200825724 九、發明說明： 【發明所屬之技術領域】 a 本發㈣關於多主機系統或叢鮮統之服務接管技術，特別 係關於一種高可用性叢集系統之服務接管系统及方法。 【先匈技術】 目麵了使運行重要鶴之電齡統提料間_服務，最 普通的做法是佈置高可用（H她Available)之叢集(Cluster)或多主 •機系統。高可用叢集通常由至少兩台主機構成，在對外提供服務 之過私中，一台主機提供正常的服務，其它主機則處於"待命,， 狀態。並且各個主機之間透過〜跳㈤涵⑻,，機制實現運作 狀態之互相監控。 例如「第1圖」顯示了一種典型高可用性之叢集結構示意圖， 在圖示實例中，整個系統即主機系統10由兩台主機構成，主機 12與主機14，並分別具有__私有網際協定㈤讀心贈 φ Protocol ’ Private正）位址 192 168 〇1 及 i92 i68 〇2，但主機系統 10對外提供服務則透過一可訪問之公共網際協定位址，或稱網際 協定_ic她酬細c〇1，觸cIp)位址1〇此^ -通過公共網際協定位址訪問主機系統10，從客戶端之角度來看， '整個系統就是—台提供-公共網際協定位址:1α1α11()之主機系 統，所以整個系統對客戶端隱藏了具體的結構。兩個主機u i 14之間通過“心跳”鋪互相侧對方之狀態，當“待命，，主機 檢測^目祕供服務之主贿生故障而不能提供服務或運作狀態 不穩定時’由“待命，’主機接管公共網際協定位址及工作，對外 200825724 提供服務。發生轉之主_進行錯誤恢復，當恢制正常狀態 後’則f於“待命” I態，隨時準備接管發生故障主機之服務。 目月ϋ所有的叢集所提供之服務幾乎都可以透過網路實現，並 且透過網路提供服務才材能魏服務在㈣魏之多個主機之 ，，無間斷切換。但是，透過公共網際協定位址胃賴m 務性肢不_，因此崎協定紐接管後服務是否·也存在 不同。例如’-些服務可以在網際協定位址接管后立刻提供，例 =，，，屯網路服務之動態主機組態協定（DHcp)、領域名稱服務 ⑽s，DomamNameSeryice)、終端機模擬協定巾㈣和靜 態網葉網補覽之超文件傳定（黯）服務，妙服務只要 有-個與絲故障主機—樣陳小的配置播就可以啓動，即可以 無間斷的對外提供服務。， 反之’播案傳送協定（FTP)、超文件傳送協定等 檔案服航未必簡対瞧歸，目為這魏絲提供網路連 接外’級供存放齡之空間，存放難空間需要有準備的時間， 需要保證目丽提供服務之主機存放稽空間與原紐供服務主機之 存放播空間為同-位置。此外，如果通過網路提供對區塊設傷之 訪問服務’例如網路小型電腦系統介面（iscsi)，這種情況就更 =複雜。域不但需要提供對外連接服務，還需要保證故障切換 前和切換後之磁碟為同-個’不能在切換過程中變更實體訪.問磁 碟。在這種情況下，服務不能被立即接管，而需要等待磁碟系统 都準備好才可以執行。 200825724 因此，在運作主機及時接管了網際協定，如果在接管前沒有 做好充分的軟硬體環境準備，尤其是需較長時間硬體準備之後才 能安全接管瓣麟之航下，例如網削、型電⑽道介面服務 必/頁保也在網際協疋位址和網路服務本身接管前，硬碟和相應的 、廉價磁碟冗餘陣列（RAID，Redundant 乂 ___200825724 IX. Description of the invention: [Technical field to which the invention pertains] a This document relates to a service takeover technology for a multi-master system or a cluster system, and more particularly to a service takeover system and method for a high availability cluster system. [First Hungarian Technology] The most common approach is to deploy a highly available cluster or a multi-master system. A high-availability cluster is usually composed of at least two hosts. In the private service of external services, one host provides normal services, and the other hosts are in a state of "standby,". And each host communicates with each other through the function of ~hop (five) culvert (8). For example, "Figure 1" shows a typical high-availability cluster structure. In the illustrated example, the entire system, host system 10, consists of two hosts, host 12 and host 14, and each has a private network protocol (5). Read the φ Protocol 'Private Positive' address 192 168 〇1 and i92 i68 〇2, but the host system 10 provides external services through an accessible public Internet Protocol address, or Internet Protocol _ic 〇1, touch cIp) address 1 〇 this ^ - access to the host system 10 through the public Internet Protocol address, from the client's point of view, 'the whole system is - Taiwan provides - public Internet Protocol address: 1α1α11 () The host system, so the entire system hides the specific structure from the client. The two hosts ui 14 are placed on each other's side by "heartbeat". When "standby, the host detects that the main service of the secret service is faulty and cannot provide service or the operating state is unstable" is "standby," 'The host takes over the address and work of the public Internet Protocol and provides services to the external 200825724. The master of the transfer _ performs error recovery, and when the normal state is restored, then f is in the "standby" I state, ready to take over the service of the failed host. The services provided by all the clusters can be realized through the Internet, and the services provided by the network can serve the four hosts of Wei, without interruption. However, through the public Internet Protocol, the address of the stomach is not the same, so there is also a difference in the service after the Kawasaki agreement. For example, '-some services can be provided immediately after the Internet Protocol address is taken over, for example, Dynamic Host Configuration Protocol (DHcp), Domain Name Service (10)s, DomamNameSeryice), Terminal Simulator (4) and Static network leaf network to browse the super-file transfer (黯) service, as long as there is a --wire failure host - like a small configuration broadcast can start, that is, can provide external services without interruption. On the contrary, the file delivery service (FTP), super file transfer agreement and other files may not be easily returned. The purpose of this is to provide a network connection outside the 'level for storage space, storage space needs to be prepared Time, it is necessary to ensure that the host storage space of the service provided by the eye is the same as the location of the original host for the service host. In addition, this situation is even more complicated if the access to the block is provided through the network, such as the network small computer system interface (iscsi). The domain not only needs to provide external connection services, but also needs to ensure that the disk before and after the failover is the same - the disk cannot be changed during the switching process. In this case, the service cannot be taken over immediately, and it needs to wait for the disk system to be ready to execute. 200825724 Therefore, the operation host timely took over the Internet Protocol. If the software and hardware environment preparation is not completed before the takeover, especially after a long time of hardware preparation, it can safely take over the air, such as meshing, The type of power (10) channel service must be / page security before the Internet protocol address and the network service itself take over, the hard disk and the corresponding redundant array of cheap disks (RAID, Redundant 乂 ___
