JP5913003B2 - Computer control apparatus, method and program - Google Patents

Description

  The present invention relates to a physical computer of a system in which a virtual environment is constructed on a physical computer and a technology for controlling the virtual environment.

  In applications that require high reliability such as railway operation management, power system control, and plant control, a multi-system system equipped with a standby computer that takes over the processing of the active computer when a failure occurs in the active computer Is used (see Patent Document 1).

  In the multiplex system of Patent Document 1, when a failure occurs in the active computer, a restart / stop request is issued from the standby computer that detected the failure to the active computer in order to quickly and surely switch the system to the standby computer. A method of transmitting a message has been proposed.

  By the way, at present, it is possible to construct a virtual computer (virtual environment) on a physical computer by using a technology for virtualizing the computer, and furthermore, a plurality of virtual environments on the same physical computer. It is also possible to construct An application can be executed on such a virtual environment.

  Even in such a system in which a virtual environment is constructed on a physical computer, a method has been proposed in which failure of the physical computer and the virtual environment is monitored and system switching of the computer is executed in order to achieve high availability ( Patent Document 2).

Japanese Patent No. 4487260 Japanese Patent No. 4809209

  The multiplex system of Patent Document 1 is based on a physical computer. Therefore, when multiple virtual environments are built on the physical computer, the virtual environment that exists in the standby computer from the virtual environment that exists in the active computer is triggered by a failure that occurs in each virtual environment on the physical computer. There is no means to switch the system to a computer environment. In addition, since the multiplexing system of Patent Document 1 is based on a physical computer, a restart / stop request message cannot be transmitted to the virtual environment. Therefore, when a failure occurs in the active computer, the active computer cannot be forcibly transferred to the standby system by the restart / stop request message, and both computers in the duplex system determine themselves as active. May work.

  In addition, when a plurality of virtual environments are constructed on a physical computer, there is a possibility that a communication load on a communication path is increased due to a message transmitted / received at the time of failure, and a state where communication cannot be temporarily performed may occur. Further, in a system in which a virtual environment exists, the network layers are multistage as compared with a system configured by only physical computers. For this reason, the load on the communication path becomes high at the time of a failure, and this causes an intermittent failure on the communication path.

  In this way, when an intermittent failure occurs on the communication path, in Patent Document 2, the standby virtual environment existing in the standby computer determines that a failure has occurred in the active computer, and performs system switching. End up. Then, when the communication path becomes normal after that, it is conceivable that both computers operate with their own computers determined to be active. This is not preferable in applications that require high reliability such as railway operation management, power system control, and plant control.

  An object of the present invention is to provide a technique that makes it possible to appropriately control a system in which a virtual environment is constructed on a physical computer.

  A computer control device according to an aspect of the present invention is a computer control device for a system that constructs a virtual environment on a physical computer and configures the physical computer and the virtual environment to be duplicated, and includes the physical computer and the virtual computer. Survival monitoring means that is arranged in each of the virtualized environments and both systems corresponding to the duplexing of the physical computer and the virtualized environment send and receive a survival monitoring message to each other, and the duplexing of the physical computer and the virtualized environment In the inconsistency determining means for determining whether or not there is a mismatch in which both of the corresponding systems recognize that the own system is the active system, and in the alive monitoring means, the alive monitoring message is received within a predetermined timeout period. A fault location identifying means for judging a physical computer or a virtual environment of a system corresponding to a timed-out system as a fault, and the irregularity In the determination means, if there is a mismatch, the mismatch location specifying means for determining that the physical computer or virtual environment of the system whose operation time is old as the active system is a failure, and the failure location specifying means or the mismatch If the system identified as a failure is an active system in the location specifying means, the physical computer or virtual environment of the active system is not operated as an active system by a predetermined protection process, and the corresponding standby system And a state control unit that stops the physical computer or the virtual environment of the standby system if the physical computer or the virtual environment is transitioned to the active system and the system determined to be a failure is the standby system.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to control appropriately the system which built the virtual environment on the physical computer.

It is a block diagram of the computer system by this embodiment. It is a block diagram which shows the whole structure of the computer system by a present Example. It is a block diagram which shows the whole structure of the computer system by a present Example. It is a figure which shows the physical computer and virtual environment configuration control management tables 261A and 261B in a present Example. It is a flowchart which shows process flow S401 in which the configuration control application on a physical computer and a virtual environment in a present Example transmits a survival monitoring message | telegram. It is a flowchart showing a processing flow S501 in which the physical computer and the configuration control applications 270A, 270B, 283AA, 283AB, 283BA, and 283BB in the virtual environment receive a survival monitoring message. It is a flowchart which shows process flow S601 which the physical computer / virtualization environment communication path | route monitoring part 250A, 250B in a present Example performs. It is a flowchart which shows processing flow S701 of the physical computer / virtualization environment failure location identification part 240A, 240B in a present Example. It is a flowchart which shows processing flow S801 in which the physical computer and virtualization environment restart / stop part 230A, 230B in this embodiment commands restart and stop. It is a flowchart which shows process flow S901 when the physical computer and virtualization environment restart / stop part 230A, 230B in a present Example receives the notification of restart / stop. It is a flowchart showing a processing flow S1001 executed when the physical computer / virtualized environment configuration control management unit 220A, 220B receives a notification from the physical computer / virtualized environment restart / stop unit 230A, 230B in this embodiment. It is a flowchart showing a processing flow S1101 of processing executed when the physical computer / virtualized environment configuration control management unit 220A, 220B receives a notification from the physical computer / virtualized environment communication path monitoring unit 250A, 250B in this embodiment. .

  Embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram of a computer system according to an embodiment of the present invention. Referring to FIG. 1, the computer system according to the present embodiment includes two physical computers 10A and 10B that are duplicated. The physical computer 10A and the physical computer 10B have basically the same configuration, and are paired, with one serving as an active system and the other serving as a standby system to form a duplex. In duplexing, when a failure occurs in the active system, the active system and the standby system are switched, and the standby system becomes a new active system.

