JP3597349B2 - Storage subsystem and fault recovery method thereof - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a storage subsystem and a failure recovery technique thereof, and is particularly effective when applied to, for example, a data redundant storage subsystem which is installed in a remote location and includes a plurality of storage subsystems each having a redundant storage configuration. Technology.
[0002]
[Prior art]
In an information processing system consisting of a central processing unit and a peripheral storage device, as the amount of information has increased and the demand for reliability of data to be handled has increased, the reliability of storage media and storage devices against physical failure has been improved. As a countermeasure, a data duplication storage subsystem has been put to practical use for recovering data from backup data in the event of data loss due to a failure by holding data twice in a plurality of storage media.
[0003]
On the other hand, as individual storage subsystems, by dividing data into a plurality of storage media and arranging them, and further generating and distributing redundant data represented by parity data with some data as one unit, A RAID storage device that recovers data from redundant data and other data in the unit when a storage medium of certain data fails has been put into practical use.
[0004]
However, in systems in which information processing systems function over a wide area and many information processing systems are linked, as typified by on-line systems such as banks, these data reliability improvement technologies are not suitable. Data is stored in multiple storage subsystems in a redundant manner and redundancy is achieved.If a failure occurs in the entire storage subsystem or the entire information processing system including the central processing unit fails due to, for example, a power outage or fire in the entire building, If the system stops operating, the damage not only affects the entire system in a wide area, but also the damage caused by the data loss becomes enormous. In response to such a concern, a data duplication management system that duplicates data in a remote place has been put to practical use. However, in this remote data duplication, since the data communication between the remote information processing systems is processed by the communication function between the central processing units, the load on the central processing unit for performing data processing, arithmetic, and the like is large. Reducing the load on the processing unit has been an issue for remote data duplication systems.
[0005]
As a countermeasure against such a problem, a function for performing communication and data transfer between the control devices is provided in the storage control device between the remote information processing systems, and the control devices are connected via a communication / data transfer path. As a result, a system for reducing the load on the central processing unit by assigning a load for data duplication to the storage control device has been put to practical use. In this remote data redundant storage subsystem, an information processing system that performs a main task is defined as a primary system, and is defined as a first central processing unit, a first storage subsystem, and a first storage control device, respectively. In addition, the information processing system on the backup side is referred to as a secondary system, and is referred to as a second central processing unit, a second storage subsystem, and a second storage control device, respectively. In general, each of the first and second storage control devices includes a large-capacity cache memory (disk cache) having a nonvolatile mechanism. The first and second storage controllers are connected by one or more data transfer paths, and the relationship between the primary and secondary pair volumes is defined for each unit of data (for example, for each volume). The primary data is called master data (master volume), and the secondary data is called remote data (remote volume). In the write request (I / O) to the storage subsystem in the primary system, the write data from the first central processing unit to the first storage subsystem is written not only to the storage device under its control but also to the first storage subsystem. As a host of the second storage controller, it issues a data write I / O to the second storage subsystem to achieve data duplication. If a failure occurs on the primary system during the operation of data file duplication in this way and business cannot be continued, the business is immediately switched to the secondary system and duplication is performed. The business is continued based on the data of the second storage subsystem that has been set. An example of such a technique is the technique disclosed in US Pat. No. 5,155,845.
[0006]
When a data volume already existing on the first storage subsystem is newly defined as a remote duplex volume and a duplex pair is newly created (this is called an initial copy), the first storage control device The data of the volume of the first storage subsystem is sequentially read from the storage device to the cache memory, and the first storage control device issues a write I / O to the second storage subsystem, so that the volume data is Make a copy. One unit of data copying at this time may be one unit (track) of the data storage unit, or may be one unit of a plurality of data units (eg, cylinders). Further, the first storage subsystem can execute the I / O of the initial copy processing, and at the same time, receive the updated I / O from the first central processing unit. In updating data on a volume on which an initial copy is being executed, the first storage controller updates the update range of an area whose initial copy processing has been performed (copying to the second storage subsystem has been completed). In the case of updating, the update data is reflected on the second storage subsystem in a synchronous or asynchronous manner.
[0007]
The first and second storage subsystems may be a RAID data storage method as described below. This technology is described in D. A, Patternson, et al. "Introduction to Redundant Arrays of Inexpensive Disks (RAID)", spring COMPCON '89, pp. 146-64. 112-117, Feb. This is a technique described in a 1989 paper. In the RAID system, the storage subsystem is composed of n + m storage devices as one data storage unit, and is divided into n storage devices for each unit of data (for example, one track on a storage medium) and stored. I do. Further, redundant data called parity data is created with n data units as one group. The number of redundant data is determined according to the degree of redundancy. When the degree of redundancy is m, m pieces of redundant data are created. The redundant data itself is also stored in a storage medium different from the storage medium of the data group constituting the redundant data. A data group including the n data units and the m redundant data is called a redundancy group. As a result, even if one storage device becomes unreadable due to a failure, data can be reproduced from the other n-1 data and m redundant data in the redundancy group, and similarly, Even in the case where writing becomes impossible due to a failure, data is logically stored by updating the m pieces of redundant data. In this way, data reliability is improved in the event of a failure in a storage medium or a disk medium.
