JP5625949B2 - System monitoring apparatus and system monitoring method - Google Patents

Description

  The present invention relates to a system monitoring apparatus and a system monitoring method, and more particularly to a system monitoring apparatus and a system monitoring method using a watchdog timer function.

  As a device for monitoring the normal operation of a computer system, a monitoring device using a watchdog timer function is widely adopted.

  This monitoring device, for example, implements a timer called a watch dog timer (hereinafter also referred to as WDT (Watch Dog Timer)) inside a dedicated processor (hereinafter referred to as a monitoring processor) that is independent of system operation in the system. Device.

  For example, the WDT always repeats subtraction (may be addition) of the timer value, and outputs a timeout signal when the timer value becomes 0 (may be a predetermined value), that is, when a time-out occurs. This timeout signal is output as an NMI (Non-Maskable Interrupt) signal or a reset instruction signal to the system to be monitored by the monitoring processor. When the WDT receives a signal instructing resetting, the WDT resets the timer value to a predetermined value (may be 0).

  A system monitored by such a monitoring device instructs the monitoring processor to reset the WDT at a certain time (a time sufficiently shorter than the time when WDT times out) (for example, the monitoring processor from the system side). Polling). Upon receiving this instruction, the monitoring processor outputs a signal instructing the WDT to reset. Therefore, when the system is normal, the WDT resets the timer value before timing out based on a signal instructing resetting, so that the timer does not time out.

  As described above, the monitoring device using the WDT function monitors whether the system is operating normally by continuously updating the WDT (resetting the timer value) and causing no timeout.

  Patent Document 1 discloses a watchdog timer control device which is an example of a monitoring device using the above-described WDT function.

  This watchdog timer control device has a temperature monitoring unit and a watchdog timer unit, and operates as follows. First, the watchdog timer unit has a counter, and the value of this counter is subtracted at regular intervals. The watchdog timer unit outputs a counter 0 detection signal when the value of the counter becomes zero. Further, the temperature monitoring unit instructs the counter initial setting command to the watch dog timer unit in synchronization with a request signal received at regular intervals from a CPU (Central Processing Unit) to be monitored.

JP 2009-205276 A

  However, in the technology described in the above-mentioned prior art documents, there is a problem that an NMI signal or a reset instruction signal is issued to a monitored system in a normal state, which may hinder system operation. There is a point.

  The reason for this is that if there is a failure on the interface that receives the timer reset instruction (counter initial setting command) or if the monitoring processor (watchdog timer control device) operates abnormally, the timer is updated (counter This is because there is a case where the initial setting) fails and the WDT times out.

  An object of the present invention is to provide a system monitoring apparatus and a system monitoring method that solve the above-described problems.

The system monitoring apparatus of the present invention includes a WDT that outputs a time-out signal when measuring a predetermined time;
An instruction receiving unit that receives a first reset timer instruction for instructing resetting of the WDT and outputs a reset timer signal to the WDT;
A reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT is transferred to the instruction receiving unit as the first reset timer instruction, and a transfer failure of the first reset timer instruction is detected. An instruction transfer unit that outputs information on the first transfer failure when
And a filter unit that prohibits transmission of the timeout signal based on the information on the first transfer failure.

In the system monitoring method of the present invention, a monitoring processor of a system monitoring apparatus including a WDT that outputs a time-out signal when measuring a predetermined time receives a first reset timer instruction that instructs resetting of the WDT, Output reset timer signal to WDT,
The system monitoring apparatus transfers a reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT to the monitoring processor as the first reset timer instruction, and the first reset timer instruction When the first transfer failure is detected, the first transfer failure information is output, and the transmission of the timeout signal is prohibited based on the first transfer failure information.

  The present invention has an effect that it is possible to prevent a system operation from being hindered due to a time-out of WDT even though the system to be monitored is in a normal state.

It is a block diagram which shows the structure of the system monitoring apparatus which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the system in the 1st thru | or 4th embodiment of this invention. It is a block diagram which shows the structure of the filter part of the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the instruction transfer part of the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the monitoring processor of the 1st Embodiment of this invention. It is a block diagram which shows the structure of the system monitoring apparatus which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the filter part of the 2nd Embodiment of this invention. It is a flowchart which shows operation | movement of the instruction | indication transfer part of the 2nd Embodiment of this invention, and a transfer alternative part. It is a flowchart which shows operation | movement of the monitoring processor of the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the system monitoring apparatus which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows operation | movement of the monitoring processor of the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the system monitoring apparatus which concerns on the 4th Embodiment of this invention.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a system monitoring apparatus 100 according to the first embodiment of the present invention.

  Referring to FIG. 1, the system monitoring apparatus 100 according to the present embodiment includes an instruction transfer unit 130, a filter unit 170, and a monitoring processor 500.

  FIG. 2 is a block diagram showing a system configuration including the system monitoring apparatus 100 and the computer system 101 that is the monitoring target of the system monitoring apparatus 100. Referring to FIG. 2, the computer system 101 includes a reset timer instruction issuing unit 102 and a system control controller 103.

