JPH11296492A - Control method and device for multi computer system recovery and machine readable recording medium recording program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable flexible performance such as distributing a performance load among computers in normal performance, which is impossible in a conventional technique that fixedly decides a computer beforehand by which recovery processing is executed by having a computer of the lowest system load at that time out of computers operating normally execute the recovery processing when a fault occurs to a computer in a multi computer system. SOLUTION: A load information recording means 4 monitors performance load conditions of each of computers A, B and C at every constant interval of time and records them in a load information management file 3. When a fault occurs to a computer (for example, A), a fault notification means 7 selects a computer (for example B) of the lowest performance load out of computers which normally operate, and notifies it of the fault. A recovery control means B-8 of the computer B to which the fault is notified performs the recovery processing on the basis of data image before updated in a update recording file 5, and releases exclusion state.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multi-computer system in which a plurality of computers share data and perform exclusive control so that inconsistency does not occur in the shared data. Recovery control technology in cases.

[0002]

2. Description of the Related Art Conventionally, in a recovery control system of this kind of multi-computer system, when a failure occurs during execution of a business processing program on a certain computer, a failure is notified to another predetermined computer, and the failure is notified. The computer receiving the notification recovers the data being updated, so that no inconsistency occurs in the shared data.

One example of a conventional recovery control system is described in Japanese Patent Application Laid-Open No. 63-98764.

The system described in this publication is a multi-computer system having an external shared storage unit. In a multi-computer system, each computer constituting the multi-computer is provided with a file for updating file data in response to an execution result of an application program. A file access control unit for accessing the storage unit, and updating of the updated information in the recovery information storage area corresponding to the own computer in the external shared storage unit in response to the update of the file data by the access of the file access control unit Recovery information storage means for storing in order, monitoring means for monitoring the operation status of other computers,
When an abnormality of another computer is detected by this monitoring means,
If the other computer is a computer that performs recovery processing on its own computer, a recovery device that recovers file data of the other computer using information in a recovery information storage area corresponding to the other computer It is.

[0005] The recovery control system having such a configuration operates as follows.

In order to detect the downtime of each computer in the multi-computer system, a health check signal is exchanged between the computers. If the signal does not arrive even after the elapse of a certain time, it is detected as a failure of the computer, and it is determined whether or not the computer performs a recovery process. When a computer fails, which computer performs the recovery process is determined in advance. If it is determined that the recovery process is to be performed on the computer, the faulty computer that is still under exclusive control is forcibly imported to the computer, and the recovery information of the faulty computer Is read, and a recovery process is executed if necessary.

Another method is disclosed in Japanese Patent Application Laid-Open No. 4-21986.
No. 0 publication.

The system described in this publication is a loosely-coupled computer system comprising a plurality of hosts and having a multi-system control processor for exclusively controlling a shared resource among the hosts, a monitoring timer for monitoring time for each host, A monitoring timer starting means for starting a monitoring timer corresponding to each host when each host starts using the multi-system control processor; and a multi-system for resetting the monitoring timer within a predetermined time and determining that the corresponding host is in use. A monitoring timer reset means for communicating to the control processor, a host failure detection means for detecting a failure of the host corresponding to a case where the monitoring timer is not reset within a fixed time, and a failure of a certain host detected by the host failure detection means. Host failure notifier that notifies other hosts to that effect And a recovery order definition means for defining in advance recovery order definition information for determining a recovery host for performing cleanup processing of the host when the host fails. The host operation information acquisition means for acquiring the host operation information held by the multi-system control processor when the failure of the host is notified, and the host operation information acquired by the host operation information acquisition means and the recovery order definition means A recovery host determining unit that determines whether or not the own host should perform recovery and which host should perform recovery by comparing with the recovery order definition information, and the own host is a recovery host by the recovery host determining unit If it is determined that the failed host will be cleaned up Having a host and a recovery activation means for moving.

The recovery control system having such a configuration operates as follows.

