JP2016206965A - Computer system and computer system control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent memory dump from being forcibly stopped when abnormality occurs in an active computer without requiring special hardware.SOLUTION: An active computer includes: a computer management device for managing the active computer; a communication unit for transmitting first operation information indicating that a first OS providing business is operating to a standby computer; and a second OS for outputting the contents of a memory after the occurrence of failure in the first OS. The computer management device has second operation information capable of setting the operation state of the first OS. The active computer sets operation start to the second operation information at the start of business, and when the first OS stops due to failure, sets operation stop to the second operation information and then starts the second OS. After the elapse of a first prescribed time from receiving the first operation information, the standby computer obtains the second operation information and takes over the business of the active computer if the second operation information is in the operation stop.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a multi-system control method for a computer system.

  The multi-computer system includes an active computer that executes a job and a standby computer that takes over the job when the active computer is monitored and an abnormality is detected. A series of processes in which the standby computer takes over work when an abnormality occurs in the active computer is called failover (or system switching).

  The following three points are required for failover. First, in order to support the analysis of the cause of the abnormality, a memory dump of the active computer that caused the abnormality is collected. Secondly, to prevent the active computer that caused the abnormality from outputting inappropriate data, the operation of the active computer was completely stopped before the standby computer took over the operation, or the active computer was stopped. Make sure. Third, in order to shorten the business stop time during failover, the current computer is stopped at the earliest possible timing.

  When a recent operating system (hereinafter referred to as OS) detects an abnormality by itself or receives a non-maskable interrupt (NMI = Non Maskable Interrupt), it retains the memory contents of the first OS at that time. The second OS is activated, and the second OS permanently saves the memory contents of the first OS as a memory dump.

  Especially in a multi-system, a standby computer that detects an abnormality in the active computer inputs the NMI to the active computer using a known or well-known method, so that the operation of the active computer is stopped and memory dump processing is started. At the same time.

  However, if the OS of the active computer has already started memory dump processing, if the standby computer inputs NMI to the active computer according to the above procedure, the memory dump processing stops and the memory dump fails. There is.

  As a method of suppressing NMI input after starting the memory dump process, Patent Document 1 states that “in the interrupt process for an interrupt generated by the function expansion board mounted on the computer in which the fault has occurred in response to the interrupt instruction message, Failure information is stored by executing the saving of the failure information, instructing the function expansion board to inhibit the interrupt generation function and the computer operation stop function, and ignoring the message to stop the computer transmitted later. Technology for "continuing storage" is disclosed.

International Publication No. 99/26138

  However, in Patent Document 1, a function expansion board having the above-described functions is required. However, such special hardware is not widely spread and is not available in various regions and at low cost. difficult. Furthermore, a standard OS does not always support a device driver for using the special hardware.

  Therefore, the present invention has been made in view of the above problems, and it is possible to prevent a memory dump from being forcibly stopped when an abnormality occurs in an active computer without requiring special hardware. Objective.

  The present invention includes a plurality of computers having a processor and a memory, wherein at least one of the plurality of computers is an active computer, at least one of the other computers is a standby computer, and the active computer A computer system having a network for connecting the standby computer, wherein the active computer is connected to the active computer, and a computer management device that manages the active computer and a first that provides a service A communication unit that transmits first operating information indicating that the first OS is operating to the standby computer, and the contents of the memory after a failure occurs in the first OS. A second OS for outputting, and the computer management apparatus has second operation information capable of setting an operation state of the first OS, and an adapter connected to the standby computer. The active computer sets the operation start in the second operation information of the computer management apparatus at the start of the operation, and operates in the second operation information when the first OS is stopped due to a failure. After setting the stop, the second OS is started, and the standby computer acquires the second operation information after a first predetermined time has elapsed after receiving the first operation information. If the second operation information is the operation stop, it is determined that the first OS has stopped, and the work of the active computer is taken over.