  The system monitoring apparatus 100 may be included in the computer system 101, and the instruction transfer unit 130 and the filter unit 170 may be included in the system control controller 103 of the computer system 101.

  In the system monitoring apparatus 100, the instruction transfer unit 130 receives a reset timer instruction 600 that is issued from the reset timer instruction issuing unit 102 and instructs to reset the time measurement of the WDT 550. Subsequently, the instruction transfer unit 130 transfers the received reset timer instruction 600 to the instruction reception unit 530 as the first reset timer instruction 601. When the instruction transfer unit 130 detects that the transfer of the reset timer instruction 601 has failed, the instruction transfer unit 130 outputs a filter-on signal 621 (also referred to as first transfer failure information).

  The interface between the instruction transfer unit 130 and the instruction reception unit 530 is, for example, an IPMI (Intelligent Platform Management Interface) KCS (Keyboard Controller Style) interface that is a standard interface for hardware monitoring.

  The filter unit 170 prohibits transmission (passing) of the timeout signal 611 based on the filter-on signal 621 output from the instruction transfer unit 130. Note that the filter unit 170 outputs a timeout signal 612 based on the timeout signal 611 when the transmission of the timeout signal 611 is not prohibited. The time-out signal 611 and the time-out signal 612 indicate that a time-out has occurred, for example, with “logic 1”. That is, outputting the timeout signal 611 and outputting the timeout signal 612 means that the timeout signal 611 is set to “logic 1” and the timeout signal 612 is set to “logic 1”, respectively. Note that the timeout signal 611 and the timeout signal 612 may have other forms (for example, a pulse).

  The monitoring processor 500 includes an instruction receiving unit 530 and a WDT 550.

  The instruction receiving unit 530 receives the reset timer instruction 601 and outputs a reset timer signal 602 to the WDT 550. The reset timer signal 602 is, for example, a “logic 1” pulse. The reset timer signal may be in another form (for example, a pulse of “logic 0”).

  The WDT 550 outputs a timeout signal 611 when measuring a predetermined time (hereinafter referred to as a timeout time). In addition, when WDT 550 receives reset timer signal 602, WDT 550 resets the time count at that time and restarts the time-out time count from the beginning. The timeout time is, for example, twice the interval time (hereinafter referred to as reset timer interval time) at which the reset timer instruction issuing unit 102 issues the reset timer instruction 600. The timeout time may be any time as long as it exceeds the interval at which the reset timer signal 602 is output, taking into account fluctuations in the reset timer interval time and transfer delay of the reset timer instruction.

  In the computer system 101, the reset timer instruction issuing unit 102 issues a reset timer instruction 600 at a predetermined timing. The predetermined timing is, for example, a timing at which the computer system 101 executes processing that is periodically executed in a normal state. The execution interval of this process is the above-described reset timer interval time.

  The system controller 103 receives the time-out signal 612, and based on this, for example, reset processing and memory dump processing of the computer system 101 are started.

  FIG. 3 is a block diagram illustrating a configuration of the filter unit 170. FIG. 3 shows that the timeout signal 611 and the timeout signal 612 are “logic 1” and that a timeout has occurred, and the filter-on signal 621 (to be described later) turns the filter on when “logic 1” (that is, the timeout signal). The filter unit 170 in the case of a signal instructing that the transmission of 611 is prohibited) is shown.

  Referring to FIG. 3, the filter unit 170 includes an AND element 171 and an inverter element 172.

  The inverter element 172 inverts the logic of the filter on signal 621 and outputs the inverted signal to the AND element 171.

  The AND element 171 outputs a logical product of the inverted filter on signal 621 and the timeout signal 611 as the timeout signal 612.

  Next, the operation of the present embodiment will be described in detail with reference to FIGS.

  The timeout time of WDT 550 is 4 seconds.

  The reset timer instruction issuing unit 102 issues a reset timer instruction 600 at intervals of 2 seconds. It should be noted that the issuance interval of the reset timer instruction 600 varies even during normal operation depending on the operating state of the monitored system, but here it is assumed to be a constant interval for ease of understanding. That is the premise.

  First, a case where the system monitoring apparatus 100 is normal will be described.

  FIG. 4 is a flowchart showing the operation of the instruction transfer unit 130 of this embodiment.

  FIG. 5 is a flowchart showing the operation of the monitoring processor 500 of this embodiment.

  When the state of the computer system 101 is normal, the reset timer instruction issuing unit 102 issues a reset timer instruction 600 at intervals of 2 seconds.

  In FIG. 4, the instruction transfer unit 130 receives the reset timer instruction 600 (S701).

  Next, the instruction transfer unit 130 transmits a reset timer instruction 601 to the instruction receiving unit 530 of the monitoring processor 500 based on the received reset timer instruction 600 (S702). Specifically, for example, the instruction transfer unit 130 transmits a command including the reset timer instruction 601 to the instruction reception unit 530, and the instruction reception unit 530 transmits a reception response to the instruction transfer unit 130. To do.