[0008]
In a conventional remote data duplication storage subsystem using a RAID system, when redundancy is lost due to a failure of a storage medium in the first storage subsystem, a failure occurs in the first storage subsystem. Using the (n-1) data and the m redundant data stored in the storage medium in the first storage subsystem other than the storage medium thus restored, the data in the storage medium in which the failure has occurred is restored and the first storage is performed again. After recording on the storage medium in the subsystem and completely restoring the redundancy and n data, the second storage subsystem and the second storage subsystem are not copied until data copying from the second storage subsystem is completed. Can be operated as a redundant system. For example, Japanese Patent Application Laid-Open No. 06-266508 discloses this type of technology.
[0009]
However, this technique will limit the RAID's ability to function as a remote data duplicate storage subsystem until complete redundancy and data recovery within the first storage subsystem is achieved.
[0010]
[Problems to be solved by the invention]
In the case of the above-described RAID system, there is a case where a logical volume and a physical volume do not correspond one-to-one (particularly, RAID5 or the like), and a plurality of logical volumes are created in a unit of creating redundant data (hereinafter referred to as an ECC group). May include volume. At this time, if a failure occurs in a plurality of physical storage media in the ECC group, the ECC group loses redundancy and access to data in the ECC group becomes impossible (blockage of the ECC group). There is a technical problem that access to data in all logical volumes in the ECC group becomes impossible due to blockage of the group.
[0011]
On the other hand, in the case where the above-described RAID system is used for the remote data redundant storage subsystem, even if one ECC group in the first storage subsystem is closed in this way, the data in the ECC group is not At the time of access, data read / write processing can be executed by accessing a physical storage medium in the second storage subsystem that duplicates the data.
[0012]
However, in this state, the read / write request from the central processing unit is processed using only the data in the second storage subsystem, and the data is not in a duplicated state. Therefore, if this state continues for a long time, a failure occurs in the second storage subsystem, and the risk of causing data loss due to the secondary system going down increases. Therefore, a process for immediately recovering the closed ECC group is required.
[0013]
Here, in order to recover the closed ECC group, the data in the physical storage medium in the second storage subsystem in which the data in the physical storage medium in which the failure has occurred is duplicated is stored in the first storage subsystem. It is necessary to perform a process of copying the data in the spare physical storage medium to restore the data and recovering the redundant data of the closed ECC group.
[0014]
However, copying all the logical volumes included in the closed ECC group requires a large amount of processing time, delays recovery of the ECC group, increases the time occupying each resource in the subsystem, and increases the central processing. The processing performance of the read / write request from the device may be degraded. Further, in the conventional remote data duplication technology, the duplication is performed in units of logical volumes, and there is no awareness of duplication of physical volumes. Therefore, the redundant data is not copied, and the redundancy of the closed ECC group cannot be restored. If the redundant data is to be recovered, all data except the redundant data in the closed ECC group is recovered to the first storage subsystem, and then the redundant data is created based on those data. You need to recover the data. This also takes time to recover the closed ECC group.
[0015]
Therefore, when a failure occurs in a plurality of storage media in the ECC group in the first storage subsystem and redundancy is lost, the ECC group is immediately reconfigured to restore data redundancy and remote data duplication. Means are needed to return to the state.
[0016]
An object of the present invention is to provide a storage subsystem capable of quickly recovering redundancy lost due to a failure in a storage subsystem having a redundant storage configuration without stopping the system, and a failure recovery technique thereof. is there.
[0017]
Another object of the present invention is to provide a storage subsystem capable of quickly recovering redundancy and a data duplication state lost due to a failure in a storage subsystem having a redundant storage configuration without stopping the system, and a failure in the storage subsystem. It is to provide a recovery technique.
[0018]
[Means for Solving the Problems]
The storage subsystem failure recovery method of the present invention comprises:
Storing a plurality of data and redundant data generated from the plurality of data in a plurality of storage media of the primary storage subsystem in a distributed manner;
Copying the plurality of data and the redundant data to the plurality of storage media of the secondary storage subsystem;
When a data failure exceeding the redundancy of the redundant data occurs in the primary storage subsystem, the normal data stored in the multiple storage media of the primary storage subsystem and the multiple data in the secondary storage subsystem Restoring the fault data from the data stored in the storage medium.