Each host previously defines recovery order definition information for determining a recovery host for performing a cleanup process of its own host when its own host has failed by the recovery order definition means. Then, the host operation information acquisition unit acquires the host operation information held by the multi-system control processor when the host failure of the other host is notified, and the recovery host determination unit acquires the host operation information acquired by the host operation information acquisition unit. By comparing the information with the recovery order definition information defined by the recovery order definition means, it is determined whether or not the own host should perform recovery and which host should be recovered,
When the recovery host determining means determines that the own host is the recovery host, the recovery starting means starts the trouble-shooting process of the failed host.

[0011]

In the above-described recovery control method in the conventional multi-computer system, the computer that performs recovery processing when a failure occurs in a certain computer is fixedly determined, and is responsible for recovery processing. It is necessary to always operate such a computer with an allowance for the operation load of the processor and the like in preparation for the failure of the other computers. In other words, if the operating load does not have a margin, the other computer may fail when the operating load of the computer performing the recovery process is high. This is because normal work is delayed or recovery processing cannot be performed quickly. As described above, in the conventional recovery control method, it is necessary to provide a margin for the operation load of the computer in charge of the recovery process. Therefore, during normal operation, the operation load is distributed among the computers. There is a problem that it is difficult to perform flexible operations.

[Object of the Invention] The object of the present invention is to
Data composed of a plurality of computers and necessary for execution of the business processing program is shared as shared data that can be updated and referred to by all of the constituent computers. However, in a multi-computer system that can be executed, if a failure occurs that makes it impossible to continue execution of the business processing program while a business processing program is being executed on a certain computer, a computer other than the computer that is operating normally In the recovery control, the recovery processing is performed on the computer with the lowest operation load at that time, which eliminates the need to fixedly determine the computer to perform the recovery processing in advance and enables more flexible operation. To provide technology.

[0013]

SUMMARY OF THE INVENTION A multi-computer system recovery control apparatus according to the present invention has the following objects.
When updating shared data (1 in FIG. 1) from a certain business processing program, exclusive control for performing control to prevent simultaneous updating from another business processing program so that inconsistency does not occur in the shared data (1 in FIG. 1). Means (FIG. 1-2) and update record management means (FIG. 1-5) for storing a data image before update in an update record file (5 in FIG. 1) when an update process to the shared data (1 in FIG. 1) occurs. 1-6), when a computer that cannot continue the execution of the business processing program occurs while the business processing program is being executed, among the normally operating computers other than the computer, A fault notifying means (7 in FIG. 1) for notifying a computer having a fault to a computer with the lowest operating load at the time point is provided for each of the computers (A, B, and C in FIG. 1). Computer failure When the computer has been notified, the data being updated from the update record file (5 in FIG. 1),
Recovery control means for reading the data image before update, restoring the data that was being updated to the state before update, and releasing the exclusive state of the shared data that has been subjected to exclusive control and cannot be updated (FIG. A-8, B-8, C-
8).

In this configuration, when a failure occurs in a certain computer (for example, A in FIG. 1) among the computers (A, B, and C in FIG. 1) constituting the multi-computer system, the failure notification means ( 1) of the normally operating computers (B and C in FIG. 1) has a fault in the computer with the lowest operation load (eg, B in FIG. 1) at that time. Notify the computer and perform recovery processing.

Further, the multi-computer system recovery control device of the present invention allows each of the computers (A, B, C in FIG. 1) to be started at a predetermined time interval so that the recovery process can be started promptly when a failure occurs. Load information recording means (4 in FIG. 1) for obtaining operation load information indicating the operation load of the above and recording it in the load information management file (3 in FIG. 1), and the failure notification means (7 in FIG. 1) Among the normally operating computers, the computer with the lowest operation load indicated by the operation load information recorded in the load information management file (3 in FIG. 1) is assigned to the failed computer. A configuration for notifying is provided.

In this configuration, the load information recording means (4 in FIG. 1) obtains the operation load information indicating the operation load of each computer (A, B, C in FIG. 1) at regular time intervals, and obtains the load information. It is recorded in the management file (3 in FIG. 1). Then, a computer (for example, A in FIG. 1) among the computers (A, B, and C in FIG. 1) constituting the multi-computer system.
In the event of a failure, the failure notification means (7 in FIG. 1)
In the normally operating computers (B and C in FIG. 1), the computer having the lowest operation load indicated by the operation load information recorded in the load information management file (3 in FIG. 1) is faulty. Notify the computer where the error occurred.