  Next, the instruction transfer unit 130 waits for a reception response (S703). If the reception response is received within a predetermined time (for example, 1 millisecond) (YES in S703), the process ends.

  In FIG. 5, the instruction receiving unit 530 receives a reset timer instruction 601 and outputs a reset timer signal 602 to the WDT 550 based on the reset timer instruction 601 (S711).

  Next, the WDT 550 receives the reset timer signal 602 and resets the time measurement based on the reset timer signal 602 (S712). Then, the WDT 550 starts counting the timeout time from the beginning.

  When the computer system 101 and the system monitoring apparatus 100 are normal, the above process is repeated.

  When the state of the computer system 101 is abnormal (for example, the program runs away and is in a stalled state), the reset timer instruction issuing unit 102 does not issue the reset timer instruction 600. Accordingly, the instruction receiving unit 530 does not output the reset timer signal 602.

  For this reason, the WDT 550 continues timing without resetting the timing. As a result, the timed time reaches the timeout time (4 seconds). When the timed time reaches the timeout time, the WDT 550 sets the timeout signal 611 to “logic 1”.

  Next, the filter unit 170 receives a timeout signal 611 of “logic 1”. At this time, the filter on signal 621 is “logic 0 (the filter on signal 621 is not output)”. Accordingly, the filter unit 170 performs a logical product with the signal “logic 1” obtained by inverting the filter ON signal 621 of “logic 0”, and sets the timeout signal 612 to “logic 1” (outputs the timeout signal 612).

  Next, a case where a failure occurs anywhere from the instruction transfer unit 130 to the instruction receiving unit 530 will be described.

  The state of the computer system 101 is normal, and the reset timer instruction issuing unit 102 issues a reset timer instruction 600 at intervals of 2 seconds.

  Next, the instruction transfer unit 130 receives the reset timer instruction 600 (S701), and based on this, transmits the reset timer instruction 601 to the instruction receiving unit 530 of the monitoring processor 500 (S702).

  Next, the instruction transfer unit 130 waits for a reception response (S703). However, due to the above-described failure, the instruction receiving unit 530 cannot receive a command including the reset timer instruction 601 and does not transmit a reception response.

  When the reception response is not received within a predetermined time (for example, 1 millisecond) (NO in S703), the instruction transfer unit 130 detects that the transfer of the reset timer instruction 601 has failed (S704). .

  Next, the instruction transfer unit 130 sets the filter-on signal 621 to “logic 1” based on the detection of the transfer failure of the reset timer instruction 601 (S705).

  The filter unit 170 prohibits the transmission of the timeout signal 611 based on the input “logic 1” filter-on signal 621.

  On the other hand, the instruction receiving unit 530 does not output the reset timer signal 602 because it cannot receive the reset timer instruction 601.

  For this reason, the WDT 550 continues timing without resetting the timing. As a result, the timekeeping time reaches the timeout time. When the timed time reaches the timeout time (4 seconds), the WDT 550 sets the timeout signal 611 to “logic 1”.

  Next, the filter unit 170 receives the time-out signal 611 of “logic 1”, takes a logical product with a “logic 0” signal obtained by inverting the filter-on signal 621 of “logic 1”, and the time-out signal 612 is logically It remains “0” (the timeout signal 612 is not output).

  The above is the description of the operation of the present embodiment.

  The instruction transfer unit 130 sets the filter on signal 621 to “logic 0” (first transfer success information) when the transfer of the reset timer instruction 601 is successful in the state where the filter on signal 621 is set to “logic 1”. May also be called). That is, the instruction transfer unit 130 may permit transmission of the timeout signal 611 when a failure that has occurred in any of the instruction transfer unit 130 to the instruction reception unit 530 is recovered.

  Further, the instruction transfer unit 130 may prohibit transmission of the timeout signal 611 when the transfer has failed n (n is a natural number) times or more. In this case, the timeout time is not less than n times the reset timer interval time.

  The first effect of the present embodiment described above is that it is possible to prevent a time-out of the WDT 550 from occurring even if the monitored system is in a normal state, thereby hindering system operation. Is a point.

  This is because the instruction transfer unit 130 detects the transfer failure of the reset timer instruction 601 and the filter unit 170 prohibits the transmission of the timeout signal 611 based on the transfer failure information.

  The 2nd effect in this embodiment mentioned above is that the period when the monitoring function by the system monitoring apparatus 100 is not effective can be shortened.

  The reason is that the instruction transfer unit 130 allows the transmission of the timeout signal 611 when the transfer of the reset timer instruction 601 is successful.

[Second Embodiment]
Next, a second embodiment of the present invention will be described in detail with reference to the drawings. Hereinafter, the description overlapping with the above description is omitted as long as the description of the present embodiment is not obscured.

  FIG. 6 is a block diagram showing the configuration of the system monitoring apparatus 200 according to the second embodiment of the present invention.

  Referring to FIG. 6, the system monitoring apparatus 200 according to the present embodiment includes an instruction transfer unit 230, a transfer substitution unit 240, a filter unit 270, and a monitoring processor 502.

