JP5277227B2 - Cluster system recovery method, server and software - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make it possible to resume services on an active machine of a cluster system when services are being provided on a backup machine after occurrence of a resource failure on the active machine. <P>SOLUTION: A cluster system including an active machine and a backup machine is disclosed. Failure clearing means of the active machine clears a failed state stored in state storage means of the active machine. Then, transition inhibition means of the active machine makes the cluster state of the backup machine transition to a state in which transition to service-providing status is inhibited. Then, transition inhibition cancel means of the active machine makes the cluster state of the backup machine transition to a state in which transition to service-providing status is possible. <P>COPYRIGHT: (C)2012,JPO&amp;INPIT

Description

  The present invention relates to a cluster system recovery method, a server, and software.

  As the importance of services increases, so does the demand for systems with low downtime. For this reason, a highly available cluster software such as Heartbeat and Pacemaker that enables continuation of services by building a redundant cluster system with multiple servers and automatically switching servers when some failure occurs. It has been developed (see Non-Patent Document 1).

  High-availability cluster software monitors resources, networks, shared disks, etc. on the server. If a failure is detected on a server that is in service, the server is switched to a standby server in advance and the service is continued.

  FIG. 1 shows a schematic diagram of a cluster system using high-availability cluster software. The cluster system includes a plurality of servers (active machine and spare machine) connected to a network and a shared disk that is shared and used by the plurality of servers.

  The active machine and the spare machine each have an operating system (OS), high-availability cluster software, and resources that are components necessary for providing a service. The high-availability cluster software detects the occurrence of a failure in the active machine and automatically switches to a spare machine when a failure occurs. The service operating status, resource operating status and failure status in the server are stored in the status storage unit of the internal disk, and detailed information such as the failure location is stored in the log storage unit of the internal disk.

  The active machine and the spare machine are connected to a network called a service LAN and provide a service based on resources to the client. The active machine and the spare machine are connected to a network called an interconnect LAN, and exchange information such as service operating status, resource operating status, and fault status in the server. Furthermore, the current machine and the spare machine are connected to a network called a management LAN, and can receive commands from the maintenance terminal.

  The active machine and the spare machine can be set with a forced power-off function for forcibly turning off the power of other servers when a failure occurs. The forced power cut-off function cuts off the power of the other server by transmitting an instruction to turn off the power to the hardware control board of the other server via the management LAN.

  The shared disk is a storage device that stores data used for service provision in order to maintain service consistency. With the shared disk, the service can be continued using the same data even after switching from the current machine to the spare machine.

  As described above, the failure of the resource is monitored by the high availability cluster software. Therefore, when a resource failure occurs, the service can be continued with the spare machine. After the system is switched to the spare machine, the service is continued on the spare machine (see Patent Document 1).

Japanese Patent No. 4353005, “System Switching Method for Cluster Configuration Computer System”

Mitsunori Mitsuno et al., “Development of OSS Middle Heartbeat to Improve Service Availability”, NTT Technical Journal, March 2009, pages 46-49

  As described above, after the system is switched to the spare machine, the service is provided by the spare machine, but it is not clear at which server the service is provided by which server.

  Furthermore, when the performance of the spare machine is inferior to that of the active machine in the cluster system, the processing speed decreases while the service is provided by the spare machine. Such a decrease in processing speed is not only when the performance of the spare machine is inferior to that of the active machine, but also when a cluster system is composed of two or more active machines and one spare machine. It can happen.

  An object of the present invention is to restart a service on an active machine when a resource failure occurs in the active machine of a cluster system and the service is operating on a spare machine.

In order to solve the above-described problems of the present invention, the cluster system recovery method of the present invention includes:
The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status A cluster system recovery method for transitioning the cluster state of the active machine to service operation when a resource failure occurs in the active machine and the spare machine is operating.
The active device failure clearing means is in a state in which the cluster state of the working machine stored in the state storage means is in a resource failure state, and the cluster state of the spare machine stored in the state storage means is in service operation state If it is, a failure clear step for clearing the failure state stored in the state storage means of the working machine,
When the active device transition suppression means is in a state in which the failure state of the active machine stored in the state storage means is cleared and the cluster state of the active machine stored in the state storage means can transition to service operation , a transition suppression step of transition to the state transition of the cluster state of the spare unit into the service operation is suppressed,
The active device transition inhibition canceling means that the cluster status of the active machine stored in the status storage means is in service operation status, and the standby machine cluster status stored in the status storage means is in service operation status. A transition deactivation step for transitioning the cluster state of the spare machine to a state where it can transition to service operation,
It is characterized by having.