Further, the multi-computer system recovery control device of the present invention can obtain an accurate operation load of a computer at the present time and can reduce a delay of a normal operation of the computer due to an operation load information acquisition process. Therefore, when a computer (for example, A in FIG. 6) in which execution of the business processing program cannot be continued occurs, a normally operating computer (FIG. 6A) other than the computer (A in FIG. 6) occurs. 6
B, C), obtains the operation load information indicating the operation load of the computer, and selects a computer having the lowest operation load based on the obtained operation load information (see FIG. 6).
9), and the failure notification means (7a in FIG. 6)
A configuration is provided in which the computer having the lowest operating load selected by the load state reference means (9 in FIG. 6) is notified of the failed computer.

In this configuration, when a computer (for example, A in FIG. 6) in which execution of the business processing program cannot be continued occurs, the load state reference means (9 in FIG. 6)
Obtains the operation load information indicating the operation load from the normally operating computers (B and C in FIG. 6) other than the computer (A in FIG. 6), and determines the most operation load based on the obtained operation load information. Choose a computer with a lower score. Load state reference means (FIG. 6)
9) selects the computer with the lowest operation load, the failure notifying means (7a in FIG. 6) causes the load state referring means (FIG. 6).
The computer selected in step 9) is notified of the failed computer.

[0019]

Embodiments of the present invention will now be described in detail with reference to the drawings.

FIG. 1 is a block diagram showing a configuration example of the first embodiment of the present invention, and is a block diagram in a case where three computers constitute a multi-computer system.

Referring to FIG. 1, in a first embodiment of the present invention, data which is constituted by a plurality of computers A, B, and C and which is necessary for executing a business processing program is described.
In a multi-computer system that is shared as shared data 1 that can be updated and referenced from all the computers as constituent elements and that can be executed by any of the computers A, B, and C, the same business processing program is shared by a certain business processing program When updating data 1, exclusive control means 2 for performing control to prevent simultaneous updates from other business processing programs so that inconsistency does not occur in shared data 1, and each computer A, B,
The operation load status of the computers A, B, and C, such as the operation load status of a processing processor (not shown) that executes the business processing program in C, is monitored at regular time intervals, and information on the load status at each time point is obtained. Load information recording means 4 for sequentially recording in the load information management file 3; update record management means 6 for storing a data image before update in the update record file 5 when an update process to the shared data 1 occurs; , B, and C, when a failure that makes it impossible to continue the execution of the business processing program occurs during execution of the business processing program, the failure is detected and recorded by the load information recording unit 4. The contents of the load information management file 3 are retrieved, and among the normally operating computers other than the computer in which the failure has occurred, the operating load of the computer at that time is the highest. The fault notifying means 7 for notifying the generated calculator obstacle to have the computer, each computer A, B, C
Provided for each computer, and when a failure notification is sent to the corresponding computer, a data image before update of the shared data 1 being updated is read from the update record file 5 stored by the update record management means 6 and updated. The data that was in the middle of the process is restored to the state before the update, and the data that has been put into the exclusive state by the exclusive control means 2 and cannot be updated is further deleted.
Recovery control means A-8 for setting an updatable non-exclusive state,
B-8 and C-8.

Each of these means has the following functions.

When the business processing program starts an update process on the shared data 1, the exclusive control means 2 causes a predetermined exclusive control unit (file, block, record, etc.) including the data to be updated to transition to the exclusive state. Accordingly, an update request from the other business processing program to the exclusive control unit is kept waiting, so that the data to be updated is simultaneously updated from the other business processing program and can be prevented from being destroyed. When the update processing from the business processing program to the shared data 1 is completed, the exclusive control unit 2 changes the exclusive control unit in the exclusive state to a non-exclusive state in which all the programs can be updated. . This makes it possible to perform processing according to the waiting access request.

