JP6654662B2 - Server device and server system - Google Patents

Description

  The present invention relates to a technology related to availability of a server system including a plurality of server devices.

FIG. 5 is a simplified block diagram illustrating a configuration example of a cluster system, which is a type of server system. The cluster system 50 includes a plurality of server devices 51 _1, 51 _2, and a database system 52. Server device 51 _1, 51 ₂ are connected to each other via the information communication network 53. Further, the server apparatus 51 _1, 51 ₂ are connected in common to the database system 52, it is possible to use data stored in the database system 52 in common.

In the cluster system 50, one of the server devices 51 _1, 51 ₂ is operating as the active system and the other to operate as a standby system. Thus, when a failure occurs in the active server device, the standby server device operates in place of the server device, so that the cluster system 50 can operate even if a failure occurs in the active server device. The operation as a system can be continued. In other words, the cluster system 50 can increase the availability of the system (the performance that allows the system to operate continuously).

JP-A-01-304545 JP-A-2003-076592

  By the way, the standby server device detects that a failure has occurred in the active server device using a heartbeat signal, for example, as described in Patent Documents 1 and 2. The heartbeat signal is a signal that the active server device periodically outputs. When the active server is shut down due to the occurrence of a failure, the heartbeat signal is not output from the active server. The standby server monitors the output status of the heartbeat signal, and if it detects that the heartbeat signal is not output after the scheduled output time, the active server fails. Is determined (detected) as shut down.

  After detecting that the active server device has been shut down due to the occurrence of a failure, the standby server device executes switching processing to switch from the failed server device to operate as the active server device.

  Further, the server device switched from the standby system to the active system executes the recovery processing of the database system 52 before starting the normal processing. That is, if the failed server device accesses the database system 52 during a period from the occurrence of the failure to the time of shutdown, the server device may not be able to access normally. This unauthorized access may complicate the storage state of the data stored in the database system 52, or may destroy a part of the data. In order to prevent the situation caused by such unauthorized access from continuing, the server device switched to the active system performs the recovery process of the database system 52 before starting the normal process. Since the time required for the recovery process is long, there is a problem that it takes a long time from when a failure occurs in the server device to when the standby server device starts up as the active system in place of the server device.

  The present invention has been devised to solve the above-mentioned problems. That is, a main object of the present invention is to provide a technique in which when a failure occurs in an active server device, a standby server device quickly starts up as an active system instead of the server device.

In order to achieve the above object, a server device of the present invention comprises:
A control circuit that executes a process based on a computer program including a process of controlling a connection with a shared resource commonly connected to another server device;
A failure detection circuit for detecting that a failure has occurred in the own device;
When the failure detection circuit detects the occurrence of a failure, a connection control circuit that disconnects the connection with the shared resource,
A machine control circuit that notifies the other server device of the occurrence of the failure when the failure detection circuit detects the occurrence of the failure,
The control circuit has a function of executing a process based on middleware that is a computer program, and executes a process of controlling connection with the shared resource as one of processes based on the middleware,
The machine control circuit has a function of executing a process based on firmware which is a computer program, and as one of the processes based on the firmware, when the fault detection circuit detects the occurrence of a fault, another server device To notify the occurrence of a failure.

Further, the server system of the present invention includes:
A plurality of server devices connected to each other,
These servers have shared resources connected in common,
The server device is a server device of the present invention,
At least one of the plurality of server devices functions as a standby system, and the other server devices operate as active systems,
When a failure occurs in the server device operating as an active system, the control circuit in the standby system server device generates a failure from the machine control circuit provided in the active server device. The state shifts from the standby state to the normal operation state by being notified.

  According to the present invention, when a failure occurs in the active server device, the standby server device can quickly start up (transfer to the normal operation state) as the active server instead of the server device.

FIG. 1 is a block diagram illustrating a simplified configuration of a server device according to a first embodiment of the present invention and a server system including the same. It is a block diagram showing the composition of the server device of a 2nd embodiment concerning the present invention in a simplified form. It is a figure explaining a server system provided with a server device of a 2nd embodiment. FIG. 14 is a diagram illustrating an operation example when a failure occurs in the server device according to the second embodiment. FIG. 2 is a diagram illustrating an example of a server system.

  An embodiment according to the present invention will be described below with reference to the drawings.