  According to the present invention, it is possible to prevent the memory dump by the second OS from being forcibly stopped when an abnormality occurs in the active computer without requiring special hardware. Further, the standby computer can detect the stop of the first OS of the active computer at the timing when the active computer that has been stopped due to the occurrence of an abnormality shifts to the second OS. As a result, the standby computer can be handed over in a short time from a stop due to an abnormality in the active computer. Furthermore, since the active computer and the standby computer do not require OS modification or special drivers, a general-purpose OS can be used.

1 is a block diagram illustrating an example of a multiplex computer system according to a first embodiment of this invention. FIG. It is a time chart of the case where the working system computer stops spontaneously, showing the first embodiment of the present invention. It is a time chart of the case where the working system computer stops according to an instruction from the standby system computer according to the first embodiment of this invention. The second embodiment of the present invention will be described, and the second embodiment of the present invention will be described. When the second OS for memory dump processing hangs up, a process for automatically restarting the first OS is described. It is a time chart which shows an example. FIG. 5 is a state transition diagram of a watchdog timer according to the first and second embodiments of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing an example of a multiplex computer system according to the first embodiment of this invention. The multi-computer system includes at least one active computer 10 among a plurality of computers, an active BMC (Baseboard Management Controller) 6 that manages the active computer 10, at least one standby computer 20, The standby system BMC 7 that manages the standby system computer 20, the network 32 that connects the active system computer 10 and the standby system computer 20, the active system computer 10 and the standby system BMC 7, and the standby system computer 20 and the active system BMC 6 are connected. Network 31.

  The active computer 10 and the standby computer 20 are configured in the same way, and at least an arithmetic unit 11 that executes a software program including an OS as will be described later, a memory 12 that stores the program and data necessary for the execution, A communication device 13 that performs heartbeat (hereinafter referred to as HB) communication, a LAN adapter 14 that transmits a command to another BMC, and a storage device 15 that stores data and the contents of a memory dump are provided. Here, the storage device 15 includes, for example, a hard disk and a nonvolatile storage medium. The communication device 13 is a LAN adapter, for example.

  The memory 12 of the active computer 10 includes a first OS (1stOS in the figure) 1 for providing business (not shown), middleware (Middle in the figure) 2 for generating HB, etc., and a first A second OS (2nd OS in the figure) 3 that executes a memory dump after the OS 1 is stopped is stored. The computing device 11 of the active computer 10 executes the first OS 1 and middleware 2 until a failure occurs. Note that applications and services running on the first OS 1 are provided from the active computer 10 as business.

  The memory 12 of the standby computer 20 stores the OS 4 and middleware (Middle in the figure) 5 for monitoring the HB of the active computer 10 and is executed by the arithmetic unit 11.

  The active BMC 6 is configured in the same manner as the standby BMC 7. The active BMC 6 is mounted on the active computer 10, and the standby BMC 7 is mounted on the standby computer 20.

  The active BMC 6 includes a LAN adapter 16 for receiving a command from the standby computer 20 via the network 31, an arithmetic device 19, and a memory 8. The standby BMC 7 is similarly configured, and the LAN adapter 16 receives a command from the active computer 10.

  The memory 8 stores a watchdog timer (hereinafter referred to as WDT) 18 and a WDT setting state 17 that holds the state of the WDT 18. As the WDT setting state 17, at least one of “valid state” and “invalid state” is set. Any of these states may be used as long as they can be distinguished from each other.

  In this embodiment, the “valid state” indicates that the operating state of the active computer 10 “starts” the business. The “invalid state” indicates that the operating state of the active computer 10 is “stopped”.

  The active computer 10 and the active BMC 6 are connected by a system interface 30 and, for example, a KCS (Keyboard Controller Style) interface that performs communication by a simple I / O port operation is used. The system interface 30 between the standby computer 20 and the standby BMC 7 is the same.

  The active computer 10 and the standby computer 20 may have a symmetric configuration including the active BMC 6 and the standby BMC 7, and may be mutually supervised and controlled by switching roles.

  In the first embodiment, the example in which the WDT 18 is set in the memory 8 of the memory 8 has been described. However, the WDT may be configured by hardware (not shown).