The load information recording means 4 stores the operation load status such as the usage rate of the processing processors of the computers A, B, and C executing the business processing programs and the number of the business processing programs scheduled as the processing queue. Monitoring is performed at regular time intervals, and the obtained usage rates of the processing processors are stored in the load information management file 3 as operation load information indicating the operation loads of the computers A, B, and C.

When the business processing program starts the processing of updating the shared data 1, the update record management means 6 stores the data image of the predetermined unit including the update data before the update, the address information of the unit, and the business processing program. The identifier of the computer executing the program is stored in the update record file 5 in association with the identifier. Further, when the business processing program ends the data update processing, update end information indicating that the update processing has ended is added to the information stored in the update record file 5. Note that the above information may be deleted from the update record file 5 instead of adding the update end information.

When the failure notifying means 7 detects that a failure has occurred in any one of the computers A, B and C, the failure notification means 7 refers to the load information management file 3 to check the computer other than the failed computer. Obtains the latest operating load information at the time, further selects the computer with the lowest operating load at that time based on the obtained operating load information, and notifies the recovery control means of the computer of the failed computer. I do.

Recovery control means A-8, B-8, C-8
When the failed computer is notified from the failure notifying unit 7, the computer refers to the update record file 5 to determine whether or not there is data that is being updated by the failed computer. If there is any data having the status of, the data image before update of the data being updated stored in the update record management file 5 is extracted, and the content of the shared data 1 is updated based on the data image. Restore data.

Next, the operation of this embodiment will be described in detail with reference to FIG. 1, FIG. 2, FIG. 3, FIG. 4, and FIG.

FIG. 2 shows the exclusive control unit 2 and the update record management unit 6 when the business processing program executed on the computers A, B, and C starts the update process on the shared data 1.
This shows the flow of the processing.

The business processing program executed on any of the computers A, B, and C outputs an update request to the exclusive control means 2 when performing an update process on the shared data 1. Accordingly, if the exclusive control unit of the shared data 1 including the data to be updated by the business processing program is not in the exclusive state, the exclusive control unit 2 can update the exclusive control unit from another business processing program. A transition is made to an exclusive state that cannot be performed (step 2-1 in FIG. 2). Thereafter, the update record management means 6 associates the update record data with a predetermined unit including the data to be updated by the business processing program, the address information, and the identifier of the computer executing the business processing program. Recorded in file 5 (step 2-2), exclusive control means 2
Is instructed to start updating (step 2-3). Upon receiving the instruction, the exclusive control means 2 starts an update process (step 2-4).

FIG. 3 shows the flow of processing between the exclusive control means 2 and the update record management means 6 when the business processing program has finished updating the shared data 1.

The exclusive control means 2 notifies the update record management means 6 of the end of the data update processing to the shared data 1 when the business processing program ends the update processing of the shared data 1 (step 3 in FIG. 3). 1). Update record management means 6
Receives this notification, adds the update end information to the information stored in the update record file 5 in step 2-2 of FIG. 2 (step 3-2), and includes the update end information in the added information. The exclusive address information is notified to the exclusive control means 2 (step 3-3). The exclusive control means 2 updates the exclusive control unit indicated by the address information to a non-exclusive state accessible from another business processing program (step 3-4).

FIG. 4 shows the data format of the load information management file 3 recorded by the load information recording means 4. The load information recording means 4 is provided at a predetermined time interval,
Information N on the operation load status such as the usage rate of the processing processors and the number of business processing programs scheduled as queues in all the computers A, B and C.
a, Nb, Nc are obtained, and the obtained operation load information Na,
Nb and Nc are stored in the load information management file 3 together with the obtained time “hh: mm: ss” and computer identifiers A, B, and C that uniquely indicate the target computer. FIG. 4 shows a multi-computer system including three computers A, B, and C indicated by identifiers A, B, and C, and the time "hh: mm: s".
This is an example of the contents recorded in the load information management file 3 when the operation load information of the computers A, B, and C is acquired in “s”.

Next, the operation when a failure occurs will be described.

FIG. 5 shows a flow of a recovery process when a failure occurs in a certain computer which is executing the business process program.

