JP5512442B2 - Management device, method and program for disaster recovery system - Google Patents

Description

  The present invention is a so-called recovery of a service in which a failure has occurred by a facility in a place where the influence of the disaster did not occur so that the service by the information communication system can be continued even in the event of a disaster such as an earthquake or flood. The present invention relates to a technology for responding to a request for “disaster recovery”.

  In conventional disaster recovery support, a dedicated backup facility is generally prepared for each user system that performs services. As a backup system that operates only in the event of a failure, a server system that is equivalent to the primary system that operates normally is used. Will be prepared.

  For this reason, the facility cost is approximately twice that in the case where disaster recovery is not performed, and the high introduction cost has been a major obstacle to proceeding with disaster recovery.

  In recent years, due to the development of server virtualization technology, when a failure occurs in a virtualization server, a virtual machine operating on the virtualization server is replaced with another having a free resource of the necessary capacity (no failure has occurred). It has become possible to start on a virtualization server. An example of such a technique is “VMware High Availability (HA)” shown in Non-Patent Document 1.

  Non-Patent Document 1 also discloses a technique called “VMware Site Recovery Manager (SRM)”. In addition to the “Protected Site” that operates the primary system that operates normally, a “Recovery Site” that operates the backup system that operates in the event of a failure is provided, and the “Recovery Plan” is executed. Disaster countermeasures can be performed by operation.

"Introduction to VMware" written by VMware, November 12, 2008, published by Shosuisha Co., Ltd.

  In the above-mentioned “VMware SRM”, it is possible to effectively use resources by operating virtual machines other than the user system targeted for disaster countermeasures in the normal “recovery site”. In addition, it is possible to use one “Recovery Site” resource as a backup resource shared by multiple “Protected Sites”, and there is a possibility that the problem of high equipment costs can be solved. .

  However, when the backup resource is shared, there may be a situation where the backup resource is insufficient depending on the number of user systems under the influence of the failure at the same time and the amount of resources used. On the other hand, it is possible to provide a backup priority for each user system so that a user system with a high priority can be recovered. However, any user system can be recovered when a failure occurs. It is not enough when a reliable disaster recovery response is required.

  In actual operation, the data center that accommodates the virtualization server is generally installed in a geographically dispersed area. Therefore, the data center that operates the user system is There is an intention of the user (service provider) to freely select. However, in the technology such as “VMware SRM” described above, since the relationship between one “recovery site” and a plurality of “protected sites” that share the resource is fixed, the degree of freedom of selection is low. .

  In consideration of the above circumstances, the present invention makes use of an environment in which a plurality of data centers are dispersed in a region, realizes low cost by sharing backup resources, disasters depending on regions, etc. Management of user system placement and data center resources so that a disaster recovery function can be provided to the user system in the event of a failure, and the degree of freedom in selecting the data center where the user system is to be operated It aims at realizing the mechanism which does.

  In accordance with the principles of the present invention, a management device is provided for deploying a user system in one of a plurality of data centers. Here, each data center includes at least one virtualization server, and the virtualization server can operate the arranged user system by at least one virtual machine operating on the virtualization server. The resources that each data center has can be used for either the purpose of being allocated as a primary resource used by the user system during normal times or the purpose of being reserved as a backup resource in the event of a failure. Is.

  The management device stores first information related to a current resource amount of each of the plurality of data centers, and a second indicating a resource amount required by the user system as an arrangement request for the user system Assuming that a failure has occurred in an area to which an input means for inputting information and a normal data center where the user system is located belong, the user system is arranged in a data center belonging to an area not affected by the failure Based on the first information and the second information, a determination unit that determines whether or not a sufficient resource amount can be secured as a backup resource, and a determination by the determination unit that a backup resource can be secured Accordingly, the user system in the normal location of the user system and the user in the data center. Outputs information identifying the primary resource amount to be allocated to the system, in accordance with by the backup resource reservation inability of determining said determination means, and a reject output means disposed request of the user system.

  With the above configuration, it is possible to maintain a backup resource that can restore and operate a user system in a different region when a failure occurs in any region. It is possible to provide a disaster recovery response. In addition, since the backup resources in each region are shared between other regions, it is possible to save the equipment cost for that amount. Furthermore, among the resources of each data center, the amount used as the primary resource and the amount reserved as the backup resource can be distributed in the desired ratio, so the data center where the data system is to be placed can be selected Can be given a degree of freedom.

  Based on the first information, the determination unit of the management device determines a total primary resource capacity that is a resource amount that is permitted to be used as a primary resource in the plurality of data centers as a whole, and the second information indicates Means for determining whether or not the resource amount required by the user system can be allocated within the range of the total primary resource capacity may be included.

  With this configuration, the upper limit of the amount of resources that can be used to operate the user system in a normal state across data centers in multiple regions is determined, and the remaining resources can be secured as shared backup resources. it can.

  In the above configuration, assuming that a failure has occurred in a certain region, the processing of totaling the resource capacities of the data centers belonging to the region that is not affected by the failure is performed for a plurality of regions. A total resource capacity may be obtained, and the smallest of these total resource capacity may be determined as the total primary resource capacity.

  As a result, the upper limit of the amount of resources that can be used for normal operation of user systems across multiple data centers in multiple regions can be recovered only in other regions, regardless of the failure. It is possible to calculate so as to secure backup resources. This takes advantage of the fact that only one region is affected by the failure at the same time, and there are no backup resources, even if there is a surplus depending on which region the failure occurs. The allocation of primary resources is permitted only to the extent that can be guaranteed.

  The determination unit of the management device determines an individual primary resource capacity that is a resource amount that is permitted to be used as a primary resource in a data center that is a normal location of the user system based on the first information, and Means for determining whether or not the resource amount required by the user system indicated by the second information can be allocated within the range of the individual primary resource capacity may be included.

  With this configuration, it is possible to determine which data center should be the normal location for user systems that have requested placement, with shared backup resources secured across data centers in multiple regions. Become.

  In the above-described configuration, the determination unit may perform determination using a data center selected based on a predetermined criterion as a candidate for a data center that is a normal placement destination of the user system.