Further, the storage subsystem failure recovery method of the present invention includes:
Creating a redundancy group with the plurality of data and the redundancy data generated from the plurality of data;
Distributing and storing a plurality of data and redundant data in a plurality of storage media of the primary storage subsystem;
Copying the plurality of data and the redundant data to the plurality of storage media of the secondary storage subsystem;
When a failure exceeding the redundancy of the redundant data occurs in the storage medium of the primary storage subsystem, the data stored in the normal storage medium of the primary storage subsystem and the secondary storage corresponding to the failed storage medium Creating another redundancy group from the data copied to the storage medium of the subsystem.
Further, the storage subsystem failure recovery method of the present invention includes:
Storing a plurality of data and redundant data generated from the plurality of data in a plurality of storage media of the primary storage subsystem in a distributed manner;
Copying the plurality of data and the redundant data to the plurality of storage media of the secondary storage subsystem;
When a failure exceeding the redundancy of redundant data occurs in the redundancy group G1 including only the primary storage means of the primary storage subsystem, the primary storage means having no failure belonging to the redundancy group G1 Configuring a redundant group G2 with the secondary storage unit that holds data corresponding to the primary storage unit in which a failure has occurred;
Copying the contents held by the secondary storage means holding data corresponding to the failed primary storage means to the primary spare storage means of the primary storage subsystem; And a step of configuring a redundant group G3 between the primary storage means that has not been performed and the primary spare storage means.
Further, the storage subsystem failure recovery method of the present invention includes:
Storing a plurality of data and redundant data generated from the plurality of data in a plurality of storage media of the primary storage subsystem in a distributed manner;
Copying the plurality of data and the redundant data to the plurality of storage media of the secondary storage subsystem;
When a failure exceeding the redundancy of redundant data occurs in the redundancy group G1 including only the primary storage means of the primary storage subsystem, the primary storage means having no failure belonging to the redundancy group G1 Configuring a redundant group G2 with the secondary storage unit that holds data corresponding to the primary storage unit in which a failure has occurred;
Copying the contents held by the secondary storage means for holding data corresponding to the failed primary storage means to the primary spare storage means of the primary storage subsystem; Is greater than the number of primary spare storage means, the primary storage means belonging to the redundancy group G1 in which no failure has occurred, the primary spare storage means, and the primary storage means in which the failure has occurred. Configuring a redundant group G4 with the secondary storage means for storing data to be stored.
Further, the storage subsystem of the present invention includes storage means for holding update data in multiplex with storage means provided in another storage subsystem,
The storage unit is a storage subsystem that stores a plurality of data constituting a redundancy group and redundant data generated from the data in a distributed manner on a plurality of storage media,
When a failure exceeding the redundancy of redundant data occurs in the redundancy group G1 configured by the storage unit of the storage subsystem, a storage unit in which no failure belongs to the redundancy group G1 and a storage unit in which the failure has occurred A redundant group G2 is configured with storage means provided in another storage subsystem that holds data corresponding to.
[0019]
More specifically, as an example, in the data redundancy storage subsystem, a failure occurs in m (m> 1) storage media in the first redundant data group G1 in the primary storage subsystem, and If it becomes impossible to form a redundant data group that guarantees redundancy using only the storage medium in the storage subsystem, the secondary storage subsystem holding the duplicated data of the m failed storage media A second redundant data group G2 is configured from the storage medium of the first storage subsystem and a normal storage medium other than the failed storage medium in the first redundant data group G1 in the primary storage subsystem, and a failure occurs. Means for guaranteeing the redundancy of the data in the first redundant data group G1 and enabling processing of a read / write request from a higher-level device.
The (m-1) pieces of data in the failed storage medium are copied from the secondary storage subsystem to a spare storage medium in the primary storage subsystem to perform first redundancy. The data group G1 is reconfigured into the third redundant data group G3 to restore the data redundancy, and the remaining data in the failed storage medium is replaced with the failed first redundant data. There is provided means for restoring the data in the spare storage medium in the primary storage subsystem using the data in the data group G1 and the redundant data, and returning the data to the data duplex state.
[0020]
In addition, the data in the m storage media in which the failure occurred is restored from the secondary storage subsystem to the spare storage medium in the primary storage subsystem in units of creating a redundant data group, and Is reconfigured into a third redundant data group G3, and a read / write request from a higher-level device for the range in which the reconfiguration of the third redundant data group G3 has been completed is reconfigured. Processing is performed using the data in the third redundant data group G3, and a read / write request from a higher-level device for a range in which data has not been copied and the third redundant data group G3 has not been reconfigured is Processing is performed using the data in the above-described second redundant data group G2, and the third redundant data group G3 of the first redundant data group G1 is copied by copying the data. After completion reconfiguration, those having a means for returning the data duplication state.
[0021]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0022]
FIG. 1 is a conceptual diagram showing an example of the configuration of an information processing system including a data duplication storage subsystem configured by a storage subsystem that executes a failure recovery method according to an embodiment of the present invention. 3 and 4 are explanatory diagrams showing an example of control information used in the data duplication storage subsystem of the present embodiment, and FIG. 5 is an example of an operation of the data duplication storage subsystem of the present embodiment. FIG. 6 is a flowchart showing an example of the operation of the data duplication storage subsystem of the present embodiment. FIG. 7 is a conceptual diagram showing an example of the operation of a modification of the data redundancy storage subsystem of the present embodiment.