When a failure occurs in the computer (for example, A) that executes the business processing program and the program cannot be executed, the failure notification unit 7 detects the failure (step 5-1 in FIG. 5). ), Referring to the load information management file 3, obtains operation load information on the computers B and C operating normally (step 5-2). Thereafter, the failure notifying means 7 selects a computer having the lowest operation load at that time based on the operation load information of the computers B and C (step 5-3). Now, for example, if the computer C is selected as the computer with the lowest operation load, the failure notifying unit 7 notifies the computer C that the failure has occurred and the identifier A of the computer A in which the failure has occurred. (Step 5-4).

On the other hand, in the computer C that has received the notification, the recovery control means C-8 refers to the update record file 5 (step 5-5), and the computer A in which the failure has occurred remains in the state of being updated. It is confirmed whether or not there is data (step 5-6). If there is no data in the middle of the update process, the process ends because the recovery process is unnecessary. On the other hand, if there is data being updated, the pre-update data image recorded in the update recording file 5 is extracted (step 5-7), and the data is restored to the state before the update processing (step 5-7). Step 5-8). When the data recovery is completed, the exclusive control means 2 updates the exclusive state of the data to a non-exclusive state (step 5-9). Through the above processing, the shared data 1 becomes consistent, and the business processing program running on the computers B and C can perform the processing using the data.
If necessary, after the processing of step 5-9 is completed, the computer C performing the recovery processing re-executes the update processing for the shared data 1 being executed by the computer A in which the failure has occurred. May be.

Next, the effect of the present embodiment will be described.

In this embodiment, if a failure occurs in a computer A during execution of a business processing program, the execution of the business processing program cannot be continued. Since the computer B or C having the lowest system load at that time can be selected from the normally operating computers B and C other than the computer A, the computer performing the recovery process is not required. It is possible to perform more flexible operation than a conventional recovery control system determined in advance. The embodiments described above exemplify a multi-computer system composed of three computers, but the same applies to a multi-computer system composed of four or more computers. Can be applied.

Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 6, according to a second embodiment of the present invention, data which is constituted by a plurality of computers A, B, and C and which is necessary for executing a business processing program is described in FIG.
In a multi-computer system that is shared as shared data 1 that can be updated and referenced from all of the computers A, B, and C as constituent elements and that can execute the same business processing program on any of the computers A, B, and C Exclusive control means 2 for performing control to prevent simultaneous updating from other business processing programs so that inconsistency does not occur in shared data 1 when the shared data 1 is updated from the business processing program, and update processing to shared data 1 Occurs, the update record management means 6 for storing the data image before the update in the update record file 5 and one of the computers A, B, and C
If a failure that makes it impossible to continue the execution of the business processing program occurs during the execution of the business processing program, operating load information indicating the operating load of the computer from a normally operating computer other than the computer concerned A load state reference unit 9 for collecting and selecting a computer with the lowest operation load at that time based on the operation load information;
If a failure occurs in any of B and C, the failure is detected and notified to the load state reference means 9.
When a computer with the lowest operation load is selected at that time, a failure notifying means 7a for notifying the computer of the occurrence of the failure, and a computer A, B,
In the case where a failure notification is provided to the corresponding computer provided for each C, the data image of the shared data 1 being updated is read from the update record file 5 stored by the update record management means 6 before the update, Recovery control means A for restoring data that was in the process of being updated to the state before the update, and for converting data that has been made exclusive and non-updatable by the exclusive control means 2 into an updatable non-exclusive state. −
8, B-8 and C-8.

As described above, this embodiment is provided with the fault notifying means 7a instead of the fault notifying means 7,
The difference from the first embodiment is that a load state reference unit 9 is provided instead of the load information management file 3 and the load information recording unit 4.

Each means shown in FIG. 6 has the following functions.

When the business processing program starts an update process on the shared data 1, the exclusive control means 2 changes a predetermined exclusive control unit including the data to be updated to the exclusive state. Further, when the update processing from the business processing program to the shared data 1 is completed, the exclusive control unit which has been in the exclusive state is transited to the non-exclusive state in which all the programs can be updated.