  As a result, it is possible to determine the data center where the user system is normally arranged, reflecting the intention of the user (service provider). As a predetermined standard, for example, priority is given to an area where communication delay to a client is small, and information related to an area such as a local government can be stored in a data center in the same area. For example, the usage amount may be balanced.

  The management device belongs to a region that is not affected by the failure, if a failure occurs in a region where a normal data center where the user system is located belongs, and the data center at the time of failure where the user system is located You may further provide the selection means to select from among data centers.

  With this configuration, it is possible to determine in which data center a resource for recovering and operating the user system in which a failure has occurred is allocated from a shared backup resource secured across data centers in a plurality of regions.

  In the above configuration, the selection unit may select a data center selected based on a predetermined criterion as a candidate for a data center that is an arrangement destination when the user system fails.

  As a result, it is possible to determine the data center that is the placement destination in the event of a failure of the user system, reflecting the intention of the user (service provider). As a predetermined standard, for example, priority is given to an area where communication delay to a client is small, and information related to an area such as a local government can be stored in a data center in the same area. For example, the usage amount may be balanced. The reference for determining the placement destination at the time of failure and the reference for determining the placement destination at the normal time may be the same or different.

  In the above configuration, the selection unit determines an individual backup resource capacity that is a resource amount that can be used as a backup resource in a data center that is an allocation destination in the event of a failure of the user system, based on the first information, Means for determining whether or not the resource amount required by the user system indicated by the second information can be allocated within the range of the individual backup resource capacity may be included.

  As a result, it is possible to select a data center to which resources for recovering and operating the user system can be allocated as an allocation destination in the event of a user system failure.

  In the above configuration, when the determination by the determination unit is performed, selection is performed by the selection unit, and the output unit is configured to output information for specifying a data center where the user system is normally arranged. When outputting the information for specifying the data center that is the location of the user system when the failure occurs, and when the data center that is the location of the user system cannot be selected by the selection means May reject the user system placement request.

  As a result, when determining the normal placement destination data center of the user system that requested the placement, the placement destination data center at the time of failure of the user system can also be determined. This selection timing is particularly useful, for example, in a method of performing control based on the minimum divided resource amount described later. It is also useful in the backup resource capacity fixing method described later.

  In the above configuration, when the failure occurs, selection is performed by the selection means, and the amount of backup resources to be allocated to the user system in the data center and the data center to which the user system is arranged at the time of the failure is determined. You may make it further provide the additional output means which outputs the information to identify.

  Thereby, when a failure occurs, it is possible to determine a placement destination data center for recovering the user system in which the failure has occurred. This selection timing is useful, for example, in a backup resource capacity non-fixing method described later, particularly when control based on the minimum divided resource amount is not performed. It is also useful in a backup resource capacity fixing method that does not perform control based on the minimum divided resource amount.

  In the above configuration, the determination unit assumes that the resource amount up to the capacity of the resource of the data center that is a normal location of the user system is permitted to be used as a primary resource. The selection means includes a means for determining whether or not a resource amount required by the user system can be allocated, and the selecting means is based on a resource capacity of a data center serving as a placement destination at the time of failure of the user system. A means for determining whether or not the resource amount required by the user system in the data center can be allocated within the capacity range excluding the resource amount currently used may be included.

  This is a backup resource capacity non-fixed method. According to this method, the backup resource capacity is not secured in advance in each data center, so select the data system where the user system is normally placed. It is possible to increase the degree of freedom.

  In the case of a backup resource capacity non-fixed method, the amount of resources that the management device requires in the data center by another user system that uses the data center that is the normal placement destination of the user system as the placement destination in the event of a failure However, it is possible to determine whether or not the allocation is possible. If the allocation is not possible, a re-selection unit that re-selects the data center that is the allocation destination in the event of a failure of the other user system may be further provided. Good.

  This reselection means is particularly useful when determining the placement destination data center at the time of failure of the user system when the placement destination data center of the user system that requested the placement is determined. This is because, in the case of the backup resource capacity non-fixed method, when the user system is operated in a normal placement destination data center, the backup resource capacity in the data center decreases. Note that when a failure occurs, this reselection means may be omitted when determining a placement destination data center for recovering the failed user system.

  Alternatively, in the above-described configuration, the determination unit may calculate a backup resource capacity reserved in advance as a backup resource in the data center from a resource capacity of a data center that is a normal placement destination of the user system. The resource amount up to the excluded capacity includes a means for determining whether or not the resource amount required by the user system can be allocated in the data center, assuming that use as a primary resource is permitted, The selection means allocates a resource amount required by the user system in the data center within a range of backup resource capacity reserved in advance as a backup resource in a data center that is an allocation destination in the event of a failure of the user system. Is it possible It may include means for determining whether.

  This is a backup resource capacity fixing method. According to this method, since the backup resource capacity is secured in advance in each data center, the data center that is the destination for the failure is set once for each user system. It only needs to be selected, and reselection can be eliminated.

  In the case of the fixed backup resource capacity method, the total backup resource capacity, which is the amount of resources secured as backup resources in the plurality of data centers as a whole, is allocated to the plurality of data centers, so that the backup resources are secured in advance in each data center. The backup resource capacity may be determined.

  The ratio of the total backup resource capacity allocated to a plurality of data centers may be determined by the administrator in consideration of the characteristics of each data center, the intention of each user (service provider), and the like.

  The management device selects two or more data centers as data centers where the user system is normally arranged, and allocates the resource amount required by the user system to the two or more data centers. You may further provide the division means which enables allocation of the amount of primary resources.

  With this configuration, when deciding on a data center where user systems are normally placed, if there are enough primary resources as a whole for a plurality of data centers, the user system will be placed in one of the data centers. Even when there is no place where the capacity can be accommodated, the user system can be divided and placed in two or more data centers to positively respond to the user system placement request.

  The management device selects two or more data centers as the data center where the user system is arranged at the time of failure, and allocates the resource amount required by the user system to the two or more data centers. There may be further provided a dividing unit that enables allocation of a backup resource amount when the failure occurs.

  With this configuration, when deciding on a data center where a user system is to be placed in the event of a failure, there are sufficient backup resources for the entire data center, but if you attempt to place a user system in one of those data centers Even when there is no place where the capacity can be accommodated, the user system can be divided and placed in two or more data centers to positively respond to the user system placement request. In particular, in the method of determining the location data center where the user system is restored when a failure occurs, it is assumed that the user system can be restored at some data center, and the placement request is accepted on a normal basis. Therefore, it is desirable to realize the arrangement at the time of failure even if it is divided.