Disks)邏輯卷（Lv)設置已經準備好，因為涉及到硬體準備通 常需要較多的時間，通常至少需要3〇秒鐘左右，在沒有準備好前 籲，果通過此網際協定位址訪問這個服務，就會造成“服務拒 、巴"進而發生拒絕訪問錯誤。系統會以此給出服務報告錯誤， 因此習知技術無法實現服務的無間斷及透明接管。 【發明内容】 為了解決上述習知技術中的問題與缺陷，本發明之目的在於 提供一種多主機系統之服務接管系統及方法，藉以在多主機系统 之提供服叙錢發纽料，奸域關安全、無間斷 且透明地接官其網際協定位址及服務，以保證服務的正常運行及 功能的正常使用。 . . - 人為達上述目的，本發明所揭露之—種服務接衫統，應用於 編巾，服務主機 处ί Μ㈣定健對外提供服務，待命主機處於待 =軍2務主絲魅少-懈命域之_過心跳 監 官模組及—請求處理模組；於此，此網際協定位 接―痛猎由心跳機制判斷服務主機之運作狀態，並當服務 7 200825724 ^生故障時發送一資源釋放請求通知服務主機釋放其佔有的 並=際齡健絲務’ 服務主機謂相際協定位址 備完全之前，丟棄透過對外 中一待命域，服務接管模組個以準備鮮服務主機之服 =t主機所需之服務環境，以及接管服務。請求處理模組 =測财接管之輸魏賴雜，纽在服務環境未準 料包 網際協定位址對此服務訪問之請求資 此外，本發明所揭露之—種服務接管方法，應用於包含一服 機及至v自待命主機之多主機系統中，服務域盘至少一 個待命主叙間透過心職歓相餘雜，此方法包含以 ^驟：藉由心嶋_服務主機之運作狀態，並當服務主機 =故障轉送—魏請麵知職域，轉放其佔有的 際财健及服務；接管服務域之騎提供服務之-對 ^際協讀址至其巾—待命域；顿接管服務域之服務至 二、:備&全之"縣透過對外網際協定位址對此服務之訪問請 ,、貝料二卩及在服務%<鮮備完全之後接管服務，並接收對此 服務之關請求資料包，哺外提供服務。 拉其=^在夕主齡統及類似環境下透過網際協定位址及服務 故官提供:可用服務時，對於需要時間準備之服務接管，為了保 也發生故^之錢服務麵_定位輯接管後安全無誤地提供 對外服4目此在服務接f之群備接管服務所需之服務環境， 亚在準備兀成之縣棄對服務的請求資料包。進而不斷地侦測服 200825724 準備狀態，直至準#完成之後以執行服務的接管與對外 提供服務。 因此，本發明具有以下優點：不僅保證了具有快速接管特性 2服務關快速，縣料驗輕叙敎下客戶端 -二服務主機_連接不中斷，實現多主機魏騎協定位址及服 務的無間斷及透明接管。 【實施方式】 明如^關本發明之特徵與實作，兹配合圖示作最佳實施例詳細說 多主:ΠΓ圖」’係顯示了本發明之多主機服務接管系統， 夕機糸、、先包卜服務主機及至少一個待命主機，例如「第 所示之實施例中，多主機系統1G包含主機12及物」 設主機12為服務主機， 叹 化不里假 待人主们Γ 為—待命主機，且服務主機12與 寺:機U之間透過心跳機制互相監控運作狀態。因此，針對習 =奴上姻題’本發攸Μ機黯接H _ 下文中將對上述各娜組作詳細朗。 镇、，且26 本發明之娜齡她鮮额2G侧叫 之服務峨12發生轉之後，使得紅待命雜之射—主機= 機㈣则峨她1咖.㈣猶過去: 子=固^主機時，關於由哪個待命主機接管服務可以隨機選 ^ . -<、P主機都會4圖接管此故障主機的網際協定位址和服 200825724 務’但為了防止多個 成冲突，目前廇泛採用^ 際協定位址和服務而造 令牌梅觀咖====== 個待命域擁有Mw Ί王板之間私動事衣，哪 嫌有7牌補有網際齡 裁機制就是無論哪一個待A㈣p收视務的接吕我務，仲 之前都#偏㈣ 即料接管網際協定位址和服務 定，，，列執行“有鎖定，，，如果沒有“鎖 …鎖疋’然後接管網際協定位址和服務，反之如 户入;入*鎖Ο則結束，不進行接管。這兩個技術用于防止 Γ 机同时接管網際協定位址和服務而造成的冲突，是 而要指出的是，本發明之待命主機接管服務之技術並不局限於上 述兩種。 之纟接吕之待命主機發送指令要求此故障服務主機將苴 對频供服務之崎齡健釋放。由此，絲關此對外網際 協定位址10.10.U0之各戶端電腦或應用程式仍然、透過此位址訪 馨問C騎I際财此網際協定位址和提供服務之主機已經變化 為另一主機。 在待命主機Μ接管原服務主機丨2之網_定位址之後，對 於例如純網路服務及靜態網頁網站瀏覽服務等可透過服務接管模 組22立即接管，並對外提供。但對於需要接管環境之服務，例如 網路小型電腦系統介面（iSCSI)、檔案傳送協定（FTp)、伺服器 訊息區塊/公用網際網路檔案系統（SMB/CIFS)、網路檔案系統 (NFS)等網路區塊設備服務及播案服務，需要一定時間之軟體 準備（少數情況）及硬體準備（多數情況），只有執行上述服務接 10 200825724 矛=才能f過所接管之網際協定位址及時、安全地提供服 力 服矛力接官模組22則需要在服務 .故障咖2«驻騎咖4输鏡魏w此 -同'模組22之接管環境準備隨服務類型的不同而不 。接錄務f要提群備好接管 硬 ::叫而有些服務則不需要準備接管環境^ 逮地接官。因此，服務接管模組 、 準備進行觸。如果不f要祕:要對接g服務以需要環境 務接其rHM 即接管此服務；否則，服 f ^ίίΓ 〇 介二 r、==;、:^ _案系統（叫贿器罐塊/公 、】而要㈣準備服務環境；相反，對力 ==態主機組態協定（啦P)、領域名稱服路 服矛力接賴組22财需斜群備服務魏。 4 非常耗時的軟硬體準備主要是與硬體待 ' 磁帶_備非常耗時（如等待磁碟被她U放— ^轉到開頭位置，創建廉價磁碟冗餘陣列（嶋^ ^有^===2顧準備則需要等待一個超時二 Ή服矛力了此4要更改配置槽案或者更改路捏等。 11 200825724 對於服務接管則比較容易，只需要重新啓動或啓動本主機上之服 務程式即可。 多主機系統之對外服務不但包含網路小型電腦系統介面等區 •塊設備訪問魏，也提供了難傳送協定（FTp)、舰器訊息區 . 塊/公用網際網路檔案系統（SMB/CIFS)、網路檔案系統（NFS) 等檔案訪問功能。另外，還提供了遠端登入協定（SSH)、終端機 模擬協定（Telnet)、用戶介面（WebUI)等管理功能，同時提供 • 了動態主機組態協定（DHCP)、領域名稱服務（DNS)等網路功 能。這些服務大致可以分為兩類：第一類服務如網路小型電腦系 統介面、檔案傳送協定、伺服器訊息區塊/公用網際網路檔案系 統、網路播案系統等服務，這類服務需要與硬體資源約定，例如 網路小型電齡統介面必紋對某個確定的磁盤的操作，而槽案 傳达協定、恤1訊息區塊/公賴際網純m、網路標案系 統等共用必須基於某個確定的磁盤上的某個目錄。第二類服務如 嫌遠端登人協定、終端機模擬協定等管理功能和動態主機組態協 =、領，名稱服務等網路功能。這類服務基本與硬體資源無關。 只要计异機正書工作，網際協定位址正常提供就可以提供對外的 -服務’所以在以上雙控制器故障接管過程中，這兩類服務需要需 幾 要分別處理。 對於第-類服務，除保證故障後的連接性外，還需要保證訪 問的工間與發生轉雜問的空暇相同的。否顧戶訪問空間 曰發生文化’導致不能正常提供服務。_第—類服務在故障切 換WS要先將棚準餅，紐才能提供真正的服務。 12 200825724 對於第二類服務，需要保證故障發生後的快速連通性，需要 保也在故p早發生後不能有明顯的延遲。因為這些服務尤其是遠端 .$人财' 終端機模擬蚊、用戶介面之管理服務都與用戶體驗 密切相關’明_延遲會降低用戶的體驗品質。其中對於第—類 .服叙轉接管環境，她雜管模組22之資鮮級组24完 成。資源準備模組％係提供接管該服務之網路連接，以及提供= 該服務主機發生故障之前相同之訪問空間。其中當接管服務為产 #案服務時’該資源準備模組係提供與該服務主機發生故障之前^ 同位置之才田案存放空間；當接管服務為區塊設備訪問服務時，該 資源準備模組鱗備與服務主機發生故障之前為同—訪問服務^ 塊設備之區塊設備。 例如’對於磁碟陣列⑺址如…之儲存空間準備，資源準 備模綷24可執行步驟如下：發送指令要求故障主機釋放所佔用的 、碟》又備’如果故障主機還可以活動’則釋放這些硬碟設備，否 φ則因為已經擒掉，也就不冑要釋放硬碟設傷；重新起始化這些硬 碟之公共_空間，科讀取廉價刺冗餘_、邏輯卷之电穿 賴；根據廉價磁魏餘_之組歸料將這些硬碟分組組錢 -廉價磁魏餘_ ’此時廉價磁碟冗餘陣列還原；根據邏輯卷之 ί裝資料將廉價磁碟冗餘陣列劃分或啟動為不同的邏輯卷，此時 避輯卷還原。對_路小型電腦系統介面服務，需要將設備輸出 給相應的啟動器〇nltiatQ〇 ’對於播案傳送狀、伺服器訊息區 塊/公用網際網路槽案系統、網路槽案系統服務，將這些設備掛載 (mount)到♦曰疋的目錄’根據組裳資料分不同的廉價磁碟冗餘陣 200825724 列、邏輯卷全雜裝完成，朗财設備鱗備料止，此時所 有的硬體資源才準備完畢。 九 對網際協定位址接管模組20及服務接官模組22對 故障主機之他接料及服務鮮狀環鮮触行了說明。在 上舰務接管過程中，服務接管模組a係依照故障主機透過網際 協疋位址提供給客戶叙職來確摘有要接管舰務，並依昭 处服務紐财同而執行械快速接管或者接管環境準備。但 =在服務接管之準備過程中，對應服務之端口被_，這時如 際财位址訪問此服務端口，則會造成服務被拒絕錯 姓Άΐ戶"^之關出現問題，進而客戶端會放棄此服務訪問 =明=’ ίΓ證服務接管環境準備時，實現服務的無間斷 透月1 ’本伽之Μ機服務接管純包含—求 =時偵測及瞭解某一待接管服務之— 二二可以透過命令調用或函數则來實現服務環境或 =斷，並#完成時給出—個返回值，以代表 才木作成功與否。或者，請求處 '衣 某個磁碟增齡令結束時於 在。即如奸4、=;—然後再去檢測那個標諸是否已經存 則代表在，麻騎要之魏已鲜備好，否 局限^好。但對於環鮮備完成之觸本發明並不 =多種能達到這個目的之方法均可以使用。 偵測服務環境準 備之狀At .參、 …肴、.矛中不 過接管之多=:]斷服務是否已經正常接管，並對透 夕主機糸統之對外網際败位址訪嶋服務端口之請 14 200825724 求進行處理。在贿環鮮備轉備完全之前，請核理模组％ =對此服務之關請求:雜包。_賴請求錢達至相應服 ，端:之前被丢棄，㈣不會產生服務被拒絕之回應至客戶端， 客戶端則m為沒有收到回應而_重新發送請求重試。 p亚且在服務接管模、组22服務接_境準備完全之後，接管服 矛力後吻開對應服務端口。請求處理模組％同時停止對此服務端 、'、之訪問$求貝料包的去棄’開始接收發送此端口之訪問請求資 料包’ _實現了服務_外正f提供。對於其它g要準備時間 ^寺接管服叙關，均魏上妨t實現祕駐 能的正當#®。 《丁汉力 耻’在訪問服務的客戶端看來，服務實現了無間斷、透明 齡接官’雖然訪問服務叫間會暫時延緩，但最終服務並沒 喊’資料沒有丟失而保證了安全性及可靠性。 下面將結合# 3圖」對本發明之多主機系統之服務接管方 1出說明，此圖為本發明多主機系統之服務接管方法之步驟流 =本發明係麵於包含_服務主機及至少—個待命主機之多 幾系’、中，主機與至少_個待命域之間透過心跳機 复^監控運倾態。