[0023]
The information processing system according to the present embodiment includes a central processing unit 1 and a data duplication storage subsystem including a storage control device 2, a disk device 3, a storage control device 4, and a disk device 5. The storage control device 2 of the data duplication storage subsystem is connected to the central processing unit 1 by the data transfer path 61, but the storage control device 4 is not connected to the central processing unit 1, and the storage control device 2 They are connected by a transfer path 62.
[0024]
In each of the disk device 3 and the disk device 5, a plurality of physical drives 3a (primary storage means) and a plurality of physical drives 5a (secondary storage means) are arranged, respectively. A storage configuration is used. That is, data received from the outside is divided into a plurality of data units, and redundant data (group) such as parity is generated from the data unit group. These data unit groups and corresponding redundant data (group) are The data is distributed and stored in different physical drives 3a (physical drives 5a).
[0025]
A spare physical drive 3a (SPARE-VOL) and a spare physical drive 5a (SPARE-VOL) are arranged in each of the disk device 3 and the disk device 5, and as described later, a failure occurs as necessary. Is used as a substitute for the physical drive where the error occurred.
[0026]
In the following description, the storage subsystem composed of the storage control device 2 and the disk device 3 connected to the central processing unit 1 is referred to as the primary storage subsystem, and the storage subsystem composed of the storage control device 4 and the disk device 5 is represented as the secondary storage subsystem. Side storage subsystem.
[0027]
First, an example of the configuration of the primary storage subsystem will be described.
[0028]
The channel control unit 22 has an interface function between the central processing unit 1 and the storage control unit 2 and receives an input / output request for data in the disk device 3 issued by the central processing unit 1. The host command processing unit 24 executes the request received by the channel control unit 22. The drive control unit 27 has an interface function between the storage control device 2 and the disk device 3 connected via the drive path 63, and controls data transfer between the disk device 3 and the storage control device 2.
[0029]
The control memory 25 includes a logical / physical VOL conversion table 201 for performing mutual conversion between a logical volume and a physical volume, and a pair indicating a duplex state of a volume in the primary storage subsystem and a volume in the secondary storage subsystem. A state management table 202 and a physical VOL state management table 203 are stored. These details will be described later as necessary.
[0030]
The cache memory 26 is a buffer memory for temporarily storing data when transferring data between the central processing unit 1 and the disk device 3. The physical drive failure recovery unit 28 controls recovery processing when a failure occurs in the physical drive 3a in the disk device 3. The details will be described later as necessary. The data transfer control unit 21 has an interface function between the storage control device 2 and the storage control device 4 connected via the data transfer path 62, and controls data transfer. The remote I / O control unit 23 performs a process of issuing an input / output request for data in the disk device 5.
[0031]
Next, an example of the configuration of the secondary storage subsystem will be described.
[0032]
The channel control unit 41 has an interface function between the storage control device 2 and the storage control device 4 connected via the data transfer path 62, and performs an input / output request for data in the disk device 5 issued by the storage control device 2. Accept. The host command processing unit 42 executes the request received by the channel control unit 41. The drive control unit 45 has an interface function between the storage control device 4 and the disk device 5 connected via the drive path 64, and controls data transfer between the disk device 5 and the storage control device 4. The control memory 43 stores a logical / physical VOL conversion table 401 for performing mutual conversion between a logical volume and a physical volume. The details will be described later as necessary. The cache memory 44 is a buffer memory for temporarily storing data when transferring data between the storage control device 2 and the disk device 5. The physical drive read / write processing unit 46 executes read / write processing of data in the disk device 5 for each physical drive 5a.
[0033]
Next, data duplication of the primary storage subsystem and the secondary storage subsystem will be described.
[0034]
First, the logical VOL and the physical VOL in the primary storage subsystem form a duplex pair state with the logical VOL and the physical VOL in the secondary storage subsystem, respectively. This pair status is stored in the pair status management table 202. This copy for forming a pair is called a formed copy. As for the formation copy, the formation copy control unit 29 reads the data in the disk device 3, issues a write request from the remote I / O control unit 23 to the pair VOL in the disk device 5, and writes the data, thereby duplicating the data. I am planning.
[0035]
Next, before describing the flow of data from the central processing unit 1, an outline of processing at the time of updating data in RAID5 will be described. In RAID 5, data is divided and stored by a plurality of drives. Further, a certain data unit has redundant data (hereinafter referred to as parity data). The data group of the unit for creating the parity data and the column of the parity data are called a stripe row, and the unit for creating the parity data is called an Error Correction Code group (hereinafter, referred to as an ECC group). Now, when an update request is issued for a certain data, the updated new parity data is determined from the old data before the update and the old parity data and the updated data of the stripe row, and the updated data and the new parity data are written to the drive. . This process is called a read-modify-write process.