  In the above configuration, the second information is information indicating a minimum divided resource amount that should be allocated at least in each data center when the resource amount required by the user system is allocated to two or more data centers. The dividing means may include means for allocating resource amounts with reference to the second information.

  By dividing the user system according to this minimum divided resource amount, if the user system is divided too small, there is a possibility that the operation may be hindered, and such a situation can be avoided. .

  In the above configuration, in addition to outputting information for specifying a data center that is a normal placement destination of the user system, the output unit is information for specifying a data center that is a placement destination when the user system is faulty When the management device cannot perform allocation in accordance with the minimum divided resource amount in the dividing unit, the selection of the data center to be arranged at the time of failure of another user system is selected. You may make it further provide the re-selection means to redo.

  In the control method based on the minimum divided resource amount, the primary resources as a whole of multiple data centers are sufficient, but there is no data center that has a usable resource capacity that exceeds the minimum divided resource amount. A situation can occur where there is no location to restore the system. To prevent this, when deciding the normal placement destination data center of the user system that requested the placement, the placement destination data center at the time of failure of the user system should also be decided. If it cannot be determined, it is desirable to determine that the backup resource cannot be secured and reject the user system placement request. In addition, it is possible to increase the possibility of re-selecting the data center that is the placement destination in the event of a failure of another user system and determining the placement destination of the user system that requested the placement in the event of a failure. Good.

  In the above configuration, when the resource amount required by the user system is allocated to a data center that is a destination for two or more failures, the condition of the minimum divided resource amount is the data center that is a normal destination. It may be set more relaxed than the conditions for allocation.

  As a result, if the user system is divided into small parts, there may be a disadvantage such as slowing down the operation. In normal times, the user system should be divided as much as possible with emphasis on the comfort of operation, etc. Fine control can be performed to allow small divisions with emphasis on the possibility of finding the center.

  The above-described user system includes at least one application server and means (for example, a relay device such as a gateway) for making the application server accessible from a client via a network, and the application server includes the virtual machine It may be realized by. Data used by the application server for service processing may be stored in the application server, or the user system may further include a gateway for storing in another server and accessing the server.

  When the user system includes a plurality of application servers, the ratio of the amount of resources allocated as a guide to each application server may be determined in advance. If this ratio is determined so that it can be expanded by copying multiple copies of the same user system when it becomes necessary to operate the user system with large-scale resources, each user system is minimized. An operation of registering with a resource configuration and expanding it as necessary to increase the scale becomes possible.

  The management device registers, in the name resolution server in the network, the correspondence between the name for publishing the service of the user system and the address at which the data center where the user system is located can be specified in the network. A means for enabling access from the client may be further provided.

  As a result, while the user system is operating in the normal placement destination data center, if you make an inquiry based on the name of the user system, the address of the normal placement destination data center is obtained and a failure occurs. When the user system is restored and operated at the location data center at the time, the registered contents are rewritten. Therefore, if an inquiry is made based on the name of the same user system, the address of the location data center at the time of failure can be obtained. When the user system is divided and arranged, a plurality of addresses are registered corresponding to one name, and any one address can be obtained using a mechanism such as load balancing.

  The management device described above shows the relationship between the faulted area and the affected data center when a fault that occurs in one area may affect data centers that belong to one or more different areas. Storage means for storing third information may be further provided, and the determination means may include means for making a determination with reference to the third information.

  With this configuration, even if there is an overlap between areas that may affect each data center if a disaster occurs, the user system in the area where the failure occurred, regardless of when and in what area However, it is possible to maintain a state where backup resources sufficient for recovery operation are secured in another area.

  Alternatively, the plurality of data centers are grouped by region so that a failure occurring in one group does not affect the data centers of other groups, and the data centers in each group have A capacity obtained by subtracting the largest of the total capacity of resources from the capacity of resources of the plurality of data centers as a whole may be used as a resource amount that is permitted to be used as a primary resource in the plurality of data centers.

  According to this configuration, there can be no overlap between areas that may affect each data center if a disaster occurs. It is possible to easily obtain the total primary resource capacity for securing the backup resources that can restore and operate the user system in another area in the entire data centers.

  Each invention described above as a management device is an invention of a management method for locating a user system in one of a plurality of data centers, or an invention of a management program for operating a computer as the management device. However, the invention of the storage medium storing the management program is also established.

  As described above, according to the present invention, by utilizing an environment in which a plurality of data centers are dispersed in a region, a backup resource is shared and a low cost is realized, and a failure such as a disaster depending on a region is realized. It is possible to reliably provide a disaster recovery function for the user system at the time of occurrence. It is also possible to give a degree of freedom to the selection of the data center where the user system is operated.

Explanatory drawing of a system (this system) provided with the management apparatus in embodiment of this invention Illustration of data synchronization between data centers (between DCs) Illustration of each resource amount (capacity, primary resource, backup resource) Explanatory diagram showing the relationship of each resource amount (A) A figure showing an example of a resource unit (RU) (b) A figure showing an example of calculation of a resource amount of each DC (DC1 and DC2) The figure which shows an example of the management information related to the data center The figure which shows an example of the management information relevant to a user system Explanatory diagram of backup DC selection timing Explanatory drawing of processing flow when there is no guarantee of minimum divided resource amount in non-fixed method Explanatory diagram of the processing flow when there is a guarantee of the minimum divided resource amount in the non-fixed method Explanatory diagram of processing flow for fixed method Diagram showing an example of area definition Diagram showing the relationship between the disaster occurrence area and the affected DC The figure which shows an example (specific example of calculation of TP) of the resource amount of each DC The figure which shows an example of the calculation result of total primary resource capacity | capacitance TP Explanatory drawing of calculation of total primary resource capacity TP in case of simple model The figure which shows an example of selection conditions of primary DC The figure which shows an example of the conditions which the backup DC should satisfy The figure which shows an example of the relation between the disaster occurrence area and the affected DC Illustration of user system configuration The figure which shows an example of the management information and value of a user system The figure which shows an example of the setting item and value determined according to DC of arrangement | positioning destination Explanatory drawing of selection of placement destination DC that improves resource utilization efficiency Illustration of the effect of sharing backup resources Diagram showing examples of allocation of main usage and backup usage of resources in each region

(Configuration of this system)
Hereinafter, a management apparatus according to an embodiment of the present invention will be described with reference to the drawings. Here, a system including a management apparatus (hereinafter referred to as the present system) will be described as an example. FIG. 1 is an explanatory diagram showing the configuration of the present system. As shown in FIG. 1, the present system 1 includes a plurality of data centers 2 distributed in a plurality of regions (Osaka, Tokyo, Toyama, etc.). In this example, two data centers 2 (DC-1, 2 in the figure) are installed in Osaka, two data centers 2 (DC-3, 4) are installed in Tokyo, and two data centers 2 are installed in Toyama. (DC-5, 6) is installed.