The server of the present invention
The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status And a server operating as the working machine,
When a resource failure occurs in the working machine and the spare machine is in service,
When the cluster status of the active machine stored in the status storage means is a resource failure status, and the cluster status of the spare machine stored in the status storage means is a service operating status, Fault clearing means for clearing the fault state stored in the state storage means;
When the failure state of the working machine stored in the state storage means is cleared and the cluster state of the working machine stored in the state storage means is in a state where it can be shifted to service operation, the cluster state of the spare machine is serviced. A transition inhibiting means for transitioning to a state in which the transition to the inside is inhibited;
The cluster state of the active machine stored in the state storage means is a service operating state, and the standby machine cluster state stored in the state storage means is a state in which the transition to the service operating state is suppressed. If a transition inhibit release means for transitioning to a state that can transition the cluster state of the spare unit into the service operation,
It is characterized by having.

The program of the present invention is
The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status Then, the server operating as the working machine is
When a resource failure occurs in the working machine and the spare machine is in service,
When the cluster status of the active machine stored in the status storage means is a resource failure status, and the cluster status of the spare machine stored in the status storage means is a service operating status, Failure clearing means for clearing the failure state stored in the state storage means;
When the failure state of the working machine stored in the state storage means is cleared and the cluster state of the working machine stored in the state storage means is in a state where it can be shifted to service operation, the cluster state of the spare machine is serviced. A transition deterring means for transitioning to a state in which the transition to the inside is deterred, and
The cluster state of the active machine stored in the state storage means is a service operating state, and the standby machine cluster state stored in the state storage means is a state in which the transition to the service operating state is suppressed. If the transition inhibit release means for transitioning to a state that can transition the cluster state of the spare unit into the service operation,
It is a program for making it function as.

  According to the present invention, when a resource failure occurs in the active machine and the service is in operation on the spare machine, the service can be restarted on the active machine.

Schematic diagram of cluster system using high availability cluster software Functional block diagram of a cluster system according to an embodiment of the present invention State transition diagram of the cluster state managed by the state manager The figure which shows the information stored in a state memory | storage part The figure which shows the transition of the cluster state which concerns on the Example of this invention Functional block diagram when the present invention is applied to high availability cluster software Flowchart of cluster system recovery method when the present invention is applied to high availability cluster software

  Embodiments of the present invention will be described below with reference to the drawings.

  In the embodiment of the present invention, a cluster system including an active machine and a spare machine is used. The active machine and the spare machine are respectively a failure monitoring means for monitoring a failure state, a state management means for managing a cluster state indicating a service operating state of the active machine and the spare machine based on the failure state, and a cluster state and a failure state. And state storage means for storing.

  When a resource failure occurs in the active machine and the service is in operation on the spare machine, the fault clearing means of the active machine clears the fault state stored in the status storage means of the active machine. Next, the transition suppression means of the active machine shifts the cluster state of the spare machine to a state where the transition to service operation is suppressed. Due to this transition inhibition, the cluster status of the active machine transits to service operation. Next, the transition suppression canceling means of the active machine shifts the cluster state of the spare machine to a state where it can transition to service operation. In this way, the cluster state of the active machine can be shifted to service operation.

  Before describing the cluster system and method according to the embodiment of the present invention in detail, first, terms used in the embodiment of the present invention will be described.

  “Cluster configuration” refers to a technology in which a plurality of servers are connected to each other so that users or other servers providing services behave as if they are one server as a whole. With a cluster configuration, even if one server fails, the service can be continued throughout the system, and failure repair or replacement can be performed while the service is continuing.

  An “active machine” refers to a server that is in service when a service is started and no failure has occurred in a cluster system.

  “Spare machine” refers to a server that takes over services when a failure occurs in a working machine in a cluster system. The spare machine may take over the service of one working machine or may take over the services of a plurality of working machines. That is, the relationship between the active machine and the spare machine may be a one-to-one relationship or an N-to-one relationship.

  “High availability cluster software” refers to software for providing a cluster configuration. High-availability cluster software monitors server failures and performs system switching when a failure occurs.

  “Resource” means a component necessary for providing a service. A resource in a cluster configuration refers to an application that is subject to control by the highly available cluster software such as starting, stopping, and monitoring. Resources include databases and the like.