  In the following description, FIG. 2 includes the system monitoring apparatus 200 of the present embodiment and the computer system 101 that is the monitoring target of the system monitoring apparatus 200 by replacing the system monitoring apparatus 100 in the figure with the system monitoring apparatus 200. Refer to it as a block diagram showing the system configuration.

  In addition to the function of the instruction transfer unit 130 of the first embodiment, the instruction transfer unit 230 of the system monitoring apparatus 200, when the transfer of the reset timer instruction 601 fails, uses a reset timer instruction (first operation) instead of the reset timer instruction 601. 2, which is also referred to as a reset timer instruction 2), is output to the transfer replacement unit 240.

  The transfer substitution unit 240 transfers the reset timer instruction 604 to the substitution instruction receiving unit 540 based on the substitution instruction 603. Further, when the transfer substitution unit 240 detects that the transfer of the reset timer instruction 604 has failed, it outputs a filter-on signal 622 (also referred to as second transfer failure information). The interface between the transfer substitution unit 240 and the substitution instruction reception unit 540 is, for example, IPMI Over Lan that performs control by IPMI via a LAN (Local Area Network).

  The filter unit 270 prohibits transmission of the timeout signal 611 based on the first transfer failure information detected by the instruction transfer unit 230 and the second transfer failure information output by the transfer substitution unit 240.

  The monitoring processor 502 further includes an alternative instruction receiving unit 540 and the operation of the WDT 550 is different from that of the monitoring processor 500 of the first embodiment.

  The substitute instruction receiving unit 540 receives the reset timer instruction 604 and outputs a reset timer signal 605 to the WDT 550. The reset timer signal 605 is, for example, a “logic 1” pulse. The reset timer signal may be in another form (for example, a pulse of “logic 0”).

  When the WDT 550 receives the reset timer signal 602 or the reset timer signal 605, the WDT 550 resets the time measurement time at that time, and restarts the time-out time measurement from the beginning. This point is different from the WDT 550 of the first embodiment.

  FIG. 7 is a block diagram illustrating a configuration of the filter unit 270. In FIG. 7, the timeout signal 611, the timeout signal 612, and the filter on signal 621 are the same as those of the first embodiment, and a filter on signal 622 (to be described later) instructs to turn on the filter with “logic 1”. In this case, the filter unit 270 is shown.

  Referring to FIG. 7, the filter unit 270 includes an AND element 171 and a NAND element 273.

  The NAND element 273 outputs a signal obtained by inverting the logical product of the filter ON signal 621 and the filter ON signal 622 to the AND element 171.

  The AND element 171 outputs a logical product of the output of the NAND element 273 and the timeout signal 611 as the timeout signal 612.

  Next, the operation of the present embodiment will be described in detail with reference to FIGS. The premise is the same as that in the first embodiment.

  First, the operation when the system monitoring apparatus 200 is normal is the same as the operation described in the first embodiment.

  Next, a case where a failure has occurred anywhere between the instruction transfer unit 230 and the instruction reception unit 530 will be described.

  FIG. 8 is a flowchart showing the operations of the instruction transfer unit 230 and the transfer alternative unit 240 of this embodiment. The operations in S701 to S705 are the same as the operations described in the first embodiment.

  FIG. 9 is a flowchart showing the operation of the monitoring processor 502 of this embodiment.

  In FIG. 8, the instruction transfer unit 230 outputs an alternative instruction 603 based on the detection of the transfer failure of the reset timer instruction 601 (S721).

  Note that the filter unit 270 receives the “logic 1” filter-on signal 621 in step S705. However, the filter unit 270 does not prohibit transmission of the timeout signal 611 because the filter-on signal 622 is “logic 0”.

  On the other hand, the instruction receiving unit 530 does not output the reset timer signal 602 because it cannot receive the reset timer instruction 601.

  Next, the transfer substitution unit 240 transmits a reset timer instruction 604 to the substitution instruction receiving unit 540 based on the substitution instruction 603 (S722). Specifically, the transmission of the reset timer instruction 604 is performed by, for example, the transfer substitution unit 240 sending a command including the reset timer instruction 604 to the substitution instruction receiving unit 540, and the substitution instruction receiving unit 540 receiving a response to the transfer substitution unit 240. Send.

  Next, the transfer substitution unit 240 waits for a reception response (S723). If the reception response is received within a predetermined time (for example, 2 milliseconds) (YES in S723), the process ends.

  In FIG. 9, the substitute instruction receiving unit 540 receives the reset timer instruction 604 and outputs a reset timer signal 605 to the WDT 550 based on the reset timer instruction 604 (S731).

  Next, the WDT 550 receives the reset timer signal 605 and resets the time measurement based on the reset timer signal 605 (S732). Then, the WDT 550 starts counting the timeout time from the beginning.

  Next, when a failure occurs between any of the above-described instruction transfer unit 230 and the instruction reception unit 530, and further when a failure occurs between any of the transfer substitution unit 240 and the substitution instruction reception unit 540 Will be described.