  In each data center 2, a user system 3 is operated. For example, in DC-1, user systems-1 and 2 are operated, and in DC-2, user system-3 is operated. In DC-3, user systems -4 and 5 are operated, and in DC-4, user systems -6 and 7 are operated. Further, in DC-5, the user system-8 is operated, and in DC-6, the user system-9 is operated.

  The management device 4 is connected to each data center 2 through a network, and can perform information communication with each data center 2. The management device 4 is configured by a computer device or the like, and includes a storage unit 5 configured by a memory, an HDD, and the like, an input unit 6 configured by a keyboard, a mouse, and the like, and a process configured by an MPU, a CPU, and the like. A display unit 8 including a unit 7 and a liquid crystal display is provided. As will be described later, the management device 4 includes various functions for providing a disaster recovery function for the user system 3 when a failure occurs. These functions can be realized by a program stored in the HDD or memory of the management device 4.

(Function of this system)
The system 1 has the following three functions. The first function is “a function that reliably responds to the occurrence of regional scale failures”. With this function, even when a failure occurs in “when” or “which region”, it is possible to guarantee that all the user systems 3 in the failure region always have backup resources sufficient for recovery operation in another region. Can be recovered quickly in the event of a failure.

  The second function is “a function capable of minimizing the amount of required backup resources by sharing backup resources between regions”. By sharing backup resources in each region among other regions, the amount of backup resources required as a whole can be reduced compared to a case where such sharing is not performed.

  The third function is “a function that allows a user system to freely select a data center where the user system is to be placed”. For example, if you want to place the system in a data center 2 in a region with as little communication delay as possible, or if you want to perform information processing related to the region (such as local government information processing) in the data center 2 in the same region, various resources between data centers This function is effective, for example, when it is desired to add the data center 2 while balancing the amount of usage (CPU, memory, network, etc.).

  In the system 1, in the resource pool of each data center 2, the distribution of the amount to be secured as the primary resource for regular use and the remaining backup resource is within a range in which the first function and the second function can be realized. Since it can be set freely, the third function can be realized, that is, all three functions can be realized.

(Features of this system)
It can be said that the present system 1 has the following two features so that all the above three functions can be realized. The first feature is “integrated management of backup resources in all data centers”. If backup resources required in each region are individually secured, it is not possible to effectively share backup resources between regions. Therefore, in the present system 1, first, an upper limit value (total primary resource capacity) of a resource amount that can be used for operating the user system 3 in a normal state in “the entire data center in each region” is calculated, and the remaining resources are calculated. Secured as a shared backup resource. This upper limit value is calculated so that a backup resource sufficient to recover from a failure can be secured in any other region regardless of the region where the failure occurs. Therefore, in the present system 1, the user system 3 can be freely arranged in the data center 2 in a desired area within a range not exceeding the upper limit value of the entire data center.

  The second feature is “corresponding to distributed arrangement of user systems”. In the user system 3 that requires a resource amount of a certain level or more, even if there are sufficient primary resources or backup resources as a whole data center, there is no place where the capacity can be accommodated when placing in each data center 2 May occur. Therefore, in the present system 1, each user system 3 is registered with a minimum resource configuration, and can be expanded to an operation with a large-scale resource as required by an expansion technique (clustering). Further, in the present system 1, when resources are insufficient at the individual data center level, the user system 3 is operated so that the total value becomes a necessary resource amount in a plurality of data centers, and the user system 3 is operated as DNS. By linking with name resolution technology, users can use it as a single system.

(Premise of this system)
This system 1 is premised on the use of functions by data synchronization between data centers (between DCs). First, data synchronization between DCs will be described with reference to FIG. FIG. 2 is an explanatory diagram of data synchronization between DCs. As shown in FIG. 2, the data center 2 includes a gateway server 9, a DNS server 10, a virtualization server 11, a database server 12, and a storage server 13. As the virtualization server 11, for example, “VMware Server”, “VMware ESX”, or the like can be used. The database server 12 and the storage server 13 of each data center 2 are connected by a data synchronization line (dedicated line, VPN line, etc.), and data is synchronized. Here, details of the data synchronization method and method between the DCs are not particularly mentioned, but for example, a replication function between known storages can be used. When data synchronization is performed between the DCs, even if a failure occurs in a certain DC and the storage of the DC, data necessary for restarting the same user system 3 can be obtained from the storage of another DC.

  The disaster recovery function of the system 1 is based on the premise that two functions based on data synchronization between DCs can be used. The first function is “a function for starting an application server of each user system in all DCs”. With this function, the activation image of each application server 14 is stored on the storage server 13 where data synchronization is performed between DCs, and can be activated from any DC storage. The second function is “a function to access application data of each user system 3 in all DCs”. With this function, application data is stored on a storage or database server 12 in which data synchronization is performed between DCs, and in any DC, the user system 3 accesses application data from the storage or database server 12. Will be able to.

Next, the concept of the resource amount of each DC will be described with reference to FIGS. FIG. 3 is an explanatory diagram of each resource amount (capacity, primary resource, backup resource). As shown in FIG. 3, the resource amount of each DC includes “capacity C _n ” that is the capacity of the entire resource of the n-th (n = 1, 2,...) Data center 2 (DC-n). “Primary resource P _n ”, which is a capacity that can be used as a primary resource of DC-n (a resource that is normally used by the user system 3), and a backup resource of DC-n (a resource that is not normally used) “Backup resource B _n ” which is a capacity is included.

