JP2022144118A - Computer system and restart program - Google Patents

Abstract

To enable autonomous restoration of a failure.SOLUTION: A computer system includes: a first failure information storage part for storing first failure management information including information of a first failure that occurs in a first process group operating in a first group logically divided from a second group; a second failure information storage part for storing second failure management information obtained by registering second external failure information corresponding to the information of the first failure and information of an influence object of the first failure in the second group in association with each other; a first process management part for transmitting the information of the first failure to a first failure information communication part in the case of detecting the first failure; and a second process management part for restarting an influence object of the first failure corresponding to the second external failure information with reference to the second failure management information in the case that a second failure information communication part receives the information of the first failure.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to a computer system and a reboot program.

2. Description of the Related Art Conventionally, when a process executed by a computer or a virtual machine running under the control of a hypervisor on a computer fails, there is a technique for detecting the failure and restarting the process or the virtual machine.

For example, Patent Literature 1 discloses a system that detects failures that occur in multiple processes that provide different functions, does not restart normally running processes, and restarts only the failed process. , an electronic device that prevents a normally running process from interrupting the provision of functionality.

Further, Patent Literature 2 discloses a computer device that accepts input from a user of a reset level representing a range of virtual machines to be reset, and resets the virtual machines corresponding to the reset level.

JP 2016-207124 A JP 2012-18452 A

However, in the conventional technology disclosed in the above-mentioned Patent Document 1, if a process depends on other processes, the dependency is not taken into account. , the request to restart another process that depends on that process cannot be fulfilled.

Further, in the conventional technology disclosed in Patent Document 2, although the range of virtual machines to be reset can be determined for each reset level in consideration of the dependency relationship between the virtual machines, it is possible to determine which reset level to reset. Since it is necessary for the user to decide whether or not to start the system, there is a problem that recovery from a failure cannot be performed autonomously.

An object of the present disclosure is to provide a computer system and a restart program that enable recovery from autonomous failures.

A computer system according to the present disclosure stores first failure management information including information about a first failure occurring in a first process group operating in a first group logically separated from a second group. a first failure information storage unit, a second external failure information corresponding to the information of the first failure, and the information of the target affected by the first failure in the second group are registered in association with each other. a second failure information storage unit for storing failure management information of the first failure, and a first process management unit for transmitting information of the first failure to the first failure information communication unit when the first failure is detected; , when the second fault information communication unit receives the information of the first fault, referring to the second fault management information and restarting the target affected by the first fault corresponding to the second external fault information. and a second process management unit.

When a restart program according to the present disclosure detects a first failure occurring in a first process group operating in a first group logically separated from a second group, a procedure for reading first failure information from a first failure information storage unit storing first failure management information including information and transmitting the information to a first failure information communication unit; and receiving the first failure information. information of the first failure from the second failure information communication unit, second external failure information corresponding to the information of the first failure, and information of the target affected by the first failure in the second group The second failure management information is read from the second failure information storage unit that stores the second failure management information registered in association with the second failure management information, and the second external failure information corresponding to the first failure information is specified. and restarting the affected target of the first failure corresponding to the identified second external failure information.

According to the present disclosure, recovery from autonomous failures is possible.

A diagram showing an example of a configuration of a computer system according to Embodiment 1 A diagram showing an example of failure management information 23a A diagram showing an example of failure management information 33a Flowchart showing an example of a procedure of restart processing performed by the first VM 20 Flowchart showing an example of a procedure of restart processing performed by the second VM 30 A diagram showing an example of the configuration of a computer system according to Embodiment 2 A diagram showing an example of failure management information 43a A diagram showing an example of failure management information 53a A diagram showing an example of failure management information 63a A diagram showing an example of the configuration of a computer system according to Embodiment 3 A diagram showing an example of failure management information 72a A diagram showing an example of failure management information 84a A diagram showing an example of failure management information 94a A diagram showing an example of the failure management information 105a A diagram showing an example of the fault management information 113a 3 is a flow chart showing an example of a procedure of restart processing performed by the hypervisor 70;

Hereinafter, embodiments of the present disclosure will be described in detail based on the drawings.

(Embodiment 1)
FIG. 1 is a diagram showing an example of the configuration of a computer system according to Embodiment 1. As shown in FIG.

As shown in FIG. 1, the computer system includes a hypervisor 10, a first VM (Virtual Machine, virtual machine) 20, and a second VM 30. FIG.

The hypervisor 10 is a control unit that logically divides one computer into a first VM 20 and a second VM 30 and operates them as two independent virtual machines. The first VM 20 and the second VM 30 are virtual machines generated in this way.

Although the number of virtual machines operating on the hypervisor 10 is assumed to be two here, the number may be two or more.

A first VM 20 on which a process group including processes 21 a to 21 n is executed includes a process monitoring section 22 , a failure information storage section 23 , a failure information communication section 24 and a process management section 25 . The process monitoring unit 22, the fault information communication unit 24, and the process management unit 25 may be implemented as individual processes, or may be implemented as a single process having their respective roles.

Functions of the process monitoring unit 22, the fault information communication unit 24, and the process management unit 25 are realized by the processor. Also, the function of the fault information storage unit 23 is implemented by a storage device such as a memory.

The process monitoring unit 22 monitors faults occurring in a process group including the processes 21a to 21n. For example, the process monitoring unit 22 transmits heartbeat messages to the processes 21a to 21n, and notifies the process management unit 25, which will be described later, of the processes that do not respond. This makes it possible to detect processes that have stopped working or are stuck in an infinite loop.

The failure information storage unit 23 stores failure management information 23a in which information about failures that occur in a process group including the processes 21a to 21n and information about targets affected by the failures are associated and registered.

FIG. 2 is a diagram showing an example of the fault management information 23a. The fault management information 23a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the first VM 20 and information indicating that the process is executed outside the first VM 20 . In addition, in the example of FIG. 2, the latter information is not registered. The failure information is information about failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET" in the fault information is information indicating whether the fault occurred in a virtual machine (VM), container, or process. "VM" is identification information indicating the virtual machine in which the failure occurred. "PROC" is identification information indicating the process in which the failure occurred.

For example, process information "PROCESS12" is registered in association with failure information "TARGET:PROC, VM:1, PROC:PROCESS12" and affected target information "PROCESS13".

This indicates that when a failure occurs in the process "PROCESS12" in the first VM 20, the process "PROCESS13" must be restarted due to the occurrence of the failure.

Further, process information "PROCESS13" is registered in association with failure information "TARGET: PROC, VM: 1, PROC: PROCESS13".

This fault information indicates that the process in which the fault occurs in the first VM 20 is "PROCESS13". It should be noted that no affected target information is registered for the process "PROCESS13", so there is no target that needs to be restarted when a failure occurs in the process "PROCESS13".

Returning to the description of FIG. 1 , the failure information communication unit 24 communicates with the failure information communication unit 34 of the second VM 30 .

For example, when a failure occurs in the processes 21a to 21n in the first VM 20, the failure information communication unit 24 transmits the failure information shown in FIG. The failure information communication unit 24 also receives failure information transmitted from the failure information communication unit 34 .

The process management unit 25 manages the processes 21a to 21n in the first VM20. For example, the process management unit 25 detects from the notification from the process monitoring unit 22 that a failure has occurred in the processes 21a to 21n. Also, the process management unit 25 detects that a failure has occurred in the processes 21a to 21n by receiving failure messages from the processes 21a to 21n.

Then, the process management unit 25 refers to the failure management information 23a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 2, if the process that detected the failure is "PROCESS12", the process management unit 25 outputs the failure information "TARGET: PROC, VM: 1, PROC: PROCESS12" and the failure information "PROCESS13". Get affected information.

Thereafter, the process management unit 25 instructs the failure information communication unit 24 to transmit the failure information to the second VM 30, which is another VM, when failure information is registered like the process "PROCESS12". do.

In addition, the process management unit 25 restarts the registered affected object when the affected object information is registered like the process of "PROCESS12". Furthermore, the process management unit 25 restarts the failed process.

Further, when "PROCESS13" is registered as the affected target information like the process "PROCESS12" shown in FIG. The failure information communication unit 24 is instructed to transmit to a certain second VM 30 .

In addition, since the affected object information corresponding to the process of "PROCESS13" is not registered, the process management unit 25 does not restart the process.

Furthermore, when the failure information communication unit 24 receives failure information from the second VM 30, which is another VM, the process management unit 25 acquires the failure information, and the failure information is included in the failure management information 23a. It is determined whether or not it corresponds to the failure information.

Then, when the failure information corresponds to the failure information included in the failure management information 23a, the process management unit 25 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 25 restarts the registered affected target.

The second VM 30 on which a process group including the processes 31a to 31m is executed includes a process monitoring section 32, a failure information storage section 33, a failure information communication section 34, and a process management section . The process monitoring unit 32, the fault information communication unit 34, and the process management unit 35 may be implemented as individual processes, or may be implemented as a single process having their respective roles.

Functions of the process monitoring unit 32, the fault information communication unit 34, and the process management unit 35 are realized by the processor. Also, the function of the failure information storage unit 33 is implemented by a storage device such as a memory.

The process monitoring unit 32 monitors failures occurring in a process group including the processes 31a to 31m. For example, the process monitoring unit 32 sends heartbeat messages to the processes 31a to 31m, and notifies the process management unit 35, which will be described later, of the processes that do not respond.

The failure information storage unit 33 stores failure management information 33a in which information about failures that occur in a process group including the processes 31a to 31m and information about targets affected by the failures are associated and registered.

