 assigns a VLAN ID to each NWSW connection port or server-mounted NIC, and controls a security function for separating the network for each VLAN ID. In the fifth embodiment, it is possible to search for a spare server in consideration of a case where the active server and the connection destination NWSW 104 or the disk array device 103 are different, or a case where the zone of the FCSW 104 or the VLAN ID of the NWSW 105 is different between servers.

FIG. 25 shows the configuration of the management server 101 ″ according to the fifth embodiment of the present invention. Unlike the other embodiments, the failover mechanism 110 ″ of the management server 101 ″ has an FCSW setting change module 307 and an NWSW setting. The change module 308 is added, and the FCSW setting change module 307 requests the FCSW management mechanism 140 to change the setting so that the zones match when the spare server is in a different zone from the active server. The NWSW setting change module 308 is a functional module that requests the NWSW management mechanism 150 to change settings so that the VLAN IDs match when the spare server has a different VLAN ID from the active server. Operation type of change module 307 and NWSW setting change module 308 Ring is a time when the server search module 303 finds a backup server.

FIG. 26 shows the server management table 301 according to the fifth embodiment of the present invention. Column 409
Indicates the type of server chipset. If the chipset is uniquely determined, the server model name may be used. If the chipset does not match between the active server and the spare server, there is a possibility that the business cannot be taken over, so a server with the same chipset type is searched by this column. A column 409 indicates the number of ports of the server-mounted NIC. A column 410 indicates the number of HBA ports mounted on the server. Columns 409 and 410 may not be able to take over work unless the number of I / O ports matches between the active server and the spare server.
Used to search for spare servers. A column 412 is a VLAN ID to which the server belongs. Even if the VLAN ID does not match between the active server and the spare server, the spare server's VL
By matching the AN ID with the active server by the NWSW setting change module 308, it is possible to take over the work. A column 413 is an identifier of a zone to which the server belongs.
Even if the active server and spare server have different zones, the spare server zone is
By matching with the active server by the W setting change module 307, it is possible to take over the work. A column 414 indicates the connection destination NWSW of the server. If the connection destination NWSW is different between the active server and the spare server, the task may not be taken over, so this column is used to search for the spare server. A column 415 indicates a disk array device to which the server is connected. If the connection destination disk array device is different between the active server and the spare server, the boot disk of the active server cannot be accessed from the spare server, so the business cannot be taken over. Therefore, this column is used for searching for spare servers. In addition, information on the connection destination port between the server and the disk array device and information on the connection destination controller of the disk array device may be added to the server management table 301.

The server search method of this patent can be applied not only to failover, but also to search for servers to be scaled out or scaled up in a load balancing system.

101 Management server 102 Server 103 Disk array device 104 FCSW
105 NWSW
110 Failover mechanism 120 HBA
121 NIC
122 BMC
130 Disk mapping mechanism 131 Disk 140 Partition mechanism.

Claims (12)