[0036]
Next, the flow of data when a write request for data in the disk device 3 is issued from the central processing unit 1 will be described. The write request issued from the central processing unit 1 is accepted by the channel control unit 22, and the write data is stored in the cache memory 26 by the host command processing unit 24. On the other hand, the drive control unit 27 reads the old data before update of the update range in the disk device 3 and the old parity data of the stripe row, and stores them in the cache memory 26. Then, new parity data is created from the old data, old parity data, and update data stored in the cache memory 26, and the write data and the new parity data are written to the disk device 3.
[0037]
On the other hand, the remote I / O control unit 23 sends the write data in the disk device 3 and the data on the paired physical drives 5a in the disk device 5 to be duplicated to the storage control device 4 of the secondary storage subsystem. Issues a write request, and transfers the write data from the central processing unit 1. In the storage controller 4, the write request from the storage controller 2 is accepted by the channel controller 41, and the host command processing unit 42 stores the write data in the cache memory 44.
[0038]
On the other hand, the drive control unit 27 obtains new parity data from the write data, the pre-update data, and the old parity data of the stripe row, and writes the new parity data to the disk device 5 together with the write data. When all of these write processes are completed, the storage controller 2 reports the end of the write process to the central processing unit 1.
[0039]
Next, each table in the control memory 25 will be described.
[0040]
The logical / physical VOL conversion table 201 is a table for performing conversion between a logical VOL and a physical VOL, and when a read / write request is issued to a certain logical VOL from the upper level, which logical VOL corresponds to which physical VOL. Information is stored. FIG. 2 is an explanatory diagram showing an example of the configuration of the logical / physical VOL conversion table 201. The logical VOL number 201a and the physical VOL number 201b are stored in association with each other, and when a plurality of logical VOLs are set in one physical VOL, information on the used cylinder range 201c in the physical VOL is provided as necessary. Is also set. Although not particularly shown, the logical / physical VOL conversion table 401 in the control memory 43 of the secondary storage subsystem has the same configuration.
[0041]
FIG. 3 is an explanatory diagram showing an example of the contents of the pair status management table 202. This table includes a logical VOL pair status management table 2001 and a physical VOL pair status management table 2002.
[0042]
The logical VOL pair status management table 2001 stores information indicating a correspondence relationship between a logical VOL in the primary storage subsystem and a logical VOL in the secondary storage subsystem. Specifically, as an example, information such as a primary logical VOL number 2001a, a secondary logical VOL number 2001b, a pair status flag 2001c, and an effective range pointer 2001d indicating a double-completed data range in the VOL are set. You.
[0043]
The physical VOL pair status management table 2002 stores information indicating the correspondence between the physical VOL in the primary storage subsystem and the duplication of the physical VOL in the secondary storage subsystem. Specifically, as an example, information such as a primary physical VOL number 2002a, a secondary physical VOL number 2002b, a pair status flag 2002c, an effective range pointer 2002d indicating a double-completed data range in the VOL, and the like are set. You.
[0044]
The pair status flag 2001c and the pair status flag 2002c are, for example, “0”: non-duplex, “1”: duplex, “2”: under duplex configuration, “3”: primary side failure, “4”: secondary Information such as side failure is set as needed.
[0045]
FIG. 4 is an explanatory diagram showing an example of the configuration of the physical VOL status management table 203. An ECC group number 203a for identifying a plurality of ECC groups, an ECC group status flag 203b, a constituent physical VOL number 203c indicating a physical VOL group constituting the ECC group, and a state of each physical VOL constituting the ECC group And a physical VOL status flag 203d indicating the status.
[0046]
The ECC group status flag 203b is “0”: normal, “1”: collection operation disabled, “2”: collection operation in progress, “3”: collection operation using the secondary volume, “4”: SPARE-VOL recovery in progress. , "5": Information such as during the collection operation using the SPARE-VOL is set as necessary.
[0047]
The physical VOL status flag 203d is set as necessary with information such as "0": normal, "1": failure, "2": use of secondary physical VOL, "3": use of SPARE-VOL. Is done.
[0048]
Next, an operation when a failure occurs in one physical drive in one ECC group will be described. When one physical drive in one ECC group fails and a read / write request is issued from the central processing unit 1 to data in the failed drive, data and parity of a stripe row including the read / write request range A process of restoring data in a range where reading and writing are disabled due to a failure from the data and executing a read / write process is called a collection read / write process. Further, a process of restoring all data in a drive in which a failure has occurred by the collection read process and reflecting the restored data on the spare drive to reconfigure the ECC group is called a collection copy process.