  FIG. 2 is a time chart of a case where the active computer 10 stops spontaneously due to a failure. In the example of FIG. 2, in the case where the active computer 10 itself detects an abnormality and performs OS stop processing (kernel panic) and start-up processing of the second OS 3 for collecting a memory dump, the active computer 10 The flow of processing of the active system BMC 6 and the standby system computer 20 is shown.

  As described above, the active computer 10 and the standby computer 20 are connected by the network 32, the active computer 10 and the active BMC 6 are connected by the system interface 30, and the active BMC 6 and the standby computer 20 are connected by the network 31. Has been. Details of each step are as follows.

  In step 100, before starting work on the active computer 10, the middleware 2 transmits a command for enabling the watchdog timer (WDT) 18 as an initial setting to the active BMC 6. In the first embodiment, only the WDT 18 is enabled, and the timer of the WDT 18 is not started. The active computer 10 may perform the above initial setting (initialization process) at the time of startup, business start, or the like.

  In step 101, the working BMC 6 sets the WDT setting state 17 to “valid state”.

  In steps 102 and 102n, the middleware 5 of the active computer 10 transmits a heartbeat (HB) to the standby computer 20 via the network 32 at a predetermined time interval Ti, and the active computer 10 is operating normally. Notify me repeatedly.

  In steps 103 and 103n, the middleware 2 of the standby computer 20 receives the HB message from the active computer 10 and stores the reception time.

  In step 104, the first OS 1 running on the active computer 10 detects its own inconsistency and a kernel panic occurs. The active computer 10 starts the migration process to the second OS for collecting the memory dump.

  In step 105, a command for invalidating the WDT 18 is issued via the system interface 30 in the OS-independent processing executed in the middle of the migration of the first OS 1 to the second OS 3. It transmits to system BMC6.

  Here, the OS-independent processing is processing that initializes a standardly mounted device such as VGA by a simple I / O port operation or the like and prepares for the startup of the second OS 3. Since the communication using the above-mentioned KCS interface can also be realized by a simple I / O port operation, it is easy to implement so as to operate without an OS. For example, a command for operating an I / O port may be loaded immediately before the second OS 3 stored in the memory 12.

  In step 106, the active BMC 6 receives the invalidation command from the active computer 10 and updates the WDT setting state 17 to “invalid state”.

  If the standby computer 20 determines in step 107 that the predetermined time Tc 202 has elapsed since the last reception of the HB, it transmits a WDT state acquisition command to the active BMC 6 via the network 31. The active BMC 6 responds with an “invalid state” which is the current WDT setting state 17. The standby computer 20 detects that the WDT setting state 17 of the active BMC 6 is “invalid state”.

  In step 108, when the required specification of the time from the abnormal stop of the active computer 10 to the business takeover is Tf203, the standby computer 20 is acquired in step 107 when Tf203 time has elapsed since the last reception of HB. The determined WDT setting state 17 is determined. When the determination result is “invalid state”, the standby computer 20 recognizes that the operation of the active computer 10 is completely stopped, and takes over the operation executed on the active computer 10. . As for taking over the business, a known or publicly known technique may be applied, and therefore will not be described in detail here.

  In step 109, the active computer 10 performs the startup process of the second OS 3.

  In step 110, the active computer 10 starts the memory dump process when the startup process of the second OS 3 is completed. It should be noted that kdump or the like can be employed for the memory dump process including the startup process of the second OS 3.

  In step 111, the active computer 10 saves the contents of the memory 12 of the first OS 1 in, for example, the storage device 15 and completes the memory dump.

  In step 112, the active computer 10 restarts the first OS 1 after the memory dump is completed. The active computer 10 may function as a new standby system after the first OS is restarted, or may be stopped without restarting.

  Here, the time Tc202 from when the standby computer 20 lastly receives HB until WDT state acquisition (107) is obtained is obtained as follows. The HB transmission interval is Ti200, and the maximum required time from kernel panic (104) to WDT invalidation (105) is Td201 (for example, Td201 is several hundred milliseconds). At this time, the time Tc 202 that satisfies Tc> Ti + Td and Tc <Tf may be set in the middleware 2 of the standby computer 20. The time Tf203 from the last reception of HB to the business handover (108) may be set in the middleware 2 by adding a predetermined value to the time Tc202.

