JP6424134B2 - Computer system and computer system control method - Google Patents

Description

  The present invention relates to a multi-system control method for a computer system.

  The multi-computer system includes an active computer that executes a job and a standby computer that takes over the job when the active computer is monitored and an abnormality is detected. A series of processes in which the standby computer takes over work when an abnormality occurs in the active computer is called failover (or system switching).

  The following three points are required for failover. First, in order to support the analysis of the cause of the abnormality, a memory dump of the active computer that caused the abnormality is collected. Secondly, to prevent the active computer that caused the abnormality from outputting inappropriate data, the operation of the active computer was completely stopped before the standby computer took over the operation, or the active computer was stopped. Make sure. Third, in order to shorten the business stop time during failover, the current computer is stopped at the earliest possible timing.

  When a recent operating system (hereinafter referred to as OS) detects an abnormality by itself or receives a non-maskable interrupt (NMI = Non Maskable Interrupt), it retains the memory contents of the first OS at that time. The second OS is activated, and the second OS permanently saves the memory contents of the first OS as a memory dump.

  Especially in a multi-system, a standby computer that detects an abnormality in the active computer inputs the NMI to the active computer using a known or well-known method, so that the operation of the active computer is stopped and memory dump processing is started. At the same time.

  However, if the OS of the active computer has already started memory dump processing, if the standby computer inputs NMI to the active computer according to the above procedure, the memory dump processing stops and the memory dump fails. There is.

  As a method of suppressing NMI input after starting the memory dump process, Patent Document 1 states that “in the interrupt process for an interrupt generated by the function expansion board mounted on the computer in which the fault has occurred in response to the interrupt instruction message, Failure information is stored by executing the saving of the failure information, instructing the function expansion board to inhibit the interrupt generation function and the computer operation stop function, and ignoring the message to stop the computer transmitted later. Technology for "continuing storage" is disclosed.

International Publication No. 99/26138

  However, in Patent Document 1, a function expansion board having the above-described functions is required. However, such special hardware is not widely spread and is not available in various regions and at low cost. difficult. Furthermore, a standard OS does not always support a device driver for using the special hardware.

  Therefore, the present invention has been made in view of the above problems, and it is possible to prevent a memory dump from being forcibly stopped when an abnormality occurs in an active computer without requiring special hardware. Objective.

The present invention includes a plurality of computers having a processor and a memory, wherein at least one of the plurality of computers is an active computer, at least one of the other computers is a standby computer, and the active computer A computer system having a first network connecting the standby computer, wherein the active computer is connected to the active computer and provides a computer management device for managing the active computer A first OS that performs communication, a communication unit that transmits a heartbeat indicating that the first OS is operating to the standby computer at a predetermined period, and the failure after the first OS has failed. a second OS for outputting the contents of the memory, and the computer management system, when it counts to a second predetermined time and the watchdog timer for executing a predetermined action, And timer setting state information for setting the operating state of the serial watchdog timer, via the second network have, an adapter connected to said standby computer, the active computer, the at the start of the business A valid state indicating the start of the task is set in the timer setting state information of the computer management apparatus, a hard reset of the active computer is set as the action, and the processor of the active computer has the first OS When stopped due to a failure, the second OS is started after transmitting a start command to start counting of the watchdog timer to the computer management device, and the computer management device receives the start command and receives the start command. update the timer setting state information to the start state, the standby system computer, a first predetermined time from the reception of the heartbeat After There has elapsed, it obtains the timer setting state information, the long timer setting state information is the start state, it is determined that the first OS has stopped taking over the task of the active computer, the working The second OS of the system computer resets the watchdog timer every third predetermined time, and the computer management device is set as the predetermined action when counting up to the second predetermined time. The hard reset is input to the active computer .

  According to the present invention, it is possible to prevent the memory dump by the second OS from being forcibly stopped when an abnormality occurs in the active computer without requiring special hardware. Further, the standby computer can detect the stop of the first OS of the active computer at the timing when the active computer that has been stopped due to the occurrence of an abnormality shifts to the second OS. As a result, the standby computer can be handed over in a short time from a stop due to an abnormality in the active computer. Furthermore, since the active computer and the standby computer do not require OS modification or special drivers, a general-purpose OS can be used.