  “Cluster state” refers to the operating state of a service in a server. The cluster state includes ACT, SBY [online], SBY [standby], SBY [during transition], OUS, and NONE.

  “Resource status” refers to the operating status of resources in the server. The resource state includes a state where the resource is operating on another server, a state where the resource is operating on the local server, a state where the resource is stopped, and a state where the resource is not managed.

  “ACT” refers to a state in which a service is running on the server. In a cluster configuration, the state of a server on which a resource providing a service such as a database is operating is referred to as “ACT”.

  “SBY [online]” refers to a state in which transition to ACT is possible. In a cluster configuration, when system switching occurs due to a failure or the like, the state of a server that can switch resources from ACT is referred to as “SBY [online]”.

  “SBY [standby]” refers to a state where transition to ACT is suppressed. In a cluster configuration, even when a system switchover occurs due to a failure or the like, the state of a server that is prevented from transitioning to ACT is referred to as “SBY [standby]”.

  “SBY [in transition]” refers to a state during system switching. In a cluster configuration, a system state in which a system switchover due to a failure or the like has occurred but a resource stop has failed and the system switchover has not ended is referred to as “SBY [in transit]”.

  “OUS” refers to a state in which a server is experiencing a resource failure. In the cluster configuration, a state in which a resource failure has occurred is referred to as “OUS”.

  “NONE” means a state in which the server is not incorporated in the cluster configuration. A state of a server that is not incorporated in the cluster configuration, such as a state where the high availability cluster software is stopped, is referred to as “NONE”.

<Configuration of cluster system>
FIG. 2 is a functional block diagram of the cluster system according to the embodiment of the present invention. The cluster system includes a plurality of servers (current machine 10 and spare machine 20) connected to each other, and a shared disk 30 that is shared and used by the plurality of servers. The active machine 10 and the spare machine 20 provide services to clients via the router 40. Note that the performance of the current machine 10 may be superior to the performance of the spare machine 20. Further, the cluster system may be composed of two or more active machines and one spare machine.

  The active machine 10 includes a resource 101, a failure monitoring unit 111, a resource start / stop unit 113, a state management unit 115, a state storage unit 117, a failure log storage unit 119, a failure clear unit 121, and a system switching. It includes an instruction unit 123, an ACT inhibition suppression unit 125, a state confirmation unit 127, an operating system (OS) 151, a power supply control unit 153, and a power supply 155.

  The spare machine 20 includes a resource 201, a failure monitoring unit 211, a resource start / stop unit 213, a state management unit 215, a state storage unit 217, a failure log storage unit 219, an operating system (OS) 251, A power supply control unit 253 and a power supply 255 are provided.

  Resources 101 and 201 are applications that provide services to clients. Resources 101 and 201 are activated on a server whose cluster status is in service (ACT).

  The failure monitoring units 111 and 211, the resource start / stop units 113 and 213, and the state management units 115 and 215 correspond to high availability cluster software.

  The failure monitoring units 111 and 211 monitor the failure state of the server. For example, resources, networks, shared disks, etc. are monitored. The resource is monitored only by the server in service (ACT), but the network, the shared disk, and the built-in disk are monitored by both the active machine and the spare machine. When a failure is detected in the active machine, the failure state is stored in the state storage unit 117 via the state management unit 115. For example, an error status indicating the number of failures and failure occurrence timing (resource start failure, failure during resource monitoring, resource stop failure) is stored in the state storage unit 117 as the failure state. As will be described below, the failure state of the active machine is also stored in the spare machine state storage unit 217 via the state management unit 215. Similarly, when a failure is detected in the spare unit, the failure state of the spare unit is stored in the state storage unit 217 via the state management unit 215 and further stored in the state storage unit 117 via the state management unit 115. Is done. Further, detailed failure logs (error messages) indicating the failure locations of the current machine and the spare machine are stored in the failure log storage units 119 and 219, respectively.

  The resource start / stop units 113 and 213 start and stop resources based on the cluster state and the failure state. When the resource of another server is stopped when the cluster state of the server is in a state where it can transition to ACT (SBY [online]), the resource start / stop units 113 and 213 start the resource. When a failure occurs when the cluster state of the server is in service (ACT), the resource start / stop units 113 and 213 stop the resource.