(1st Embodiment)
FIG. 1A is a simplified block diagram illustrating a configuration of a server device according to a first embodiment of the present invention. FIG. 1B is a diagram illustrating a server system including the server device according to the first embodiment.

  The server device 1 according to the first embodiment is connected to another server device 1 by, for example, a LAN (Local Area Network), as shown in FIG. In the server system 7, the plurality of server devices 1 are connected to the shared resource 8 in common and use the shared resource 8 in common.

  As shown in FIG. 1A, the server device 1 of the first embodiment includes a control circuit 2, a machine control circuit 3, a failure detection circuit 4, and a connection control circuit 5. The control circuit 2 has a function of executing a process based on a computer program including a process of controlling connection with the shared resource 8.

  The failure detection circuit 4 has a circuit configuration for detecting that a failure has occurred in the own device 1. The connection control circuit 5 has a function of disconnecting the connection with the shared resource 8 before the control circuit 2 instructs the disconnection of the connection with the shared resource 8 when the failure detection circuit 4 detects the occurrence of the failure. . The machine control circuit 3 has a function of notifying another server device 1 of the occurrence of a failure when the failure detection circuit 4 detects the occurrence of a failure.

  In the example shown in FIG. 1B, the number of the server devices 1 constituting the server system 7 is two, but if the number of the server devices 1 constituting the server system 7 is plural, It is not limited to two.

  In the first embodiment, a fault detection circuit 4 is provided separately from the control circuit 2. Therefore, the server device 1 can detect the occurrence of a failure by the failure detection circuit 4 separately from the processing of the control circuit 2. Further, in the first embodiment, the failure detection circuit 4 detects the occurrence of a failure, so that the server apparatus 1 can generate the failure before the control circuit 2 instructs the connection to the shared resource 8 to be disconnected. It is possible to quickly cut off the connection with the shared resource 8. For this reason, since the time from when a failure occurs in the server device 1 to when the server device 1 cuts off the connection with the shared resource 8 is long, the server device 1 cannot connect to the shared resource 8 inappropriately. Is prevented from occurring.

  In the first embodiment, when the failure detection circuit 4 detects the occurrence of a failure, the machine control circuit 3 notifies the other server devices 1 of the occurrence of the failure. Therefore, the server device 1 functioning as a standby system in the server system 7 can detect the occurrence of the failure in the server device 1 before the server device 1 in which the failure has occurred stops driving due to the failure. Thus, the standby server device 1 can start the switching process to the active system before the server device 1 in which the failure has occurred is stopped.

  As described above, when a failure occurs, the server device 1 of the first embodiment can notify the occurrence of the failure so that the server device 1 as the standby system can quickly start the process of switching to the active system. Further, when a failure occurs, the server device 1 can promptly cut off the connection with the shared resource 8 as described above, so that an inappropriate connection with the shared resource 8 can be avoided. It is possible to prevent troubles of the shared resource 8 caused by a poor connection. In combination with this and the fact that the standby server device 1 can start the switching process earlier, in the first embodiment, the standby server device 1 operates from the standby state as the active system (starts up). ) Can be shortened.

(2nd Embodiment)
Hereinafter, a second embodiment according to the present invention will be described.

  FIG. 2 is a simplified block diagram showing the configuration of the server device of the second embodiment. FIG. 3 is a simplified block diagram showing a configuration of a cluster system which is a server system including the server device of the second embodiment.

The cluster system 20 according to the second embodiment includes a plurality of server devices 21 (21 ₁ ,..., 21 _n (where n is an integer of 2 or more) and a database system 22. In the second embodiment, the database system 22 includes a plurality of server devices 21 (21 ₁ , 21 ₂ , 21 ₃ , 21 ₂ , 21 ₂ , 21 ₂ , 21 ₂ , 21 ₂ , 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21 , 21 _n ) are shared resources connected in common.The database system 22 and the server device 21 are connected using, for example, a fiber channel (Fiber Channel (FC)) which is a kind of communication system.

The plurality of server devices 21 (21 ₁ ,..., 21 _n ) are connected to each other via information communication networks 25 and 26 such as LANs. In the second embodiment, the server devices 21 (21 ₁ ,..., 21 _n ) have the following common configuration. The server device 21 (21 ₁ ,..., 21 _n ) is not particularly limited as far as it has the common configuration.