當當前提供服務之服駐機發生故障時， 域透過心跳的方__此轉域之狀態，因此其 待。卩域麻τ對此故障主機之網際協定位址 由於有些類型之服務在接管時需要於接管主機提供㈣的 力環境，在準備服務接管環境需花費-定的時間，目此多主機 15 200825724 系統之所有服務在服務接管/切換過程中沒有或沒有完全進入到 正常工作的狀態。 „這裡可以定«狀所有服務均完全進Μ正常工作狀態 為^就绪狀態’即所有類型之服務已接收至上述接管故障主機 之網際協定位址即服務之主機中，並能夠對外提供完整、正常的 服務，則稱作整個多主統進人了 〃就緒〃狀態。反之，如果 系統處於”保護’，狀態’則表示整個系統在網路協定位址接管/服 務接管過程中或其它故障切換過程中沒有或沒有完全進入到"就 ，狀態。此外，定義服務〃保護〃狀態是對於某些需要準備接 官軟硬體環境才能接管之服務，所採取的保護狀態，即在服務聲 境準備未完成之前，.服務不能接管而不能正常提供對外服務之狀 態。由於服務不能正常對外提供，因此在客戶端訪問此服務之請 =應服務端口之前，將此訪問請求資料包吾棄。直至服務 為就、、者狀態，即在完成服務接管環境準備之後接管服務，並 i求㈣包的請’開始接收發送此端口之娜_料包，. 貫現服務的對外正常提供。 現在請參考「第3圖」，首先設置待命主 狀 狀態（步驟102)，今絲妒）士门士 <狀九、马保。隻 也^ )錄輮―，同牯設置待命主機系統之所有服務 為保護狀態（步驟1〇4)。所有服務為〃 t 輩咖π王* ，服矛力為料狀態則可以透過簡 丢輯有服務請求之方式達到訪問請求處 述狀恶步驟為本發明之重要部份，下面結合 詳。果^ 保護，狀態之系統及服務之請求處理步驟。 相沉明. 16 200825724 弟4圖」為夕保護，，狀態服務之訪問請求處理流程示意圖， 當客戶端訪問此待命主機系統時.，處理客戶端服務訪問請求之流 程如圖所示。接收客戶端發送對某—服務之訪問請求至„保護,， .狀態系統（步驟202)，判斷此服務是否處於"就緒„狀態（资驟 ' 2〇4):如果服務沒有處於，就緒狀態，即當前為Μ呆言r狀態 則丟棄對此服務之訪問請求資料包（步驟2〇6);否則，發送裏相 應服務進行處理（步驟208 )。 鲁 對於’’保護”狀態之服務訪問請求包丟棄具有多種實現方式， 在Unlx/LmUX平台最簡單的方法是使用iptabw贈他沈實^ 如下面的指令可以丟棄所有發往“網路小型電腦系統介面，，服務 的請求。 #iptables -A INPUT _p tcp 〜dport 3260 -j DROP，其中 3260 是 iSCSI的服務埠。 對於非保護〃狀態服務，即服務處於〃就緒〃狀態時，則 擊取消對此服務之訪問請求丟棄操作，即取诮對服務的保護，而是 要求服務處理此訪問請求。例如取消訪問請求包丢棄之指令為：Disks) Logical Volume (Lv) settings are already in place, because it usually takes more time to get involved in hardware preparation, usually it takes at least 3 seconds or so. If you are not ready, you can access this through the Internet Protocol address. The service will cause "service rejection, bar" and then the access denied error. The system will give a service report error, so the conventional technology can not achieve the uninterrupted and transparent takeover of the service. [Summary of the invention] Knowing the problems and deficiencies in the technology, the object of the present invention is to provide a service takeover system and method for a multi-host system, so as to provide a service in a multi-host system, and the traitor is safe, uninterrupted and transparently connected. The official website address and service of the official website to ensure the normal operation of the service and the normal use of the function. . . - For the above purpose, the service cover system disclosed in the present invention is applied to the towel and the service host. Μ(4) Dingjian provides external services, and the standby host is in the waiting for the military. The main task is to be less fascinating - the heartbeat supervisor module and the request processing module. In this case, the Internet Protocol is connected to the game by the heartbeat mechanism to determine the operational status of the service host, and when the service 7 200825724 ^ fails, a resource release request is sent to notify the service host to release its possession and Before the service host says that the address of the intercommunication agreement is completely complete, the service environment that takes over the external standby domain, the service takeover module to prepare the service host of the service host, and the takeover service are requested. = The measurement of the financial takeover of Wei Lai, New in the service environment is not allowed to package the Internet Protocol address for this service access request. In addition, the present invention discloses a service takeover method, which is applied to include a service machine and to v In the multi-host system of the standby host, at least one standby domain of the service domain disk is interspersed with the heart of the job. This method includes the following steps: by the heartbeat _ service host operation status, and when the service host = failure transfer -We ask for a job area, transfer the possession of the wealth and services; take over the service domain to provide services - to the ^ co-access to its towel - standby domain; Service to the second: Prepare & All " County access to this service through the Internet Protocol address, please wait for the service, take over the service after the service is complete, and receive the service The request for information package, the provision of services outside the service. Laqi = ^ in the eve of the same age and similar circumstances through the Internet Protocol address and service provided by the official: when the service is available, for the time to prepare for the service takeover, in order to protect After the occurrence of the money service _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Furthermore, the service state of 200825724 is continuously detected until the completion of the service to complete the service and the external service. Therefore, the present invention has the following advantages: not only ensures fast takeover characteristics 2 service is fast, the county is light Under the customer-two service host _ connection is not interrupted, to achieve multi-host Wei riding agreement address and service without interruption and transparent takeover. [Embodiment] The features and implementations of the present invention will be described in detail with reference to the preferred embodiments of the present invention. The multi-master service