  The state management units 115 and 215 manage the cluster state based on the failure state. The status management unit 115 of the active machine 10 and the status management unit 215 of the standby machine 20 exchange information such as failure status (number of failures, error status) and cluster status stored in the status storage unit, and information on each server Are stored in the state storage units 117 and 217.

  FIG. 3 shows a state transition diagram of the cluster state managed by the state management units 115 and 215. The cluster state includes ACT, SBY [online], SBY [standby], SBY [during transition], OUS, and NONE. When a resource failure occurs in the ACT server, the cluster state changes from ACT to OUS (T1). When a failure other than resources (failure of network, shared disk, etc.) occurs in the ACT server, the cluster state changes from ACT to SBY [in transit] (T2). When the failure state of the OUS server is cleared, the cluster state changes from OUS to SBY [online] (T3). When a system switchover occurs due to a failure or the like and the SBY [online] server takes over the service, the cluster state changes from SBY [online] to SBY [in transit] (T4), and further becomes ACT (T5). When the service operation is inhibited in the ACT server in order to take over the service from the ACT server to another server, the cluster state changes from ACT to SBY [standby] (T6). When the SBY [standby] server cancels the transition to ACT, the cluster state changes from SBY [standby] to SBY [online] (T7). When the transition to ACT is inhibited by the server of SBY [online], the cluster state is changed from SBY [online] to SBY [standby] (T8). Further, when the high availability cluster software stops due to the power supply stop, the operating system stop, or the high availability cluster software itself, the cluster state becomes NONE (T9 to T13). When the high availability cluster software is activated, the cluster state changes from NONE to SBY [online] (T14). If the high availability cluster software is activated when the cluster status of both the active machine and the standby machine is NONE, the cluster status changes from NONE to ACT (T15).

  The status storage units 117 and 217 store the cluster status and failure status of each server. Specifically, the state storage units 117 and 217 store both the information on the active machine 10 and the information on the spare machine 20, respectively, and exchange the information between the state management unit 115 and the state management unit 215. The information stored in 117 and the information stored in the state storage unit 217 are held the same.

  FIG. 4 shows an example of information stored in the state storage units 117 and 217. The state storage units 117 and 217 store a cluster state, the number of failures, an error status, and a resource state for each server. The state storage units 117 and 217 store any one of ACT, SBY [online], SBY [standby], SBY [during transition], OUS, and NONE as the cluster state. As the number of failures, the number of failures (values 0 to N) is stored. As an error status indicating the failure occurrence timing, any one of a no error state, a state in which resource start has failed, a state in which a failure has been detected during resource monitoring, and a state in which resource stop has failed is stored. As the resource status, any of the status where the resource is operating on another server, the status where the resource is operating on the local server, the status where the resource is stopped, and the status where the resource is not managed is stored. .

  Further, the state storage units 117 and 217 may store a forced power-off setting state indicating whether or not a function for forcibly turning off the power of other servers is set. The forced power-off setting state may be set for the entire system or may be set for each server. The active device 10 and the spare device 20 transmit an instruction to forcibly turn off the power to the power control unit 253 or 153 of the other server when a failure occurs in the network, the shared disk, the internal disk, or the like. You may have a forced power-off function part.

  The failure log storage units 119 and 219 store failure logs (error messages) of the active machine 10 and the standby machine 20, respectively. The failure log includes detailed information indicating the failure location.

  The failure clear unit 121 clears the failure state stored in the state storage unit 117 via the state management unit 115. Specifically, the failure clear unit 121 sets the number of failures of the working machine stored in the state storage unit 117 to 0, and sets the error status of the working machine to an error-free state. By clearing the failure, the number of failures of the working machine stored in the state storage unit 217 is set to 0 via the state management unit 215, and the error status of the working machine is also set to an error-free state.

  The system switching instruction unit 123 instructs system switching from the standby machine 20 to the active machine 10 via the state management unit 115. Specifically, the cluster state of the spare machine 20 stored in the state storage unit 117 is shifted to a state in which the transition to service operation is suppressed. Due to this transition inhibition, the cluster state of the active machine 10 transitions to service operation. As a result, the cluster statuses of the standby machine 20 and the active machine 10 stored in the status storage unit 217 are also changed via the status management unit 215, and the cluster status of the standby machine 20 becomes SBY [standby]. The cluster state becomes ACT. Then, the resource 201 of the standby machine 20 is stopped, and the resource 101 of the active machine 10 is started.