  As a result of the above processing, the active computer 10 and the standby computer 20 do not require special hardware as in the conventional example, and adopt a standard computer equipped with a BMC, while using the standard computer with the BMC. It is possible to prevent the memory dump from being forcibly stopped when an abnormality occurs.

  Further, the standby computer 20 can detect the stop of the first OS 1 of the active computer at the timing when the active computer 10 stopped due to the occurrence of abnormality shifts to the second OS 3. As a result, it is possible to cause the standby computer 20 to take over the work in a short time after the work is stopped due to an abnormality in the active computer 10. Further, since the active computer 10 and the standby computer 20 do not require modification of the OS or special drivers, a general-purpose OS can be used.

  FIG. 3 is a time chart in the case where, in FIG. 2, the first OS 1 of the active computer 10 kernel panics, a non-response failure such as an infinite loop of internal processing of the OS occurs. . Details of each step are as follows.

  Steps 100 to 103n are the same as in the case of FIG.

  In step 120, the first OS 1 of the active computer 10 hangs up and periodic HB transmission (102) stops.

  In step 107, the standby computer 20 transmits a WDT state acquisition command to the active BMC 6 via the network 31 when a predetermined time Tc202 has elapsed since the last reception of HB. The working BMC 6 responds with the WDT setting state 17. The standby computer 20 detects that the WDT setting state 17 of the active BMC 6 remains “valid”.

  In step 121, if the required specification of the time from the abnormal stop of the first OS 1 of the active computer 10 to the business takeover is Tf203, when the standby computer 20 has elapsed Tf203 time since the last HB was received. The WDT setting state 17 acquired in step 107 is determined. If the WDT setting state 17 is “valid state”, there is a possibility that the operation of the active computer 10 may continue to operate, so the standby computer 20 sends an NMI to the active BMC 6 via the network 31. An input instruction is transmitted to instruct stop of work and start of memory dump processing in the active computer 10.

  In step 108, the first OS 1 of the active computer 10 is stopped due to the input of the NMI to the active computer 10, so that the standby computer 20 takes over the work being executed on the active computer 10.

  In step 122, the active BMC 6 that has received the NMI input instruction inputs the NMI to the active computer 10 via the system interface 30.

  In step 104, the active computer 10 that has received the NMI performs a kernel panic process as NMI handling.

  In steps 105 to 106, as in FIG. 2, the active computer 10 transmits an invalidation command for the WDT 18, and the active BMC 6 updates the WDT setting state 17 to “invalid state”.

  In step 123, since it is also assumed that the first OS 1 running on the active computer 10 is not stopped due to the input of the NMI, the standby computer 20 receives a predetermined (Tc-Ti) from the NMI input instruction (121). ) After 210 hours have passed, WDT status acquisition is performed again. The standby computer 20 may determine that the WDT setting state 17 acquired again is an “invalid state”. In this case, the business handover is not performed in step 108 but is performed after it is determined in step 123 that the WDT setting state 17 is “invalid state”.

  Steps 109 to 112 are the same as the processing in FIG. 2 described above. The active computer 10 starts the second OS 3 to execute a memory dump, and restarts the first OS 1 after the memory dump is completed. .

  Through the above processing, in the first embodiment, in the multi-computer system configured by the computer equipped with the BMC and the general-purpose OS, the active computer 10 can be used without stopping the memory dump process executed by the active computer 10. It can be detected in a short time by the standby computer 20 that the first OS has stopped abnormally due to a hang-up or the like.

  Further, the active computer 10 in which the failure has occurred may invalidate the WDT 18 before starting the second OS 3 for collecting the memory dump, and notify the standby computer 20 that the operation of the active system has been stopped. it can. As a result, it is possible to shorten the time from the occurrence of a failure of the active computer 10 until the standby computer 20 takes over the work.