  Two virtual environments 11AA and 11AB are constructed in the physical computer 10A. Similarly, two virtual environments 11BA and 11BB are also constructed in the physical computer 10B. The virtual environment 11AA of the physical computer 10A and the virtual environment 11AB of the physical computer 10B constitute a duplex, and the virtual environment 11BA of the physical computer 10A and the virtual environment 11BB of the physical computer 10B constitute a duplex.

  In addition, the physical computers 10A and 10B control the computers of the computer system in which both the physical computer and the virtual environment are duplicated, so that the survival monitoring units 12A, 12AA, 12AB, 12B, 12BA, 12BB, and the inconsistency determination unit 13A , 13B, failure location identification units 14A, 14B, mismatch location identification units 15A, 15B, and state control units 16A, 16B.

  The survival monitoring unit 12A in the physical computer 10A and the survival monitoring unit 12B in the physical computer 10B, the inconsistency determining unit 13A and the inconsistency determining unit 13B, the fault location specifying unit 14A, the fault location specifying unit 14B, and the inconsistent location specifying unit 15A The inconsistent part specifying unit 15B, the state control unit 16A, and the state control unit 16B are the same. Here, the physical computer 10A will be mainly described.

  Survival monitoring units 12A, 12AA, and 12AB are arranged in the physical computer 10A and the virtual environments 11AA and 11AB, respectively. Similarly, survival monitoring units 12B, 12BA, and 12BB are arranged in the physical computer 10B and the virtual environments 11BA and 11BB, respectively.

  In order to confirm that the physical computer 10A and the physical computer 10B, which are both systems corresponding to each other in duplication, are alive, the alive monitoring unit 12A and the alive monitoring unit 12B transmit and receive a alive monitoring message to each other. Similarly, in order to mutually confirm that the virtualization environment 11AA and the virtualization environment 11BA, which are both systems corresponding to duplication, are alive, the alive monitoring unit 12AA and the alive monitoring unit 12BA send and receive a alive monitoring message to each other. To do. Similarly, in order to mutually confirm that the virtualization environment 11AB and the virtualization environment 11BB, which are both systems corresponding to the duplex, are alive, the survival monitoring unit 12AB and the survival monitoring unit 12BB send and receive a survival monitoring message to each other. To do.

  The inconsistency determination unit 13A is configured so that both systems corresponding to each duplication, ie, the physical computer 10A and the physical computer 10B, the virtual environment 11AA and the virtual environment 11BA, and the virtual environment 11AB and the virtual environment 11BB are both own systems. It is determined whether or not there is an inconsistency that the system is recognized as active. For example, it is possible to know the recognition of the other system by including information indicating that the own system is recognized as an active system in a message transmitted and received between both systems.

  When the survival monitoring message is not received within the predetermined timeout time in the survival monitoring units 12A, 12AA, and 12AB, the failure location specifying unit 14A determines that the physical computer 10B or the virtual environment 11BA, 11BB of the system corresponding to the system. Is determined to be a failure.

  If there is a mismatch in the mismatch determination unit 13A, the mismatch location specifying unit 15A determines that the physical computer or the virtual environment of the system with the old operation start time is a failure. For example, the operating system start time of the other system can be known by including the time (the operating system start time) when the local system starts operating as an active system in a message transmitted and received by both systems.

  The state control unit 16A operates the physical computer or the virtual environment of the active system by a predetermined protection process if the system determined to be a failure by the fault location specifying unit 14A or the inconsistent location specifying unit 15A is an active system. While not operating as a system, the corresponding standby physical computer or virtual environment is transitioned to the active system. Further, if the system determined to be a failure by the failure location specifying unit 14A or the inconsistent location specifying unit 15A is a standby system, the state control unit 16A stops the physical computer or the virtual environment of the standby system. Since the fault location specifying unit 14A or the inconsistent location specifying unit 15A of the physical computer 10A specifies the fault of the other physical computer 10B or the virtual environments 11BA and 11BB constructed thereon, the state control unit 16A Instruct the other physical computer 10B or the virtual environments 11BA and 11B to perform a protection process or a process to be stopped using a message.

  As described above, according to the present embodiment, in a computer system in which a virtual environment is constructed on a physical computer and the physical computer and the virtual environment are duplicated, appropriate control is performed when a failure occurs in the physical computer or the virtual environment. Can be executed.

  For example, if the active virtual environments 11BA and 11BB are faulty, the above-described protection processing is performed by using a predetermined memory area of the virtual environments 11BA and 11BB as a memory area outside the virtual environments 11BA and 11BB. The processing may be a process of resetting the virtualization environments 11BA and 11BB after saving the data. According to this, when system switching occurs due to a failure, it is possible to acquire data that can be used to identify the cause of the failure.

  Further, for example, the inconsistent location specifying unit 15A records the time when the physical computers 10A and 10B and the virtual environments 11AA, 11AB, 11BA, and 11BB start operating as the active system as the active system start time. If there is a mismatch between the two corresponding systems, the system to be failed may be determined by referring to the operating system start time of both systems. According to this, when the state of both systems becomes inconsistent, it can be easily determined which system is the failure.

  Further, for example, the failure location specifying unit 14A sets a timeout time in advance for each of the physical computer 10A and the virtual environments 11AA and 11AB, and records the last reception time that is the time when the survival monitoring message was last received. If the time from the last reception time to the current time exceeds the timeout time, it may be determined that a timeout has occurred. According to this, it is possible to easily determine the timeout of the survival monitoring message.

  Note that each unit provided in the physical computers 10A and 10B in FIG. 1 can also be realized by causing a computer to execute a software program that defines each processing procedure.