  The ACT deterrence canceling unit 125 causes the state management unit 115 to transition the cluster state of the spare machine 20 stored in the state storage unit 117 to a state in which the standby state can be shifted to service operation. By canceling this transition inhibition, the cluster state of the spare machine 20 stored in the state storage unit 217 also transits via the state management unit 215, and the cluster state of the spare machine 20 becomes SBY [online].

  The state confirmation unit 127 confirms information stored in the state storage unit 117 via the state management unit 115. For example, the cluster status, the number of failures, the error status, and the resource status of both the active machine 10 and the spare machine 20 are confirmed.

  The operating system 151 is basic software for operating high-availability cluster software and applications on the server.

  The power control unit 153 receives an instruction to forcibly turn off the power from another server, and turns on and off the power 155 that supplies power to the server.

  FIG. 5 shows the transition of the cluster state according to the embodiment of the present invention. In the embodiment of the present invention, it is assumed that a resource failure has occurred in the active machine of the cluster system and the service is being operated in the spare machine. From this state, the restoration processing to the working machine is performed, and the service is resumed on the working machine.

  Specifically, as shown in FIG. 5, when a service is started and no failure has occurred, the cluster status of the active machine is ACT and the cluster status of the spare machine is SBY [online] ( S1). When the failure monitoring unit 111 detects a resource failure of the active machine, the state management units 115 and 215 change the cluster state of the active machine to OUS (S2). In this case, system switching from the active machine to the spare machine is executed, and the resource start / stop unit 113 of the active machine stops the resource. Also, the resource start / stop unit 213 of the spare machine starts the resource when the stop of the resource of the active machine is completed. When the resource stop of the active machine and the resource start of the spare machine are successful, the cluster state of the active machine becomes OUS and the cluster state of the spare machine becomes ACT (S3).

  In order to restart the service on the active machine from this state, the state confirmation unit 127 may confirm that the cluster state of the active machine is OUS and the cluster state of the standby machine is ACT. The failure clear unit 121 clears the failure state (failure count and error status) in the active machine, and sets the cluster state of the active machine to SBY [online] (S4). In order to confirm the normal end of the process, the state confirmation unit 127 may confirm that the cluster state of the active machine is SBY [online] and the failure state is cleared. Next, the system switching instruction unit 123 instructs system switching from the spare machine to the active machine. Specifically, the cluster state of the active machine is changed to ACT by changing the cluster state of the spare machine to SBY [standby] (S5). In order to confirm the normal end of the process, the state confirmation unit 127 may confirm that the cluster state of the active machine is ACT and the cluster state of the spare machine is SBY [standby]. After that, the ACT deterrence cancellation unit 125 changes the cluster state of the spare machine to SBY [online] (S6). In order to confirm the normal end of the process, the state confirmation unit 127 may confirm that the cluster state of the active machine is ACT and the cluster state of the spare machine is SBY [online]. In this way, the cluster state of the active machine and the spare machine can be returned to the state where the service is started and no failure has occurred.

<Application to high availability cluster software>
FIG. 6 shows a functional block diagram when the present invention is applied to high availability cluster software.

  High-availability cluster software includes a failure monitoring function that monitors the failure status of servers, a resource start / stop function that starts and stops resources based on the cluster status and failure status, and manages the cluster status based on the failure status State management function. The failure log is stored in the failure log storage unit of the internal disk, and the cluster status, the number of failures, the error status, and the resource status for each server are stored in the status storage unit of the internal disk.

  The above-described failure clear unit 121, system switching instruction unit 123, ACT deterrence cancel unit 125, and status confirmation unit 127 will be described below in the current machine of such a highly available cluster software system, which will be described below. As described above, the cluster state of the active machine and the spare machine can be returned to a state in which no failure has occurred by starting the service.

  FIG. 7 shows a flowchart of a cluster system recovery method when the present invention is applied to high-availability cluster software.

  This recovery method starts from a state in which a resource failure occurs in the active machine of the cluster system and the service is operating on the spare machine. In this case, the current machine and the spare machine are in the following state.