  In the case where the function expansion board or BMC as in the conventional example is not used, the standby computer 20 is currently used until the initialization of the LAN adapter 14 and the like is completed after the second OS 3 for collecting the memory dump is started. Cannot notify that the work of the host has stopped. For this reason, the waiting time from when a failure occurs in the active computer 10 until the standby computer 20 takes over the work of the active computer 10 becomes long.

  On the other hand, as in the first embodiment, by disabling the WDT 18 before starting the second OS 3, the standby computer 20 receives the last HB and waits for the WDT after a lapse of time Tc. The setting state 17 can be acquired and it can be determined that the current service has stopped. Thereby, quick failover can be realized.

  In the first embodiment, the middleware 2 of the active computer 10 transmits HB, and the middleware 5 of the standby computer 20 monitors the occurrence of a failure in the active computer 10, but these processes are performed by the OS. You may go.

  Further, in the first embodiment, the example in which the WDT setting state 17 for storing the state of the WDT 18 mounted on the active BMC 6 is shown, but the present invention is not limited to this. For example, it is only necessary that the “active state” and the “invalid state” can be set by the active BMC 6 or the like without affecting the execution of the active computer 10 (unintended operation). That is, among the resources secured in the memory 8 of the active BMC 6 and the resources of the arithmetic unit 11, resources that can be used without affecting the active computer 10 can represent “valid” and “invalid”. That's fine.

  In the second embodiment of the present invention, after starting the second OS (Operating System) 3 for collecting a memory dump shown in FIGS. 2 and 3 of the first embodiment, the second OS 3 hangs up. In this case, a hard reset is input to the active computer 10 and the first OS 1 is restarted. As a result, it is possible to ensure that the active computer 10 stopped due to the occurrence of abnormality can be quickly restored as a new standby system even if a failure occurs in the second OS 3.

  The configuration of the computer system of the second embodiment is the same as that of the first embodiment, except that the function of the WDT 18 that is not used in the first embodiment is used.

  FIG. 5 simply shows the state transition of the WDT setting state 17 when using the WDT 18 of the active BMC 6 in the second embodiment, and more accurately conforms to the specification of the IPMI (Intelligent Platform Management Interface). To do.

  First, when the WDT setting state 17 is an arbitrary state, the arithmetic unit 19 performs an initial setting 500 and makes a transition to the valid state 501. At this time, the arithmetic unit 19 sets the initial counter as a part of the setting items in the WDT setting state 17 to Tt and the action to hard reset.

  Next, when a WDT start 502 (actually, the same as WDT reset) command is transmitted to the active BMC 6, the WDT setting state 17 becomes the start state 503, and the arithmetic unit 19 is a current counter that is a part of the WDT setting state 17. Is set to the value Tt of the initial counter.

  When the WDT setting state 17 is in the start state 503, when the preset unit time elapses 504, the arithmetic unit 19 decrements the current counter by one.

  Similarly, when the WDT setting state 17 is in the start state 503, when a WDT reset 505 command is transmitted to the active BMC 6, the arithmetic unit 19 resets the value of the current counter to the value Tt of the initial counter.

  Further, when the WDT setting state 17 is in the start state 503, when the current counter becomes 0, a hard reset is input to the computer on which the active system BMC 6 is mounted according to the action setting, and the state transits to the timer firing state 507. As a result, the active computer 10 receives a hard reset as a predetermined action by counting up the WDT 18 and forcibly restarts.

  Based on the above, processing for realizing the second embodiment will be described with reference to FIGS. 4 and 5. FIG. 4 is a time chart showing an example of processing for automatically restarting the first OS 1 when the second OS 3 for memory dump processing hangs up. The processing in FIG. 4 applies the second embodiment to the case of FIG. 2 of the first embodiment, but can be similarly applied to the case of FIG. 3 of the first embodiment. Details of each step are as follows.

  In step 130, the active computer 10 transmits to the active BMC 6 a command for setting the WDT 18 to the valid state 501 as an initial setting before starting the business. Here, the WDT 18 is merely set to the valid state 501 and the timer (current counter) is not started.

  In step 131, the working BMC 6 receives the WDT 18 validation command and sets the WDT setting state 17 to the valid state 501.