  Next, an example that more specifically embodies the above-described embodiment will be described.

  2 and 3 are block diagrams showing the overall configuration of the computer system according to this embodiment. FIG. 2 shows an active physical computer 100A, and FIG. 3 shows a standby physical computer 100B.

  Referring to FIG. 2, the active physical computer 100A includes a memory 200A, a processor 110, a disk interface 120, and communication interfaces 130 and 131. The disk interface 120 is connected to the disk 140. The communication interface 130 is connected to the network 150, and the communication interface 131 is connected to the network 160.

  On the memory 200A, virtual environment logical partitions 281AA and 281AB, a configuration control application 270A, a physical computer / virtualized environment sharing memory partition 230A, a physical computer / virtualized environment restart / stop unit 230A, A physical computer / virtualized environment fault location identifying unit 240A, a physical computer / virtualized environment communication path monitoring unit 250A, a physical computer / virtualized environment configuration control managing unit 220A, and an OS (Operating System) 210A for the physical computer. Exists.

  Configuration control application 270A, physical computer / virtualized environment sharing memory partition 230A, physical computer / virtualized environment restart / stop unit 230A, physical computer / virtualized environment fault location identifying unit 240A, physical computer / virtualized environment The virtual environment communication path monitoring unit 250A and the physical computer / virtualized environment configuration control management unit 220A operate on the physical computer OS 210A.

  The virtual environment logical partition 281AA includes a virtual environment 282AA including a configuration control application 283AA and a virtual environment OS 284AA. Similarly, the virtual environment logical partition 281AB includes a virtual environment 282AB including a configuration control application 283AB and a virtual environment OS 284AB. The configuration control application 283AA operates on the virtual environment OS 284AA, and the configuration control application 283AB operates on the virtual environment OS 284AB.

  The standby physical computer 100B shown in FIG. 3 is the same as the active physical computer 100A shown in FIG. However, here, the virtual environments 282BA and BB exist in the virtual environment logical partitions 281BA and BB, respectively. The virtual environment 282BA includes a configuration control application 283BA and a virtual environment OS 284BA, and the virtual environment 282BB includes a configuration control application 283BB and a virtual environment OS 284BB.

  In the computer system having the above-described configuration, when a failure occurs in the active physical computer 100A, the active physical computer 100A and the standby physical computer 100B are switched, and the physical computer 100A is switched to the standby system. Thus, the physical computer 100B becomes an active system.

  The virtual environment logical partitions 281AA, 281AB and 281BA, 281BB exist on the memories 200A, 200B included in the physical computers 100A, 100B, respectively. The virtual environment A is duplicated by the active virtual environment A 282AA of the virtual environment logical partition 281AA and the standby virtual environment A 282BA of the virtual environment logical partition 281BA. Similarly, the virtual environment B is duplicated by the active virtual environment B 282AB and the standby virtual environment B 282BB.

  When a failure occurs in the active virtual environment A 282AA, the active virtual environment A 282AA and the standby virtual environment A 282BA are switched, and the virtual environment A 282AA becomes the standby system. Environment A 282BA becomes the active system.

  When a failure occurs in the active virtual environment B 282AB, the active virtual environment B 282AB and the standby virtual environment B 282BB are switched, and the virtual environment B 282AB becomes the standby system. The environment B282BB becomes the active system.

  The disk 140 connected to the disk interface 120 of each physical computer is provided with management information 141 for constructing a system and a memory dump area 142 as an area for recording data acquired by memory dump.

  In addition, the communication interface 130 included in each of the physical computers 100A and 100B is connected to the network 150, the communication interface 131 is connected to the network 160, and the communication path is duplicated by the network 150 and the network 160.

  The configuration control applications 270A and 270B existing on the OSs 210A and 210B for the respective physical computers indicate the state of the own physical computer and the time when the own physical computer transited to the active system via the duplex communication interfaces 130 and 131. Send and receive liveness monitoring messages including each other. When the state of the own physical computer is not the active system, 0 is set in the survival monitoring message as the time when the own physical computer transited to the active system. If a value other than 0 is set as the time when the physical computer transits to the active system, this indicates that the physical computer recognizes that the own system is the active system, and if 0 is set, that Indicates that the physical computer recognizes that its own system is a standby system.

  Further, the configuration control applications 283AA, 283AB, 283BA, and 283BB on the respective virtual environment OSs 284AA, 284AB, 284BA, and 284BB are communication interfaces 130 and 131 that are duplexed between the active system and the standby system for each virtual environment. Via the, a survival monitoring message including the state of the self-virtualized environment and the time when the self-virtualized environment transitions to the active system is transmitted and received. When the state of the self-virtualized environment is not the active system, 0 is set in the survival monitoring message as the time when the self-virtualized environment has transitioned to the active system. If a value other than 0 is set as the time when the virtual environment transitions to the active system, this indicates that the virtual environment recognizes that the local system is the active system, and if 0 is set. This indicates that the virtual environment recognizes that its own system is a standby system.

  Survival monitoring messages transmitted / received between both systems of the physical computer and the configuration control application of the virtual environment are acquired by the physical computer / virtual environment communication path monitoring units 250A and 250B existing in the OSs 210A and 210B for the physical computers. The Based on this, the physical computer / virtualized environment communication path monitoring units 250A, 250B, based on the transmission / reception time, the physical computers existing in the physical computer / virtualized environment sharing memory partitions 260A, 260B corresponding to the message. Update the area in the virtualization environment configuration control management table 261A, 261B that records the time (final transmission time, final reception time) at which a message was transmitted / received.

  If there is a mismatch in the survival monitoring message, the physical computer / virtualized environment restart / stop unit 230A, 230B is notified to stop the counterpart physical computer or virtualized environment. From the time when the own system in the survival monitoring message transitions to the active system, if both duplexed systems recognize that the own system is the active system, it may be determined that there is an inconsistency in the survival monitoring message.