takeover system of the present invention is shown in detail. First, the service host and at least one standby host, for example, "In the embodiment shown, the multi-host system 1G includes the host 12 and the object". The host 12 is the service host, and the user is stunned. Standby the host, and the service host 12 and the temple: machine U monitor each other through the heartbeat mechanism. Therefore, for the Xi = slave marriage, the hair machine is connected to H _. The following is a detailed description of the above-mentioned groups. The town, and 26 of the invention of the age of her fresh 2G side called the service 峨 12 after the turn, making the red standby shot - host = machine (four) is 峨 her 1 coffee. (four) still past: child = solid ^ host When it comes to which standby host to take over the service, you can randomly select ^. -<, P host will take over the Internet Protocol address of this faulty host and service 200825724. But in order to prevent multiple conflicts, it is widely used. The address and service of the agreement are made by the token Mei Guancai ====== The standby domain has Mw Ί 板 之间 之间 私 私 , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , In the case of the viewing service, I have to deal with the Internet. Before the second, I will take over the Internet Protocol address and service, and the column will execute "with lock, if there is no "lock...lock" and then take over the Internet Protocol address and Service, and vice versa; enter * lock, then end, do not take over. These two techniques are used to prevent conflicts caused by the simultaneous takeover of Internet Protocol addresses and services. It is to be noted that the technology of the standby host takeover service of the present invention is not limited to the above two. After that, the standby host sends an instruction requesting that the faulty service host will release the service provider. Therefore, the computer or application program of the external Internet Protocol address 10.10.U0 is still accessed through this address. The host of the Internet Protocol and the service provided by the host have changed to another. A host. After the standby host takes over the network address of the original service host 2, it can immediately take over and provide external access to the service delivery module 22, such as a pure network service and a static web site browsing service. But for services that need to take over the environment, such as network small computer system interface (iSCSI), file transfer protocol (FTp), server message block / public Internet file system (SMB / CIFS), network file system (NFS ) Network block device services and broadcast services, which require a certain amount of software preparation (a few cases) and hardware preparation (in most cases), only the implementation of the above services 10 200825724 spear = can f take over the Internet Protocol The location of the service in a timely and safe manner, the service of the spear force of the official module 22 is required in the service. Fault coffee 2 « 坐 坐 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 Do not. Receiving services f to mention the group ready to take over hard :: call and some services do not need to prepare to take over the environment ^ catch the ground. Therefore, the service takes over the module and is ready to touch. If you don't want to be secret: you need to dock the g service to need the environment to pick up its rHM and take over the service; otherwise, serve f ^ ίίΓ 〇介二r, ==;, :^ _ case system (called bribe cans / public , and (4) prepare the service environment; on the contrary, the force == state host configuration agreement (La P), the domain name service road service spear force access group 22 financial needs oblique group backup service Wei. 4 very time-consuming soft The hardware preparation is mainly with the hardware waiting for the tape _ preparation is very time consuming (such as waiting for the disk to be put by her U - ^ go to the beginning position, create a redundant array of cheap disks (嶋 ^ ^ have ^ === 2 Preparations need to wait for a timeout. The second is to change the configuration slot or change the pinch. etc. 11 200825724 It is easier to take over the service, just restart or start the service program on this host. The external services of the multi-host system not only include the network small computer system interface, etc. • Block device access Wei, but also provides the difficult transfer protocol (FTp), the ship information area. Block/public Internet file system (SMB/CIFS) File access function such as Network File System (NFS). In addition, remote is also provided. Management functions such as login protocol (SSH), terminal emulation protocol (Telnet), and user interface (WebUI), as well as network functions such as Dynamic Host Configuration Protocol (DHCP) and Domain Name Service (DNS). Can be divided into two categories: the first type of services such as network small computer system interface, file transfer protocol, server message block / public Internet file system, network broadcast