1 is a block diagram illustrating an example of a multiplex computer system according to a first embodiment of this invention. FIG. It is a time chart of the case where the working system computer stops spontaneously, showing the first embodiment of the present invention. It is a time chart of the case where the working system computer stops according to an instruction from the standby system computer according to the first embodiment of this invention. The second embodiment of the present invention will be described, and the second embodiment of the present invention will be described. When the second OS for memory dump processing hangs up, a process for automatically restarting the first OS is described. It is a time chart which shows an example. FIG. 5 is a state transition diagram of a watchdog timer according to the first and second embodiments of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing an example of a multiplex computer system according to the first embodiment of this invention. The multi-computer system includes at least one active computer 10 among a plurality of computers, an active BMC (Baseboard Management Controller) 6 that manages the active computer 10, at least one standby computer 20, The standby system BMC 7 that manages the standby system computer 20, the network 32 that connects the active system computer 10 and the standby system computer 20, the active system computer 10 and the standby system BMC 7, and the standby system computer 20 and the active system BMC 6 are connected. Network 31.

  The active computer 10 and the standby computer 20 are configured in the same way, and at least an arithmetic unit 11 that executes a software program including an OS as will be described later, a memory 12 that stores the program and data necessary for the execution, A communication device 13 that performs heartbeat (hereinafter referred to as HB) communication, a LAN adapter 14 that transmits a command to another BMC, and a storage device 15 that stores data and the contents of a memory dump are provided. Here, the storage device 15 includes, for example, a hard disk and a nonvolatile storage medium. The communication device 13 is a LAN adapter, for example.

  The memory 12 of the active computer 10 includes a first OS (1stOS in the figure) 1 for providing business (not shown), middleware (Middle in the figure) 2 for generating HB, etc., and a first A second OS (2nd OS in the figure) 3 that executes a memory dump after the OS 1 is stopped is stored. The computing device 11 of the active computer 10 executes the first OS 1 and middleware 2 until a failure occurs. Note that applications and services running on the first OS 1 are provided from the active computer 10 as business.

  The memory 12 of the standby computer 20 stores the OS 4 and middleware (Middle in the figure) 5 for monitoring the HB of the active computer 10 and is executed by the arithmetic unit 11.

  The active BMC 6 is configured in the same manner as the standby BMC 7. The active BMC 6 is mounted on the active computer 10, and the standby BMC 7 is mounted on the standby computer 20.

  The active BMC 6 includes a LAN adapter 16 for receiving a command from the standby computer 20 via the network 31, an arithmetic device 19, and a memory 8. The standby BMC 7 is similarly configured, and the LAN adapter 16 receives a command from the active computer 10.

  The memory 8 stores a watchdog timer (hereinafter referred to as WDT) 18 and a WDT setting state 17 that holds the state of the WDT 18. As the WDT setting state 17, at least one of “valid state” and “invalid state” is set. Any of these states may be used as long as they can be distinguished from each other.

  In this embodiment, the “valid state” indicates that the operating state of the active computer 10 “starts” the business. The “invalid state” indicates that the operating state of the active computer 10 is “stopped”.

  The active computer 10 and the active BMC 6 are connected by a system interface 30 and, for example, a KCS (Keyboard Controller Style) interface that performs communication by a simple I / O port operation is used. The system interface 30 between the standby computer 20 and the standby BMC 7 is the same.

  The active computer 10 and the standby computer 20 may have a symmetric configuration including the active BMC 6 and the standby BMC 7, and may be mutually supervised and controlled by switching roles.

  In the first embodiment, the example in which the WDT 18 is set in the memory 8 of the memory 8 has been described. However, the WDT may be configured by hardware (not shown).

  FIG. 2 is a time chart of a case where the active computer 10 stops spontaneously due to a failure. In the example of FIG. 2, in the case where the active computer 10 itself detects an abnormality and performs OS stop processing (kernel panic) and start-up processing of the second OS 3 for collecting a memory dump, the active computer 10 The flow of processing of the active system BMC 6 and the standby system computer 20 is shown.