  The physical computer / virtualized environment fault location identifying units 240A, 240B on the physical computer OSs 210A, 210B are cyclically started with the minimum value of the timeout time existing in the physical computer / virtualized environment configuration control management tables 261A, 261B. . The cyclically activated physical computer / virtualized environment fault location specifying unit 240A, 240B specifies the fault occurrence location if there is a location where the survival monitoring message is interrupted, and the fault occurrence location is a physical computer or virtual environment. Whether or not there is, the specified information is sent to the physical computer / virtualized environment restart / stop units 230A and 230B as a notification of the occurrence of a failure. Note that the minimum value of the timeout time is used here so that the occurrence of the timeout can be detected within one cycle of the timeout time regardless of the physical computer or the virtual environment. Because.

  The physical computer / virtualized environment restart / stop units 230A, 230B on the physical computer OSs 210A, 210B acquire the state of the physical computer and the virtualized environment from the physical computer / virtualized environment configuration control management tables 261A, 261B. .

  Further, the physical computer / virtualized environment restart / stop units 230A and 230B are configured so that the failure location is determined by the physical computer or virtualization based on the notification of the failure occurrence from the physical computer / virtualized environment failure location specifying unit 240A and 240B. Judge whether it is any active system in the environment.

  When the failure location is the active system of the physical computer, the physical computer / virtualized environment restart / stop units 230A and 230B re-enter the communication interface 130 and 131 of the partner system in which the failure has occurred via the network. A restart message instructing activation is transmitted to generate an NMI (interrupt that cannot be masked) to the OS on the physical computer. Thereafter, the physical computer / virtualized environment restart / stop units 230A and 230B wait for a specified time, notify the physical computer in which a failure has occurred to the reset, and the physical computer / virtualized environment configuration control management units 220A and 220B. Notify the status change to standby status.

  When the failure occurrence location is a virtual environment, the physical computer / virtual environment restart / stop unit 230A, 230B is the physical computer / virtual environment restart / stop unit 230A of the partner system in which the failure occurs. Alternatively, a restart message instructing restart of the virtual environment is transmitted from the communication interfaces 130 and 131 to the network 230B via the network.

  The physical computer / virtualized environment restart / stop unit 230A or 230B of the system that has received the restart message generates an NMI to the virtual environment OSs 284AA, 284AB, 284BA, and 284BB in the virtual environment where the failure has occurred. . Thereafter, the physical computer / virtualized environment restart / stop units 230A and 230B wait for a specified time, notify the virtual environment in which a failure has occurred, a reset message, and the physical computer / virtualized environment configuration control management unit 220A. , 220B is notified of the state change to the standby state.

  The physical computer / virtualized environment configuration control management unit 220A, 220B operates on the physical computer OS 210A, 210B, and the physical computer / virtualized environment configuration existing in the physical computer / virtualized environment shared memory partitions 230A, 230B. Based on the information in the control management tables 261A and 261B, the configuration control of each physical computer and the virtual environment is managed, and when a state change notification is received, the corresponding state existing in the table is changed.

  FIG. 4 is a diagram showing the physical computer / virtualized environment configuration control management tables 261A and 261B in this embodiment.

  The identifiers (A, B) of the physical computers 100A, 100B are registered in the table for the physical computers in the upper part of FIG.

  In the state T002, information indicating whether the physical computers 100A and 100B with the identifier T001 are active or standby is registered.

  In the active system start time T003, an active system start time, which is a time when the physical computers 100A and 100B start to operate as active systems, is recorded.

  In the last transmission time T004, the time when the survival monitoring message was last transmitted from each of the physical computers 100A and 100B is recorded.

  In the last reception time T005, the time at which the survival monitoring message was last received from the partner physical computers 100A and 100B in the duplex is recorded.

  In the time-out time T006, a time-out time for determining that the survival monitoring message from the counterpart physical computers 100A and 100B has been interrupted is recorded.

  The table for the virtual environment in the lower row is connected to the right side of the upper table. In the table for the virtual environment, identifiers T007 (A, B, A, B) indicating the virtual environments 282AA, 282AB, 282BA, 282BB existing in the respective physical computers 100A, 100B are recorded. For example, the virtualization environment at the top level is the virtualization environment with identifier A constructed in the physical computer with identifier A, and the virtualization environment at the second level is the virtualization environment with identifier B constructed in the physical computer with identifier A It is.

  In the state T008, information indicating whether each of the virtualization environments 282AA, 282AB, 282BA, and 282BB is an active system or a standby system is registered.

  In the active system start time T009, the time when each of the virtualization environments 282AA, 282AB, 282BA, and 282BB transitions to the active system is recorded.

  In the partner T010, an identifier indicating which virtual environment of which physical computer corresponds to each virtual environment 282AA, 282AB, 282BA, 282BB in the duplex is recorded. ¥ For example, the virtual environment at the top corresponds to the virtual environment with identifier A constructed in the physical computer with identifier B.

  The last transmission time T011 records the time when the survival monitoring message was last transmitted to the virtual environment corresponding to the duplexing indicated by the partner T010.

  In the final reception time T012, the time when the last survival monitoring message is received from the virtual environment corresponding to the duplexing shown in the partner T010 is recorded.

  In the timeout time T013, the timeout time of the survival monitoring message in each of the virtualization environments 282AA, 282AB, 282BA, and 282BB is recorded.

  FIG. 5 is a flowchart showing a processing flow S401 in which the physical computer and the configuration control application on the virtual environment in this embodiment transmit a survival monitoring message. The configuration control applications 270A, 270B on the physical computers 100A, 100B and the configuration control applications 283AA, 283AB, 283BA, 283BB on the virtual environments 282AA, 282AB, 282BA, 282BB all perform the same operation.