system and other services, such services need to be with the hardware Resource conventions, such as the network small-scale computer interface must be for the operation of a certain disk, and the sharing of the slot communication agreement, the message block / the public network, the network road sign system, etc. must be based on A certain directory on a certain disk. The second type of service is a network function such as a remote access protocol, a terminal emulation protocol, and a dynamic host configuration protocol, a name service, and the like. Basically, it has nothing to do with hardware resources. As long as the computer is working properly, the Internet Protocol address can be provided to provide external services. Therefore, in the above dual controller failure takeover process, these two services For the first-class service, in addition to ensuring the connectivity after the failure, it is also necessary to ensure that the access to the work room is the same as the space for the occurrence of the miscellaneous question. The service is provided normally. _ The first type of service in the failover WS must first be the shed, and the new one can provide the real service. 12 200825724 For the second type of service, it is necessary to ensure the rapid connectivity after the failure, and it is necessary to protect it. There can be no obvious delay after the early occurrence of p. Because these services are especially remote, the management of the terminals and the user interface are closely related to the user experience. The delay will reduce the user experience quality. For the first-class service delivery environment, the fresh-keeping group 24 of her miscellaneous module 22 is completed. The resource preparation module % provides the network connection to take over the service, and provides the same access space before the service host fails. Wherein when the takeover service is for the production case, the resource preparation module provides the storage space of the same location before the failure of the service host; when the takeover service is the block device access service, the resource preparation module The squad is the same as the block device of the service device before the failure of the service host. For example, for the storage space preparation of the disk array (7) address, the resource preparation module 24 can perform the following steps: sending an instruction requesting the failed host to release the occupied disk, and preparing 'if the failed host can also be active', then releasing these Hard disk device, no φ because it has been smashed, it is not necessary to release the hard disk set damage; re-initialize the common _ space of these hard disks, the section reads cheap thorn redundancy _, logical volume of electricity According to the group of cheap magnetic Wei Yu _ group of these hard disk grouping money - cheap magnetic Wei Yu _ 'At this time cheap disk redundant array restore; according to the logical volume of the data to divide the redundant array of cheap disk Or start as a different logical volume, at this time to avoid the volume to restore. For the small computer system interface service, the device needs to be output to the corresponding initiator 〇nltiatQ〇' for the broadcast transmission, server message block/public internet slot system, network slot system service, These devices are mounted to the directory of ♦ ' 'According to the group singer data, the cheap disk redundancy array 200825724 column, the logical volume is completely miscellaneous, the Langcai equipment scale is ready, all the hardware at this time The resources are ready. Nine pairs of Internet Protocol Address Takeover Module 20 and Service Provider Module 22 have a description of the faulty host's picking and service fresh ring. In the process of taking over the ship, the service take-over module a is based on the faulty host to provide the customer with a rehearsal address through the Internet coordinating address to ensure that the ship is taken over, and the device is quickly taken over according to the service. Or take over the environment. However, in the preparation process of the service takeover, the port of the corresponding service is _, and then accessing the service port as the financial address will cause the service to be rejected, and the client will Abandon this service access = Ming = ' Γ Γ 服务 服务 服务 接 接 接 环境 环境 环境 环境 环境 ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' Second, you can use the command call or function to implement the service environment or = break, and # give a return value when finished, to represent the success or failure of the wood. Or, the request is at the end of a certain disk ageing order. That is, if the rape is 4, =; - then go to check whether the standard has been saved, then the representative, the horse riding the Wei has been prepared, no limitation ^ good. However, the invention of the invention is not a plurality of methods that can achieve this purpose. Detecting the preparation of the service environment At. Participation, food, and spears, but take over