FIG. 3 is a diagram showing an example of the fault management information 33a. The fault management information 33a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the second VM 30 and information indicating that the process is executed outside the second VM 30 . The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "VM" and "PROC" in the failure information are the same information as "TARGET", "VM" and "PROC" in the failure information of the failure management information 33a shown in FIG. .

Here, the process information "EXTERNAL_ERROR" is registered in association with the failure information (external failure information) "TARGET: PROC, VM: 1, PROC: PROCESS12" and the affected information "PROCESS22, PROCESS23". It is

This indicates that when a failure occurs in the process "PROCESS12" in the first VM 20, it is necessary to restart the processes "PROCESS22" and "PROCESS23" due to the occurrence of the failure.

Returning to the description of FIG. 1 , the failure information communication unit 34 communicates with the failure information communication unit 24 of the first VM 20 .

For example, when a failure occurs in the processes 31a to 31m in the second VM 30, the failure information communication unit 34 transmits the failure information shown in FIG. Further, the failure information communication section 34 receives failure information transmitted from the failure information communication section 24 .

The process management unit 35 manages the processes 31a-31m in the second VM30. For example, the process management unit 35 detects from the notification from the process monitoring unit 32 that a failure has occurred in the processes 31a to 31m. Also, the process management unit 35 detects that a failure has occurred in the processes 31a to 31m by receiving failure messages from the processes 31a to 31m.

Then, the process management unit 35 refers to the failure management information 33a, and acquires failure information and affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 3, if the process in which the failure occurred is "PROCESS22", the process management unit 35 outputs the failure information "TARGET: PROC, VM: 2, PROC: PROCESS22" and the failure information "PROCESS23". Get affected information.

After that, the process management unit 35 instructs the failure information communication unit 34 to transmit the failure information to the first VM 20, which is another VM, when failure information is registered like the process "PROCESS22". do.

In addition, the process management unit 35 restarts the registered affected object when the affected object information is registered like the process of "PROCESS22". Furthermore, the process management unit 25 restarts the failed process.

In the example of FIG. 3, since the failure information corresponding to the process "PROCESS23" is not registered, the process of transmitting the failure information to the first VM 20 is not performed. In the case of a process that does not affect others even if a failure occurs, it is possible to suppress unnecessary failure information transmission processing by not registering failure information. In addition, since the affected object information corresponding to the process "PROCESS23" is not registered, the process management unit 35 does not restart the process.

Further, when the failure information communication unit 34 receives failure information from the first VM 20, which is another VM, the process management unit 35 acquires the failure information, and the failure information is included in the failure management information 33a. It is determined whether or not it corresponds to the fault information.

Then, when the failure information corresponds to the failure information included in the failure management information 33a, the process management unit 35 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 35 restarts the registered affected target.

For example, it is assumed that the failure information communication unit 34 has received information "TARGET: PROC, VM: 1, PROC: PROCESS 12" from the first VM 20 as failure information.

In this case, this fault information corresponds to the fault information of "EXTERNAL_ERROR" of the fault management information 33a shown in FIG. process.

Here, since the failure information and the affected information are registered in "PROCESS22", the process management unit 35 instructs the failure information communication unit 34 to transmit the failure information to the first VM 20, Restart the process of "PROCESS23" registered as the affected information.

Since the failure information corresponding to the process of "PROCESS23" is not registered, the process of transmitting the failure information to the first VM 20 is not performed. In addition, since the affected object information corresponding to the process "PROCESS23" is not registered, the process management unit 35 does not restart the process.

Next, an example of the procedure of restart processing performed by the first VM 20 will be described. FIG. 4 is a flowchart illustrating an example of a procedure of restart processing performed by the first VM 20 .

As shown in FIG. 4, the process management unit 25 detects that a failure has occurred in the processes 21a to 21n from a notification from the process monitoring unit 22 or from a failure message received from the processes 21a to 21n (step S101).

Next, the process management unit 25 refers to the fault management information 23a, and based on the information of the process in which the fault occurred, acquires the fault information and the affected object information corresponding to the process from the fault management information 23a. (step S102).

Then, the process management unit 25 determines whether fault information corresponding to the process is registered in the fault management information 23a (step S103).

If failure information corresponding to the process is registered in the failure management information 23a (Yes in step S103), the process management unit 25 instructs the failure information communication unit 24 to transmit the failure information to another VM. is transmitted to the second VM 30 (step S104).

After that, the process management unit 25 determines whether or not influence target information corresponding to the process is registered in the failure management information 23a (step S105).

If the affected object information corresponding to the process is registered in the fault management information 23a (Yes in step S105), the process management unit 25 restarts the affected object registered in the affected object information ( step S106).

If fault information corresponding to the affected process to be restarted is registered in the fault management information 23a, the process management unit 25 instructs the fault information communication unit 24 to transmit the fault information. If it is sent to the second VM 30 and the affected object information corresponding to the process is registered, the affected object registered in the affected object information is restarted.

Furthermore, the process management unit 25 restarts the process in which the occurrence of the failure has been detected (step S107), and terminates this restart processing.

In step S103, if the failure information corresponding to the process is not registered in the failure management information 23a (No in step S103), or if the failure management information 23a corresponds to the process in step S105, If the affected target information is not registered (No in step S105), the process management unit 25 restarts the process in which the occurrence of the failure is detected (step S107), and terminates this restart processing.

Next, an example of the procedure of restart processing performed by the second VM 30 will be described. FIG. 5 is a flowchart illustrating an example of a procedure of restart processing performed by the second VM 30. As illustrated in FIG.

As shown in FIG. 5, the failure information communication unit 34 of the second VM 30 receives failure information transmitted by the failure information communication unit 24 of the first VM 20 (step S201).

Then, the process management unit 35 acquires the failure information from the failure information communication unit 34, refers to the failure management information 33a, and acquires the failure information and the affected information corresponding to the failure information from the failure management information 33a. Processing is performed (step S202).

Then, the process management unit 35 determines whether fault information corresponding to the fault information acquired from the fault information communication unit 34 is registered in the fault management information 33a (step S203).

If failure information corresponding to the failure information acquired from the failure information communication unit 34 is registered in the failure management information 33a (Yes in step S203), the process management unit 35 instructs the failure information communication unit 34 to , the failure information is transmitted to the first VM 20, which is another VM (step S204).

After that, the process management unit 35 determines whether or not affected information corresponding to the failure information acquired from the failure information communication unit 34 is registered in the failure management information 33a (step S205).

If the affected information corresponding to the failure information acquired from the failure information communication unit 34 is registered in the failure management information 33a (Yes in step S205), the process management unit 35 registers the affected information registered in the affected information. restarts the affected target, and terminates the restart processing (step S206).

If the failure management information 33a registers failure information corresponding to the affected process to be restarted, the process management unit 35 instructs the failure information communication unit 34 to transmit the failure information. If it is sent to the first VM 20 and the affected object information corresponding to the process is registered, the affected object registered in the affected object information is restarted.

Further, in step S203, if failure information corresponding to the failure information acquired from the failure information communication unit 34 is not registered in the failure management information 33a (No in step S203), or in step S205, failure management If the affected target information corresponding to the failure information acquired from the failure information communication unit 34 is not registered in the information 33a (No in step S205), this restart processing ends.

Thus, in Embodiment 1, the failure information storage unit 23 of the first VM 20 stores the first error generated in the processes 21a to 21n operating in the first VM 20 logically separated from the second VM 30. The failure management information 23a including failure information is stored, and the failure information storage unit 33 of the second VM 30 stores second failure information (external failure information) corresponding to the first failure information, The failure management information 33a registered in association with the information on the affected target of the first failure in the first failure is stored, and when the process management unit 25 of the first VM 20 detects the first failure, failure information is transmitted to the failure information communication unit 24, and when the failure information communication unit 34 of the second VM 30 receives the first failure information, the process management unit 35 refers to the failure management information 33a. , the target affected by the first failure corresponding to the second failure information (external failure information) is restarted.

As a result, it is possible to autonomously recover from failures by considering inter-process dependencies.

Further, in the first embodiment, the process monitoring unit 22 of the first VM 20 monitors heartbeats of the processes 21a to 21n, notifies the process management unit 25 of the heartbeat monitoring result information, and processes the process management unit 25. However, based on the notification from the process monitoring unit 22, failures in the processes 21a to 21n are detected.

This makes it possible to detect processes that have stopped working or are stuck in an infinite loop.

In addition, in the first embodiment, in addition to the fault management information 23a of the first VM 20, first fault information (external fault information ) and information on the target affected by the second failure are registered in association with each other, information on the second failure is further registered in the failure management information 33a of the second VM 30, and process management When the second failure is detected, the unit 35 causes the failure information communication unit 34 to transmit the second failure information, and the process management unit 25 of the first VM 20 causes the failure information communication unit 24 to transmit the second failure. When the failure information is received, the failure management information 23a is referred to and the target affected by the second failure corresponding to the first failure information (external failure information) is restarted.

As a result, recovery from a failure occurring in the first VM 20 as well as recovery from a failure occurring in the second VM 30 can be autonomously performed.

Moreover, in Embodiment 1, the logically divided two groups are the first VM 20 and the second VM 30 operating on the hypervisor.

Thereby, when the process of the second VM 30 depends on the process of the first VM 20, it is possible to autonomously recover from the failure.

(Embodiment 2)
FIG. 6 is a diagram showing an example of the configuration of a computer system according to Embodiment 1. As shown in FIG. As shown in FIG. 6, this computer system executes processes 40a to 40l and container management processes 41a and 41b. The container management processes 41a and 41b are processes for managing the first container 50 and the second container 60, respectively.