  Referring to FIG. 5, the configuration control application uses the physical computer / virtualized environment configuration control management tables 261A and 261B shown in FIG. 4 to identify communication partner identifiers T007 and T010 corresponding to the duplication of the virtual environment, Information on T002 and T008 indicating the state of the physical computer and the virtual environment is acquired (step S402). Subsequently, the configuration control application transmits information on whether the environment in which it exists to the active system or the standby system and the time when the environment becomes the active system to the communication partner as a survival monitoring message (step S403). Subsequently, the configuration control application waits for half the timeout period (step S404), and returns to step S402.

  FIG. 6 is a flowchart showing a processing flow S501 in which the physical computer and the configuration control applications 270A, 270B, 283AA, 283AB, 283BA, and 283BB in the virtual environment receive the survival monitoring message. The configuration control application of this example corresponds to the survival monitoring units 12A, 12AA, 12AB, 12BA, and 12BB of the above-described embodiment illustrated in FIG. The configuration control applications 270A, 270B on the physical computers 100A, 100B and the configuration control applications 283AA, 283AB, 283BA, 283BB on the virtual environments 282AA, 282AB, 282BA, 282BB all perform the same operation.

  Referring to FIG. 6, the configuration control application uses the physical computer / virtualized environment configuration control management tables 261A and 261B shown in FIG. 4 to identify the virtual environment and the corresponding communication partner identifier in the duplication of the virtual environment. Information on T007 and T010, and states T002 and T008 of the physical computer and the virtual environment are acquired (step S502). In this case, it is assumed that a communication partner corresponding to the duplication of physical computers is known in advance. Subsequently, the configuration control application receives the survival monitoring message transmitted from its own communication partner (step S503), and returns to step S501.

  FIG. 7 is a flowchart showing the processing flow S601 executed by the physical computer / virtualized environment communication path monitoring units 250A and 250B in this embodiment. The physical computer / virtualized environment communication path monitoring units 250A and 250B of the present example correspond to the inconsistency determination units 13A and 13B of the above-described embodiment illustrated in FIG. The physical computer / virtualized environment communication path monitoring units 250A and 250B existing in the physical computer OSs 210A and 210B perform the same operation.

  Referring to FIG. 7, the physical computer / virtualized environment communication path monitoring units 250A and 250B perform the virtualization shown in T007 from the physical computer / virtualized environment configuration control management tables 261A and 261B shown in FIG. Information of T010 indicating the communication partner of the environment is acquired (step S602).

  Next, the physical computer / virtualized environment communication path monitoring units 250A and 250B, based on the information acquired in step S602, the configuration control applications 270A and 270B and the virtual environments 282AA and 282AB on the physical computers 100A and 100B, The transmission / reception of the survival monitoring message of the configuration control applications 283AA, 283AB, 283BA, and 283BB on 282BA and 282BB is monitored (step S603). Then, the physical computer / virtualized environment communication path monitoring units 250A, 250B perform the final transmission / reception time T004 of the physical computer and each virtual environment in the corresponding physical computer / virtualized environment configuration control management table 261A, 261B shown in FIG. T005, T011, T012, and active system start times T003, T009 are updated (step S604).

  Subsequently, the physical computer / virtualized environment communication path monitoring unit 250A, 250B refers to the data of the transmitted / received survival monitoring message and the data managed in the physical computer / virtualized environment configuration control management tables 261A, 261B. Then, it is determined whether the statuses of both systems in the duplexing of each physical computer and the virtual environment are consistent or inconsistent (step S605). Here, when both systems are operating as active systems, it is determined that the states of both systems are inconsistent.

  If the two systems are not matched, the physical computer / virtualized environment communication path monitoring units 250A and 250B indicate that the physical computers / virtualized environment configuration control management units 220A and 220B have inconsistencies in the states of both systems. Is sent (step S606).

  FIG. 8 is a flowchart showing the processing flow S701 of the physical computer / virtualization environment fault location identifying unit 240A, 240B in this embodiment. The physical computer / virtualization environment fault location specifying units 240A and 240B of this embodiment correspond to the fault location specifying units 14A and 14B shown in FIG.

  Referring to FIG. 8, the physical computer / virtualized environment fault location identifying units 240A, 240B are each virtualized by the identifier T007 from the physical computer / virtualized environment configuration control management tables 261A, 261B shown in FIG. Information on the partner T010 indicating the communication partner in the environment is acquired (step S702). Subsequently, the physical computer / virtualized environment failure location specifying unit 240A, 240B obtains information on timeout times T006 and T013 of the physical computer and each virtual environment from the physical computer / virtualized environment configuration control management tables 261A, 261B. (Step S703). Further, the physical computer / virtualized environment fault location specifying unit 240A, 240B waits for a time corresponding to the minimum value of the timeout times T006, T013 existing in the physical computer / virtualized environment configuration control management tables 261A, 261B (steps). S704).

  Next, the physical computer / virtualized environment failure location specifying unit 240A, 240B refers to the physical computer / virtualized environment configuration control management tables 261A, 261B, and finally transmits and receives the life monitoring message for the physical computer and each virtualized environment. It is determined whether or not a timeout period has elapsed since the update times T004, T005, T011, and T012 (step S705).

  Then, the physical computer / virtualized environment fault location identifying unit 240A, 240B returns to step S702 without doing anything if there is no physical computer or virtual environment that has timed out.

  On the other hand, if there is a physical computer or virtual environment that has timed out, the physical computer / virtual environment fault location identifying unit 240A, 240B determines that a fault has occurred in the physical computer or virtual environment (step) S706).

  From the result of step S706, the physical computer / virtualized environment fault location identifying unit 240A, 240B determines that the physical computer / virtualized environment restart / stop unit 230A, 230B, if a fault has occurred in the physical computer, It is notified that a failure has occurred in the physical computer 100A or 100B (step S707).