the number of people: =] Whether the service has been taken over normally, and the service port of the external network of the company 14 200825724 Seek processing. Before the bribe ring is ready, please check the module %= request for this service: miscellaneous package. _ Lai requested the money to reach the corresponding service, the end: was previously discarded, (4) will not generate a response to the service is rejected to the client, the client m is not received a response and _ resend the request to retry. After the service takeover mode and the group 22 service connection are completed, the service port is opened after taking over the spear force. The request processing module % simultaneously stops the service provider, ', accesses the request, and discards the access packet, and starts to receive the access request packet for sending this port' _ to implement the service_outside positive f. For other g to prepare time ^ Temple take over the service, the Wei Wei can achieve the right #®. "Ding Hanli Shame" in the view of the client accessing the service, the service has achieved an uninterrupted, transparent age of the official' although the access to the service will be temporarily suspended, but the final service did not call 'data is not lost to ensure security and reliability Sex. The following is a description of the service takeover party of the multi-host system of the present invention in conjunction with the #3 diagram, which is a step flow of the service takeover method of the multi-host system of the present invention. The present invention is embodied in a service host and at least one The standby host has more than one system, the middle, and the host and at least _ standby fields are monitored by the heartbeat machine. When the service of the currently serving service fails, the domain passes the state of the heartbeat __ the state of this domain, so it waits. The network protocol address of this faulty host is due to the fact that some types of services need to take over the power provided by the host when taking over, and it takes a certain amount of time to prepare for the service to take over the environment. All services in the service takeover/switching process have not or have not fully entered the normal working state. „ Here you can determine that all services are fully operational. The ready state is that all types of services have been received into the host of the Internet Protocol address that takes over the failed host, and can provide complete and normal external access. The service, called the entire multi-master system, enters the "ready" state. Conversely, if the system is in "protection," the state indicates that the entire system is in the network protocol address takeover/service takeover process or other failover process. No or no full access to the state, just. In addition, the definition of the service 〃 protection status is the protection status of some services that need to be prepared to take over the hardware and software environment, that is, before the service sound environment preparation is not completed, the service cannot be taken over and cannot be provided normally. The status of the service. Since the service cannot be provided externally, the access request packet will be discarded before the client accesses the service. Until the service is on, the status, that is, after the completion of the service takeover environment preparation, take over the service, and ask for (4) the package please 'start receiving and sending the port of the _ package, the normal service is provided. Now, please refer to "3rd figure", first set the standby status (step 102), this time, the sorcerer, the singer, the ninth, the Ma Bao. Only ^) is recorded, and all services of the standby host system are set to be protected (step 1〇4). All services are 〃 , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , The protection process, the status of the system and the service request processing steps. Xiang Shenming. 16 200825724 Brother 4 Figure "Early protection, state service access request processing flow diagram, when the client accesses the standby host system. The process of processing the client service access request is as shown. The receiving client sends an access request to the service to the „protection, 。 state system (step 202), and determines whether the service is in the “ready” state (suggested '2〇4): if the service is not in, ready state That is, the current access request packet for the service is discarded (step 2〇6); otherwise, the corresponding service is sent for processing (step 208). Lu has a variety of implementations for service access request packet discarding in the 'protected' state. The easiest way to use the iptabw is to give him a solid ^ on the Unlx/LmUX platform. The following instructions can discard all the packets sent to the "network small computer system". Interface, service request. #iptables -A INPUT _p tcp ~dport 3260 -j DROP, where 3260 is the iSCSI service. For an unprotected stateful service, that is, when the service is in the Ready state, then the access request drop operation for this service is cancelled, that is, the protection of the service is taken, and the service is required to process the access request. For example, the instruction to cancel the access request packet discard is:
#iptables -D INPUT、p tq卜 dport 3260-j DROP w #iptables -A INPUT -p tcp ^dport 3260 -j ACCEPT < 上面兩個過程將服務之〃保護〃狀態去除，使系統可以接收 並處理上個步驟吾棄的發往〃網路微型電腦系統介面〃之服務請 求。 17 200825724 出的疋這裡只疋給出貫現上述操作之一概括實例， 並非用以做本㈣之賴細，能财現上麵作之f知技術 均可以應用於本發明中。 β在設置純及服務為〃保護〃狀態之後,，接管故障主機對外 曰/、服矛力之A….罔際協疋位址（步驟1〇6)。關於網際協定位址之 接管為習知技術，例如可參見開源項目_，LinuxVlrtualS_) ^網際協定接管之實現代碼。雜，則可轉管各個服務。系統 φ提供了夕個對外服務，對於不需要進行軟硬體準備或準備時間極 短的服務’系統立刻可以提供。因此，判斷需接管之服務是否需 要執行服務接管環境準備（步驟間，若不需要，則立即接管此 服務（步驟110)。例如提供管理功能及提供網路功能之服務，這 、二服^基本與硬財源無關，麵際齡位址正常提供後即能夠 對外提供。 關於步驟應妓否需要準備服務接管環境，可依據接管服 •矛摘魏靖’如果所提供之職觸存郎紐轴容相關， 彳如、、’罔路小型電域統介面（ISCSI)、槽案傳送協定（阳）、超 文件傳送齡（職）、網路播齡統⑽s)、舰器訊息區塊 =用網際網路觀系統（SMB/CIps)等等與存触間或文件内 欠相關的職’則㈤要時間準備服務環境；相反，對於純網路服 矛力’例如_路服務之_主機組祕定（DHcp)、領域名稱服 務（ms)等則不需要時醉備服魏境。 ，如以騎’對於某倾硬體:#_定之服務，例如網路小 垔_系統介面、檔案傳送協定等’由於需要服務接管環境準備 18 200825724 驟112，執行服務接管之資源 闕於％境準備触體步卿面將給出 因而不能立即提供，因此前進至步 環境準備步驟（步驟H2) 詳細說明。 不時，鮮環鮮備隨服務類型的 nr常耗時的軟硬體準備主要是與硬體或等待時間有 ^而有些環境準制需要等待—個超時時間。有些需準備的服#iptables -D INPUT, p tq卜dport 3260-j DROP w #iptables -A INPUT -p tcp ^dport 3260 -j ACCEPT < The above two procedures remove the protection status of the service, so that the system can receive and process In the previous step, I abandoned the service request sent to the network micro-computer system interface. 17 200825724 The following is a summary of the above operations. It is not intended to be used as a basis for this (4). It can be applied to the present invention. After the setting of pure and service is 〃 protection status, take over the faulty host's external 曰/, service spear force A.... 疋 疋 疋 address (steps 1 〇 6). The takeover of the Internet Protocol address is a well-known technology, for example, see the open source project _, LinuxVlrtualS_) ^ The implementation code of the Internet Protocol takeover. Miscellaneous, you can transfer to various services. The system φ provides an external service, and the system can be provided immediately for services that do not require software or hardware preparation or preparation time. Therefore, it is judged whether the service to be taken over needs to perform service takeover environment preparation (if it is not needed, the service is taken over immediately (step 110). For example, providing management functions and providing network function services, Regardless of the hard financial resources, the face-to-age address can be provided externally after the normal address is provided. Regarding the steps, whether the service take-over environment needs to be prepared, can be based on the take-over service • spear-picking Wei Jing' Related, such as,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, The network view system (SMB/CIps) and so on are not related to the contact or file. (5) Time to prepare the service environment; on the contrary, for the pure network service spear force 'eg _ road service _ host group secret DHcp, domain name service (ms), etc., do not need to be diverted to Wei Wei. For example, to ride a 'for a certain hardware: #_定的服务, such as network 垔 _ system interface, file transfer agreement, etc.' due to the need for service takeover environment preparation 18 200825724 Step 112, the implementation of service takeover resources 阙 % The preparation of the touch step will be given and thus cannot be provided immediately, so proceed to the step environment preparation step (step H2). From time to time, fresh ring fresh with the service type of nr often time-consuming software and hardware preparation is mainly with hardware or waiting time ^ and some environmental standards need to wait - a timeout. Some clothes to be prepared
較谷易’只需要錄啓域_本主機上之服務程式即可。 之硬贿賴以服務，除絲輯叙接管服務 立聽連接性外，遷需要保證訪問之空間與發生故障前訪問的故 障=空間是相_。否戶糊㈣會發生變化，導致不能 正吊提供服務。所以賴服務在故障城前需要先將硬體準備 然後才能提供真正的服務。當與硬體資源約定之接管服務為 植=服務時，需提供與服務主機發纽障之前_位置之槽案存 放二間，當接管服務為區塊設備訪問服務時，則準備與服務主機 發生故障之前糾—糊服魏塊設備之區塊設備。 在接官服務之貢源環境準備完成之後接管這個服務（步驟 114) ’然後此服務才進入“就緒，，狀態乂步驟116)，並正常提供 對外服務（步驟12〇)。這些接管耗時的服務在進行資源準備時的 枯間雖然报長，但因為一直處於系統及服務的雙重“保護，，狀態 下，系統對透過網際協定位址訪問這個服務之所有請求，即網際 協定貢料包都會被絲掉，％以不會產生服務拒絕㈣息，而客 戶端也會不斷重試這種服務。參見「第4圖」之“保護，，狀態服 19 200825724 務請求處理流程示賴。在這種情況τ，無論是否需要時間 的服務都將得到报好的接管。 β餘-服務進入，，就緒"狀態（步驟116)後，會同時判斷 疋否退有處於“保護，，狀態之服務（步驟118)，若沒有，則整個 -糸統設置為“就緒，，狀態（步驟122);否則，前進至步驟1〇8， 對其它處於"保護，狀態之接管服務執行步驟108至步驟122。 重複上述步驟，直至完成所有服務之接管，使其均處於 鬌 =按，系統處於1緒'狀態，因此這時對服務之訪問請 流程進行處理。 >，者狀緣“核理餘示意圖之 驟二「第=所示，主機系統接收對服務端口之訪問請求(步 3〇4) it 減服鶴雜崎求進行處理（步驟 狀雜的麵流程’系統在大部分時間處於這個 求概被丟棄的處理。— 就、、者狀恶，上述網際協定接管步驟 一人又透==時由上述步驟互相作用完成安全的故障切換。 服務能夠'嶋供，瞻證了不能===== 和服務器的連接不中斷。此外，不僅不能=提 況下等服務就绪後及時提供服務，士月供服糾 中於一個高 力且保祖了將多義型的服務集 域錢切多觀務柯雜。相上情況 20 200825724 下執行服務轉接管時’能解給用戶真正的無崎、透明切換 的多服務系統及良好的用戶體驗。 雖然本發明以前述之較佳實施方式揭露如上，然其並非用以 •限定本發明。本倾之技術人貞應當意制在不·本發明所附 -之申請專利範圍所揭示之本發明之範圍和精神之情況下，所為之 ^動與潤飾’均屬本發明之專利保護範圍之内。關於本發明所界 疋之保濩範圍請參考所附之申請專利範圍。 翁 【圖式簡單說明】 ^圖為-典型高可雜雙主機叢錢統之結構示意圖； 弟2圖為本發明之多主機服務接誓系統； ^ 5二t保，狀態服務之訪問請求處理流程圖；以及 【主私二狀態服務之糊請求處理流程圖。 10 主機系統 12 主機 Μ .主機 20網際協定位址接管模組 22 服務接管模組 24 資源準備模組 26 請求處理模組 步驟102設置系統為保護狀態 步驟104設置所有服務為保護狀態 200825724 步驟106接管公共網際協定位址 步驟108是否需要準備服務接管環境？ 