[0049]
In the present embodiment, if two or more physical drives 3a have failed in one ECC group of the primary storage subsystem and the above-described collection process cannot be performed, the secondary storage subsystem An example of a method of reconstructing an ECC group using the corresponding data will be described. Hereinafter, this will be described.
[0050]
As described above, in the case of RAID 5, if a failure occurs in two or more physical drives 3a in one ECC group, the collection process becomes impossible, and data in the ECC group loses redundancy. At this time, information indicating that the ECC group is unusable (“1”: collection operation disabled) is stored in the ECC group status flag 203b of the physical VOL status management table 203. In this case, in the data duplication storage subsystem of the present embodiment, the failed ECC group in the primary storage subsystem can be reconfigured using the secondary storage subsystem, and the ECC group can be recovered. It is.
[0051]
One of the methods will be described with reference to FIG.
[0052]
First, assume that a failure has occurred in M (M> 1) physical drives 3a in a certain ECC group in the primary storage subsystem. The ECC group at this time is referred to as a first ECC group G1. First, information indicating that the ECC group cannot be used (“1”: collection operation disabled) is stored in the ECC group status flag 203b of the physical VOL status management table 203. Then, the physical drive failure recovery unit 28 replaces the physical drive 5a in the secondary storage subsystem that is paired with the failed physical drive 3a in place of the physical drive in the failed primary storage subsystem. And a second ECC group G2 as shown in FIG. When there is a write request from the central processing unit 1 for the data in the second ECC group G2, the redundant data created after the data update is performed by the parity drive (P) in the second ECC group G2 and the redundant data. Write to both parity drives (P) in one ECC group G1. As a result, it is possible to process a read / write request from the central processing unit 1 while guaranteeing the redundancy in the first and second ECC groups G2.
[0053]
By configuring the second ECC group G2 in this way, the redundancy of the data in the ECC group is guaranteed, and the read / write processing from the central processing unit 1 can be performed normally. In this state, the data (D) in the failed physical drive 3a may be restored, or the spare physical drive 3a (S) may be eventually replaced in the primary storage subsystem as shown in FIG. The used third ECC group G3 may be formed to return to the duplex state.
[0054]
Next, a method of restoring data in a failed physical drive will be described.
[0055]
When a failure occurs in the M physical drives 3a in one ECC group in the primary storage subsystem, the physical drive failure recovery unit 28 performs data recovery on the data in the (M-1) failed physical drives. By referring to the physical VOL pair status management table 2002, each physical VOL # (physical drive 5a) in the secondary storage subsystem in a duplicated pair status with the failed physical drive 3a is calculated. Then, the remote I / O control unit 23 issues a read request to the data in the physical VOL in units of the physical VOL #, and sends the data from the secondary storage subsystem to the spare volume (S) in the primary storage subsystem. To restore the data in the (M-1) physical drives 3a in which a failure has occurred. As a result, the ECC group including the failed physical drive 3a can perform a collection operation, and the ECC group status flag 203b of the physical VOL status management table 203 indicates that the ECC group is available (“5”: SPARE-VOL). (During collection operation by use) is written.
[0056]
If a read / write request is issued from the central processing unit 1 to an ECC group in the primary storage subsystem in which a collection operation cannot be performed during data copying, the second ECC group shown in FIG. As shown in G2, an ECC group including the physical drive 5a in the secondary storage subsystem paired with the failed physical drive 3a as a component is reconfigured, and data in the reconfigured ECC group is used. Process. After the data copying is completed and the collection operation is enabled in the failed ECC group, the remaining data in the failed physical drive is corrected to the primary storage by the correction copy process. The data is restored to the spare drive (S) in the subsystem. The spare volume whose data has been restored is newly registered in (the primary physical VOL number 2002a of) the physical VOL pair status management table 2002, and the physical VOL in the primary storage subsystem and the physical VOL in the secondary storage subsystem are registered. Maintain the VOL duplex pair state.
[0057]
Further, when a failure of M (M> 1) physical drives 3a occurs in one ECC group, the pair status of the logical VOL including the failed physical drive 3a in the logical VOL pair status management table 2001 is changed to the released state. In the event that the data has been restored, there may be means for automatically returning the pair status on the logical VOL pair status management table 2001 to the duplex pair status after the above data restoration. FIG. 6 is a flowchart showing the processing sequence as described above.
[0058]
If the number of failed physical drives is M (M> 1) in one ECC group, the data may be recovered by the method shown in FIG.