  Also, at least one of the plurality of server devices 21 functions as a standby system, and prepares for a case where the other server devices 21 functioning as an active system cannot operate normally due to a failure.

  The server device 21 includes a control circuit 31, a BMC (Baseboard Management Controller) 33, a board unit 34, and I / O (Input / Output) circuits 35 to 37. The control circuit 31 includes a CPU (Central Processing Unit), and can have various functions by reading a computer program (program) stored in a storage device (not shown) and executing the program. In the second embodiment, the control circuit 31 includes a middleware unit 32 as a function unit. The middleware unit 32 is a functional unit that operates based on a computer program called middleware, and executes, for example, operations related to the database system 22. Also, the middleware unit 32 has a function of executing a switching process for switching from the standby system to the active system when another server device 21 notifies that a failure has occurred while functioning as the standby system. ing. Further, in the second embodiment, the middleware section 32 has a function of shifting to a normal operation state without executing the recovery processing of the database system 22 after the switching processing.

  The control circuit 31 further includes, as a functional unit, an OS unit (not shown) that operates based on an operating system (OS) that is basic software. The OS unit has a function of executing a process of terminating the application processing being executed and a shutdown process of stopping the operation of the server device 21 when a failure occurs in the server device 21.

  Each of the I / O circuits 35 to 37 includes a circuit that connects to the control circuit 31 and connects the control circuit 31 to a connection partner set according to, for example, an application. Specifically, for example, the I / O circuits 35 and 36 are configured by network interface cards, and are connected to the control circuit 31 in another server device 21 by information communication networks 25 and 26 such as LANs. The I / O circuit 37 is configured by a fiber channel card and connects to the database system 22.

  The BMC 33 is a unit (part) in which a plurality of circuits including the machine control circuit 40 and the connection circuit 42 are formed. The machine control circuit 40 is a circuit that controls hardware configuring the server device 21 according to a computer program called firmware. The machine control circuit 40 has a function of monitoring an error (abnormality) in the server device 21 based on the firmware. For example, a plurality of error detection registers (not shown) are provided in the server device 21. Each error detection register is a storage unit that, when an error (abnormality) of a predetermined type is detected, temporarily stores information that the error has been detected. The machine control circuit 40 performs an operation (process) of sequentially checking such an error detection register at a predetermined timing, and monitors whether an error has occurred.

  The machine control circuit 40 further includes a notification unit 41 as a function unit. The notification unit 41 has a function of notifying the middleware unit 32 and the standby server device 21 that a failure has occurred in the server device 21.

  The connection circuit 42 has a circuit configuration for connecting the BMC 33 to the information communication network (LAN) 26. The connection circuit 42 transmits the notification (notification for notifying the occurrence of a failure) issued from the notification unit 41 to the standby server device 21 through the information communication network (LAN) 26.

  The board unit 34 is a unit (part) in which a plurality of circuits including the failure detection circuit 43 and the connection control circuit 44 are formed on a common circuit board.

  The failure detection circuit 43 is hardware that detects that a failure has occurred in the server device 21. The failure detected by the failure detection circuit 43 is a failure that makes it difficult for the server device 21 to continue operating. As specific examples, the failures include a power supply abnormality and a temperature abnormality in which the temperature inside the device exceeds an applicable range. Further, the failure detection circuit 43 may provide a multi-bit error that cannot be corrected by a correction method such as ECC (Error Checking and Correction) or a parity error in the data processed by the control circuit 31 when the transaction times out. Is also detected as a failure.

  The failure detection circuit 43 detects such a failure based on signals acquired from the control circuit 31 and the BMC 33, and generates a failure detection signal for notifying (reporting) the occurrence of a failure when the failure is detected. It has. The signal that the failure detection circuit 43 acquires from the control circuit 31 is, for example, a signal that notifies that a failure has been detected as an interrupt. The signal acquired from the BMC 33 is, for example, a signal output when an error occurrence is detected by error monitoring. In the second embodiment, the failure detection signal generated by the failure detection circuit 43 is output to the BMC 33 and the connection control circuit 44. When the BMC 33 receives the failure detection signal, the notification unit 41 notifies the middleware unit 32 and the standby server device 21 of the occurrence of the failure as described above.