This computer system comprises a process monitoring section 42 , a fault information storage section 43 , a fault information communication section 44 , a process management section 45 , a first container 50 and a second container 60 . The first container 50 and the second container 60 are containers that are logically divided from each other in one computer to execute applications.

Although the number of containers is two here, it may be two or more. The process monitoring unit 42, the fault information communication unit 44, and the process management unit 45 may be implemented as separate processes, or may be implemented as a single process having their respective roles.

The process monitoring unit 42 monitors faults occurring in a process group including the processes 40a to 40l and the container management processes 41a and 41b. For example, the process monitoring unit 42 transmits heartbeat messages to the processes 40a to 40l and the container management processes 41a and 41b, and notifies the process management unit 45 (to be described later) of processes that do not receive a response.

The fault information storage unit 43 stores fault management information 43a in which information on faults occurring in a process group including the processes 40a to 40l and the container management processes 41a and 41b is associated with information on targets affected by the faults and registered. do.

FIG. 7 is a diagram showing an example of the fault management information 43a. The fault management information 43a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the first VM 20 and information indicating that the process is executed outside the first VM 20 . The failure information is information on failures of these processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET" in the fault information is information indicating whether the fault occurred in a virtual machine (VM), container, or process. "CONTAINER" is identification information indicating a failed container. "PROC" is identification information indicating the process in which the failure occurred.

For example, process information "CONTAINER2_MNG_PROCESS" is registered in association with failure information "TARGET:CONTAINER, CONTAINER:2" and affected object information "PROCESS13".

This indicates that when a failure occurs in the container management process 41b called "CONTAINER2_MNG_PROCESS", the process called "PROCESS13" must be restarted due to the occurrence of the failure.

Also, the process information "PROCESS13" is registered in association with the failure information "TARGET:PROC, CONTAINER:-, PROC:PROCESS13".

This fault information indicates that the process in which the fault occurs is "PROCESS13". It should be noted that no affected target information is registered for the process "PROCESS13", so there is no target that needs to be restarted when a failure occurs in the process "PROCESS13".

Further, the process information "EXTERNAL_ERROR" is registered in association with the failure information (external failure information) "TARGET: PROC, CONTAINER: 2, PROC: PROCESS32" and the affected information "PROCESS13". .

This indicates that when a failure occurs in the process of the second container 60 called "PROCESS32", it is necessary to restart the process called "PROCESS13" due to the occurrence of the failure.

As described above, no affected target information is registered for the process "PROCESS13", so there is no target that needs to be restarted when a failure occurs in the process "PROCESS13".

Returning to the description of FIG. 6 , the failure information communication unit 44 communicates with the failure information communication unit 54 of the first container 50 and the failure information communication unit 64 of the second container 60 .

For example, when a failure occurs in the processes 40a to 40l or the container management processes 41a and 41b, the failure information communication unit 44 sends the failure information shown in FIG. 54 and the failure information communication unit 64 .

The failure information communication unit 44 also receives failure information transmitted from the failure information communication unit 54 and the failure information communication unit 64 .

The process management unit 45 manages the processes 40a-40l and the container management processes 41a and 41b. For example, the process management unit 45 detects from the notification from the process monitoring unit 42 that a failure has occurred in the processes 40a to 40l or the container management processes 41a and 41b.

Further, the process management unit 45 receives a fault message from the processes 40a to 40l or the container management processes 41a and 41b to notify that a fault has occurred in the processes 40a to 40l or the container management processes 41a and 41b. To detect.

Then, the process management unit 45 refers to the failure management information 43a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 7, if the faulty process is "CONTAINER2_MNG_PROCESS", the process management unit 25 sets the fault information "TARGET: CONTAINER, CONTAINER: 2" and the affected target information "PROCESS13". get.

Thereafter, the process management unit 45 performs fault information communication so as to transmit the fault information to the first container 50 and the second container 60 when fault information is registered as in the process of "CONTAINER2_MNG_PROCESS". 44 is instructed.

In addition, the process management unit 45 restarts the registered affected object when the affected object information is registered like the process of "CONTAINER2_MNG_PROCESS". Furthermore, the process management unit 45 restarts the failed process.

Here, as shown in FIG. 7, when "PROCESS13" is registered as the affected object information, the process management unit 45 stores the fault information corresponding to the process "PROCESS13" in the first container 50 and in the first container. The failure information communication unit 44 is instructed to transmit to the second container 60 .

In addition, since the affected object information corresponding to the process of "PROCESS13" is not registered, the process management unit 45 does not restart the process.

Furthermore, when the fault information communication unit 44 receives fault information from the first container 50 or the second container 60, the process management unit 45 acquires the fault information, and converts the fault information into fault management information. 43a or not.

Then, when the failure information corresponds to the failure information included in the failure management information 43a, the process management unit 45 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the failure information is registered, the process management unit 45 restarts the registered affected target.

For example, it is assumed that the failure information communication unit 44 has received information "TARGET: PROC, CONTAINER: 2, PROC: PROCESS 32" from the second container 60 as failure information.

In this case, this fault information corresponds to the fault information (external fault information) of "EXTERNAL_ERROR" in the fault management information 43a shown in FIG. ” process.

In addition, since the failure information is registered in "PROCESS13", the process management unit 45 instructs the failure information communication unit 44 to transmit the failure information to the first container 50, and as the affected information, Restart the registered "PROCESS13" process.

In addition, since the affected object information corresponding to the process of "PROCESS13" is not registered, the process management unit 45 does not restart the process.

A first container 50 in which a process group including processes 51 a to 51 n is executed includes a process monitoring section 52 , a failure information storage section 53 , a failure information communication section 54 and a process management section 55 . The process monitoring unit 52, the fault information communication unit 54, and the process management unit 55 may be implemented as individual processes, or may be implemented as a single process having their respective roles.

Functions of the process monitoring unit 52, the fault information communication unit 54, and the process management unit 55 are realized by the processor. Also, the function of the failure information storage unit 53 is implemented by a storage device such as a memory.

The process monitoring unit 52 monitors failures occurring in a process group including the processes 51a to 51n. For example, the process monitoring unit 52 transmits heartbeat messages to the processes 51a to 51n, and notifies the process management unit 55, which will be described later, of the processes that do not receive a response.

The failure information storage unit 53 stores failure management information 53a in which information about failures that occur in a process group including the processes 51a to 51n and information about targets affected by the failures are associated and registered.

FIG. 8 is a diagram showing an example of the failure management information 53a. The fault management information 53a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the first container 50 and information indicating that the process is executed outside the first container 50 . In addition, in the example of FIG. 8, the latter information is not registered. The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "CONTAINER" and "PROC" in the fault information are information similar to "TARGET", "CONTAINER" and "PROC" in the fault information of the fault management information 43a shown in FIG. .

For example, process information "PROCESS21" is registered in association with failure information "TARGET: PROC, CONTAINER: 1, PROC: PROCESS21" and affected target information "PROCESS22".

This indicates that when a failure occurs in the process "PROCESS21" in the first container 50, the process "PROCESS22" must be restarted due to the occurrence of the failure.

Further, process information "PROCESS22" is registered in association with failure information "TARGET: PROC, CONTAINER: 1, PROC: PROCESS22".

This fault information indicates that the process in which the fault occurs in the first container 50 is "PROCESS22". It should be noted that no affected target information is registered for the process "PROCESS22", so there is no target that needs to be restarted when a failure occurs in the process "PROCESS22".

Returning to the explanation of FIG. 6 , the failure information communication section 54 communicates with the failure information communication section 44 and the failure information communication section 64 .

For example, when a failure occurs in the processes 51a to 51n in the first container 50, the failure information communication unit 54 sends the failure information shown in FIG. It is transmitted to the information communication section 64 . Further, the failure information communication section 24 receives failure information transmitted from the failure information communication section 44 and the failure information communication section 64 .

The process manager 55 manages the processes 51a-51n in the first container 50. FIG. For example, the process management unit 55 detects from the notification from the process monitoring unit 52 that a failure has occurred in the processes 51a to 51n. Also, the process management unit 55 detects that a failure has occurred in the processes 51a to 51n by receiving failure messages from the processes 51a to 51n.

Then, the process management unit 55 refers to the failure management information 53a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 8, if the process in which the fault has occurred is "PROCESS21", the process management unit 55 outputs the fault information "TARGET: PROC, CONTAINER: 1, PROC: PROCESS21" and the fault information "PROCESS22". Get affected information.

Thereafter, process management unit 55 instructs failure information communication unit 54 to transmit the failure information to failure information communication unit 44 and failure information communication unit 64 when failure information is registered as in the process “PROCESS21”. direct to.

In addition, the process management unit 55 restarts the registered affected object when the affected object information is registered like the process of "PROCESS21". Furthermore, the process management unit 55 restarts the failed process.

Here, as shown in FIG. 8, when "PROCESS22" is registered as the affected object information, the process management unit 55 sends fault information corresponding to the process "PROCESS22" to the fault information communication unit 44 and the fault information communication unit 44. The failure information communication unit 54 is instructed to transmit to the unit 64 .

In addition, since the affected object information corresponding to the process of "PROCESS22" is not registered, the process management unit 55 does not restart the process.

Furthermore, when the fault information communication unit 54 receives fault information from the fault information communication unit 44 or the fault information communication unit 64, the process management unit 55 acquires the fault information, and stores the fault information in the fault management information 53a. It is determined whether or not it corresponds to the included fault information.