  As described above, the active computer 10 and the standby computer 20 are connected by the network 32, the active computer 10 and the active BMC 6 are connected by the system interface 30, and the active BMC 6 and the standby computer 20 are connected by the network 31. Has been. Details of each step are as follows.

  In step 100, before starting work on the active computer 10, the middleware 2 transmits a command for enabling the watchdog timer (WDT) 18 as an initial setting to the active BMC 6. In the first embodiment, only the WDT 18 is enabled, and the timer of the WDT 18 is not started. The active computer 10 may perform the above initial setting (initialization process) at the time of startup, business start, or the like.

  In step 101, the working BMC 6 sets the WDT setting state 17 to “valid state”.

  In steps 102 and 102n, the middleware 5 of the active computer 10 transmits a heartbeat (HB) to the standby computer 20 via the network 32 at a predetermined time interval Ti, and the active computer 10 is operating normally. Notify me repeatedly.

  In steps 103 and 103n, the middleware 2 of the standby computer 20 receives the HB message from the active computer 10 and stores the reception time.

  In step 104, the first OS 1 running on the active computer 10 detects its own inconsistency and a kernel panic occurs. The active computer 10 starts the migration process to the second OS for collecting the memory dump.

  In step 105, a command for invalidating the WDT 18 is issued via the system interface 30 in the OS-independent processing executed in the middle of the migration of the first OS 1 to the second OS 3. It transmits to system BMC6.

  Here, the OS-independent processing is processing that initializes a standardly mounted device such as VGA by a simple I / O port operation or the like and prepares for the startup of the second OS 3. Since the communication using the above-mentioned KCS interface can also be realized by a simple I / O port operation, it is easy to implement so as to operate without an OS. For example, a command for operating an I / O port may be loaded immediately before the second OS 3 stored in the memory 12.

  In step 106, the active BMC 6 receives the invalidation command from the active computer 10 and updates the WDT setting state 17 to “invalid state”.

  If the standby computer 20 determines in step 107 that the predetermined time Tc 202 has elapsed since the last reception of the HB, it transmits a WDT state acquisition command to the active BMC 6 via the network 31. The active BMC 6 responds with an “invalid state” which is the current WDT setting state 17. The standby computer 20 detects that the WDT setting state 17 of the active BMC 6 is “invalid state”.

  In step 108, when the required specification of the time from the abnormal stop of the active computer 10 to the business takeover is Tf203, the standby computer 20 is acquired in step 107 when Tf203 time has elapsed since the last reception of HB. The determined WDT setting state 17 is determined. When the determination result is “invalid state”, the standby computer 20 recognizes that the operation of the active computer 10 is completely stopped, and takes over the operation executed on the active computer 10. . As for taking over the business, a known or publicly known technique may be applied, and therefore will not be described in detail here.

  In step 109, the active computer 10 performs the startup process of the second OS 3.

  In step 110, the active computer 10 starts the memory dump process when the startup process of the second OS 3 is completed. It should be noted that kdump or the like can be employed for the memory dump process including the startup process of the second OS 3.

  In step 111, the active computer 10 saves the contents of the memory 12 of the first OS 1 in, for example, the storage device 15 and completes the memory dump.

  In step 112, the active computer 10 restarts the first OS 1 after the memory dump is completed. The active computer 10 may function as a new standby system after the first OS is restarted, or may be stopped without restarting.

  Here, the time Tc202 from when the standby computer 20 lastly receives HB until WDT state acquisition (107) is obtained is obtained as follows. The HB transmission interval is Ti200, and the maximum required time from kernel panic (104) to WDT invalidation (105) is Td201 (for example, Td201 is several hundred milliseconds). At this time, the time Tc 202 that satisfies Tc> Ti + Td and Tc <Tf may be set in the middleware 2 of the standby computer 20. The time Tf203 from the last reception of HB to the business handover (108) may be set in the middleware 2 by adding a predetermined value to the time Tc202.