  From the result of step S706, the physical computer / virtualized environment fault location identifying unit 240A, 240B determines that the physical computer / virtualized environment restarting / stopping unit 230A, 230B has a fault in the virtualized environment. Then, a notification that a failure has occurred in the virtual environment is sent (step S708).

  FIG. 9 is a flowchart showing a processing flow S801 in which the physical computer / virtualized environment restart / stop units 230A and 230B instruct the restart and stop in this embodiment. The physical computer / virtualized environment restart / stop units 230A and 230B of the present example correspond to the state control units 16A and 16B of the above-described embodiment illustrated in FIG.

  Referring to FIG. 9, the physical computer / virtualized environment restart / stop units 230A and 230B have the physical computers and virtualized environment configurations 261A and 261B shown in FIG. Communication partner information T010 is acquired (step S802).

  Thereafter, the physical computer / virtualized environment restart / stop unit 230A, 230B generates a failure from the physical computer / virtualized environment fault location identifying unit 240A, 240B or the physical computer / virtualized environment configuration control management unit 220A, 220B. When the failure location information is received (step S803), it is determined whether the failure location is an active system (step S804).

  When the failure occurrence location is a standby system, the physical computer / virtualized environment restart / stop units 230A and 230B indicate that the physical computer or virtualization environment that is the failure occurrence location is changed to a stopped state. Notify the virtualization environment configuration control management unit 220A, 220B (step S805), and return to step S802.

  On the other hand, if the failure location is an active system, the physical computer / virtualized environment restart / stop units 230A and 230B determine whether the failure occurrence location is a physical computer (step S806).

  If the failure location is a physical computer, the physical computer / virtualized environment restart / stop units 230A and 230B use a restart message for instructing the NMI to the physical computer OS 210A or 210B as the failure location. It is transmitted to the communication interface 130 or 131 of the physical computer that is currently in operation (step S807). The physical computer OS 210 </ b> A or 210 </ b> B of the physical computer that has received this message executes a memory dump triggered by the NMI, and data in a predetermined memory area is saved in the memory dump area 142 of the disk 140.

  Subsequently, the physical computer / virtualized environment restart / stop units 230A and 230B wait for a specified time, and then transmit a reset request message to the physical computers 100A and 100B in which the failure has occurred (step S808).

  On the other hand, if the failure occurrence location in step S806 is a virtual environment, the physical computer / virtualization environment restart / stop units 230A and 230B are failure occurrence locations via the communication interface 130 or 131 and the network. A restart message is sent to the physical computer / virtual environment restart / stop units 230A and 230B of the physical computer with the virtual environment to instruct the restart of the virtual environment that is the failure location (step S809). .

  Subsequently, the physical computer / virtual environment restart / stop units 230A and 230B wait for a specified time, and then restart the physical computer / virtual environment of the physical computer with the virtual environment that is the failure location. / A stop message for instructing stop of the virtual environment is transmitted to the stop units 230A and 230B (step S810).

  After step S808 or step S810, the physical computer / virtualized environment restart / stop units 230A and 230B indicate that the standby system environment corresponding to the active system where the failure has occurred changes state to the active system. The management environment configuration control management unit 220A, 220B is notified (step S811).

  FIG. 10 is a flowchart showing the processing flow S901 when the physical computer / virtualized environment restart / stop units 230A and 230B receive the restart / stop notification in this embodiment.

  Referring to FIG. 10, when the physical computer / virtualized environment restart / stop units 230A, 230B receive a notification message from the physical computer / virtualized environment restart / stop units 230A, 230B of the other physical computer in the duplex mode. (Step S902) From the message, it is determined which virtualization environment has a failure, NMI is notified to the virtualization environment OS of the virtualization environment, and a memory dump is started (Step S903). Next, the physical computer / virtualized environment restart / stop units 230A and 230B wait for a specified time, and then issue a reset notification to the virtualized environment in which the failure has occurred (step S904).

  Further, the physical computer / virtualized environment restart / stop units 230A and 230B control the physical computer / virtualized environment configuration in order to transition the other environment corresponding to the virtualized environment in which the failure has occurred to the active system. The management unit 220A, 220B is notified of the state change (step S905).

  FIG. 11 shows a processing flow S1001 executed when the physical computer / virtualized environment configuration control management unit 220A, 220B receives a notification from the physical computer / virtualized environment restart / stop unit 230A, 230B in this embodiment. It is a flowchart. The physical computer / virtualized environment configuration control management units 220A and 220B of the present example correspond to the inconsistent location specifying units 15A and 15B of the above-described embodiment shown in FIG.

  Referring to FIG. 11, when the physical computer / virtualized environment configuration control management unit 220A, 220B receives a status change notification from the physical computer / virtualized environment restart / stop unit 230A, 230B (S1002), FIG. The state T002 or T008 in the physical computer / virtualized environment configuration control management table 261A, 261B shown is updated, and in the case of a state transition from the standby system to the active system, the time T003 or T009 is updated (step S1003).

  FIG. 12 illustrates a processing flow S1101 of processing executed when the physical computer / virtualized environment configuration control management unit 220A, 220B receives a notification from the physical computer / virtualized environment communication path monitoring unit 250A, 250B in this embodiment. It is a flowchart to show.

  Referring to FIG. 12, the physical computer / virtualized environment configuration control management unit 220A, 220B changes from the physical computer / virtualized environment communication path monitoring unit 250A, 250B to the state of both systems in the duplication of the physical computer or virtualized environment. When a notification indicating that there is a mismatch is received (step S1102), information on the time when the physical computer or the virtual environment of the other system transitions to the active system (operating system start time) is acquired (step S1103).

  Subsequently, the physical computer / virtualized environment configuration control management unit 220A, 220B acquires the active system start time of the own system in the physical computer / virtualized environment configuration control management table 261A, 261B in the own computer in step S1103. The operating system start times of the partner systems that have been compared are compared (step S1104).