[0059]
That is, when a failure occurs in M physical drives 3a in one ECC group, information indicating that the ECC group is unusable (“1”: collection operation disabled) is stored in the ECC group status flag 203b of the physical VOL status management table 203. Is done. In this recovery, first, the physical drive failure recovery unit 28 refers to the physical VOL pair status management table 2002, and each physical VOL in the secondary subsystem in a duplicated pair status with the M failed physical drives 3a. # (Physical drive 5a) is calculated. Then, the remote I / O control unit 23 issues a read request for the calculated data in each physical VOL # in stripe units, and copies the data to the spare drive (S) in the primary storage subsystem. The range in which data copying has been completed is stored in the logical VOL pair status management table 2001 and the physical VOL pair status management table 2002 as pointers (valid range pointers 2001d and 2002d) indicating valid ranges. The ECC group is reconfigured in the range where the data copying is completed (ECC group G5 in FIG. 7), and a read / write request from the central processing unit 1 for the copied range is sent to the primary storage sub-unit. The system performs read-modify-write processing, and at the time of a write request, writes write data also to the secondary storage subsystem to maintain data duplication.
[0060]
On the other hand, when there is a read / write request from the central processing unit 1 for a range in which data copying has not been completed in stripe column units, the ECC group G4 shown in FIG. 5a is used as a substitute for the failed physical drive 3a). Further, when a failure of M (M> 1) physical drives 3a occurs in the ECC group, the pair status of the logical VOL including the failed physical drive 3a on the logical VOL pair status management table 2001 is changed to the released state. In the event that the data has been restored, there may be means for automatically returning the pair status on the logical VOL pair status management table 2001 to the duplex pair status after the above data restoration.
[0061]
As described above, by using the data duplex storage subsystem exemplified in the present embodiment, the physical drives 3a in one ECC group in the primary storage subsystem exceed the redundancy (this embodiment). Even if a failure occurs and the collection operation in the ECC group is disabled, normal data and physical data in the secondary storage subsystem corresponding to the data that has become unusable due to the failure. By reconfiguring the ECC group using the drive 5a, the data redundancy can be immediately restored, and the operation while maintaining the data redundancy can be continued without stopping the information processing system. The reliability of the storage subsystem performing data duplication can be improved.
[0062]
Further, data recovery in the physical drive 3a in which a failure has occurred during online processing with the central processing unit 1 is possible, and the operation efficiency and availability of the entire information processing system are improved. After data restoration, remote data duplication can be realized again.
[0063]
Although the invention made by the present inventor has been specifically described based on the embodiment, the present invention is not limited to the above embodiment, and various changes can be made without departing from the gist of the invention. Needless to say.
[0064]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to the storage subsystem of this invention and its failure recovery method, the effect that the redundancy lost by the failure in the storage subsystem of the redundant storage configuration can be quickly recovered without stopping the system is obtained. Can be
[0065]
Further, an effect is obtained that the redundancy and the data duplication state lost due to the failure in the storage subsystem having the redundant storage configuration can be quickly restored without stopping the system.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram illustrating an example of a configuration of an information processing system including a data duplication storage subsystem configured by a storage subsystem that executes a failure recovery method according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram showing an example of control information used in a data duplication storage subsystem configured by a storage subsystem that performs a failure recovery method according to an embodiment of the present invention;
FIG. 3 is an explanatory diagram showing an example of control information used in a data duplication storage subsystem configured by a storage subsystem that performs a failure recovery method according to an embodiment of the present invention;
FIG. 4 is an explanatory diagram showing an example of control information used in a data duplication storage subsystem configured by a storage subsystem that executes a failure recovery method according to an embodiment of the present invention;
FIG. 5 is a conceptual diagram illustrating an example of an operation of a data duplication storage subsystem configured by a storage subsystem that performs a failure recovery method according to an embodiment of the present invention;
FIG. 6 is a flowchart illustrating an example of an operation of a data duplication storage subsystem configured by a storage subsystem that executes a failure recovery method according to an embodiment of the present invention;
FIG. 7 is a conceptual diagram showing an example of an operation of a modified example of the data duplication storage subsystem configured by the storage subsystem that performs the failure recovery method according to the embodiment of the present invention;
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Central processing unit, 2 ... Storage control unit, 21 ... Data transfer control unit, 22 ... Channel control unit, 23 ... Remote I / O control unit, 24 ... Host command processing unit, 25 ... Control memory, 26 ... Cache memory 27, a drive control unit, 28, a physical drive failure recovery unit, 29, a formed copy control unit, 3, a disk device, 3a, a physical drive (primary storage unit), 4, a storage control device, 41, a channel control unit, 42: Host command processing unit, 43: Control memory, 44: Cache memory, 45: Drive control unit, 46: Physical drive read / write processing unit, 401: Logical / physical VOL conversion table, 5: Disk device, 5a: Physical Drive (secondary storage means), 61: data transfer path, 62: data transfer path, 63: drive path, 64: drive path, 201: Physical / physical VOL conversion table, 201a: logical VOL number, 201b: physical VOL number, 201c: range of cylinders used in physical VOL, 202: pair status management table, 2001: logical VOL pair status management table, 2001a: primary logical VOL No., 2001b: Secondary logical VOL number, 2001c: Pair status flag, 2001d: Effective range pointer, 2002: Physical VOL pair status management table, 2002a: Primary physical VOL number, 2002b: Secondary physical VOL number, 2002c: Pair Status flag, 2002d: valid range pointer, 203: physical VOL status management table, 203a: ECC group number, 203b: ECC group status flag, 203c: constituent physical VOL number, 203d: physical VOL status flag, G1 to G3: ECC glue Flop, G4~G5 ... ECC group.