  The transfer substitution unit 240 transmits a reset timer instruction 604 to the substitution instruction receiving unit 540 based on the substitution instruction 603 (S722).

  Next, the transfer substitution unit 240 waits for a reception response (S723). However, due to the above-described failure, the substitute instruction receiving unit 540 cannot receive a command including the reset timer instruction 604 and does not transmit a reception response.

  When the reception response is not received within a predetermined time (for example, 1 millisecond) (NO in S703), the transfer substitution unit 240 detects that the transfer of the reset timer instruction 604 has failed (S724). .

  Next, the transfer substitution unit 240 sets the filter-on signal 622 to “logic 1” based on the detection of the transfer failure of the reset timer instruction 601 (S725).

  On the other hand, the substitute instruction receiving unit 540 does not receive the reset timer instruction 604 and does not output the reset timer signal 602. Further, as described above, the instruction receiving unit 530 does not receive the reset timer instruction 601 and therefore does not output the reset timer signal 602.

  For this reason, the WDT 550 continues timing without resetting the timing. As a result, the timekeeping time reaches the timeout time. When the timed time reaches the timeout time (4 seconds), the WDT 550 sets the timeout signal 611 to “logic 1”.

  Next, the filter unit 270 receives the “logic 1” timeout signal 611, but inverts the logical product of the “logic 1” filter on signal 621 and the “logic 1” filter on signal 622 to “logic”. The logical product of the “0” signal is obtained, and the timeout signal 612 remains at the logic “0” (the timeout signal 612 is not output).

  The above is the description of the operation of the present embodiment.

  When the transfer of the reset timer instruction 604 is successful in the state where the filter on signal 622 is set to “logic 1”, the transfer substitution unit 240 sets the filter on signal 622 to “logic 0” (second transfer success information). May also be called). That is, the transfer substitution unit 240 may permit the transmission of the timeout signal 611 when a failure that has occurred in any of the transfer substitution unit 240 to the substitution instruction reception unit 540 is recovered.

  In addition, the instruction transfer unit 230 may prohibit the transmission of the timeout signal 611 and issue an alternative instruction 603 when the transfer fails n (n is a natural number) times or more. Further, the transfer substitution unit 240 may prohibit the transmission of the timeout signal 611 when the transfer fails n (n is a natural number) times or more. In this case, the timeout time is not less than n times the reset timer interval time.

  The first effect of the present embodiment described above is that, in addition to the effect of the first embodiment, even if a failure occurs in any of the instruction transfer unit 230 to the instruction reception unit 530, the monitoring of the system monitoring apparatus 200 is performed. The point is that it is possible to keep the function valid.

  The reason is that, when the instruction transfer unit 230 fails to transfer the reset timer instruction 601, the transfer substitution unit 240 transfers the reset timer instruction 604.

  The second effect of the present embodiment described above is that the period during which the monitoring function by the system monitoring apparatus 200 is not valid can be further shortened.

This is because the transfer substitution unit 240 sets the filter-on signal 622 to “logic 0” when the transfer of the reset timer instruction 604 is successful.

[Third Embodiment]
Next, a third embodiment of the present invention will be described in detail with reference to the drawings. Hereinafter, the description overlapping with the above description is omitted as long as the description of the present embodiment is not obscured.

  FIG. 10 is a block diagram showing a configuration of a system monitoring apparatus 300 according to the third embodiment of the present invention.

  Referring to FIG. 10, the system monitoring apparatus 300 according to the present embodiment includes an instruction transfer unit 130, a filter unit 170, and a monitoring processor 503.

  In the following description, FIG. 2 includes the system monitoring apparatus 300 of this embodiment and the computer system 101 that is the monitoring target of the system monitoring apparatus 300 by replacing the system monitoring apparatus 100 in the drawing with the system monitoring apparatus 300. Refer to it as a block diagram showing the system configuration.

The instruction transfer unit 130 of the system monitoring apparatus 300 is the same as the instruction transfer unit 130 of the first embodiment. Further, in this embodiment, the instruction transfer unit 130 sets the filter-on signal 621 to “logic 0” when the transfer of the reset timer instruction 601 is successful in a state where the filter-on signal 621 is set to “logic 1”. That is, the instruction transfer unit 130 permits transmission of the timeout signal 611 when a failure that has occurred in any of the instruction transfer unit 130 to the instruction reception unit 530 is recovered.
The filter unit 170 of the system monitoring apparatus 300 is the same as the filter unit 170 of the first embodiment.

  The monitoring processor 503 includes an instruction receiving unit 530, a WDT 550, a determination unit 510, an occurrence history storage unit 520, and a self-initialization unit 590.

  The instruction receiving unit 530 and the WDT 550 are the same as the instruction receiving unit 530 and the WDT 550 of the first embodiment.

  The occurrence history storage unit 520 stores whether or not the timeout signal 611 is generated. The occurrence history storage unit 520 stores no occurrence of timeout in the initial state of the system monitoring apparatus 300 (for example, immediately after the system monitoring apparatus 300 is turned on).