  The connection control circuit 44 has a circuit configuration that outputs a signal for instructing an I / O circuit (I / O card) 37 to stop access when receiving a failure detection signal. Generally, an I / O circuit (I / O card) and an I / O device such as the database system 22 are connected by a communication method called a PCI (Peripheral Component Interconnect) Express I / F (Interface). . In this case, the connection control circuit 44 asserts (validates) the reset signal defined by the communication method, thereby stopping (cutting off) the connection with the database system 22 to the I / O circuit 37. To instruct. Upon receiving the instruction to stop the connection, the I / O circuit 37 stops (cuts off) the connection with the database system 22.

  The connection control circuit 44 includes configuration registers (not shown) corresponding to the I / O circuits 35 to 37, respectively. Each configuration register stores information indicating whether or not a corresponding I / O circuit is a target for instructing a connection stop based on a failure detection signal. The connection control circuit 44 instructs the I / O circuit to stop the connection based on the information in the configuration register. The information stored in the configuration register can be rewritten by the BMC 33. As a result, by rewriting the information of the configuration register using the BMC 33, the I / O circuit to which the connection control circuit 44 instructs to stop the connection can be changed. For example, not only the I / O circuit 37 but also one or both of the I / O circuits 35 and 36 may be added to the I / O circuit instructed by the connection control circuit 44 to stop the connection.

  Hereinafter, an operation example when a failure occurs in the server device 21 of the second embodiment will be described with reference to FIG. FIG. 4 is a diagram illustrating an operation related to server switching performed by the server device 21 when a failure occurs.

  For example, suppose that at time T0 shown in FIG. 4, one of the active server devices 21 detects the occurrence of a failure. The server device 21 in which the failure has occurred (in FIG. 4, referred to as the active system) performs, for example, processing such as stopping processing based on the application program being executed by the control circuit 31 as failure handling processing.

  During the execution of the failure handling process, the failure detection circuit 43 in the active server device 21 detects the occurrence of a failure, and outputs a failure detection signal to the BMC 33 and the connection control circuit 44. Then, upon receiving the failure detection signal, the connection control circuit 44 instructs the I / O circuit 37 to stop (cut off) the connection between the control circuit 31 and the database system 22. Further, the notifying unit 41 of the BMC 33 notifies the standby server device 21 (standby A) that the failure has occurred in the active server device 21 by the connection circuit 42 (for example, time T1).

  On the other hand, the standby server device 21 (indicated as standby system A in FIG. 4) executes the switching process when notified that a failure has occurred in the active server device 21. In the second embodiment, the server device 21 of the standby system shifts to the normal operation state at the time T3 shown in FIG. 4 without executing the recovery process of the database system 22 after the switching process. That is, in the cluster system 20 of the second embodiment, the process of switching from the standby system to the active system due to the occurrence of a failure is completed.

  Here, a switching process as a comparative example with respect to the switching process in the second embodiment will be described. In this comparative example, the server device configuring the cluster system does not include the board unit 34 in the second embodiment and the notification unit 41 of the BMC 33. For this reason, in the comparative example, the server device functioning as the standby system (indicated as standby system B in FIG. 4) monitors the output status of the heartbeat signal periodically output from the active server device in the standby state. I do. During the monitoring of the heartbeat signal, when the output stop of the heartbeat signal due to the occurrence of a failure in the active server device is detected (for example, time T2 shown in FIG. 4), the standby server device (standby system B) Then, a switching process for switching to the active system is executed. Further, the standby server device performs a recovery process of the database system 22 subsequent to the switching process. After this recovery processing, the server device shifts to a normal operating state as an active system (time T4 shown in FIG. 4).

  The time required for the server device 21 in the second embodiment to switch from the standby system to the active system is shorter than the time required for the server device of the comparative example to switch from the standby system to the active system as described above. ing. For example, the time (T0-T1) required from the time when the active server device 21 detects the failure in the second embodiment to the time when the standby server device 21 (standby A) starts the switching process is: For example, 30 seconds. Further, the time (T1-T3) required for the switching process by the standby server device 21 (standby system A) is, for example, 110 seconds.