  As a result of the above processing, the active computer 10 and the standby computer 20 do not require special hardware as in the conventional example, and adopt a standard computer equipped with a BMC, while using the standard computer with the BMC. It is possible to prevent the memory dump from being forcibly stopped when an abnormality occurs.

  Further, the standby computer 20 can detect the stop of the first OS 1 of the active computer at the timing when the active computer 10 stopped due to the occurrence of abnormality shifts to the second OS 3. As a result, it is possible to cause the standby computer 20 to take over the work in a short time after the work is stopped due to an abnormality in the active computer 10. Further, since the active computer 10 and the standby computer 20 do not require modification of the OS or special drivers, a general-purpose OS can be used.

  FIG. 3 is a time chart in the case where, in FIG. 2, the first OS 1 of the active computer 10 kernel panics, a non-response failure such as an infinite loop of internal processing of the OS occurs. . Details of each step are as follows.

  Steps 100 to 103n are the same as in the case of FIG.

  In step 120, the first OS 1 of the active computer 10 hangs up and periodic HB transmission (102) stops.

  In step 107, the standby computer 20 transmits a WDT state acquisition command to the active BMC 6 via the network 31 when a predetermined time Tc202 has elapsed since the last reception of HB. The working BMC 6 responds with the WDT setting state 17. The standby computer 20 detects that the WDT setting state 17 of the active BMC 6 remains “valid”.

  In step 121, if the required specification of the time from the abnormal stop of the first OS 1 of the active computer 10 to the business takeover is Tf203, when the standby computer 20 has elapsed Tf203 time since the last HB was received. The WDT setting state 17 acquired in step 107 is determined. If the WDT setting state 17 is “valid state”, there is a possibility that the operation of the active computer 10 may continue to operate, so the standby computer 20 sends an NMI to the active BMC 6 via the network 31. An input instruction is transmitted to instruct stop of work and start of memory dump processing in the active computer 10.

  In step 108, the first OS 1 of the active computer 10 is stopped due to the input of the NMI to the active computer 10, so that the standby computer 20 takes over the work being executed on the active computer 10.

  In step 122, the active BMC 6 that has received the NMI input instruction inputs the NMI to the active computer 10 via the system interface 30.

  In step 104, the active computer 10 that has received the NMI performs a kernel panic process as NMI handling.

  In steps 105 to 106, as in FIG. 2, the active computer 10 transmits an invalidation command for the WDT 18, and the active BMC 6 updates the WDT setting state 17 to “invalid state”.

  In step 123, since it is also assumed that the first OS 1 running on the active computer 10 is not stopped due to the input of the NMI, the standby computer 20 receives a predetermined (Tc-Ti) from the NMI input instruction (121). ) After 210 hours have passed, WDT status acquisition is performed again. The standby computer 20 may determine that the WDT setting state 17 acquired again is an “invalid state”. In this case, the business handover is not performed in step 108 but is performed after it is determined in step 123 that the WDT setting state 17 is “invalid state”.

  Steps 109 to 112 are the same as the processing in FIG. 2 described above. The active computer 10 starts the second OS 3 to execute a memory dump, and restarts the first OS 1 after the memory dump is completed. .

  Through the above processing, in the first embodiment, in the multi-computer system configured by the computer equipped with the BMC and the general-purpose OS, the active computer 10 can be used without stopping the memory dump process executed by the active computer 10. It can be detected in a short time by the standby computer 20 that the first OS has stopped abnormally due to a hang-up or the like.

  Further, the active computer 10 in which the failure has occurred may invalidate the WDT 18 before starting the second OS 3 for collecting the memory dump, and notify the standby computer 20 that the operation of the active system has been stopped. it can. As a result, it is possible to shorten the time from the occurrence of a failure of the active computer 10 until the standby computer 20 takes over the work.

  In the case where the function expansion board or BMC as in the conventional example is not used, the standby computer 20 is currently used until the initialization of the LAN adapter 14 and the like is completed after the second OS 3 for collecting the memory dump is started. Cannot notify that the work of the host has stopped. For this reason, the waiting time from when a failure occurs in the active computer 10 until the standby computer 20 takes over the work of the active computer 10 becomes long.