  The determination unit 510 receives the timeout signal 611 and outputs the timeout signal 613 when the occurrence history storage unit 520 stores the occurrence of the timeout signal 611. Further, when the occurrence history storage unit 520 stores the occurrence of the timeout signal 611, the determination unit 510 records the occurrence of the timeout signal 611 in the occurrence history storage unit 520 and outputs the self-initialization signal 614. .

  When the self-initialization unit 590 receives the self-initialization signal 614, the self-initialization unit 590 resets the monitoring processor 503 itself except for the occurrence history storage unit 520.

  Next, the operation of this embodiment will be described in detail with reference to FIGS. The present embodiment is different from the first embodiment in that a determination unit 510, an occurrence history storage unit 520, and a self-initialization unit 590 are added, and operations related to the added portion are different. In the following, this different operation will be mainly described.

  FIG. 11 is a flowchart showing the operation of the monitoring processor 503 when the WDT 550 sets the timeout signal 611 to “logic 1”.

  First, the determination unit 510 detects that the timeout signal 611 has become “logic 1” (S741).

  Next, the determination unit 510 checks whether or not the occurrence history storage unit 520 stores the occurrence of timeout (S742).

  When the occurrence history storage unit 520 stores no occurrence of timeout (NO in S742), the determination unit 510 records the occurrence of timeout in the occurrence history storage unit 520 (S743). Subsequently, the determination unit 510 outputs a self-initialization signal 614 to the self-initialization unit 590 (S744).

  When the occurrence history storage unit 520 stores the occurrence of timeout (YES in S742), the determination unit 510 outputs the timeout signal 613 to the filter unit 170 (S745). The effect of the present embodiment described above is that the failure of the monitoring processor 503 can be automatically recovered in addition to the effect of the first embodiment.

  The reason is that when the first timeout occurs, the determination unit 510 outputs a self-initialization signal 614 to the self-initialization unit 590, and the self-initialization unit 590 initializes the monitoring processor 503. is there.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described in detail with reference to the drawings. Hereinafter, the description overlapping with the above description is omitted as long as the description of the present embodiment is not obscured.

  FIG. 12 is a block diagram showing a configuration of a system monitoring apparatus 400 according to the fourth embodiment of the present invention.

  Referring to FIG. 12, the system monitoring apparatus 400 according to the present embodiment includes an instruction transfer unit 230, a transfer substitution unit 240, a filter unit 270, and a monitoring processor 504.

  In the system monitoring apparatus 400 of this embodiment, the instruction receiving unit 530 of the monitoring processor 502 is replaced with the instruction receiving unit 534 of the monitoring processor 504, compared to the system monitoring apparatus 200 of the second embodiment.

  Upon receiving the reset timer signal 605, the instruction receiving unit 534 resets itself.

  The effect of the present embodiment described above is that the failure of the instruction receiving unit 530 can be automatically recovered in addition to the effect of the second embodiment.

  The reason is that when the instruction receiving unit 534 receives the reset timer signal 605, it resets itself.

  The above-described embodiments may be arbitrarily combined.

  Embodiments combining the above-described embodiments and arbitrary embodiments can provide a system monitoring apparatus and a system monitoring method suitable for a system that requires high availability. The reason is that the transfer substitution unit prevents the WDT time-out due to a single failure (failure of transfer of the reset timer instruction 601), and the filter unit prevents the WDT time-out due to the failure of the system monitoring device from affecting the system. It is.

  These embodiments also reduce system downtime and system downtime due to reduced maintenance intervention. The reason is that the determination unit and the self-initialization unit self-recover the monitoring processor, and the substitute instruction receiving unit and the instruction receiving unit self-recover the instruction receiving unit.

  Each component described in each of the above embodiments does not necessarily have to be individually independent. For example, in each component, a plurality of components may be realized as one module, or one component may be realized as a plurality of modules. Each component is configured such that a component is a part of another component, or a part of a component overlaps a part of another component. Also good.

  Further, in each of the embodiments described above, a plurality of operations are described in order in the form of a flowchart, but the described order does not limit the order in which the plurality of operations are executed. For this reason, when each embodiment is implemented, the order of the plurality of operations can be changed within a range that does not hinder the contents.

  Furthermore, in each embodiment described above, a plurality of operations are not limited to being executed at different timings. For example, another operation may occur during the execution of a certain operation, or the execution timing of a certain operation and another operation may partially or entirely overlap.

  Furthermore, in each of the embodiments described above, a certain operation is described as a trigger for another operation, but the description does not limit all relationships between the certain operation and the other operations. For this reason, when each embodiment is implemented, the relationship between the plurality of operations can be changed within a range that does not hinder the contents. The specific description of each operation of each component does not limit each operation of each component. For this reason, each specific operation | movement of each component may be changed in the range which does not cause trouble with respect to a functional, performance, and other characteristic in implementing each embodiment.

  Each component in each embodiment described above may be realized by hardware, software, or a mixture of hardware and software, if necessary. May be.