When the business processing program starts the update processing of the shared data 1, the update record management means 6 stores the data image of the predetermined unit including the update data before the update, the address information of the update unit, and the business processing program. The identifier of the computer executing the program is stored in the update record file 5 in association with the identifier. Further, when the business processing program ends the data update processing, update end information indicating that the update processing has ended is added to the information stored in the update record file 5.

When a failure occurs in one of the computers A, B, and C, the failure notification means 7a detects the failure and notifies the load state reference means 9 of the failed computer. In response, the load state referring means 9 notifies the normally operating computer with the lowest load at that point of time of the identifier of the failed computer.

The load state reference means 9 is provided with a failure notification means 7a.
When the notification of the occurrence of the failure is received from the computer, the operation of the computer such as the operation load of the processing processor executing the business processing program is performed from all the normally operating computers other than the computer in which the failure occurred. The operation load information indicating the load is acquired, and based on the information, a normally operating computer with the lowest system load at that time is selected and notified to the failure notification means 7a.

The recovery control means A-8, B-8, and C-8 provided in each of the computers A, B, and C respectively operate when the computer in which the fault has occurred is notified from the fault notifying means 7a.
Referring to the update record file 5, it is checked whether or not there is data being updated on the failed computer, and
If there is data that is being updated, the data image before the update of the data that is being updated stored in the update record file 5 is extracted, and the content of the shared data 1 is updated based on the data image. To recover data.

Next, the operation of this embodiment will be described in detail with reference to FIG. 6, FIG. 2, FIG. 3, FIG. 7, and FIG.

FIG. 2 shows a processing flow of the exclusive control means 2 and the update record management means 6 when the business processing program starts the update processing of the shared data 1, and is shown in the first embodiment. This is the same as the processing flow when the business processing program starts the update processing of the shared data 1.

FIG. 3 shows the flow of processing between the exclusive control means 2 and the update record management means 6 when the business processing program ends the update processing of the shared data 1, and is shown in the first embodiment. This is the same as the processing flow when the business processing program ends the update processing of the shared data.

FIG. 7 shows the format of the information on the operation load status obtained from the computers B and C which are operating normally by the load state reference means 9 at the time when a failure occurs in the computer A.

The load state reference means 9 determines the usage rates of the processing processors and the waiting time in all the normally operating computers when the failure notification means 7a notifies that the failure has occurred in the computer A. Information Nb and Nc relating to the operation load status such as the number of business processing programs scheduled as a matrix and identifiers B and C uniquely indicating the computers B and C are acquired, and the acquired operation load information Nb and Nc are acquired.
From the computer B or C with the lowest operating load at that time
And notifies the failure notifying means 7a of the identifier B or C of the selected computer. FIG. 7 shows a multi-computer system comprising three computers whose computer identifiers are indicated by A, B, and C, respectively. B,
It is an example of the content of the operation load information Nb, Nc of C.

Next, the operation when a failure occurs will be described.

FIG. 8 shows the flow of a recovery process when a failure occurs in a computer which is executing a business process program.

When a failure occurs in the computer (for example, A) that executes the business processing program and the program cannot be executed, the failure notification unit 7a detects the failure (step 8-1 in FIG. 8). ), And notifies the load status reference means 9 of the occurrence of the failure and the identifier A of the computer A in which the failure has occurred (step 8-2).

The load state reference means 9 operates on all the computers B and C other than the computer A in which the failure has occurred, such as the usage rate of the processing processors and the number of operation processing programs scheduled as queues. Information Nb, Nc and identifiers B, C uniquely indicating the computer are acquired from each computer (step 8-3), and from the acquired operation load information Nb, Nc, the computer with the lowest operation load at that time ( For example, computer B) is selected and notified to the fault notification means 7a (step 8-4). The failure notifying means 7a is provided for the computer B selected by the load state referencing means 9.
Is notified of the occurrence of the failure and the identifier A of the failed computer (step 8-5).