FIG. 4 is an explanatory diagram showing the relationship between each resource amount. As shown in FIG. 4, the relationship between the resource amounts (capacity C _n , primary resource P _n , backup resource B _n ) of each DC can be expressed by the following equation (1).

  The DC resource includes a plurality of types such as a CPU, a memory, and a network. Therefore, the DC resource amount has a value for each type and is multidimensional. For simplification of processing, this may be made one-dimensional as follows.

  First, the minimum unit (resource unit, RU) for handling various resources collectively is determined. The resource unit can be arbitrarily determined as a set of minimum units of each resource (CPU, memory, network, etc.) that guarantees the allocation amount for the user system 3. FIG. 5A shows an example of a resource unit (RU). In this example, 2.0 GHz is set to 1 RU for the CPU, 2.0 GB is set to 1 RU for the memory, and 1.0 Mbps is set to 1 RU for the network.

  Here, since the minimum unit (RU) is an allocation amount for the user system 3, an integer [RU] is always allocated to the user system 3, but when the user system 3 includes a plurality of application servers 14. Is allowed to be assigned a decimal number [RU] to each application server 14.

  Next, the resource amount of each DC is calculated using such a unit called a resource unit. Specifically, the number of RUs corresponding to each resource type is calculated, and the smallest value among them is set as the DC resource amount. FIG. 5B shows an example of calculating the resource amount of each DC (DC-1 and DC-2). In this example, for DC-1, since the CPU resource amount is converted to 350 RU, the memory resource amount is converted to 400 RU, and the network resource amount is converted to 400 RU, the minimum value among them is 350 RU. , Calculated as the resource amount of DC-1. For DC-2, the CPU resource amount is converted to 300 RU, the memory resource amount is converted to 250 RU, and the network resource amount is converted to 300 RU. Therefore, the minimum value of 250 RU is Calculated as the DC-2 resource amount.

  As another example, not all resource types are considered, but only the resource of the selected type is focused, and the amount of the resource of that type may be the resource amount in units of RUs. For example, in the example of FIG. 5B, focusing on only the CPU resources, the DC-1 resource amount may be 350 RU (as it is), and the DC-2 resource amount may be 300 RU.

(Management information)
Next, management information used in the system 1 will be described with reference to FIGS. 6 and 7. The management information of the system 1 includes data center related management information and user system related management information. FIG. 6 is a diagram illustrating an example of management information related to the data center. As shown in FIG. 6, the management information related to the data center is roughly divided into management information related to individual DC related to each data center 2 (DC _n ) and management information about the entire DC.

The individual DC related management information includes “various resource capacities C _n ” indicating the capacities of the respective DC resources (CPU, memory, network) and the capacities of the respective DC primary resources (CPU, memory, network). “Primary resource capacity P _n ” shown, “Backup resource capacity B _n ” showing the capacity of each DC backup resource (CPU, memory, network), and each DC primary resource (CPU, memory, network) "Primary resource usage amount U _n " indicating the usage amount. The individual DC-related management information includes information on a “user system IP address list” and a “user system VLAN ID list” used when the user system 3 is placed in the DC.

  The management information of the entire DC includes information of “total primary resource capacity TP” indicating the primary resource capacity of the entire DC and “total backup resource capacity TB” indicating the backup resource capacity of the entire DC. A method of calculating “total primary resource capacity TP” and “total backup resource capacity TB” will be described later.

The management information related to the individual DC is registered based on the declaration of the manager of the data center 2. For example, for “various resource capacities C _n ”, “user system IP address list”, and “user system VLAN ID list”, values reported by the administrator of the data center 2 are registered. For “primary resource capacity P _n ” and “backup resource capacity B _n ”, values calculated or determined by the management apparatus 4 of the system 1 are registered. The “primary resource usage amount U _n ” can be updated by the management apparatus 4 of the present system 1 in accordance with an increase in usage amount due to the addition of the user system.

  FIG. 7 is a diagram illustrating an example of management information related to the user system. As shown in FIG. 7, the management information related to the user system is roughly classified into management information related to the user system configuration relating to each user system (Sm) and management information related to the user system placement destination DC.

The management information related to the user system configuration includes “required resource amount R _m ” indicating the resource amount required by the user system 3, and at least the user system 3 divided when the user system 3 is DC-distributed. “Minimum divided resource amount Rmin _m ” indicating the resource amount to be allocated is included. When the user system 3 is DC-distributed, the resource amount to be allocated as the total value is “necessary resource amount R _m ”. The management information related to the user system configuration includes various types of configuration information. The configuration information includes information such as a service publishing host name, a service publishing protocol, a service health check protocol, and application server related information. The information related to the application server includes information such as the OS boot image name and the allocated resource ratio (AP1: 80%, AP2: 20%).

  The management information related to the user system placement destination DC includes management information of the primary data center and management information of the backup data center. The management information of the primary data center includes information on the data center 2 that is the placement destination as a primary, and a service front IP address at the time of DC placement. The management information of the backup data center includes information on the data center 2 that is the allocation destination at the time of failure and information on the IP address for service front at the time of DC allocation.

  Note that the minimum divided resource amount may be set to different values for primary DC placement and backup DC placement. For example, the backup placement value may be set smaller than the primary placement value in order to relax the emergency backup DC selection condition.

  If the minimum divided resource amount is set large, the operating environment of the user system 3 is improved (for example, the operation becomes faster). On the other hand, if the minimum divided resource amount is set to be small, the resource use efficiency is improved (the possibility that the arrangement request of the user system 3 is accepted increases). Further, when determining the minimum divided resource amount, the allocated resource ratio of the application server 14 in the user system 3 may be taken into consideration. For example, the resource amount allocated to the smaller proportion may not be excessively reduced.

  Information related to the user system configuration is registered based on the declaration of the user (service provider) who operates each user system 3. Further, information determined by the management device 4 of the system 1 is registered as information related to the user system placement destination DC.