  Further, the physical configuration of each component is not limited to the description of the above embodiment, and may exist independently, may exist in combination, or may be configured separately. May be.

A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.
(Appendix 1)
A watchdog timer (WDT, WatchDog Timer) that outputs a time-out signal when measuring a predetermined time;
An instruction receiving unit that receives a first reset timer instruction for instructing resetting of the WDT and outputs a reset timer signal to the WDT;
A reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT is transferred to the instruction receiving unit as the first reset timer instruction, and a transfer failure of the first reset timer instruction is detected. An instruction transfer unit that outputs information on the first transfer failure when
A filter unit for prohibiting transmission of the timeout signal based on the information on the first transfer failure;
A system monitoring device.
(Appendix 2)
The instruction transfer unit outputs information on the first transfer success when the transfer success of the first reset timer instruction is detected,
The filter unit permits transmission of the timeout signal based on the first transfer success information;
The system monitoring apparatus according to claim 1, wherein
(Appendix 3)
The monitoring processor further includes an alternative instruction receiving unit that receives a second reset timer instruction that instructs to reset the WDT and outputs a reset timer signal to the WDT,
The instruction transfer unit outputs a substitute instruction for instructing a substitute transfer of the second reset timer instruction instead of the first reset timer instruction when a transfer failure of the first reset timer instruction is detected. And
Based on the substitution instruction, the second reset timer instruction is transferred to the substitution instruction receiving unit, and a second transfer failure information is output when a transfer failure of the second reset timer instruction is detected. Further including an alternative part,
The filter unit prohibits transmission of the timeout signal based on the information on the first transfer failure and the information on the second transfer failure.
The system monitoring apparatus according to appendix 1 or 2, characterized in that:
(Appendix 4)
The transfer substitution unit outputs second transfer success information when detecting the transfer success of the second reset timer instruction,
The filter unit permits transmission of the timeout signal based on at least one of the first transfer success information and the second transfer success information.
The system monitoring device according to supplementary note 3, characterized by:
(Appendix 5)
The monitoring processor includes an occurrence history storage unit that stores presence / absence of occurrence of the timeout signal;
When the time-out signal is received, the time-out signal is output when the time-out signal is generated in the generation history storage unit, and the generation history storage unit stores the occurrence of the time-out signal is not stored. A determination unit that outputs a self-initialization signal when
The system monitoring apparatus according to any one of appendices 2 to 4, further comprising: a self-initialization unit that receives the self-initialization signal and resets the monitoring processor except for the occurrence history storage unit.
(Appendix 6)
The system monitoring device according to any one of appendices 3 to 5, wherein the instruction receiving unit resets the instruction receiving unit when the substitute instruction receiving unit receives a second reset timer instruction.
(Appendix 7)
A monitoring processor of a system monitoring apparatus including a WDT that outputs a timeout signal when a predetermined time is measured receives a first reset timer instruction that instructs resetting of the WDT, and outputs a reset timer signal to the WDT. ,
The system monitoring apparatus transfers a reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT to the monitoring processor as the first reset timer instruction, and the first reset timer instruction A system monitoring method that outputs information on the first transfer failure when the transfer failure is detected, and prohibits transmission of the timeout signal based on the information on the first transfer failure.
(Appendix 8)
The system monitoring device outputs first transfer success information when detecting transfer success of the first reset timer instruction, and transmits the timeout signal based on the first transfer success information. To give permission,
The system monitoring method according to appendix 7, wherein:
(Appendix 9)
The monitoring processor receives a second reset timer instruction for instructing reset of the WDT, and outputs a reset timer signal to the WDT;
The system monitoring device outputs an alternative instruction instructing an alternative transfer of the second reset timer instruction instead of the first reset timer instruction when a transfer failure of the first reset timer instruction is detected Then, based on the substitute instruction, the second reset timer instruction is transferred, and when the transfer failure of the second reset timer instruction is detected, the second transfer failure information is output, and the first The system monitoring method according to appendix 7 or 8, wherein transmission of the timeout signal is prohibited based on information on transfer failure and information on the second transfer failure.
(Appendix 10)
The system monitoring apparatus outputs second transfer success information when detecting the transfer success of the second reset timer instruction, and outputs the first transfer success information and the second transfer success information. The system monitoring method according to any one of appendices 7 to 9, wherein transmission of the timeout signal is permitted based on at least one of them.
(Appendix 11)
The monitoring processor stores whether or not the timeout signal is generated. When the timeout signal is received, the monitoring processor outputs the timeout signal when the occurrence of the timeout signal is stored. Appendix 8 to 10, wherein a self-initialization signal is output when stored, and based on the self-initialization signal, the monitoring processor itself is reset except for storage of the occurrence of the timeout signal. The system monitoring method according to any one of the above.