  Steps 102 to 104 are the same as in FIG. 2 of the first embodiment. After the HB is transmitted, the first OS 1 of the active computer 10 becomes a kernel panic due to the occurrence of an abnormality.

  In step 132, a WDT start 502 command is transmitted to the active BMC 6 via the system interface 30 in the OS-independent process before starting the second OS 3 for collecting the memory dump. Similarly to the first embodiment, the second embodiment also instructs the active BMC 6 to change the settings before starting the second OS 3.

  In step 133, the active BMC 6 updates the WDT setting state 17 to the start state 503.

  Steps 107 to 109 are the same as in FIG. 2 of the first embodiment, and the standby computer 20 that has acquired the updated WDT setting state 17 takes over the work of the active computer 10, and the active computer 10 Start OS3.

  In steps 134 to 134n, after the second OS 3 is activated and during the memory dump, the active computer 10 sends a WDT reset 505 command to the active BMC 6 via the system interface 30 at a predetermined period. Send to.

  In steps 135 to 134n, the working BMC 6 receives the WDT reset 505 command and resets the current counter to the initial counter value Tt. Then, the working BMC 6 repeats the counting of the current counter as described above.

  In step 110, the active computer 10 starts the memory dump process when the startup process of the second OS 3 is completed.

  In step 136, the memory dump process of the second OS 3 hangs up for some reason. In step 137, after a predetermined time Tt has elapsed since the last WDT reset 135n, the current counter becomes 0 and the timer fires. The working BMC 6 sets the WDT setting state 17 to the firing state 507, and inputs a hard reset to the working computer 10 as set in the action.

  In step 138, the active computer 10 is forcibly restarted by the hard reset input in step 137. As a result, the active computer 10 can be restored as a new standby computer.

  Note that the hang-up (136) of the second OS 3 is the same when it occurs at the timing of step 109 and later.

  With the above processing, in the second embodiment, in the memory dump processing by the second OS 3 performed by the active computer 10 after the first OS 1 is stopped, from the start of the second OS 3 to the completion of the memory dump. Even if a hang-up occurs during this period, the standby computer 20 can take over the work, and the active computer 10 can be restarted and restored as a new standby system within a predictable time. .

  In the first and second embodiments, the example in which the active BMC 6 is used as a device for inputting the NMI and the hard reset to the active computer 10 is shown, but the present invention is not limited to this. For example, any computer management device that can input an NMI or a hard reset to the active computer 10 may be used.

  Further, in the first and second embodiments, the standby computer 20 refers to the WDT setting state 17 of the active BMC 6 and determines that the operation is reliably stopped in the active computer 10. However, the standby computer 20 is limited to the WDT setting state 17. Is not to be done. For example, when the active computer 10 starts a business (or before the start), the middleware 2 or the first OS “start” (= WDT) to the business operation state indicating the start of the business of the active BMC 6 or the computer management apparatus. Set Enabled.

  Then, before the first OS becomes a kernel panic and the second OS 3 is started, the status indicating that the task has been stopped by a predetermined I / O operation indicates the operation status of the active BMC 6 or the active computer management device. Set “Stop” (= WDT invalid) to the state. The standby computer 20 acquires the operational status of the active BMC 6 or the computer management device after the elapse of a predetermined time Tc from the last HB, and if it is “stopped”, the operation of the active computer 10 is reliably stopped. It can be determined that the business can be taken over.

  As described above, according to the present invention, “start” or “stop” of the business operation state is set in the computer management apparatus connected to the active computer 10, and the standby computer 20 detects the occurrence of a failure. If the business operation state is “stopped”, the business of the active computer 10 can be taken over and a quick failover can be realized.