步驟110立即接管此服務 步驟112執行服務接管之資源環境準備 步驟114接管此服務 步驟116設置此服務為就緒狀態 步驟118是否仍存在保護狀態之服務？ 步驟120提供對外服務 步驟122設置系統為就緒狀態 步驟202接收到服務訪問請求 步驟204服務是否處於就緒狀態？ 步驟206丟棄服務之訪問請求資料包 步驟208發送至相應服務進行處理 步驟302接收到服務訪問請求 步驟304發送至相應服務進行處理 22Compared to Gu Yi, you only need to record the service program on the host. The hard bribe relies on service, in addition to the silk pick-up service. In addition to listening to connectivity, the need to ensure access to the space and the failure before the failure of the access = space is phase _. No household paste (4) will change, resulting in the failure to provide services. Therefore, the service needs to be prepared before the faulty city to provide real service. When the takeover service agreed with the hardware resource is the service=service, it is required to provide two slots before the service host sends a barrier. When the takeover service is a block device access service, it is prepared to occur with the service host. Correction before the failure - the block device of the Wei block device. Take over the service after the completion of the tribute environment of the pick-up service (step 114) 'The service then enters "Ready, status 乂 step 116) and provides external services normally (step 12 〇). These take-up time-consuming Although the service is in charge of resource preparation, although it is always in the dual protection of the system and service, the system will access all requests for accessing the service through the Internet Protocol address, that is, the Internet Protocol tribute package will The wire is dropped, % will not produce a service rejection (four) interest, and the client will continue to retry the service. See "4," "Protection, State Service 19 200825724. Request processing flow. In this case, τ, whether or not the service is required, will receive a good takeover. β余-service access, ready After the state (step 116), it will be judged at the same time whether or not the service is in the "protected state" (step 118). If not, the entire system is set to "ready, state (step 122); otherwise Go to step 1〇8 and perform steps 108 to 122 for the other management services in the "protection, state. Repeat the above steps until all services are taken over, so that they are all in the 鬌= press, the system is in the 1' Status, so the process of accessing the service is processed at this time. >, the role of the "Nuclear balance diagram" (2), the host system receives the access request to the service port (step 3〇4) it minus Take the crane and ask for processing (the step-by-step process) The system is in this process of being disposed of for most of the time. - As it is, the situation is the same, the above-mentioned Internet Protocol takeover step is one pass and then == The steps interact to complete a secure failover. The service can't provide a confession, and the connection to the server is not interrupted. In addition, not only can the service be provided in time after the service is ready, The service is entangled in a high-force and the ancestors will be versatile, and the services will be multi-disciplinary. The situation is 20. When the service transfer pipe is executed under 200825724, the user can be truly unsalected and transparent. Switched multi-service system and good user experience. Although the invention has been described above in the preferred embodiments of the foregoing, it is not intended to limit the invention. The skilled person should not be bound by the invention. In the case of the scope and spirit of the invention as disclosed in the scope of the invention, the scope of the invention is within the scope of the patent protection of the invention. The scope of application for patents. Weng [simple description of the schema] ^ The picture is a schematic diagram of the structure of a typical high-duplex dual-host cluster of money; the brother 2 is the multi-host service swear system of the invention; ^ 5 two t guarantee, state service Access request processing flow chart; and [main and private two state service paste request processing flow chart. 10 host system 12 host 主机 host 20 internet protocol address takeover module 22 service takeover module 24 resource preparation module 26 request processing The module step 102 sets the system to the protection state step 104 to set all the services to the protection state 200825724. Step 106 takes over the public internet protocol address step 108. Is the service takeover environment required? Step 110 immediately takes over this service step 112 to perform resource takeover for the service takeover Step 114 takes over this service step 116 to set whether the service is ready state step 118 is there still a protection state service? Step 120 provides an external service. Step 122 sets the system to a ready state. Step 202 receives a service access request. Step 204 Is the service in a ready state? Step 206 discards the service access request data packet. Step 208 sends the corresponding service to the processing. Step 302 receives the service access request. Step 304 sends the corresponding service to the processing.