(Current machine status)
Cluster state: OUS
Number of failures: 1 or more Error status: 2
Resource status: 0
(Status of spare machine)
Cluster state: ACT
Number of failures: 0
Error status: 0
Resource status: 1
Prior to execution of the recovery method, the status check unit 127 executes a status check command to read the cluster status stored in the status storage unit of the active machine, and the cluster status of the active machine is OUS, and the standby machine cluster It may be confirmed that the state is ACT. Here, in the high-availability cluster software, since the information in the state storage unit is exchanged between the standby machine and the active machine, the statuses of both the active machine and the standby machine can be read by the status check command. When the cluster state of the active machine is OUS, the number of failures of the active machine is 1 or more and the error status of the active machine is 2.

  In this state, the failure clear unit 121 executes a failure clear command to clear the number of failures and the error status of the current machine stored in the status storage unit of the current machine (S101). By clearing the failure, the cluster state of the active machine transits from OUS to SBY [online]. The high-availability cluster software on the active machine notifies the standby high-availability cluster software of the failure clearing and the transition of the cluster state, and the high-availability cluster software on the standby machine receives this notification and stores it in the status storage unit of the spare machine. The stored failure count and error status of the working machine are cleared, and the cluster state of the working machine is set to SBY [online].

  Next, the status check unit 127 executes a status check command to read the cluster status, failure count, and error status of the active machine stored in the status storage unit of the active machine (S103). It is SBY [online], and it is confirmed whether the number of failures and the error status are cleared (S105). At this time, the working machine and the spare machine are in the following states.

(Current machine status)
Cluster state: SBY [online]
Number of failures: 0
Error status: 0
Resource status: 0
(Status of spare machine)
Cluster state: ACT
Number of failures: 0
Error status: 0
Resource status: 1
If clearing of the failure fails and the active machine is not in the above state (S105: NO), an error is output (S107). For example, the error is displayed on a maintenance terminal connected to the management LAN.

  When the failure is successfully cleared and the active machine is in the above state (S105: YES), the system switching instruction unit 123 executes a state transition command (system switching command), and the status storage unit of the active machine Is changed to SBY [standby], so that the cluster state of the active machine is changed to ACT (S109). The high availability cluster software of the active machine notifies the high availability cluster software of the standby machine of the transition of the cluster state, and the high availability cluster software of the standby machine receives this notification and stores the standby status stored in the status storage unit of the standby machine. The cluster state of the machine is set to SBY [standby], and the cluster state of the active machine is set to ACT.

  Next, the status check unit 127 executes a status check command to read the cluster status of the active machine and the spare machine stored in the status storage unit of the active machine (S111), and the cluster status of the active machine is ACT. Then, it is confirmed whether the cluster state of the spare machine is SBY [standby] (S113). At this time, the working machine and the spare machine are in the following states. When the cluster status of the active machine is ACT, the resource status of the active machine is 1, and the resource status of the spare machine is 0.

(Current machine status)
Cluster state: ACT
Number of failures: 0
Error status: 0
Resource status: 1
(Status of spare machine)
Cluster state: SBY [standby]
Number of failures: 0
Error status: 0
Resource status: 0
If the system switching fails and the active machine and the spare machine are not in the above state (S113: NO), an error is output (S115).

  When the system switch is successful and the active machine and the spare machine are in the above state (S113: YES), the ACT deterrence canceling unit 125 executes the state transition command (system switch command) to The cluster state of the spare machine stored in the state storage unit is changed to SBY [online] (S117). The high availability cluster software of the active machine notifies the high availability cluster software of the standby machine of the transition of the cluster state, and the high availability cluster software of the standby machine receives this notification and stores the standby status stored in the status storage unit of the standby machine. Set the cluster state of the machine to SBY [online].

  Next, the status confirmation unit 127 executes a status confirmation command to read the cluster status of the spare machine stored in the status storage unit of the active machine (S119), and the cluster status of the spare machine is SBY [online]. (S121). At this time, the working machine and the spare machine are in the following states.

(Current machine status)
Cluster state: ACT
Number of failures: 0
Error status: 0
Resource status: 1
(Status of spare machine)
Cluster state: SBY [online]
Number of failures: 0
Error status: 0
Resource status: 0
If the state transition fails and the spare machine is not in the above state (S121: NO), an error is output (S123).

  If the state transition is successful and the spare machine is in the above state (S121: YES), the process ends.

  Note that the above processing flow may be implemented by causing each functional unit of the active machine to be executed from a maintenance terminal connected to the management LAN.

<Effect of Example>
As described above, according to the embodiment of the present invention, when a resource failure occurs in the active device of the cluster system and the service is operating in the spare device, the service can be restarted in the active device. Therefore, when a service is provided by a spare machine, it can be determined that a failure that cannot be recovered by restarting the resource has occurred.