  In the first and second embodiments, the example in which the communication device 13 uses the HB that is transmitted to the standby computer 20 at a predetermined period and the state in which the active computer 10 is set to the WDT setting state 17 has been described. It is not limited to. For example, first operation information indicating that the active computer 10 is operating and second operation information indicating that the first OS 1 of the active computer 10 has been stopped may be provided in the computer management apparatus. . In this case, the standby computer 20 acquires the second operation information from the computer management apparatus after a predetermined time from the reception of the last first operation information, thereby causing a failure in the first OS 1. It can be determined that the first OS 1 has stopped reliably.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, any of the additions, deletions, or substitutions of other configurations can be applied to a part of the configuration of each embodiment, either alone or in combination.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. In addition, each of the above-described configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files for realizing each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

6 Active BMC
7 Standby BMC
DESCRIPTION OF SYMBOLS 10 Active computer 11 Arithmetic unit 12 Memory 13 Communication device 14 LAN adapter 15 Storage device 17 WDT setting state 18 Watchdog timer 20 Standby system computer 30 System interface 31, 32 Network

Claims (6)

A plurality of computers each having a processor and a memory; at least one of the plurality of computers is an active computer; at least one of the other computers is a standby computer; and the active computer and the standby computer A computer system having a network connecting
The working computer is
A computer management device that is connected to the active computer and manages the active computer;
A first OS that provides business;
A communication unit that transmits first operation information indicating that the first OS is in operation to the standby computer;
A second OS that outputs the contents of the memory after a failure has occurred in the first OS;
The computer management device is
Second operating information capable of setting the operating state of the first OS;
An adapter connected to the standby computer,
The working computer is
Set the operation start in the second operation information of the computer management device at the start of the business,
When the first OS is stopped due to a failure, the second OS is started after the operation stop is set in the second operation information,
The standby computer is
After the first predetermined time has elapsed since the reception of the first operation information, the second operation information is acquired, and if the second operation information is the operation stop, the first OS A computer system characterized in that it is determined that has stopped and takes over the work of the active computer. The computer system according to claim 1,
The computer management device is
It consists of a watchdog timer that executes a predetermined action when counted up to a second predetermined time,
The working computer is
The watchdog timer is started when the second OS is started, a hard reset of the active computer is set in the action, and the watchdog timer is reset every third predetermined time. Computer system to do. The computer system according to claim 1,
The standby computer is
The computer management device acquires the second operation information after the first predetermined time has elapsed after receiving the first operation information, and the second operation information is the operation start. After instructing the NMI to input, take over the work of the active computer,
The computer management device is
A computer system, wherein an NMI is input to the active computer based on a command from the standby computer. A plurality of computers having a processor and a memory; at least one of the plurality of computers is an active computer; at least one of the other computers is a standby computer; and the operation provided by the active computer A computer system control method for switching to the standby computer,
A first step in which the active computer operates a first OS that provides business;
A second step in which the active computer sets the start of operation of the first OS in the second operation information of the computer management apparatus that manages the active computer;
A third step in which the active computer transmits first operation information indicating that the first OS is in operation to the standby computer via a network;
A fourth step of setting the operation stop to the second operation information of the computer management apparatus when the first OS is stopped due to a failure;
The active computer starts a second OS that outputs the contents of the memory after a failure occurs in the first OS;
Whether the standby computer obtains the second operation information after the first predetermined time has elapsed since the reception of the first operation information, and whether the second operation information is the operation stop. A sixth step of determining whether or not;
If the result of the determination is the operation stop, the standby computer determines that the first OS has stopped, and a seventh step of taking over the work of the active computer;
A control method for a computer system, comprising: A control method for a computer system according to claim 4,
The computer management device is
It consists of a watchdog timer that executes a predetermined action when counted up to a second predetermined time,
The fifth step includes
Starting the watchdog timer when starting the second OS, and setting a hard reset of the active computer in the action;
Resetting the watchdog timer every third predetermined time;
A control method for a computer system, comprising: A control method for a computer system according to claim 4,
The standby computer, if the result of the determination is the start of operation, after instructing the computer management device to input NMI, the eighth step of taking over the work of the active computer;
The computer management device further includes a ninth step of inputting an NMI to the active computer based on a command from the standby computer;
The fourth step includes
When the first OS is stopped by the NMI, an operation stop is set in the second operation information of the computer management apparatus,
The fifth step includes
A computer system control method, comprising: starting a second OS that outputs the contents of the memory after the first OS is stopped by the NMI.

Images