Then, when the fault information corresponds to the fault information included in the fault management information 53a, the process management unit 55 determines whether or not the affected information corresponding to the fault information is registered.

If affected target information corresponding to the failure information is registered, the process management unit 55 restarts the registered affected target.

A second container 60 in which a process group including processes 61a to 61m is executed includes a process monitoring section 62, a failure information storage section 63, a failure information communication section 64, and a process management section 65. FIG. The process monitoring unit 62, the fault information communication unit 64, and the process management unit 65 may be implemented as separate processes, or may be implemented as a single process having their respective roles.

Functions of the process monitoring unit 62, the fault information communication unit 64, and the process management unit 65 are realized by the processor. Also, the function of the fault information storage unit 63 is implemented by a storage device such as a memory.

The process monitoring unit 62 monitors faults occurring in the process group including the processes 61a to 61m. For example, the process monitoring unit 62 transmits heartbeat messages of the processes 61a to 61m, and notifies the process management unit 65, which will be described later, of the processes with no response.

The failure information storage unit 63 stores failure management information 63a in which information about failures that occur in a process group including the processes 61a to 61m and information about targets affected by the failures are associated and registered.

FIG. 9 is a diagram showing an example of the fault management information 63a. The fault management information 63a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the second container 60 and information indicating that the process is executed outside the second container 60 . The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "CONTAINER" and "PROC" in the fault information are information similar to "TARGET", "CONTAINER" and "PROC" in the fault information of the fault management information 43a shown in FIG. .

Here, the fourth process information "EXTERNAL_ERROR" from the top in FIG. are associated and registered.

This indicates that when a failure occurs in the container management process 41a outside the second container 60, the processes "PROCESS31" and "PROCESS32" must be restarted due to the occurrence of the failure.

Returning to the explanation of FIG. 6 , the fault information communication section 64 communicates with the fault information communication section 44 and the fault information communication section 54 .

For example, when a failure occurs in the processes 61a to 61m in the second container 60, the failure information communication unit 64 sends the failure information shown in FIG. It is transmitted to the information communication section 54 . Further, the failure information communication unit 64 receives failure information transmitted from the failure information communication unit 44 or the failure information communication unit 54 .

The process manager 65 manages the processes 61a-61m in the second container 60. FIG.

For example, the process management unit 65 detects from the notification from the process monitoring unit 62 that a failure has occurred in the processes 61a to 61m. Also, the process management unit 65 detects that a failure has occurred in the processes 61a to 61m by receiving failure messages from the processes 61a to 61m.

Then, the process management unit 65 refers to the failure management information 63a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 9, if the failed process is "PROCESS32", the process management unit 65 acquires failure information "TARGET: PROC, CONTAINER: 2, PROC: PROCESS32". In the example of FIG. 9, influence target information is not registered in the process "PROCESS32".

After that, the process management unit 65 instructs the failure information communication unit 64 to transmit the failure information to the failure information communication unit 44 and the failure information communication unit 54 when failure information is registered as in the process "PROCESS32". direct to.

Further, when the affected object information is registered, the process management unit 65 restarts the registered affected object. Furthermore, the process management unit 55 restarts the failed process.

Here, as shown in FIG. 9, when "PROCESS31" is registered as the affected object information, the process management section 65 sends fault information corresponding to the process "PROCESS31" to the fault information communication section 44 and the fault information communication section 44. The failure information communication unit 64 is instructed to transmit to the unit 54 .

In the example of FIG. 9, since the failure information corresponding to the process "PROCESS31" is not registered, the failure information transmission process is not performed. In the case of a process that does not affect others even if a failure occurs, it is possible to suppress unnecessary failure information transmission processing by not registering failure information. In addition, since the affected object information corresponding to the process "PROCESS31" is not registered, the process management unit 65 does not restart the process.

Furthermore, when the fault information communication unit 64 receives fault information from the fault information communication unit 44 or the fault information communication unit 54, the process management unit 65 acquires the fault information, and stores the fault information in the fault management information 63a. It is determined whether or not it corresponds to the included fault information.

Then, when the failure information corresponds to the failure information included in the failure management information 63a, the process management unit 65 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 65 restarts the registered affected target.

For example, it is assumed that the failure information communication unit 64 receives information "TARGET: CONTAINER, CONTAINER: 1" from the failure information communication unit 44 as failure information.

In this case, this fault information corresponds to the fault information (external fault information) of "EXTERNAL_ERROR" shown in the fourth from the top of the fault management information 63a shown in FIG. restart the affected processes "PROCESS31" and "PROCESS32".

Since the failure information is registered in "PROCESS32", the process management unit 65 instructs the failure information communication unit 64 to transmit the failure information to the failure information communication unit 44 and the failure information communication unit 54. At the same time, the process of "PROCESS31" registered as the affected information is restarted.

In the example of FIG. 9, since the failure information corresponding to the process "PROCESS31" is not registered, the failure information transmission process is not performed. In addition, since the affected object information corresponding to the process "PROCESS31" is not registered, the process management unit 65 does not restart the process.

The processing procedure of restart processing performed by the process management units 45, 55, and 65 upon detection of a process failure is the same as the processing procedure described with reference to FIG.

That is, as shown in FIG. 4, the process management units 45, 55, and 65 receive notifications from the process monitoring units 42, 52, and 62 or receive fault messages from the respective processes to determine whether a fault has occurred in each process. is detected (step S101).

Subsequently, the process management units 45, 55, and 65 refer to the fault management information 43a, 53a, and 63a, respectively, and based on the information of the process in which the fault occurred, the fault information and affected target information corresponding to the process. from the failure management information 43a, 53a, 63a (step S102).

Then, the process management units 45, 55, 65 determine whether or not fault information corresponding to the process is registered in the fault management information 43a, 53a, 63a (step S103).

When failure information corresponding to the process is registered in the failure management information 43a, 53a, 63a (Yes in step S103), the process management units 45, 55, 65 communicate with the failure information communication units 44, 54, 64 to transmit the fault information to the other fault information communication units 44, 54 and 64 (step S104).

After that, the process management units 45, 55, 65 determine whether or not affected information corresponding to the process is registered in the failure management information 43a, 53a, 63a (step S105).

If the affected information corresponding to the process is registered in the failure management information 43a, 53a, 63a (Yes in step S105), the process management units 45, 55, 65 are registered in the affected information. restart the affected target (step S106).

If the fault management information 43a, 53a, 63a registers the fault information corresponding to the affected process to be restarted, the process management units 45, 55, and 65, the fault information communication unit 44, 54, 64 to transmit the fault information to other fault information communication units 44, 54, 64, and if the affected object information corresponding to the process is registered, it is registered in the affected object information. reboot the affected target.

Furthermore, the process management units 45, 55, 65 restart the process in which the occurrence of the failure is detected (step S107), and terminate this restart processing.

In step S103, failure information corresponding to the process is not registered in the failure management information 43a, 53a, 63a (No in step S103), or in step S105, failure management information 43a, 53a , 63a (No in step S105), the process management units 45, 55, 65 restart the process in which the occurrence of the failure is detected ( Step S107), this restart process is terminated.

Also, the processing procedure of the restart processing performed by the process management units 45, 55, and 65 upon receiving the failure information is the same as the processing procedure described with reference to FIG.

That is, as shown in FIG. 5, the fault information communication units 44, 54 and 64 receive fault information transmitted by the other fault information communication units 44, 54 and 64 (step S201).

The process management units 45, 55, and 65 acquire fault information from the fault information communication units 44, 54, and 64, refer to the fault management information 43a, 53a, and 63a, respectively, and detect faults corresponding to the fault information. A process of acquiring information and affected target information from the failure management information 43a, 53a, 63a is performed (step S202).

Then, the process management units 45, 55 and 65 determine whether fault information corresponding to the fault information acquired from the fault information communication units 44, 54 and 64 is registered in the respective fault management information 43a, 53a and 63a. is determined (step S203).

If failure information corresponding to the failure information acquired from the failure information communication units 44, 54, and 64 is registered in the failure management information 43a, 53a, and 63a (Yes in step S203), the process management units 45, 55, 65 instructs the failure information communication units 44, 54 and 64 to transmit the failure information to the other failure information communication units 44, 54 and 64 (step S204).

After that, the process management units 45, 55 and 65 determine whether affected information corresponding to the fault information acquired from the fault information communication units 44, 54 and 64 is registered in the respective fault management information 43a, 53a and 63a. (step S205).

If affected target information corresponding to the failure information acquired from the failure information communication units 44, 54, and 64 is registered in the failure management information 43a, 53a, and 63a (Yes in step S205), the process management units 45 and 55 , 65 restarts the affected object registered in the affected object information, and terminates this restart processing. (Step S206).

If the fault management information 43a, 53a, 63a registers the fault information corresponding to the affected process to be restarted, the process management units 45, 55, and 65, the fault information communication unit 44, 54, 64 to transmit the fault information to other fault information communication units 44, 54, 64, and if the affected object information corresponding to the process is registered, it is registered in the affected object information. reboot the affected target.

Further, in step S203, if failure information corresponding to the failure information acquired from the failure information communication units 44, 54, and 64 is not registered in the failure management information 43a, 53a, and 63a (No in step S203), Alternatively, in step S205, if the affected target information corresponding to the failure information acquired from the failure information communication units 44, 54, and 64 is not registered in the failure management information 43a, 53a, and 63a (No in step S205). , this restart processing ends.