  On the other hand, as in the first embodiment, by disabling the WDT 18 before starting the second OS 3, the standby computer 20 receives the last HB and waits for the WDT after a lapse of time Tc. The setting state 17 can be acquired and it can be determined that the current service has stopped. Thereby, quick failover can be realized.

  In the first embodiment, the middleware 2 of the active computer 10 transmits HB, and the middleware 5 of the standby computer 20 monitors the occurrence of a failure in the active computer 10, but these processes are performed by the OS. You may go.

  Further, in the first embodiment, the example in which the WDT setting state 17 for storing the state of the WDT 18 mounted on the active BMC 6 is shown, but the present invention is not limited to this. For example, it is only necessary that the “active state” and the “invalid state” can be set by the active BMC 6 or the like without affecting the execution of the active computer 10 (unintended operation). That is, among the resources secured in the memory 8 of the active BMC 6 and the resources of the arithmetic unit 11, resources that can be used without affecting the active computer 10 can represent “valid” and “invalid”. That's fine.

  In the second embodiment of the present invention, after starting the second OS (Operating System) 3 for collecting a memory dump shown in FIGS. 2 and 3 of the first embodiment, the second OS 3 hangs up. In this case, a hard reset is input to the active computer 10 and the first OS 1 is restarted. As a result, it is possible to ensure that the active computer 10 stopped due to the occurrence of abnormality can be quickly restored as a new standby system even if a failure occurs in the second OS 3.

  The configuration of the computer system of the second embodiment is the same as that of the first embodiment, except that the function of the WDT 18 that is not used in the first embodiment is used.

  FIG. 5 simply shows the state transition of the WDT setting state 17 when using the WDT 18 of the active BMC 6 in the second embodiment, and more accurately conforms to the specification of the IPMI (Intelligent Platform Management Interface). To do.

  First, when the WDT setting state 17 is an arbitrary state, the arithmetic unit 19 performs an initial setting 500 and makes a transition to the valid state 501. At this time, the arithmetic unit 19 sets the initial counter as a part of the setting items in the WDT setting state 17 to Tt and the action to hard reset.

  Next, when a WDT start 502 (actually, the same as WDT reset) command is transmitted to the active BMC 6, the WDT setting state 17 becomes the start state 503, and the arithmetic unit 19 is a current counter that is a part of the WDT setting state 17. Is set to the value Tt of the initial counter.

  When the WDT setting state 17 is in the start state 503, when the preset unit time elapses 504, the arithmetic unit 19 decrements the current counter by one.

  Similarly, when the WDT setting state 17 is in the start state 503, when a WDT reset 505 command is transmitted to the active BMC 6, the arithmetic unit 19 resets the value of the current counter to the value Tt of the initial counter.

  Further, when the WDT setting state 17 is in the start state 503, when the current counter becomes 0, a hard reset is input to the computer on which the active system BMC 6 is mounted according to the action setting, and the state transits to the timer firing state 507. As a result, the active computer 10 receives a hard reset as a predetermined action by counting up the WDT 18 and forcibly restarts.

  Based on the above, processing for realizing the second embodiment will be described with reference to FIGS. 4 and 5. FIG. 4 is a time chart showing an example of processing for automatically restarting the first OS 1 when the second OS 3 for memory dump processing hangs up. The processing in FIG. 4 applies the second embodiment to the case of FIG. 2 of the first embodiment, but can be similarly applied to the case of FIG. 3 of the first embodiment. Details of each step are as follows.

  In step 130, the active computer 10 transmits to the active BMC 6 a command for setting the WDT 18 to the valid state 501 as an initial setting before starting the business. Here, the WDT 18 is merely set to the valid state 501 and the timer (current counter) is not started.

  In step 131, the working BMC 6 receives the WDT 18 validation command and sets the WDT setting state 17 to the valid state 501.

  Steps 102 to 104 are the same as in FIG. 2 of the first embodiment. After the HB is transmitted, the first OS 1 of the active computer 10 becomes a kernel panic due to the occurrence of an abnormality.