DESCRIPTION OF SYMBOLS 100 System monitoring apparatus 101 Computer system 102 Reset timer instruction | indication part 103 System controller 130 Instruction transfer part 170 Filter part 171 And element 172 Inverter element 200 System monitoring apparatus 230 Instruction transfer part 240 Transfer substitution part 270 Filter part 273 Nand element 300 System Monitoring device 400 System monitoring device 500 Monitoring processor 502 Monitoring processor 503 Monitoring processor 504 Monitoring processor 510 Determination unit 520 Occurrence history storage unit 530 Instruction receiving unit 534 Instruction receiving unit 540 Alternative instruction receiving unit 550 WDT
590 Self-initialization unit 600 Reset timer instruction 601 Reset timer instruction 602 Reset timer signal 603 Substitution instruction 604 Reset timer instruction 605 Reset timer signal 611 Timeout signal 612 Timeout signal 613 Timeout signal 614 Self-initialization signal 621 Filter-on signal 622 Filter-on signal

Claims (10)

A watchdog timer (WDT, WatchDog Timer) that outputs a time-out signal when measuring a predetermined time;
An instruction receiving unit that receives a first reset timer instruction for instructing resetting of the WDT and outputs a reset timer signal to the WDT;
A reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT is transferred to the instruction receiving unit as the first reset timer instruction, and a transfer failure of the first reset timer instruction is detected. An instruction transfer unit that outputs information on the first transfer failure when
A filter unit for prohibiting transmission of the timeout signal based on the information on the first transfer failure;
A system monitoring device. The instruction transfer unit outputs information on the first transfer success when the transfer success of the first reset timer instruction is detected,
The filter unit permits transmission of the timeout signal based on the first transfer success information;
The system monitoring apparatus according to claim 1. The monitoring processor further includes an alternative instruction receiving unit that receives a second reset timer instruction that instructs to reset the WDT and outputs a reset timer signal to the WDT,
The instruction transfer unit outputs a substitute instruction for instructing a substitute transfer of the second reset timer instruction instead of the first reset timer instruction when a transfer failure of the first reset timer instruction is detected. And
Based on the substitution instruction, the second reset timer instruction is transferred to the substitution instruction receiving unit, and a second transfer failure information is output when a transfer failure of the second reset timer instruction is detected. Further including an alternative part,
The filter unit prohibits transmission of the timeout signal based on the information on the first transfer failure and the information on the second transfer failure.
The system monitoring apparatus according to claim 1 or 2, characterized in that The transfer substitution unit outputs second transfer success information when detecting the transfer success of the second reset timer instruction,
The filter unit is based on at least one of the first transfer success information and the second transfer success information output when the instruction transfer unit detects the transfer success of the first reset timer instruction. Allow the transmission of the timeout signal,
The system monitoring apparatus according to claim 3. The instruction receiving unit, the alternative when the instruction receiving unit receives the second reset timer instruction, the instruction receiving unit according to claim 3 or 4 SL mounting system monitoring device, characterized in that resetting the. The monitoring processor includes an occurrence history storage unit that stores presence / absence of occurrence of the timeout signal;
When the time-out signal is received, the time-out signal is output when the time-out signal is generated in the generation history storage unit, and the generation history storage unit stores the occurrence of the time-out signal is not stored. A determination unit that outputs a self-initialization signal when
System according to any one of claims 2 to 5, wherein the further comprising a self-initialization unit that the monitoring processor receives the self-initialization signal for resetting except the occurrence history storage unit, the Monitoring device. A monitoring processor of a system monitoring apparatus including a WDT that outputs a timeout signal when a predetermined time is measured receives a first reset timer instruction that instructs resetting of the WDT, and outputs a reset timer signal to the WDT. ,
The system monitoring apparatus transfers a reset timer instruction transmitted from a reset timer instruction issuing unit included in the monitoring target of the WDT to the monitoring processor as the first reset timer instruction, and the first reset timer instruction A system monitoring method that outputs information on the first transfer failure when the transfer failure is detected, and prohibits transmission of the timeout signal based on the information on the first transfer failure. The system monitoring device outputs first transfer success information when detecting transfer success of the first reset timer instruction, and transmits the timeout signal based on the first transfer success information. To give permission,
The system monitoring method according to claim 7. The monitoring processor receives a second reset timer instruction for instructing reset of the WDT, and outputs a reset timer signal to the WDT;
The system monitoring device outputs an alternative instruction instructing an alternative transfer of the second reset timer instruction instead of the first reset timer instruction when a transfer failure of the first reset timer instruction is detected Then, based on the substitute instruction, the second reset timer instruction is transferred, and when the transfer failure of the second reset timer instruction is detected, the second transfer failure information is output, and the first Based on the transfer failure information and the second transfer failure information, the transmission of the time-out signal is prohibited, and when the transfer success of the second reset timer instruction is detected, the second transfer success information is output. The transmission of the timeout signal is permitted based on the information on the success of the first transfer and the information on the success of the second transfer. System monitoring method described. The monitoring processor stores whether or not the timeout signal is generated. When the timeout signal is received, the monitoring processor outputs the timeout signal when the occurrence of the timeout signal is stored. 9. A self-initialization signal is output when stored, and the supervisory processor is reset based on the self-initialization signal except for storing whether the time-out signal is generated or not. 9. The system monitoring method according to 9.

Images