Claims (5)

The data sent from the higher-level device to the target logical volume of the read / write request is distributed to a plurality of physical volumes of the primary storage subsystem as a plurality of data and redundant data generated from the plurality of data. Storing and storing;
Copying the plurality of data and the redundant data to a plurality of physical volumes of a secondary storage subsystem remote from the primary storage subsystem;
The primary storage subsystem accumulates and manages physical volume pair status management information of the secondary storage subsystem;
When a failure of data exceeding the redundancy of the redundant data occurs in the primary storage subsystem, the data is stored in a plurality of physical volumes of the secondary storage subsystem based on the physical volume pair status management information. reads certain data, create a normal data stored in the plurality of physical volumes, another redundancy group from data stored in a plurality of physical volumes of the secondary storage subsystem of the primary storage subsystem And restoring the failure data. The method comprising the data sent from the host device to the logical volume to be read-write request, and the generated redundant data from said plurality of data and a plurality of data to create a redundancy group,
Distributing and storing the plurality of data and the redundant data in a plurality of physical volumes of a primary storage subsystem;
Copying the plurality of data and the redundant data to a plurality of physical volumes of a secondary storage subsystem remote from the primary storage subsystem;
The primary storage subsystem accumulates and manages physical volume pair status management information of the secondary storage subsystem;
If a failure exceeding the redundancy of the redundant data in the physical volume of the primary storage subsystem occurs, on the basis of the physical volume pair status management information, the secondary storage subsystem corresponding to the failed physical volume read data that is copied to the physical volumes, the data stored in the normal the physical volume of the primary storage subsystem, the physical volume of the secondary storage subsystem corresponding to the failed physical volume Creating another redundancy group based on the data being duplicated. The data sent from the higher-level device to the target logical volume of the read / write request is distributed to a plurality of physical volumes of the primary storage subsystem as a plurality of data and redundant data generated from the plurality of data. Storing and storing;
Copying the plurality of data and the redundant data to a plurality of physical volumes of a secondary storage subsystem remote from the primary storage subsystem;
The primary storage subsystem accumulates and manages physical volume pair status management information of the secondary storage subsystem;
When a failure exceeding the redundancy of the redundant data occurs in the redundancy group G1 including the primary physical volumes of the primary storage subsystem, a failure occurs based on the physical volume pair status management information. the read data in the secondary physical volume, and the primary physical volume disorders belonging to the redundancy group G1 has not occurred, the data corresponding to the primary physical volume failed corresponding to the primary physical volume Configuring a redundancy group G2 with the secondary physical volume that holds
Copying the content held by the secondary physical volume holding data corresponding to the failed primary physical volume to the primary spare physical volume of the primary storage subsystem,
Wherein said primary physical volume not faulted belonging to the redundant group G1, the failure recovery method of a storage subsystem and a step of configuring the redundancy group G3 between the primary spare physical volume. Has a physical volume that holds the multiple between the physical volume included the update data to other storage subsystem that is remotely located, the management table for storing the physical volume pair status management information of said other storage subsystem And a control memory,
The physical volume receives data sent from a higher-level device to a logical volume to be a target of a read / write request, as a plurality of data constituting a redundancy group and a plurality of physical data as redundant data generated from the data. A storage subsystem that is distributed and stored in a volume ,
The storage subsystem accumulates and manages physical volume pair status management information of the other storage subsystem in the management table,
When a failure exceeding the redundancy of the redundant data occurs in the redundancy group G1 configured by the physical volumes of the storage subsystem, based on the physical volume pair status management information stored in the management table, reads data of the other storage subsystem that corresponds to the physical volume of a failure to hold the said disorder belonging to the redundant group G1 does not occur physical volumes, data corresponding to a physical volume of a failure A storage subsystem forming a redundancy group G2 with a physical volume provided in the another storage subsystem. The data sent from the higher-level device to the target logical volume of the read / write request is distributed to a plurality of physical volumes of the primary storage subsystem as a plurality of data and redundant data generated from the plurality of data. Storing and storing;
Copying the plurality of data and the redundant data to a plurality of physical volumes of a secondary storage subsystem remote from the primary storage subsystem;
The primary storage subsystem accumulates and manages physical volume pair status management information of the secondary storage subsystem;
When a failure of data exceeding the redundancy of the redundant data occurs in the primary storage subsystem, normal data stored in a plurality of physical volumes of the primary storage subsystem and the secondary storage subsystem Restoring the failed data from data stored in a plurality of physical volumes of the system.

Images