  In step 132, a WDT start 502 command is transmitted to the active BMC 6 via the system interface 30 in the OS-independent process before starting the second OS 3 for collecting the memory dump. Similarly to the first embodiment, the second embodiment also instructs the active BMC 6 to change the settings before starting the second OS 3.

  In step 133, the active BMC 6 updates the WDT setting state 17 to the start state 503.

  Steps 107 to 109 are the same as in FIG. 2 of the first embodiment, and the standby computer 20 that has acquired the updated WDT setting state 17 takes over the work of the active computer 10, and the active computer 10 Start OS3.

  In steps 134 to 134n, after the second OS 3 is activated and during the memory dump, the active computer 10 sends a WDT reset 505 command to the active BMC 6 via the system interface 30 at a predetermined period. Send to.

  In steps 135 to 134n, the working BMC 6 receives the WDT reset 505 command and resets the current counter to the initial counter value Tt. Then, the working BMC 6 repeats the counting of the current counter as described above.

  In step 110, the active computer 10 starts the memory dump process when the startup process of the second OS 3 is completed.

  In step 136, the memory dump process of the second OS 3 hangs up for some reason. In step 137, after a predetermined time Tt has elapsed since the last WDT reset 135n, the current counter becomes 0 and the timer fires. The working BMC 6 sets the WDT setting state 17 to the firing state 507, and inputs a hard reset to the working computer 10 as set in the action.

  In step 138, the active computer 10 is forcibly restarted by the hard reset input in step 137. As a result, the active computer 10 can be restored as a new standby computer.

  Note that the hang-up (136) of the second OS 3 is the same when it occurs at the timing of step 109 and later.

  With the above processing, in the second embodiment, in the memory dump processing by the second OS 3 performed by the active computer 10 after the first OS 1 is stopped, from the start of the second OS 3 to the completion of the memory dump. Even if a hang-up occurs during this period, the standby computer 20 can take over the work, and the active computer 10 can be restarted and restored as a new standby system within a predictable time. .

  In the first and second embodiments, the example in which the active BMC 6 is used as a device for inputting the NMI and the hard reset to the active computer 10 is shown, but the present invention is not limited to this. For example, any computer management device that can input an NMI or a hard reset to the active computer 10 may be used.

  Further, in the first and second embodiments, the standby computer 20 refers to the WDT setting state 17 of the active BMC 6 and determines that the operation is reliably stopped in the active computer 10. However, the standby computer 20 is limited to the WDT setting state 17. Is not to be done. For example, when the active computer 10 starts a business (or before the start), the middleware 2 or the first OS “start” (= WDT) to the business operation state indicating the start of the business of the active BMC 6 or the computer management apparatus. Set Enabled.

  Then, before the first OS becomes a kernel panic and the second OS 3 is started, the status indicating that the task has been stopped by a predetermined I / O operation indicates the operation status of the active BMC 6 or the active computer management device. Set “Stop” (= WDT invalid) to the state. The standby computer 20 acquires the operational status of the active BMC 6 or the computer management device after the elapse of a predetermined time Tc from the last HB, and if it is “stopped”, the operation of the active computer 10 is reliably stopped. It can be determined that the business can be taken over.

  As described above, according to the present invention, “start” or “stop” of the business operation state is set in the computer management apparatus connected to the active computer 10, and the standby computer 20 detects the occurrence of a failure. If the business operation state is “stopped”, the business of the active computer 10 can be taken over and a quick failover can be realized.

  In the first and second embodiments, the example in which the communication device 13 uses the HB that is transmitted to the standby computer 20 at a predetermined period and the state in which the active computer 10 is set to the WDT setting state 17 has been described. It is not limited to. For example, first operation information indicating that the active computer 10 is operating and second operation information indicating that the first OS 1 of the active computer 10 has been stopped may be provided in the computer management apparatus. . In this case, the standby computer 20 acquires the second operation information from the computer management apparatus after a predetermined time from the reception of the last first operation information, thereby causing a failure in the first OS 1. It can be determined that the first OS 1 has stopped reliably.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, any of the additions, deletions, or substitutions of other configurations can be applied to a part of the configuration of each embodiment, either alone or in combination.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. In addition, each of the above-described configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files for realizing each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