As described above, in the second embodiment, the fault information storage unit 43 stores external fault information corresponding to the first fault information in the first container 50 or the second fault information in the second container 60. , information about the first failure or information about the second failure, and information about the affected object, and information about the first failure or the information about the second failure. When the fault information communication unit 44 receives the information, the process management unit 45 refers to the fault management information 43a and restarts the target affected by the first fault or the target affected by the second fault corresponding to the external fault information. I decided to

As a result, it is possible to autonomously recover from a failure, taking into consideration the dependencies between processes in the container.

Also, in the second embodiment, the logically divided two groups are containers.

As a result, recovery from failures can be performed autonomously even if there is a dependency between processes in the container.

(Embodiment 3)
FIG. 10 is a diagram showing an example of the configuration of a computer system according to Embodiment 3. As shown in FIG. The computer system described below is, for example, a system mounted on a vehicle. As shown in FIG. 10, this computer system includes a hypervisor 70, a management VM 80, a meter VM 90, and an IVI (In-Vehicle Information) VM 100. FIG.

The hypervisor 70 is a control unit that logically divides one computer into a management VM 80, a meter VM 90, and an IVI VM 100 and operates them as three independent virtual machines. The management VM 80, the meter VM 90, and the IVI VM 100 are virtual machines generated in this manner.

Although the number of virtual machines operating on the hypervisor 10 is 3 and the number of containers is 1 here, the number may be at least 1 or more.

The hypervisor 70 includes a VM monitoring unit 71 , a failure information storage unit 72 , a failure information communication unit 73 and a VM management unit 74 .

Functions of the VM monitoring unit 71, the failure information communication unit 73, and the VM management unit 74 are realized by the processor. Also, the function of the fault information storage unit 72 is implemented by a storage device such as a memory.

The VM monitoring unit 71 monitors failures of virtual machines operating in each of the management VM 80 , meter VM 90 and IVI VM 100 . For example, the VM monitoring unit 71 receives a notification indicating that a failure has occurred in a VM from the VM monitoring response unit 83 of the management VM 80, the VM monitoring response unit 93 of the meter VM 90, or the VM monitoring response unit 104 of the IVI VM 100, The occurrence of the failure is notified to the VM management unit 74, which will be described later.

Alternatively, the VM monitoring unit 71 sends a heartbeat message to the VM monitoring response units 83, 93, and 104, and notifies the VM management response units 83, 93, and 104 that a failure has occurred in the VMs of the VM monitoring response units 83, 93, and 104 that do not respond. The unit 74 may be notified.

The fault information storage unit 72 stores fault management information 72a in which information on faults occurring in virtual machine process groups in the management VM 80, the meter VM 90, and the IVI VM 100 is associated with and registered with information on targets affected by the fault. Remember.

FIG. 11 is a diagram showing an example of the fault management information 72a. The failure management information 72a includes VM information, failure information, and affected target information.

The VM information is identification information of virtual machines running in the computer system. The failure information is information about failures occurring in those virtual machines. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET" in the fault information is information indicating whether the fault occurred in a virtual machine (VM), container, or process. “VM” is identification information indicating a failed virtual machine.

For example, VM information "management VM" is registered in association with failure information "TARGET: VM, VM: MANAGER" and affected target information "SYS_RESET".

This indicates that when a failure occurs in the virtual machine process group of the "management VM", the entire computer system must be restarted due to the occurrence of the failure.

Further, the VM information "meter VM" is registered in association with the failure information "TARGET: VM, VM: METER" and the affected target information "IVI VM".

This failure information and affected information indicate that the virtual machine process group in the IVI VM 100 needs to be restarted when a failure occurs in the virtual machine process group in the meter VM 90 .

Returning to the description of FIG. 10 , the failure information communication unit 73 includes the failure information communication unit 85 of the management VM 80 , the failure information communication unit 95 of the meter VM 90 , the failure information communication unit 106 of the IVI VM 100 , and the failure information communication unit of the container 110 . Communicates with unit 114 .

For example, when a failure occurs in a virtual machine process group in the management VM 80, the meter VM 90, or the IVI VM 100, the failure information communication unit 73 transmits the failure information shown in FIG. 11 corresponding to the failed virtual machine. , to virtual machines other than the failed virtual machine.

Failure information communication unit 73 also receives failure information transmitted from failure information communication unit 85 , failure information communication unit 95 , failure information communication unit 106 , or failure information communication unit 114 .

The VM management unit 74 manages the management VM 80, the meter VM 90, and the IVI VM 100. For example, the VM management unit 74 detects that a failure has occurred in the process group of the management VM 80, the meter VM 90, or the IVI VM 100 from the notification from the VM monitoring unit 71. FIG.

Further, the VM management unit 74 transmits a restart request message by receiving a restart request message from the process management unit 86 of the management VM 80, the process management unit 96 of the meter VM 90, or the process management unit 107 of the IVI VM 100. Detects that a failure has occurred in the process group of the VM that has been executed.

Then, the VM management unit 74 refers to the failure management information 72a and acquires failure information and affected target information registered in association with the failed VM. For example, if the failed VM is a "meter VM", the VM management unit 74 acquires failure information "TARGET: VM, VM: METER" and affected target information "IVI VM".

After that, the VM management unit 74 sends the failure information to the management VM 80, the meter VM 90, the IVI VM 100, and the container 110 when failure information is registered, such as the VM of "meter VM". The communication unit 73 is instructed.

In addition, the VM management unit 74 restarts the registered affected target when the affected target information is registered, such as the VM of the “meter VM”. Furthermore, the VM management unit 74 restarts the process group of the failed VM.

Here, as shown in FIG. 11 , when “IVI VM” is registered as the affected target information, the VM management unit 74 also stores failure information corresponding to the VM of “IVI VM” as the management VM 80, the meter VM 90, the IVI The failure information communication unit 73 is instructed to transmit to the VM 100 and the container 110 .

In addition, since the affected target information corresponding to the VM of "IVI VM" is not registered, the VM management unit 74 does not restart the process group of the VM.

Furthermore, when the failure information communication unit 73 receives failure information from the management VM 80, the meter VM 90, the IVI VM 100, and the container 110, the VM management unit 74 acquires the failure information and converts the failure information into failure management information. 72a or not.

Then, when the failure information corresponds to the failure information included in the failure management information 72a, the VM management unit 74 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the failure information is registered, the VM management unit 74 restarts the registered affected target.

A management VM 80 in which a process group including processes 81a to 81n is executed includes a process monitoring unit 82, a VM monitoring response unit 83, a fault information storage unit 84, a fault information communication unit 85, and a process management unit 86. The management VM 80 is a virtual machine that manages vehicles. The process monitoring unit 82, the VM monitoring response unit 83, the fault information communication unit 85, and the process management unit 86 may each be implemented as individual processes, but they are implemented as a single process having their respective roles. can be

Functions of the process monitoring unit 82, the VM monitoring response unit 83, the fault information communication unit 85, and the process management unit 86 are realized by the processor. Also, the function of the fault information storage unit 84 is implemented by a storage device such as a memory.

The process monitoring unit 82 monitors faults occurring in the process group including the processes 81a to 81n. For example, the process monitoring unit 82 transmits heartbeat messages of the processes 81a to 81n, and notifies the process management unit 86, which will be described later, of the processes with no response.

The VM monitoring response unit 83 transmits a heartbeat message to the virtual machine of the management VM 80, and if there is no response, notifies the VM monitoring unit 71 of the hypervisor 70 that a failure has occurred in the process group of the virtual machine. .

The failure information storage unit 84 stores failure management information 84a in which information about failures that occur in a process group including the processes 81a to 81n and information about targets affected by the failures are associated and registered.

FIG. 12 is a diagram showing an example of the failure management information 84a. The fault management information 84a includes process information, fault information, and affected target information.

The process information includes information indicating processes executed in the management VM 80 and processes executed outside the management VM 80 . In addition, in the example of FIG. 12, the latter information is not registered. The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

Returning to the explanation of FIG. 10 , the fault information communication section 85 communicates with the fault information communication section 73 , the fault information communication section 95 , the fault information communication section 106 and the fault information communication section 114 .

For example, when a failure occurs in the processes 81a to 81n in the management VM 80, the failure information communication unit 85 sends failure information corresponding to the failed process to the failure information communication unit 73, the failure information communication unit 95, and the failure information communication unit 73 section 106 and failure information communication section 114 .

Further, failure information communication unit 85 receives failure information transmitted from failure information communication unit 73 , failure information communication unit 95 , failure information communication unit 106 , or failure information communication unit 114 .

The process management unit 86 manages processes 81a to 81n in the management VM 80. FIG. For example, the process management unit 86 detects from the notification from the process monitoring unit 82 that a failure has occurred in the processes 81a to 81n. Also, the process management unit 86 detects that a failure has occurred in the processes 81a to 81n by receiving failure messages from the processes 81a to 81n.

Then, the process management unit 86 refers to the failure management information 84a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

After that, when the fault information is registered, the process management section 86 transmits the fault information to the fault information communication section 73, the fault information communication section 95, the fault information communication section 106, and the fault information communication section 114. The failure information communication unit 85 is instructed.

Further, when the affected object information is registered, the process management unit 86 restarts the registered affected object. Furthermore, the process management unit 86 restarts the failed process.

Furthermore, when the fault information communication unit 85 receives fault information from the fault information communication unit 73, the fault information communication unit 95, the fault information communication unit 106, or the fault information communication unit 114, the process management unit 86 Information is acquired, and it is determined whether or not the failure information corresponds to the failure information included in the failure management information 84a.