  If the other system environment has an earlier operating system start time, the physical computer / virtualized environment configuration control management unit 220A, 220B determines that the other system environment is faulty, and this is indicated by the physical computer / virtualization. The environment restart / stop units 230A and 230B are notified (step S1105).

  According to this embodiment, even if a failure occurs in either the physical computer or the virtual environment, it is possible to notify the restart / stop message to the location where the failure has occurred, so that the failure can be performed reliably and quickly. The occurrence point can be separated. As a result, even if there is a situation where both the physical computers or the virtual environment try to operate as the active system when the survival monitoring message is temporarily interrupted due to an intermittent failure of the communication path, and then the communication path is restored Inconsistency can be resolved at that time. In addition, when the failure location is cut off, a memory dump that saves the memory state at that moment to the disk is started, and information in the memory at the time of the failure can be recorded to improve failure analysis. It is.

  To summarize this embodiment, the configuration for performing appropriate control when a failure occurs is as follows.

  (1) Configuration control application (270A, 270B)

  This application is placed on a physical computer / virtualized environment, and sends and receives liveness monitoring messages between active and standby configuration control applications.

  (2) Physical computer / virtualized environment configuration control management table (261A, 261B)

  This is a management table for uniquely identifying the failure location information of physical computers and virtual environments, the transmission / reception history of survival monitoring messages, and the status of the active or standby system of physical computers and virtual environments, from physical computers and virtual environments. Both can be referenced.

  (3) Physical computer / virtualized environment communication path monitoring unit (250A, 250B)

  Monitors the transmission / reception of the survival monitoring message for confirming the survival of the active system and the standby system in the physical computer and the virtual environment, and determines whether there is a mismatch in the combination of the active system and the standby system.

  (4) Physical computer / virtualized environment fault location identification unit (240A, 240B)

  Identify where in the physical computer and the virtual environment the failure occurred.

  (5) Physical computer / virtualized environment restart / stop unit (230A, 230B)

When a failure occurs, a restart request message is transmitted to the computer in which the failure has occurred, based on the information of the physical computer / virtualized environment failure location identification units 240A and 240B.

  At this time, if a failure has occurred in the physical computer, a restart request is transmitted to the physical computer, and an NMI (non-maskable interrupt signal) is generated for the OS of the physical computer. The memory dump at which the memory state at the time of failure occurrence is saved to the disk by NMI can be started, and information at the time of failure occurrence can be recorded.

  At this time, if a memory dump is not executed for the NMI, a stop request message is transmitted to the failed physical computer again. The faulty physical computer that has received the stop request message immediately puts the computer in a stopped state and prevents the physical computer from starting again. When a memory dump is executed, reboot or stop may be executed after the memory dump is completed.

  If a failure has occurred in the virtual environment, a restart request message is transmitted to the virtual environment restart / stop units 230A and 230B existing on the physical computer in which the failure has occurred.

  Upon receiving the restart request message, the physical computer / virtualized environment restart / stop units 230A and 230B existing on the failed physical computer are determined by the physical computer / virtualized environment fault location specifying unit 240A and 240B. An NMI (non-maskable interrupt signal) is generated for the OS in the virtual environment where the failure has occurred. By generating an NMI in the OS on the virtual environment, a memory dump for saving the memory state at the time of the failure to the disk can be started, and information at the time of the failure can be recorded.

  At this time, if a memory dump is not executed for the NMI generated in the virtual environment, a stop request message is transmitted to the virtual environment itself that has failed. In the virtual environment that has received the stop request message, the virtual environment is immediately stopped and the current state is frozen. When a memory dump is executed, reboot or stop may be executed after the memory dump is completed.

  (6) Physical computer / virtualized environment configuration control management unit (220A, 220B)

  When a failure occurs in a physical computer or virtual environment of another system, and a restart / stop notification is sent from the physical computer / virtual environment restart / stop unit 230A to the point of failure, the physical computer / virtual environment The physical computer / virtualized environment configuration control management tables 261A and 261B are updated based on the information of the failure occurrence location by the failure location identification units 240A and 240B.

  Further, when a failure occurs in the physical computer or virtual environment of the own system, and a restart / stop notification to the location of the failure is received from the restart / stop units 230A and 230B of the physical computer / virtual environment of the other system Then, the physical computer / virtualized environment configuration control management tables 261A, 261B are updated based on the information on the location where the fault has occurred from the physical computer / virtualized environment fault location specifying unit 240A, 240B.

  In addition, a restart / stop notification is sent from the physical computer / virtualized environment restart / stop unit 230A, 230B to the location where the failure occurred due to an intermittent communication path failure, and when communication is restored, the physical computer / virtualization The physical computer / virtualized environment configuration control management table 261A, 261B is updated based on the information of the environmental communication path monitoring units 250A, 250B, and the physical computer / virtualized environment configuration control management unit 220A, based on the contents of the updated table. Instruct 220B to issue a restart / stop command to the partner system.

  In the determination of this condition, when communication is recovered, the physical and standby environment information in the physical computer / virtualized environment configuration control management table 261A and the time when the partner system becomes the active system are used. The computer / virtualized environment restart / stop unit 230A, 230B determines which physical computer or virtualized environment is to be restarted or stopped.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the spirit of the present invention.

  The embodiments and examples of the present invention have been described above, but the present invention is not limited to these embodiments and examples, and these embodiments are within the scope of the technical idea of the present invention. The embodiments may be used in combination, or a part of the configuration may be changed.