  On the other hand, the standby server device (standby system B) in the comparative example has a time period T0−T1 that is longer than the time period T0−T1 from when the active server device detects the occurrence of the failure until the switching process starts. It takes T2, for example, 90 seconds. Further, the standby server device (standby system B) in the comparative example requires 110 seconds, which is the same as the time (T1-T3), for the switching process, and 300 seconds, for example, for the recovery process. That is, the standby server device (standby system B) requires a time T2-T4, for example, 410 seconds, from the start of the switching process to the transition to the normal operation.

  Therefore, in the second embodiment, it takes time from when the active server device 21 detects the failure to when the standby server device 21 (standby system A) switches to the active system and shifts to the normal operation state. The time (T0-T3) is 140 seconds as described above. On the other hand, in the comparative example, the time (T0) required from the time when the active server device detects the failure to the time when the standby server device (standby system B) switches to the active system and shifts to the normal operation state. -T4) is 500 seconds. That is, by providing the configuration in the second embodiment, the time required to switch the server from the standby system to the active system due to the occurrence of a failure can be reduced to about one third of the time required to switch the server in the comparative example. .

  The server device 21 according to the second embodiment may have a function of periodically outputting a heartbeat signal, or may have a function of notifying occurrence of a failure as described above, so that the output of the heartbeat signal may be performed. The function may be omitted.

(Other embodiments)
Note that the present invention is not limited to the first and second embodiments, and can adopt various embodiments. For example, in the second embodiment, when the standby server device 21 is switched to the active system, the standby server device 21 does not execute the recovery process of the database system 22 after the switching process, and performs the normal operation. Move to the operating state. On the other hand, the standby server device 21 may execute the recovery process of the database system 22 after the switching process. In this case, the recovery process is executed, but by providing the configuration of the second embodiment, the time required for the recovery process can be shortened. That is, in the second embodiment, the server device in which the occurrence of the failure is detected quickly disconnects the connection with the database system 22, so that the server device in which the failure has occurred is improperly connected (accessed) to the database system 22. Can be prevented. For this reason, the occurrence of troubles due to improper connection in the database system 22 can be suppressed, and the time required for the recovery processing of the database system 22 is shortened.

  Furthermore, in the second embodiment, an example is shown in which the shared resource to which the plurality of server devices 21 are connected in common is the database system 22. On the other hand, as a shared resource, the plurality of server devices 21 may be commonly connected to another device such as a printer.

1, 21 server device 2, 31 control circuit 3, 40 machine control circuit 4, 43 fault detection circuit 5, 44 connection control circuit 7 server system 20 cluster system

Claims (7)

A control circuit that executes a process based on a computer program including a process of controlling a connection with a shared resource commonly connected to another server device;
A failure detection circuit for detecting that a failure has occurred in the own device;
When the failure detection circuit detects the occurrence of a failure, a connection control circuit that disconnects the connection with the shared resource,
A machine control circuit that notifies the other server device of the occurrence of the failure when the failure detection circuit detects the occurrence of the failure,
The control circuit, when a failure occurs in its own device, executes processing to stop processing based on the computer program,
The server device notifies the connection control circuit and the machine control circuit of a failure detection signal indicating that a failure has been detected during execution of the stop processing .   The server device according to claim 1, wherein the failure detection circuit has a circuit configuration that detects a failure based on signals acquired from the control circuit and the machine control circuit.   3. The server device according to claim 1, wherein the connection control circuit has a function of instructing the shared resource to disconnect the connection when receiving a failure detection signal from the failure detection circuit. 4. 4. The machine control circuit according to claim 1, wherein, when the failure detection circuit detects the occurrence of a failure, the machine control circuit notifies another server device of the occurrence of the failure without receiving an instruction from the control circuit. The server device according to claim 3.   The connection control circuit has a function of, when receiving a failure detection signal from the failure detection circuit, instructing the shared resource to disconnect the connection without receiving an instruction from the control circuit. The server device according to claim 1.   The server device according to claim 1, wherein the shared resource is a database system. A plurality of server devices connected to each other,
These servers have shared resources connected in common,
The server device is the server device according to any one of claims 1 to 6,
At least one of the plurality of server devices functions as a standby system, and the other server devices operate as active systems,
When a failure occurs in the server device operating as an active system, the control circuit in the standby system server device generates a failure from the machine control circuit provided in the active server device. A server system that transitions from a standby state to a normal operating state when notified.

Images