  In addition, when the performance of the spare machine is inferior to that of the active machine, or when a cluster system is composed of two or more active machines and one spare machine, the processing speed of the spare machine providing the service speed A decrease can be avoided.

  For convenience of explanation, the system according to the embodiment of the present invention is described using a functional block diagram. However, the system of the present invention may be realized by hardware, software, or a combination thereof. For example, each functional unit of the server (active machine and spare machine) may be realized by software and installed on the operation system. In addition, the functional units may be used in combination as necessary.

  As mentioned above, although the Example of this invention was described, this invention is not limited to said Example, A various change and application are possible within a claim.

10 servers (current machine)
20 servers (spare machine)
DESCRIPTION OF SYMBOLS 30 Shared disk 40 Router 101 Resource 111 Failure monitoring part 113 Resource starting / stopping part 115 State management part 117 State storage part 119 Failure log storage part 121 Failure clear part 123 System switching instruction part 125 ACT deterrence cancellation part 127 State confirmation part 151 Operating system 153 Power supply control unit 155 Power supply 201 Resource 211 Failure monitoring unit 213 Resource start / stop unit 215 State management unit 217 State storage unit 219 Failure log storage unit 251 Operating system 253 Power supply control unit 255 Power supply

Claims (3)

The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status A cluster system recovery method for transitioning the cluster state of the active machine to service operation when a resource failure occurs in the active machine and the spare machine is operating.
The active device failure clearing means is in a state in which the cluster state of the working machine stored in the state storage means is in a resource failure state, and the cluster state of the spare machine stored in the state storage means is in service operation state If it is, a failure clear step for clearing the failure state stored in the state storage means of the working machine,
When the active device transition suppression means is in a state in which the failure state of the active machine stored in the state storage means is cleared and the cluster state of the active machine stored in the state storage means can transition to service operation , a transition suppression step of transition to the state transition of the cluster state of the spare unit into the service operation is suppressed,
The active device transition inhibition canceling means that the cluster status of the active machine stored in the status storage means is in service operation status, and the standby machine cluster status stored in the status storage means is in service operation status. A transition deactivation step for transitioning the cluster state of the spare machine to a state where it can transition to service operation,
A cluster system recovery method comprising: The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status And a server operating as the working machine,
When a resource failure occurs in the working machine and the spare machine is in service,
When the cluster status of the active machine stored in the status storage means is a resource failure status, and the cluster status of the spare machine stored in the status storage means is a service operating status, Fault clearing means for clearing the fault state stored in the state storage means;
When the failure state of the working machine stored in the state storage means is cleared and the cluster state of the working machine stored in the state storage means is in a state where it can be shifted to service operation, the cluster state of the spare machine is serviced. A transition inhibiting means for transitioning to a state in which the transition to the inside is inhibited;
The cluster state of the active machine stored in the state storage means is a service operating state, and the standby machine cluster state stored in the state storage means is a state in which the transition to the service operating state is suppressed. If a transition inhibit release means for transitioning to a state that can transition the cluster state of the spare unit into the service operation,
Server with. The failure monitoring means for monitoring the failure status, and the service operation status of the active machine and the spare machine based on the failure status, the status of service operation, the status of transition to service operation, and the transition to service operation are suppressed. A cluster system comprising: a status management means for managing a cluster status including a status of a fault and a resource failure status; and a current machine and a spare machine each including a status storage means for storing the cluster status and the fault status Then, the server operating as the working machine is
When a resource failure occurs in the working machine and the spare machine is in service,
When the cluster status of the active machine stored in the status storage means is a resource failure status, and the cluster status of the spare machine stored in the status storage means is a service operating status, Failure clearing means for clearing the failure state stored in the state storage means;
When the failure state of the working machine stored in the state storage means is cleared and the cluster state of the working machine stored in the state storage means is in a state where it can be shifted to service operation, the cluster state of the spare machine is serviced. A transition deterring means for transitioning to a state in which the transition to the inside is deterred, and
The cluster state of the active machine stored in the state storage means is a service operating state, and the standby machine cluster state stored in the state storage means is a state in which the transition to the service operating state is suppressed. If the transition inhibit release means for transitioning to a state that can transition the cluster state of the spare unit into the service operation,
Program to function as.

Images