Multiple servers are connected to an external disk device via a network, and each of the servers can be started up by booting the operation system from the external disk device. A failover method that takes over business processing to another server in the computer system when it occurs,
The step of detecting the failure of the active server and the server in the computer system should take over the active server using the search condition that the business is not in operation and has the same hardware configuration as the active server A search step of searching for a server, a step of enabling access to the external disk device from a server found as a result of the search, and a step of booting the found server from the external disk device. Failover method. 2. The failover method according to claim 1, wherein, in the search step, a table indicating a server search policy is referred to, and a server that should take over the active server is searched according to the search policy of the table. 2. The failover method according to claim 1, wherein, in the search step, a server search is performed from among servers in the computer system on condition that the active server and a network connection device are the same in addition to the search condition. A plurality of servers connected to an external disk device via a network, each of which can be started by booting an operation system from the external disk device, and each of the plurality of servers is a single server, Or, it has a partition management mechanism that belongs to one of a plurality of logical partitions composed of a larger number of server groups, and that the servers that belong to the one logical partition function as one logical server. In a computer system having a management server, a failover method that takes over business processing to another server when a failure occurs on an active server that is operating a certain business,
A step of detecting the occurrence of a failure in the active server, and a server that is not in operation and that currently constitutes a logical partition having the same configuration as the logical partition to which the active server belongs, among the servers in the computer system A first search step for searching a set of servers, a step of configuring a spare logical partition composed of a set of servers found as a result of the first search, and each server of the set of servers found as a result of the search A failover method comprising: enabling access to the external disk device from the server; and booting each server of the discovered server set from the external disk device. If a corresponding server set is not found in the first search step, a server set that is not in operation and can configure a logical partition having the same configuration as the logical partition to which the active server belongs is searched. The failover method according to claim 4, further comprising: a second search step, and a step of setting a set of servers found in the second search step as one logical partition. A plurality of servers are connected to an external disk device via a network, and each of the servers is a computer system that can be started by booting an operation system from the external disk device. When a failure occurs, a failover method that takes over the business processing in the computer system to another server,
The step of registering the priority of the operation that operates on each of the plurality of servers in the management table, and when the failure of the active server is detected, the active server is operating with reference to the management table A search step for searching for a server operating a job having a priority lower than that of the job; and a step of taking over the job in which the active server is operating to the server found as a result of the search. Failover method. In a computer system in which a plurality of servers are connected to an external disk device via a switch capable of constructing a plurality of virtual networks, and each of the servers can be started by booting an operation system from the external disk device. A failover method for taking over business processing to another server in the computer system when a failure occurs in the active server, and detecting a failure in the active server; and a server in the computer system A search step for searching for a server that should take over the active server on the basis of a search condition that the business is not operating and has the same hardware configuration as the active server, and a server found as a result of the search Change the switch settings so that they belong to the same virtual network as the active server. Failover method characterized by a step of. A plurality of servers connected to an external disk device via a network, each of which can be started by booting an operation system from the external disk device;
A management server for managing the plurality of servers,
In the management server,
A server management table for recording hardware configurations of the plurality of servers,
Triggered by the failure detection of the active server among the plurality of servers that are operating a certain business,
Server search means for searching for a server that should take over the active server on the basis of a search condition that the business server is not operating and has the same hardware configuration as the active server, and the server searched for by the server search means Mapping changing means for requesting the external disk device to map the external disk used by the active server;
A computer system having a failover mechanism. 9. The computer system according to claim 8, wherein the server search unit has a policy table indicating a search policy of a server, and searches for a server that should take over the active server according to the search policy of the search policy table. 9. The server search unit according to claim 8, wherein, in addition to the search condition, the server search means searches for a server to take over the active server on condition that the active server and a connected device on the network are the same.
Computer system. A plurality of servers connected to an external disk device via a network, each of which can be started by booting an operation system from the external disk device;
Each of the plurality of servers belongs to either one server or a plurality of logical partitions composed of a larger number of servers, and servers belonging to one logical partition belong to one logical partition. A logical partition mechanism that functions as a server;
A management server for managing the plurality of servers,
In the management server,
A server management table for recording hardware configurations of the plurality of servers,
The active server is used as a search condition when a business operation of the plurality of servers is in operation and a failure is detected in the active server, and the business is not operating and has the same partition configuration as the active server. Server search means for searching for a server to take over the server, and mapping change means for requesting the external disk device to map the external disk used by the active server to the server searched by the server search means;
A computer system having a failover mechanism. The management server includes a table showing combinations of servers that can form a logical partition, and when a set of servers that are not in operation and that currently have the same partition configuration as the active server cannot be found. Means for searching for a set of servers that can configure a logical partition having the same configuration as the logical partition to which the active server belongs, with reference to the table, and a set of servers found as a result of the search; The computer system according to claim 11, further comprising means for requesting the logical partition mechanism to change a partition configuration so as to configure a logical partition.

Images