Then, when the fault information corresponds to the fault information included in the fault management information 84a, the process management unit 86 determines whether or not the affected information corresponding to the fault information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 86 restarts the registered affected target.

In the example of the fault management information 84a shown in FIG. 12, since fault information and affected target information are not registered, the process management unit 86 restarts only the faulty process.

A meter VM 90 in which a process group including processes 91 a to 91 m is executed includes a process monitoring section 92 , a VM monitoring response section 93 , a fault information storage section 94 , a fault information communication section 95 and a process management section 96 . The meter VM 90 is a virtual machine that displays a driver's seat digital meter, navigation information, and the like. The process monitoring unit 92, the VM monitoring response unit 93, the fault information communication unit 95, and the process management unit 96 may each be implemented as individual processes, but they are implemented as a single process having their respective roles. can be

The functions of the process monitoring unit 92, the VM monitoring response unit 93, the fault information communication unit 95, and the process management unit 96 are realized by the processor. Also, the function of the fault information storage unit 94 is implemented by a storage device such as a memory.

The process monitoring unit 92 monitors failures occurring in the process group including the processes 91a to 91m. For example, the process monitoring unit 92 transmits heartbeat messages to the processes 91a to 91m, and notifies the process management unit 96, which will be described later, of the processes that do not respond.

The VM monitoring response unit 93 transmits a heartbeat message to the virtual machine of the meter VM 90, and if there is no response, notifies the VM monitoring unit 71 of the hypervisor 70 that a failure has occurred in the process group of the virtual machine. .

The fault information storage unit 94 stores fault management information 94a registered in association with information on faults occurring in a process group including the processes 91a to 91m and information on targets affected by the faults.

FIG. 13 is a diagram showing an example of the fault management information 94a. The fault management information 94a includes process information, fault information, and affected object information.

The process information includes information indicating a process executed in the meter VM 90 and a process executed outside the meter VM 90 . The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "VM", "CONTAINER", and "PROC" in the failure information correspond to "TARGET", "VM", "CONTAINER" in the failure management information 23a, 43a shown in FIGS. ”, and “PROC”.

Returning to the explanation of FIG. 10 , the fault information communication section 95 communicates with the fault information communication section 73 , the fault information communication section 85 , the fault information communication section 106 and the fault information communication section 114 .

For example, when a failure occurs in the processes 91a to 91m in the meter VM 90, the failure information communication unit 95 sends failure information corresponding to the failed process to the failure information communication unit 73, the failure information communication unit 85, and the failure information communication unit 73 section 106 and failure information communication section 114 .

Further, failure information communication unit 95 receives failure information transmitted from failure information communication unit 73 , failure information communication unit 85 , failure information communication unit 106 , or failure information communication unit 114 .

A process management unit 96 manages processes 91 a to 91 m in the meter VM 90 . For example, the process management unit 96 detects from the notification from the process monitoring unit 92 that a failure has occurred in the processes 91a to 91m. Also, the process management unit 96 detects that a failure has occurred in the processes 91a to 91m by receiving failure messages from the processes 91a to 91m.

Then, the process management unit 96 refers to the failure management information 94a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 13, if the failed process is "PROCESS21", the process management unit acquires the failure information "TARGET: PROC, VM: METER, CONTAINER: -, PROC: PROCESS21".

After that, the process management unit 96 sends the failure information to the failure information communication unit 73, the failure information communication unit 85, the failure information communication unit 106, and The failure information communication unit 95 is instructed to transmit to the failure information communication unit 114 .

Further, when the affected object information is registered, the process management unit 96 restarts the registered affected object. Furthermore, the process management unit 96 restarts the failed process.

Here, as shown in FIG. 13, when "PROCESS22" is registered as the affected object information, the process management section 96 sends fault information corresponding to the process "PROCESS22" to the fault information communication section 73. The failure information communication unit 95 is instructed to transmit to the unit 85 , the failure information communication unit 106 , and the failure information communication unit 114 .

Since the affected object information corresponding to the process of "PROCESS22" is not registered, the process management unit 96 does not restart the process.

Furthermore, when the fault information communication unit 95 receives fault information from the fault information communication unit 73, the fault information communication unit 85, the fault information communication unit 106, or the fault information communication unit 114, the process management unit 96 Information is acquired, and it is determined whether or not the failure information corresponds to the failure information included in the failure management information 94a.

Then, when the failure information corresponds to the failure information included in the failure management information 94a, the process management unit 96 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the failure information is registered, the process management unit 96 restarts the registered affected target.

In addition, the IVI VM 100 in which processes 101a to 101l and a process group including the container management process 102 are executed includes a process monitoring unit 103, a VM monitoring response unit 104, a failure information storage unit 105, a failure information communication unit 106, a process management A unit 107 and a container 110 are provided. The process monitoring unit 103, the VM monitoring response unit 104, the fault information communication unit 106, and the process management unit 107 may each be implemented as individual processes, but they are implemented as a single process having their respective roles. can be

The IVI VM 100 is a virtual machine that not only displays navigation, audio, and vehicle information, but also functions to link with smartphones and the like. A container management process 102 is a process for managing the container 110 .

Functions other than the process monitoring unit 103, the VM monitoring response unit 104, the failure information communication unit 106, the process management unit 107, and the failure information storage unit 113 of the container 110 are realized by the processor. Also, the functions of the failure information storage unit 105 and the failure information storage unit 113 are implemented by a storage device such as a memory.

The process monitoring unit 103 monitors faults that occur in the processes 101 a to 101 l and the process group including the container management process 102 . For example, the process monitoring unit 103 sends heartbeat messages to the processes 101a to 101l and the container management process 102, and notifies the process management unit 107, which will be described later, of processes that do not respond.

The VM monitoring response unit 104 transmits a heartbeat message to the virtual machine of the IVI VM 100, and if there is no response, notifies the VM monitoring unit 71 of the hypervisor 70 that a failure has occurred in the process group of the virtual machine. .

The fault information storage unit 105 stores fault management information 105a in which information on faults that occur in a process group including the processes 101a to 101l and the container management process 102 is associated with information on targets affected by the faults and registered. do.

FIG. 14 is a diagram showing an example of the failure management information 105a. The fault management information 105a includes process information, fault information, and affected target information.

The process information includes identification information of processes executed in the IVI VM 100 and information indicating that the processes are executed outside the IVI VM 100 . The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "VM", "CONTAINER", and "PROC" in the failure information correspond to "TARGET", "VM", "CONTAINER" in the failure management information 23a, 43a shown in FIGS. ”, and “PROC”.

Returning to the description of FIG. 10 , failure information communication section 106 communicates with failure information communication section 73 , failure information communication section 85 , failure information communication section 95 , and failure information communication section 114 .

For example, when a failure occurs in the processes 101a to 101l in the IVI VM 100 or in the container management process 102, the failure information communication unit 106 sends failure information corresponding to the failed process to the failure information communication unit 73. It is transmitted to the communication unit 85 , the failure information communication unit 95 , and the failure information communication unit 114 .

Failure information communication unit 106 also receives failure information transmitted from failure information communication unit 73 , failure information communication unit 85 , failure information communication unit 95 , or failure information communication unit 114 .

The process management unit 107 manages the processes 101 a to 101 l in the IVI VM 100 and the container management process 102 . For example, the process management unit 107 detects from the notification from the process monitoring unit 103 that the processes 101a to 101l or the container management process 102 has failed.

Also, the process management unit 107 detects that a failure has occurred in the processes 101a to 101l or the container management process 102 by receiving a failure message from the processes 101a to 101l or the container management process 102 .

Then, the process management unit 107 refers to the failure management information 105a, and acquires failure information and affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 14, if the process in which the failure occurred is the container management process 102 "CONTAINER1_MNG_PROCESS", the process management unit 107 acquires the failure information "TARGET: CONTAINER, VM: IVI, CONTAINER: 1". do.

After that, when failure information is registered as in the process of "CONTAINER1_MNG_PROCESS", the process management unit 107 sends the failure information to the failure information communication unit 73, the failure information communication unit 85, the failure information communication unit 95, and the The failure information communication unit 106 is instructed to transmit to the failure information communication unit 114 .

Further, when the influence target information is registered, the process management unit 107 restarts the registered influence target. Furthermore, the process management unit 107 restarts the failed process.

Here, as shown in FIG. 14, when "PROCESS32" is registered as the affected object information, the process management unit 107 sends fault information corresponding to the process "PROCESS32" to the fault information communication unit 73. The failure information communication unit 106 is instructed to transmit to the unit 85 , the failure information communication unit 95 , and the failure information communication unit 114 .

Since the affected object information corresponding to the process of "PROCESS32" is not registered, the process management unit 107 does not restart the process.

Furthermore, when the failure information communication unit 106 receives failure information from the failure information communication unit 73, the failure information communication unit 85, the failure information communication unit 95, or the failure information communication unit 114, the process management unit 107 Information is acquired, and it is determined whether or not the failure information corresponds to the failure information included in the failure management information 105a.

Then, when the failure information corresponds to the failure information included in the failure management information 105a, the process management unit 107 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 107 restarts the registered affected target.

For example, it is assumed that the failure information communication unit 106 receives information "TARGET: PROC, VM: METER, CONTAINER: -, PROC: PROCESS21" from the failure information communication unit 95 as failure information.

In this case, this fault information corresponds to the fault information (external fault information) of "EXTERNAL_ERROR" shown in the fourth from the top of the fault management information 105a shown in FIG. restart the affected process "PROCESS31".