On the other hand, in the computer B that has received the notification, the recovery control means B-8 refers to the update record file 5 (step 8-6), and the computer A in which the failure has occurred remains in the state of being updated. It is confirmed whether or not there is data (step 8-7). If there is no data in the middle of the update process, the process ends because the recovery process is unnecessary. On the other hand, if there is data being updated, the pre-update data image recorded in the update recording file 5 is extracted (step 8-8), and the data is restored to the state before the update processing (step 8-8). Step 8-9). When the data recovery processing is completed, the exclusive control means 2 updates the exclusive state of the data to a non-exclusive state (step 8-10).
By the above processing, the shared data 1 becomes consistent, and the business processing program running on the computers B and C can perform the processing using the data.

Although the second embodiment described above exemplifies a multi-computer system composed of three computers, the same applies to a multi-computer system composed of four or more computers. The same can be applied to a computer system.

In the present embodiment, the failure notifying means 7a performs the process of acquiring the operation load information indicating the operation load of the computer only when the computer in which the failure has occurred is detected. Compared with the first embodiment in which the processing for acquiring the operation load information is performed, it is possible to obtain the accurate operation load of the computer at the present time, and to perform the normal operation of the computer by the processing for acquiring the operation load information. Delay can be reduced.

FIG. 9 is a diagram showing an example of a hardware configuration for realizing the multi-computer system recovery control device shown in FIG. 1 or FIG. 6. The computer 91, the recording medium 92, and the recovery control means A- 8, B-8, C-
8 are provided with computers A, B, and C. The recording medium 92 is a disk, a semiconductor memory, or another recording medium, in which a multi-computer system recovery control program is recorded.

To realize the multi-computer system recovery control device shown in FIG. 1, the computer 91 reads the multi-computer system recovery control program recorded on the recording medium 92. As a result, the multi-computer system recovery control program controls the operation of the computer 91 and
Exclusive control means 2 and load information recording means 4 shown in FIG.
And the update record management means 6 and the failure notification means 7 are realized.

In order to realize the multi-computer system recovery control device shown in FIG. 6, the computer 91 reads the multi-computer system recovery control program recorded on the recording medium 92. As a result, the multi-computer system recovery control program controls the operation of the computer 91, and the exclusive control unit 2 and the update record management unit 6 shown in FIG.
The failure notification unit 7a and the load state reference unit 9 are realized.

[0064]

The first effect is that during normal operation,
The point is that flexible operation such as distributing the operation load among computers becomes possible. The reason is that, at the time of occurrence of the failure, the computer having the largest operating load is selected as the computer that executes the recovery process.

The second effect is that when a failure occurs, the recovery process can be started quickly. The reason is,
The load information recording means obtains operation load information indicating the operation load of each computer at regular time intervals and records it in a load information management file, and when a failure occurs, the failure notification means based on the contents of the load information management file. Determines the computer that performs the recovery process.

The third effect is that an accurate operation load of the computer at the present time can be obtained, and a delay of the normal operation of the computer due to the processing of obtaining the operation load information can be reduced. The reason is that only when a failure occurs in a certain computer, the load state reference means obtains the normal operation load of the computer.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration example of a first embodiment of the present invention.

FIG. 2 is a flowchart showing a processing example of an exclusive control unit 2 and an update record management unit 6 when a business processing program starts an update process on shared data 1 in the first and second embodiments.

FIG. 3 is a diagram showing a state in which the business process program ends the process of updating the shared data 1 in the first and second embodiments.
9 is a flowchart illustrating a processing example of the exclusive control unit 2 and the update record management unit 6;

FIG. 4 is a diagram showing an example of the contents of a load information management file 3;

FIG. 5 is a flowchart illustrating a processing example according to the first embodiment when a failure occurs;

FIG. 6 is a block diagram illustrating a configuration example of a second embodiment of the present invention.

FIG. 7 is a diagram illustrating an example of load state information acquired by a load state reference unit 9;

FIG. 8 is a diagram illustrating a processing example according to the second embodiment when a failure occurs;

FIG. 9 is a block diagram illustrating an example of a hardware configuration that implements the first and second embodiments.