(Processing flow of this system)
Next, a processing flow of the system 1 will be described. The processing flow of the system 1 differs depending on the backup capacity designation method of each DC. Therefore, first, a backup capacity designation method will be described. The backup capacity designation method is classified into a “non-fixed method” in which the backup resource capacity of each DC is not fixedly specified and a “fixed method” in which the backup resource capacity of each DC is fixedly specified.

  In the non-fixed method, the backup capacity of each DC is non-fixed (it is sufficient if there is a constant capacity across all DCs), so the degree of freedom in selecting the DC as the primary placement destination of the user system 3 is high. However, in the non-fixed method, the backup capacity of each DC is changed as the user system 3 is added. Therefore, each time the user system 3 is added, the selection result of the backup DC of another user system 3 may change according to the change in the resource usage status.

  On the other hand, in the fixed method, the backup DC need only be selected once when the primary DC is selected or when a failure occurs. However, in the fixed method, the backup capacity of each DC is fixedly specified before the operation of the user system 3 is started, and it is necessary for each DC to have a normal amount of resources available. For this reason, the degree of freedom of selection of the primary arrangement destination DC of the user system 3 is lower than that of the non-fixed method.

  The processing flow of the system 1 also differs depending on whether or not the minimum divided resource capacity is secured. Specifically, the backup DC selection timing differs depending on whether or not the minimum divided resource capacity is secured. Therefore, the timing for selecting the backup DC will be described here.

  FIG. 8 is an explanatory diagram of backup DC selection timing. As shown in FIG. 8, when ensuring the minimum amount of divided resources, there is a possibility of NG determination (no selectable DC) when selecting a backup DC. Is preferred. When the minimum divided resource capacity is not secured, the backup DC selection timing differs depending on whether the non-fixed method or the fixed method is used. In the case of the non-fixed method, it is preferable to select when a failure occurs. On the other hand, in the case of the fixed method, any timing may be used.

  Next, a processing flow of the system 1 will be described. Here, description will be made on a case-by-case basis depending on whether the non-fixed method or the fixed method is used and whether or not the minimum divided resource capacity is secured.

FIG. 9 is an explanatory diagram of a processing flow when the non-fixed method is used and there is no guarantee of the minimum divided resource amount. As shown in FIG. 9, first, at the stage of preparation for starting operation of the system 1, processing for registering various resource capacities of each DC is performed (S1). Specifically, for each DC, among the individual DC-related management information DC _n , various resource capacities C _n and user system IP addresses are registered. Thereafter, the primary resource capacity (total primary resource capacity TP) of all DCs is calculated (S2). A method for calculating the total primary resource capacity TP will be described in detail later.

At the stage where the system 1 is in regular operation, first, user system information is registered (S3). Specifically, user system configuration related information S _m is registered. Next, a primary DC is selected (S4). The method for selecting the primary DC will be described in detail later. If the primary DC can be selected, the user system 3 is placed on the primary DC (S5). The DC arrangement method of the user system 3 will also be described in detail later. On the other hand, if the primary DC cannot be selected, the process is terminated (S6).

When a failure occurs in a certain area, first, the failure is detected by regular monitoring (S7). Specifically, a health check is performed on the user system 3 operating on the primary DC, and if a normal response cannot be obtained, it is considered that a failure has occurred. In this case, the target IP address of the health check can be acquired from information related to the user system placement destination DC (service front IP address at the time of DC placement of the primary data center). The health check method can be determined from the user system configuration related information S _m (service health check protocol).

  Next, in the present system 1, a backup DC is selected (S8). A method for selecting the backup DC will be described in detail later. When the selection of the backup DC is completed, the user system 3 is placed on the backup DC (S9). The placement destination DC is determined based on the information related to the user system placement destination DC (the placement destination data center 2 at the time of failure).

  In the example of FIG. 9, the backup DC selection process is executed when a failure is detected. However, if selection according to changes in the usage status of the primary resources of each DC is possible at any time, at other timings. You may go. For example, backup DC selection of all user systems 3 may be performed by batch processing at night when no user system 3 is added every day.

  FIG. 10 is an explanatory diagram of a processing flow when the minimum division resource amount is guaranteed in the non-fixed method. As shown in FIG. 10, first, at the stage of preparation for starting operation of the system 1, as in the case of FIG. 9, a process of registering various resource capacities of each DC is performed (S1), and the primary resource capacities of all DCs A process of calculating (total primary resource capacity TP) is performed (S2).

Next, at a stage where the system 1 is in regular operation, user system information is registered (S3), and a primary DC is selected (S4). In this case, since there is a guarantee of the minimum divided resource amount, it is necessary to select the backup DC together with the primary DC when the user system 3 is added. However, since the backup resource capacity of each DC is not fixed, the increase in the amount of primary resource usage due to the addition of the user system 3 can be used as a backup DC from another user system 3 whose primary is a DC in another area. May have an impact. (Because B _n = C _n −P _n , the capacity as the backup resource decreases as the primary resource usage increases.) Therefore, in the flow of FIG. Reselection of the backup DC is executed for all other selected user systems 3 (S10). If the backup DC cannot be reselected, the process is terminated (S6).

  On the other hand, if the backup DC can be reselected for all other user systems 3, the backup DC is selected for the user system 3 that has selected the primary DC in step S4 (S8). When the backup DC can be selected, the user system 3 is placed on the primary DC (S5). When a failure occurs in a certain area, the failure is detected by regular monitoring (S7), and the user system 3 is placed on the backup DC (S9).

  FIG. 11 is an explanatory diagram of a processing flow in the case of the fixed method. As shown in FIG. 11, first, at the stage of preparation for starting operation of the present system 1, after performing processing for registering various resource capacities of each DC (S1), based on the total backup resource capacity TB, Processing for calculating the backup resource capacity is performed (S2). A method for calculating the total backup resource capacity TB will be described in detail later.

  Next, at a stage where the system 1 is in regular operation, user system information is registered (S3), and a primary DC is selected (S4). If the primary DC can be selected, the backup DC is selected (S8), and the user system 3 is placed on the primary DC (S5). If there is a guarantee of the minimum divided resource amount, the backup DC may not be selected and the processing may end. When a failure occurs in a certain area, the failure is detected by regular monitoring (S7), and the user system 3 is placed on the backup DC (S9). If there is no guarantee of the minimum divided resource amount, the backup DC selection process may be performed when a failure occurs.