Here, since failure information is not registered in "PROCESS 31", failure information is not transmitted to failure information communication section 73, failure information communication section 85, failure information communication section 95, and failure information communication section 114. FIG.

In addition, since the affected object information corresponding to the process "PROCESS31" is not registered, the process management unit 107 does not restart the process.

A container 110 in which a process group including processes 111a to 111k is executed includes a process monitoring unit 112, a failure information storage unit 113, a failure information communication unit 114, and a process management unit 115. FIG. The process monitoring unit 112, the fault information communication unit 114, and the process management unit 115 may be implemented as separate processes, or may be implemented as a single process having their respective roles.

Functions of the process monitoring unit 112, the fault information communication unit 114, and the process management unit 115 are realized by the processor. Also, the function of the failure information storage unit 113 is implemented by a storage device such as a memory.

The process monitoring unit 112 monitors failures occurring in a process group including the processes 111a to 111k. For example, the process monitoring unit 112 transmits heartbeat messages to the processes 111a to 111k, and notifies the process management unit 115, which will be described later, of processes that do not respond.

The failure information storage unit 113 stores failure management information 113a in which information about failures that occur in a process group including the processes 111a to 111k and information about targets affected by the failures are associated and registered.

FIG. 15 is a diagram showing an example of the failure management information 113a. The fault management information 113a includes process information, fault information, and affected target information.

The process information includes identification information of the process executed in the container 110 and information indicating that the process is executed outside the container 110 . The failure information is information on failures of those processes. The affected target information is information about the target that will be affected when the failure occurs.

"TARGET", "VM", "CONTAINER", and "PROC" in the failure information correspond to "TARGET", "VM", "CONTAINER" in the failure management information 23a, 43a shown in FIGS. ”, and “PROC”.

Here, the third process information "EXTERNAL_ERROR" from the top in FIG. PROCESS41" is registered in association with the affected target information.

This indicates that when a failure occurs in the process "PROCESS22" of the meter VM 90, it is necessary to restart the process "PROCESS41" due to the occurrence of the failure.

Returning to the description of FIG. 10, the fault information communication section 114 communicates with the fault information communication section 73, the fault information communication section 85, the fault information communication section 95, and the fault information communication section .

For example, when a failure occurs in the processes 111a to 111k in the container 110, the failure information communication unit 114 sends the failure information shown in FIG. 85 , failure information communication unit 95 , and failure information communication unit 106 .

Further, failure information communication section 114 receives failure information transmitted from failure information communication section 73 , failure information communication section 85 , failure information communication section 95 , or failure information communication section 106 .

The process manager 115 manages the processes 111a-111k in the container 110. FIG. For example, the process management unit 115 detects from the notification from the process monitoring unit 112 that a failure has occurred in the processes 111a to 111k.

Also, the process management unit 115 detects that a failure has occurred in the processes 111a to 111k by receiving failure messages from the processes 111a to 111k.

Then, the process management unit 115 refers to the failure management information 113a and acquires the failure information and the affected target information registered in association with the process in which the failure occurred.

For example, in the example of FIG. 15, if the failed process is "PROCESS41", the process management unit 115 generates failure information "TARGET: PROC, VM: IVI, CONTAINER: 1, PROC: PROCESS41" and Acquire the affected object information "PROCESS42".

After that, the process management unit 115 sends the failure information to the failure information communication unit 73, the failure information communication unit 85, the failure information communication unit 95, and The failure information communication unit 114 is instructed to transmit to the failure information communication unit 106 .

In addition, the process management unit 115 restarts the registered affected object when the affected object information is registered like the process of "PROCESS42". Furthermore, the process management unit 115 restarts the failed process.

Further, when a process is registered as affected information, the process management unit 115 also sends fault information corresponding to the process to the fault information communication unit 73, the fault information communication unit 85, the fault information communication unit 95, and the fault information The failure information communication unit 114 is instructed to transmit to the communication unit 106 .

Furthermore, when the fault information communication unit 114 receives fault information from the fault information communication unit 85, the fault information communication unit 95, or the fault information communication unit 106, the process management unit 115 acquires the fault information, It is determined whether or not the failure information corresponds to the failure information included in the failure management information 113a.

Then, when the failure information corresponds to the failure information included in the failure management information 113a, the process management unit 115 determines whether or not the affected information corresponding to the failure information is registered.

If affected target information corresponding to the fault information is registered, the process management unit 115 restarts the registered affected target.

For example, it is assumed that the failure information communication unit 114 receives the information "TARGET: PROC, VM: METER, CONTAINER: -, PROC: PROCESS22" from the failure information communication unit 95 as failure information.

In this case, this fault information corresponds to the fault information (external fault information) of "EXTERNAL_ERROR" shown third from the top of the fault management information 113a shown in FIG. restart the affected process "PROCESS41".

Here, since the failure information is registered in "PROCESS 41", the process management unit 115 sends the failure information to the failure information communication unit 73, the failure information communication unit 85, the failure information communication unit 95, and the failure information The failure information communication unit 114 is instructed to transmit to the communication unit 106, and the process of "PROCESS42" registered as the affected information is restarted.

Since the failure information and affected target information corresponding to the process of "PROCESS42" are not registered, the process management unit 115 does not issue an instruction to send failure information or restart the process.

Next, an example of a procedure of restart processing performed by the hypervisor 70 will be described. FIG. 16 is a flowchart illustrating an example of a procedure of restart processing performed by the hypervisor 70. As illustrated in FIG.

As illustrated in FIG. 16 , the VM management unit 74 detects that a failure has occurred in each VM by a notification from the VM monitoring unit 71 or by a restart request message received from each VM (step S301). .

Next, the VM management unit 74 refers to the failure management information 72a, and based on the information of the failed VM acquired from the VM monitoring unit 71, the VM management unit 74 updates the failure information and the affected target information corresponding to the VM. A process of acquiring from the management information 72a is performed (step S302).

Then, the VM management unit 74 determines whether or not failure information corresponding to the VM is registered in the failure management information 72a (step S303).

If failure information corresponding to the VM is registered in the failure management information 72a (Yes in step S303), the VM management unit 74 instructs the failure information communication unit 73 to send the failure information to failure information communication. It is transmitted to the unit 85, the failure information communication unit 95, the failure information communication unit 106, and the failure information communication unit 114 (step S304).

After that, the VM management unit 74 determines whether the affected target information corresponding to the VM is registered in the fault management information 72a (step S305).

If the affected target information corresponding to the VM is registered in the fault management information 72a (Yes in step S305), the VM management unit 74 restarts the affected target registered in the affected target information ( step S306).

Note that if the failure management information 72a registers failure information corresponding to the affected VM to be restarted, the VM management unit 74 instructs the failure information communication unit 73 to transmit the failure information. If the affected target information corresponding to the VM is registered, the affected target information Restart the affected targets registered in the .

Furthermore, the VM management unit 74 restarts the VM in which the occurrence of the failure has been detected (step S307), and terminates this restart processing.

In step S303, if the fault information corresponding to the VM is not registered in the fault management information 72a (No in step S303), or if the fault management information 72a corresponds to the VM in step S305 If the affected target information is not registered (No in step S305), the VM management unit 74 restarts the VM in which the occurrence of the failure is detected (step S307), and terminates this restart processing.

The processing procedure of restart processing performed by the process management units 86, 96, 107, and 115 (hereinafter simply referred to as management units) upon detection of a process failure is the same as the processing procedure described with reference to FIG. .

That is, as shown in FIG. 4, the process monitoring units 82, 92, 103, and 112 detect failures in the processes they manage and notify the management units of the failure detection (step S101).

Subsequently, the management unit refers to the failure management information 84a, 94a, 105a, and 113a (hereinafter simply referred to as failure management information) and, based on the information on the process in which the failure occurred, responds to the process. A process of acquiring the failure information and the affected object information from the failure management information is performed (step S102).

Then, the management unit determines whether fault information corresponding to the process is registered in the fault management information (step S103).

If the failure information corresponding to the process is registered in the failure management information (Yes in step S103), the management unit will be referred to as failure information communication units 85, 95, 106, and 114 (hereinafter simply referred to as failure information communication units). ) to transmit the fault information to another fault information communication unit (step S104).

After that, the management unit determines whether or not affected object information corresponding to the process is registered in each failure management information (step S105).

If the affected object information corresponding to the process is registered in the fault management information (Yes in step S105), the management unit restarts the affected object registered in the affected object information (step S106). .

If fault information corresponding to the affected process to be restarted is registered in the fault management information, the management section instructs the fault information communication section to replace the fault information with other fault information. If the affected object information corresponding to the process is registered, the affected object registered in the affected object information is restarted.

Furthermore, the management unit restarts the process in which the occurrence of the failure has been detected (step S107), and terminates this restart processing.

Further, in step S103, if the failure information corresponding to the process is not registered in the failure management information (No in step S103), or in step S105, the affected object corresponding to the process in the failure management information If the information is not registered (No in step S105), the management unit restarts the process in which the occurrence of the failure is detected (step S107), and terminates this restart processing.

Further, the procedure of restart processing performed by the VM management unit 74 and the process management units 86, 96, 107, and 115 (hereinafter simply referred to as management units) upon receiving fault information is the processing procedure described with reference to FIG. is similar to

That is, as shown in FIG. 5, failure information communication units 73, 85, 95, 106, and 114 (hereinafter simply referred to as failure information communication units) communicate the VMs or processes transmitted by other failure information communication units. Failure information about failure is received (step S201).