[Explanation of symbols]

 A, B, C Computer 1 Shared data 2 Exclusive control means 3 Load information management file 4 Load information recording means 5 Update record file 6 Update record management means 7, 7a Fault notification means A-8 , B-8, C-8: Recovery control means 9: Load state reference means 91: Computer 92: Recording medium

Claims (7)

[Claims] 1. A system comprising a plurality of computers and sharing data necessary for execution of a business processing program as shared data which can be updated and referred to by all of the constituent computers. In a multi-computer system in which a program can be executed by any computer, when a certain business processing program updates the shared data, an exclusive control is performed to prevent simultaneous updating from another business processing program, When the update process occurs, the data image before the update is stored in the update record file, and if the computer that cannot continue the execution of the business process program occurs during the execution of the business process program, Among the normally operating computers other than, a computer with the lowest operating load at that time The computer that has generated the failure has been notified, and the computer that has been notified of the failed computer reads the data image before update of the data being updated from the update record file, and restores the data that was being updated to the state before update. A multi-computer system recovery control method, comprising recovering and releasing the exclusive state of shared data that has been exclusively controlled and cannot be updated. 2. A computer in which operation load information indicating the operation load of each computer is obtained and recorded in a load information management file at regular time intervals, and execution of the business processing program cannot be continued. Informing the computer having the lowest operation load indicated by the operation load information recorded in the load information management file among the normally operating computers other than the computer concerned, of the failed computer. 2. The multi-computer system recovery control method according to claim 1, wherein: 3. When a computer in which execution of the business processing program cannot be continued occurs, an operation load of a normally operating computer other than the computer is determined, and a computer having the lowest operation load is determined. 2. The multi-computer system recovery control method according to claim 1, wherein a computer in which a failure has occurred is notified. 4. The same business processing is performed by sharing data that is composed of a plurality of computers and that is necessary for executing a business processing program as shared data that can be updated and referenced from all the computers as constituent elements. In a multi-computer system in which a program can be executed by any computer, when a certain business processing program updates the shared data, exclusive control means for performing exclusive control for preventing simultaneous update from another business processing program, Update record management means for storing the data image before update in the update record file when update processing to shared data occurs, and it becomes impossible to continue the execution of the business processing program while the business processing program is running If a failed computer occurs, it will be the most frequently operating computer other than the computer at that time. Failure notification means for notifying a computer with a low operation load of a computer in which a failure has occurred; provided for each of the computers, and when the computer in which the failure has occurred is notified to a corresponding computer, updating is performed from the update record file. Reads the data image of the intermediate data before the update, restores the data that was being updated to the state before the update, and releases the exclusive state of the shared data that has been subjected to exclusive control and is in an unupdateable state. A multi-computer system recovery control device comprising: a recovery control unit. 5. A load information recording unit for obtaining operation load information indicating an operation load of each computer at a fixed time interval and recording the obtained information in a load information management file, and wherein the failure notification unit operates normally. Of the computers having the lowest operation load indicated by the operation load information recorded in the load information management file among the computers that have failed. The multi-computer system recovery control device according to claim 4. 6. When a computer in which execution of the business processing program cannot be continued occurs, operation load information indicating the operation load of the computer is acquired from a normally operating computer other than the computer, A load state reference unit that selects a computer with the lowest operation load based on the acquired operation load information, and the failure notification unit determines a computer with the lowest operation load selected by the load state reference unit. 5. A configuration for notifying a computer in which a failure has occurred by using a computer.
A multi-computer system recovery control device as described. 7. Data that is composed of a plurality of computers and that is necessary for executing a business processing program is shared as shared data that can be updated and referenced from all the computers as constituent elements. A recording medium for recording a program for performing a recovery control of a multi-computer system provided with a recovery control means by a computer, wherein the computer executes another business when a business processing program updates the shared data. An exclusive control unit for performing exclusive control for preventing simultaneous updating from a processing program; an update record management unit for storing a data image before update in an update record file when an update process to the shared data occurs; During execution, there was a computer that was unable to continue execution of the business processing program In this case, among the normally operating computers other than the computer concerned, a program for functioning as a failure notifying means for notifying the computer with the lowest operation load of the failed computer at that time is recorded. Machine readable recording medium.