(Calculation of total primary capacity and total backup capacity)
Here, a method of calculating the total primary capacity TP and the total backup capacity TB will be described. First, as pre-processing, an area is defined from the viewpoint of the influence of a regional disaster on each DC. More specifically, for each DC, a geographical range that may be affected when a regional disaster occurs is defined as a “region”, and each area delimited by the boundary line of the region is defined as an “area”.

FIG. 12 is a diagram illustrating an example of area definition. Referring to the example of FIG. 12, for DC-1, a range that may affect DC-1 when a regional disaster occurs is defined as a “region”. In this case, since the DC-1 region does not overlap with other regions, the area delimited by the boundary line of the DC-1 region is defined as “area A ₁ ”.

Also for DC-2, a range that may affect DC-2 when a regional disaster occurs is defined as a “region”. In this case, since the region of DC-2 overlaps with the region of DC-3, an area that does not overlap with the region of DC-3 among the regions of DC- ₂ is defined as “area A ₂ ”. The area where the region 2 and the region DC-3 overlap is defined as “Area _2-3 ”. In other words, each overlapping region is an individual area.

FIG. 13 is a diagram illustrating a relationship between an area where a disaster has occurred and a DC that has an influence on the area. FIG. 13 shows that when a disaster occurs in the area A ₁ , there is a possibility of affecting DC-1. Also, it is shown that when a disaster occurs in area A _2-3 , there is a possibility of affecting DC-2 and DC-3.

  In the above description, as an example, the area is defined by overlapping circular regions with a radius that is likely to be affected when a disaster occurs, centering on the geographical coordinates of each DC. The scope of the invention is not limited to this. That is, depending on the assumed disaster and geographical situation, each region is not necessarily circular. Moreover, although the case where the shape and area of each region were the same was illustrated in the above description, the scope of the present invention is not limited to this, and the shape and area of each region may be different.

When preprocessing (definition of each area) is completed as described above, the amount of resources (total primary resource capacity TP) that can be used for primary operation of the user system 3 among all DCs is calculated (TP is the total DC It can also be expressed as the sum of primary resources (see equation (2) below). The total primary resource capacity TP is calculated so that recovery resources can be secured in other areas even if a local disaster occurs in any area and all DCs in the area fail. Further, the remaining total primary resource capacity TP is calculated as a resource capacity (total backup capacity TB) to be secured as a backup resource between all DCs.

More specifically, in the calculation of the total primary resource capacity TP, in order to secure backup resources in other regions that are not affected by the failure, no matter what region the failure occurs, For all the areas, it is necessary to satisfy the condition of the following formula (3).

The above equation (3) is equivalent to the following equation (4).

  In the above formula (4), the left side is the same as TP from the definition of formula (2). Here, the smallest value among the calculation results of the right side of the above-mentioned formula for all areas is the maximum value that satisfies the conditions of all areas, and is the value of TP obtained here.

The total backup resource capacity TB is calculated by subtracting the total primary resource capacity TP from the total capacity of all DCs (see the following formula (5)).

  The calculation of the total primary resource capacity TP will be described with a specific example. FIG. 14 is a diagram illustrating an example of a resource amount of each DC (specific example of calculation of TP), and FIG. 15 is a diagram illustrating a calculation result of the total primary resource capacity TP in this specific example. In the example of FIGS. 14 and 15, 600 RU (minimum value of all areas) is calculated as the calculation result of the total primary resource capacity TP. In this case, the total backup resource capacity TB is calculated as 400 RU (= 1000 RU-600 RU).

  In the case of conventional non-shared backup resources, the primary resource can only be used up to half of the total resources, but the system 1 can use more than half. For example, in the case of FIGS. 14 and 15, 60% of the total resources can be used.

  Further, as shown in FIG. 12, if the DC is not dense, the primary resource can be used at a higher rate. For example, in the case of a model (simple model) in which the distance between the DCs is long and an area where a plurality of regions overlap is not present (simple model), 650RU having the smallest value among A1 to A5 in FIG. Calculated as resource capacity TP.

  In the case of such a simple model, it is also possible to calculate the total primary resource capacity TP as follows.

First, as pre-processing, all data centers 2 are grouped by region. Then, the total amount of resources of each regional group is calculated and arranged in order from the region with the largest value (see FIG. 16). The total amount of resources of this time N-th regional group (region N group) and C _N.

In this case, the total primary resource capacity TP can be calculated using the following equation (6). The total backup resource capacity TB can be calculated using the following equation (7).

Incidentally, in a case where the maximum value of the possible range of total primary resource capacity TP (if the most conservative), and TB = C _1. In the example of FIG. 15, among DC-1 to DC-5, the DC-1 resource amount 350RU having the maximum resource amount is obtained as the total backup resource capacity TB. When this is subtracted from the total resource amount of all DCs, 1000 RU, the total primary resource capacity TP is obtained as 650 RU (= 1000 RU-350 RU).

(Selection method of user system location DC)
Next, a method for selecting the placement destination DC of the user system 3 will be described. FIG. 17 is a diagram illustrating an example of selection conditions for the primary DC. In selecting the primary DC of the user system 3, all the four conditions (conditions A to D) in FIG. 17 must be satisfied. If there is no DC satisfying the condition as a primary DC candidate, the addition of the user system 3 is NG. Note that condition a needs to be determined only when the non-fixed method is used, and condition d needs to be determined only when the minimum divided resource capacity is guaranteed.

Hereinafter, these four conditions (conditions A to D) will be described in detail. Condition a is that the total resource usage of all DCs does not exceed the total primary resource capacity, and can be expressed by the following equation (8).

Condition i is that the resource usage of the destination DC does not exceed the primary resource capacity, and can be expressed by the following equation (9). Here, R _m (DC _n ) is a resource amount that is allocated from DC _n out of the required resource amount of S _m .

Note that the primary resource capacity is obtained by the following equation (10) in the case of the non-fixed method, and is obtained by the following equation (11) in the case of the fixed method.