Then, the management unit acquires the failure information from the failure information communication unit, refers to each of the failure management information 72a, 84a, 94a, 105a, and 113a (hereinafter simply referred to as failure management information), and from the failure management information (step S202).

Then, the management unit determines whether or not failure information corresponding to the VM or process is registered in each failure management information (step S203).

If failure information corresponding to the VM or process is registered in the failure management information (Yes in step S203), the management unit instructs the failure information communication unit to transmit the failure information to another failure information communication. department (step S204).

After that, the management unit determines whether or not affected target information corresponding to the VM or process is registered in each failure management information (step S205).

If affected target information corresponding to the VM or process is registered in the failure management information (Yes in step S205), the management unit restarts the affected target registered in the affected target information, and restarts the affected target. Finish the reboot process. (Step S206).

If fault information corresponding to the affected VM or process to be restarted is registered in the fault management information, the management unit instructs the fault information communication unit to send the fault information to another machine. If it is transmitted to the failure information communication unit and affected target information corresponding to the VM or process is registered, the affected target registered in the affected target information is restarted.

Further, in step S203, if failure information corresponding to the VM or process is not registered in the failure management information (No in step S203), or in step S205, if the VM or process is registered in the failure management information If the corresponding affected target information is not registered (No in step S205), this restart processing ends.

As described above, in the third embodiment, at least one of a plurality of logically divided groups is a virtual machine or container operating on a hypervisor.

As a result, even if there is a dependency relationship between the virtual machine process and the container process, recovery from a failure can be performed autonomously.

In addition, in the failure management information described in the first to third embodiments, it is preferable that the information held as the affected object information is limited to the managed objects of the own group, except for "SYS_RESET" for restarting the system.

In other words, even if the processes of other groups are affected, the information of the affected objects is managed by the fault management information of the other groups. This is to maintain loose coupling as software.

Further, the information registered in the failure management information may be exchanged by communication between logically divided groups when the computer system is started.

For example, in the computer system of FIG. 1, when a failure occurs in the first VM 20, there is a possibility that the following round trip of failure information will occur.

(1) Fault information A is transmitted from the first VM 20 to the second VM 30 .
(2) Based on the failure information A, the process is restarted in the second VM 40 and the failure information B is sent to the first VM 20 .
(3) Based on the failure information B, the process is restarted in the first VM 20 and the failure information C is sent to the second VM 30 .

By exchanging the information registered in the failure management information among the groups in advance, it is possible to detect in advance the affected target for which the back and forth of the failure information occurs as described above. Then, when the first failure occurs, the affected object is restarted, and by omitting the failure information transmission process shown in step S204 of FIG.

In addition, information "SYS_RESET" was registered in the affected object information of the fault management information 72a shown in FIG. 11 in order to restart the entire computer system, but FIGS. Information "VM_RESET" may be registered in the affected target information managed by each VM shown in .

This "VM_RESET" is information for the VM to restart itself. For example, a VM restarts itself by sending a restart request message to the hypervisor 10,70.

Further, information "CONTAINER_RESET" may be registered in the influence target information managed by each container shown in FIGS.

This "CONTAINER_RESET" is information for the container to restart itself. For example, a container restarts itself by sending a restart request message to the container management processes 41a, 41b, 102. FIG.

Alternatively, the process management units 55, 65, and 115 of each container voluntarily perform termination processing to cause the container management processes 41a, 41b, and 102 to detect failures in the respective containers, and cause the container management processes 41a, 41b, and 102 to Each container may be restarted.

Further, in the first to third embodiments, as an example in which the failure information received from the first group corresponds to the failure information in the failure management information of the second group, the case where the failure information matches is described. However, it is not necessarily limited to that if the failure information corresponds.

For example, assume that the second group has received failure information "TARGET: VM, VM: IVI" as failure information. This failure information is information indicating that a failure has occurred in the IVI VM 100 shown in FIG.

In this case, since the IVI VM 100 will be restarted, in the failure management information of each group, the failure information in which the VM is "IVI" all correspond to the failure information "TARGET: VM, VM: IVI". is judged to be

For example, in the fault management information 113a shown in FIG. 15, the fault information "TARGET:PROC, VM:IVI, CONTAINER:-, PROC:PROCESS32" corresponding to the fourth process information "EXTERNAL_ERROR" from the top is " The subsequent processing is executed as corresponding to the failure information "TARGET: VM, VM: IVI".

In addition, the above-described embodiments are merely examples of specific implementations of the present disclosure, and the technical scope of the present disclosure should not be construed to be limited by these. That is, the disclosure may be embodied in various forms without departing from its spirit or key features.

The technology of the present disclosure can be used for computer systems and restart programs.

10 hypervisor 20 first VM
21a-21n, 31a-31m, 40a-40l, 51a-51n, 61a-61m, 81a-81n, 91a-91m, 101a-101l, 111a-111k process 22, 32, 42, 52, 62, 82, 92, 103, 112 Process monitoring unit 23, 33, 43, 53, 63, 72, 84, 94, 105, 113 Fault information storage unit 23a, 33a, 43a, 53a, 63a, 72a, 84a, 94a, 105a, 113a Fault management Information 24, 34, 44, 54, 64, 73, 85, 95, 106, 114 Fault information communication unit 25, 35, 45, 55, 65, 86, 96, 107, 115 Process management unit 30 Second VM
41a, 41b, 102 container management process 71 VM monitoring unit 74 VM management unit

Claims (11)

A first fault information storage unit for storing first fault management information including information on a first fault occurring in a first process group operating in a first group logically separated from a second group When,
storing second failure management information in which second external failure information corresponding to the information of the first failure and information affected by the first failure in the second group are registered in association with each other; a second failure information storage unit;
a first process management unit for transmitting information of the first failure to a first failure information communication unit when the first failure is detected;
When the second failure information communication unit receives the information of the first failure, the affected target of the first failure corresponding to the second external failure information by referring to the second failure management information. a second process manager that restarts the
A computer system comprising further comprising a first process monitoring unit for monitoring a heartbeat of the first process group, the first process monitoring unit notifying the first process management unit of heartbeat monitoring result information; 2. The computer system according to claim 1, wherein said first process manager detects said first failure based on a notification from said first process monitor. The first failure management information further includes first external failure information corresponding to a second failure that occurs in a second process group operating in the second group, and a target affected by the second failure. is registered in association with the information of
the second failure management information further includes information about the second failure;
The second process management unit causes the second failure information communication unit to transmit information on the second failure when the second failure is detected,
When the first failure information communication unit receives the second failure information, the first process management unit refers to the first failure management information and changes the information to the first external failure information. 3. The computer system according to claim 1, wherein the affected target of the corresponding second failure is restarted. 4. The computer system according to claim 1, wherein at least one of said first group and said second group is a container. when the first group and the second group are the containers,
third external fault information corresponding to the first fault information or the second fault information occurring in the second process group operating in the second group; a third failure information storage unit that stores third failure management information including information about a second failure and information about an affected target;
When the third failure information communication unit receives failure information of either the first failure information or the second failure information, the third failure management information is referred to, and the third failure management information is referred to. a third process management unit that restarts the target affected by the first failure or the target affected by the second failure corresponding to the external failure information;
5. The computer system according to claim 4, comprising: A third process monitoring unit for monitoring heartbeats of the process managing the first group and the process managing the second group, wherein the third process monitoring unit monitors heartbeat monitoring results. Information is notified to the third process management unit, and the third process management unit detects a failure of the process managing the first group based on the notification from the third process monitoring unit or Detecting a failure of a process managing a group, referring to the third failure management information, and managing a target affected by the detected failure of the process managing the first group or the second group 6. The computer system according to claim 5, wherein the affected object of the failure of the process to be executed is restarted. 4. The computer system according to claim 1, wherein at least one of said first group and said second group is a virtual machine running on a hypervisor. When the first group and the second group are the virtual machines,
third external fault information corresponding to the first fault information or the second fault information occurring in the second process group operating in the second group; a third failure information storage unit that stores third failure management information including information about a second failure and information about an affected target;
When the third failure information communication unit receives failure information of either the first failure information or the second failure information, the third failure management information is referred to, and the third failure management information is referred to. a VM management unit that restarts the target affected by the first failure or the target affected by the second failure corresponding to the external failure information;
8. The computer system of claim 7, comprising: further comprising a VM monitoring unit that monitors the first group and the second group, wherein the VM monitoring unit notifies the VM management unit of information on monitoring results of the first group and the second group; and the VM management unit detects a failure in the first group or the second group based on the notification from the VM monitoring unit, refers to the third failure management information, and detects the detected failure. 9. The computer system according to claim 8, wherein the failure-affected objects of the first group or the failure-affected objects of the second group are restarted. 10. The computer system according to claim 9, wherein said third fault information storage unit, said VM monitoring unit, and said VM management unit operate on a hypervisor. first fault management including information on said first fault when a first fault occurring in a first process group operating in a first group logically separated from a second group is detected; a procedure of reading the information of the first failure from the first failure information storage unit storing the information and transmitting the information to the first failure information communication unit;
Acquiring the information of the first failure from the second failure information communication unit that received the information of the first failure, obtaining the second external failure information corresponding to the information of the first failure, and the second failure information reading the second failure management information from a second failure information storage unit that stores the second failure management information registered in association with the information affected by the first failure in the group of a procedure of identifying the second external failure information corresponding to the failure information of and restarting the target affected by the first failure corresponding to the identified second external failure information;
A restart program that causes the computer to run

Images