100A, B ... physical computer, 10A, B ... physical computer, 110 ... processor, 11AA, AB, BA, BB ... virtual environment, 120 ... disk interface, 12A, AA, AB, B, BA, BB ... survival monitoring unit , 130: Communication interface, 131: Communication interface, 13A, B ... Inconsistency determination unit, 140 ... Disk, 141 ... Management information, 142 ... Memory dump area, 14A, B ... Fault location identification unit, 150 ... Network, 15A, B: Inconsistent location identification unit, 160 ... Network, 16A, B ... Status control unit, 200A, B ... Memory, 210A, B ... OS for physical computer, 220A, B ... Physical computer / virtualized environment configuration control management unit, 230A, B: Physical computer / virtualized environment restart / stop unit, 240A, B: Physical computer / virtualized environment fault location identification , 250A, B ... Physical computer / virtualized environment communication path monitoring unit, 260A, B ... Physical computer / virtualized environment sharing memory partition, 261A, B ... Physical computer / virtualized environment configuration control management table, 270A, B ... Configuration control application, 281AA, AB, BA, BB ... Logical partition for virtualized environment, 282AA, AB, BA, BB ... Virtualized environment, 283AA, AB, BA, BB ... Configuration control application, 284AA, AB, BA, BB ... Virtualized OS

Claims (6)

A computer control device of a system that constructs a virtual environment on a physical computer and configures the dual of the physical computer and the virtual environment,
Survival monitoring means that is arranged in each of the physical computer and the virtualized environment, and both systems corresponding to each duplication of the physical computer and the virtualized environment transmit and receive a liveness monitoring message to each other;
In the duplexing of the physical computer and the virtual environment, both of the corresponding systems that are generated when the active system remains the active system in the system switching when the active system is determined to be a failure are both the own system Inconsistency determining means for determining whether or not there is an inconsistency that is recognized as an active system,
In the survival monitoring means, a failure location specifying means for determining that a physical computer or a virtual environment of a system corresponding to a system that has timed out without receiving the survival monitoring message within a predetermined timeout time,
In the inconsistency determination means, if inconsistency occurs, inconsistency location specifying means for determining that the physical computer or virtual environment of the system whose operation time is old as the active system is a failure,
In the fault location specifying means or the inconsistent location specifying means, if the system determined to be a fault is an active system, the predetermined physical processing or the virtual environment of the active system is not operated by the predetermined protection processing State control for transitioning the corresponding standby physical computer or virtual environment to the active system and stopping the standby physical computer or virtual environment if the faulted system is the standby system Means,
I have a,
If the system determined to be faulty is the active system and the location where the fault has occurred is a virtualized environment, the state control means stops the virtualized environment for a physical computer with the virtualized environment. By instructing, the virtual environment is put into a state where it does not operate as an active system.
Computer control device.   The protection process includes a process of saving a predetermined memory area of the virtual environment to a memory area outside the virtual environment and resetting the virtual environment if the active virtual environment is an obstacle. The computer control device according to claim 1, comprising:   The inconsistent location specifying means records the time when the physical computer and the virtualized environment started operating as the active system as the active system start time, and if there is a mismatch between the two corresponding systems, The computer control apparatus according to claim 1, wherein a system to be a failure is determined by referring to an active system start time of the system.   The failure location specifying means predetermines the timeout time for each of the physical computer and the virtual environment, records a last reception time that is a time when the survival monitoring message was last received, and records the final reception. The computer control apparatus according to any one of claims 1 to 3, wherein a time-out from a time to a current time exceeds the time-out time, and is determined to be time-out. A computer control method for constructing a virtual environment on a physical computer and controlling a system constituting a duplex of the physical computer and the virtual environment,
Both systems corresponding in the duplexing of the physical computer and the virtualized environment send and receive the life monitoring message to each other, and the physical computer of the system corresponding to the system timed out without receiving the life monitoring message within a predetermined time or A first step of determining the virtual environment as a failure;
In the duplexing of the physical computer and the virtual environment, both of the corresponding systems that are generated when the active system remains the active system in the system switching when the active system is determined to be a failure are both the own system Whether or not there is an inconsistency that the system recognizes as the active system, and if there is a mismatch, the second is to determine the physical computer or the virtual environment of the system whose operation time is old as the active system as a failure . Steps,
If the system determined to be a failure is an active system, a predetermined protection process makes the active physical computer or virtualization environment non-operational and the corresponding standby physical computer or virtualization A third step of transitioning the environment to the active system;
If the system determined to be a failure is a standby system, a fourth step of stopping the physical computer or virtual environment of the standby system;
I have a,
If the system determined to have a failure in the third step is an active system and the location where the failure has occurred is a virtualized environment, the virtual environment is stopped on the physical computer with the virtualized environment. Instructing the virtual environment to not operate as an active system,
Computer control method. A computer control program for constructing a virtual environment on a physical computer and controlling a system that constitutes a duplex of the physical computer and the virtual environment,
Both systems corresponding in the duplexing of the physical computer and the virtualized environment send and receive the life monitoring message to each other, and the physical computer of the system corresponding to the system timed out without receiving the life monitoring message within a predetermined time or A first procedure for determining a virtualized environment as a failure;
In the duplexing of the physical computer and the virtual environment, both of the corresponding systems that are generated when the active system remains the active system in the system switching when the active system is determined to be a failure are both the own system Whether or not there is an inconsistency that the system recognizes as the active system, and if there is a mismatch, the second is to determine the physical computer or the virtual environment of the system whose operation time is old as the active system as a failure . Procedure and
If the system determined to be a failure is an active system, a predetermined protection process makes the active physical computer or virtualization environment non-operational and the corresponding standby physical computer or virtualization A third procedure for transitioning the environment to the active system;
If the system determined to be a failure is a standby system, a fourth procedure for stopping the physical computer or virtual environment of the standby system;
When letting the calculator execute
In the third procedure, if the system determined to be a failure is an active system and the location where the failure has occurred is a virtual environment, the virtual environment is stopped on the physical computer with the virtual environment. Instructing the virtual environment to not operate as an active system,
Computer control program.

Images