6 Active BMC
7 Standby BMC
DESCRIPTION OF SYMBOLS 10 Active computer 11 Arithmetic unit 12 Memory 13 Communication device 14 LAN adapter 15 Storage device 17 WDT setting state 18 Watchdog timer 20 Standby system computer 30 System interface 31, 32 Network

Claims (4)

A plurality of computers each having a processor and a memory; at least one of the plurality of computers is an active computer; at least one of the other computers is a standby computer; and the active computer and the standby computer A computer system having a first network for connecting
The working computer is
A computer management device that is connected to the active computer and manages the active computer;
A first OS that provides business;
A communication unit that transmits a heartbeat indicating that the first OS is in operation to the standby computer at a predetermined period ;
A second OS that outputs the contents of the memory after a failure has occurred in the first OS;
The computer management device is
A watchdog timer that executes a predetermined action when counted up to a second predetermined time;
Timer setting state information for setting the operating state of the watchdog timer ;
An adapter connected to the standby computer via a second network ,
The working computer is
Set a valid state indicating the start of the work in the timer setting state information of the computer management device at the start of the work, set a hard reset of the active computer as the action,
The processor of the working computer is
When the first OS is stopped due to a failure, a start command for starting the count of the watchdog timer is transmitted to the computer management apparatus, and then the second OS is started.
The computer management device is
Receiving the start command and updating the timer setting state information to a start state;
The standby computer is
After the first predetermined time has elapsed since the heartbeat was received, the timer setting state information is acquired, and if the timer setting state information is the start state , it is determined that the first OS has stopped. To take over the work of the active computer,
The second OS of the active computer is
Resetting the watchdog timer every third predetermined time;
The computer management device is
The computer system according to claim 1, wherein the hard reset set as the predetermined action is input to the active computer when counting up to the second predetermined time .   The computer system according to claim 1,
  The second OS is
  A computer system that performs a dump of the memory of the active computer in which the failure has occurred.   A plurality of computers each having a processor and a memory; at least one of the plurality of computers is an active computer; at least one of the other computers is a standby computer; and the active computer and the standby computer A computer network control method for switching the operation provided by the active computer to the standby computer,
  The working computer is
  A watchdog timer connected to the active computer and executing a predetermined action when counted up to a second predetermined time, timer setting state information for setting an operating state of the watchdog timer, and a second network An adapter connected to the standby computer, and a computer management device for managing the active computer,
  A first OS providing the business;
  A communication unit that transmits a heartbeat indicating that the first OS is in operation to the standby computer at a predetermined period;
  A second OS that outputs the contents of the memory after a failure has occurred in the first OS;
  The control method is:
  A first step in which the active computer operates the first OS that provides the business;
  The active computer sets a valid state indicating the start of the task in the timer setting state information of the computer management apparatus that manages the active computer, and sets a hard reset of the active computer as the action. Two steps,
  A third step in which the active computer transmits the heartbeat indicating that the first OS is in operation to the standby computer via a network at a predetermined period;
  A fourth step in which the processor of the active computer transmits a start command to start counting of the watchdog timer to the computer management device when the first OS is stopped due to a failure;
  A fifth step in which the computer management apparatus receives the start command and updates the timer setting state information to a start state;
  A sixth step in which the active computer starts up the second OS;
  The standby computer acquires the timer setting state information after a first predetermined time has elapsed after receiving the heartbeat, and determines whether the timer setting state information is the start state. A seventh step;
  The standby computer, if the result of the determination is the start state, determines that the first OS has stopped, an eighth step of taking over the work of the active computer;
  A ninth step in which the second OS of the active computer resets the watchdog timer every third predetermined time;
  A tenth step of inputting the hard reset set as the predetermined action to the active computer when the watchdog timer of the computer management device counts up to the second predetermined time;
A control method for a computer system, comprising:   A control method for a computer system according to claim 3,
  The sixth step includes
  A computer system control method comprising: dumping the memory of the active computer in which the failure has occurred.

Images