The condition c is to satisfy the condition of the required resource amount of the user system 3. Specifically, the allocated resource amount from the placement destination DC (the total from each DC in the case of distributed placement) is the required resource amount. It is equivalent. For example, when there is one arrangement destination DC (DC _n1 ), it is expressed by the following expression (12), and when there are two arrangement destination DCs (DC _n1 , DC _n2 ), the following expression (13 ).

Condition d means that the condition of the minimum divided resource amount of the user system 3 is satisfied. For example, when there are two arrangement destination DCs (DC _n1 and DC _n2 ), the following equations (14) and (15) It is represented by

  FIG. 18 is a diagram illustrating an example of a condition to be satisfied by the backup DC. In selecting the backup DC of the user system 3, all of the four conditions (conditions oku) shown in FIG. 18 must be satisfied. Note that the condition is only required to be determined when the minimum divided resource capacity is guaranteed. Further, as described above, there is a possibility that there is no DC satisfying the condition when guaranteeing the minimum divided resource amount of the user system 3. For this reason, the backup DC is selected when the user system 3 is added. If there is no backup DC that satisfies the conditions as a backup DC, the addition of the user system 3 is NG.

Hereinafter, these four conditions (conditions oku) will be specifically described. Condition o is that the placement destination DC is not affected even when the primary DC disaster occurs. More specifically, the intersection set of the set of areas affected by the occurrence of the disaster (A _p ) in the primary DC and the set of areas affected by the occurrence of the disaster (A _b ) in the backup DC becomes an empty set. Can be represented by the following equation (16).

  FIG. 19 is a diagram illustrating an example of a relationship between a disaster occurrence area and an affected DC. In the example of FIG. 19, when the primary DC is DC-5, the backup DC candidates that satisfy the above condition (e) are DC-1 and DC-2.

The condition is that the resource reservation amount of the placement destination DC does not exceed the backup resource capacity. Specifically, for all areas where the primary DC is affected by the occurrence of the disaster, a set (S _p ) of each user system 3 having the DC affected by the occurrence of the disaster including the additional user system 3 as the primary DC, The total required resource amount of each user system 3 that is an element of the product set (S _{p & b} ) of the set (S _b ) of each user system 3 including the additional user system 3 as the backup DC is the backup of the target DC. The resource capacity (B _n ) is not exceeded, and the condition to be satisfied for each area can be expressed by the following equation (17).

Note that the backup resource capacity (B _n ) of the target DC is expressed by the following equation (18) in the case of the non-fixed method, and is expressed by the following equation (19) in the case of the fixed method.

  The condition key is to satisfy the condition of the required resource amount of the user system 3 and is the same as the condition c. Also, the condition is to satisfy the condition of the minimum divided resource amount of the user system 3 and is the same as condition d. If different values are specified as the minimum divided resource amount for the primary DC and the backup DC, the value for the backup DC is used.

(User system DC placement method)
First, the configuration of the user system 3 will be described. FIG. 20 is an explanatory diagram of the configuration of the user system 3. As shown in FIG. 20, the user system 3 includes a plurality of application servers 14, and the application servers 14 are in a state where they can communicate with each other (see arrow (i)). The user system 3 includes a data access gateway 15 for each user system 3, and the data access gateway 15 transfers access from each application server 14 to owned data in the shared database server 12 and storage server 13 ( Arrow (ii)). The user system 3 includes a service gateway 16 for each user system 3, and the service gateway 16 transfers access from the user of the provided service to the application server 14 designated as the service front server (arrow ( see iii)). In the user system 3, from the viewpoint of ensuring security, each service gateway 16 and the data access gateway 15 block communication across the user system 3 (see arrow (iv)). Further, in this user system 3, matching information between the host name for publishing the service of the user system 3 and the IP address of the service gateway 16 is registered in the DNS server 10 (see arrow (v)).

  Since the service gateway 16 needs to be dynamically provided when the user system 3 is arranged, in practice, a method of configuring the service gateway 16 as a virtual function according to need is preferable. When the service front server has a cluster configuration including a plurality of servers, the service gateway 16 may function as a load balancer that distributes loads to the service front server.

  Since the data access gateway 15 needs to be dynamically provided when the user system 3 is arranged, a method of configuring the data access gateway 15 as a virtual function according to need is actually desirable. In addition, from the viewpoint of data security, the data access gateway 15 is preferably subjected to access restriction so that a certain user system 3 cannot access data of other user systems 3. Note that it is possible to have a configuration without the data access gateway 15 by storing data used by the user system 3 in the application server 14.

  The front-end VLAN is used for mutual communication between the application servers 14 (see arrow (i)) and transfer of access from the user to the application server 14 (see arrow (iii)). This front-end VLAN is configured to be able to communicate only within the target user system of the placement destination DC.

  The back-end VLAN is used for access transfer (see arrow (ii)) from each application server 14 to the database server 12 or the storage server 13. This back-end VLAN is configured to be able to communicate only within the target user system of the placement destination DC.

  The application server 14 is a server that constitutes the user system 3. The application server 14 can be composed of a plurality of servers. The service front server is a server that serves as a window for access from users of services provided by the user system 3. There is basically one service front server for each user system 3.

  Next, a DC arrangement method of the user system 3 will be described. Hereinafter, a procedure for arranging the user system 3 in the arrangement destination DC (one DC) is described as an example. In addition, also when arrange | positioning the user system 3 to two or more DC, the user system 3 can be arrange | positioned by taking the same procedure about each DC.

  First, “setting of each VLAN” is performed. Specifically, a front end VLAN and a back end VLAN are set. For each VLAN ID, a non-use ID is selected from the user system VLAN ID list of each DC.

  Next, “Service Gateway Configuration” is performed. Here, the service gateway 16 for each user system is configured. Specifically, the service gateway 16 is connected to a shared Internet connection LAN and a front-end VLAN. Then, a service disclosure IP address is set in the IF connected to the Internet connection LAN of the service gateway 16. As the service public IP address, an unused one is selected from the user system IP address list of each DC.

  Next, “Data Access Gateway Configuration” is performed. In this case, the data access gateway 15 for each user system is configured. Then, the data access gateway 15 is connected to the shared back-end VLAN and data transfer LAN.

Next, “Application Server Configuration” is performed. Specifically, each application server 14 is activated as a virtual machine from the activation image with reference to the amount of each allocated resource within the resources allocated to the user system 3. Here, the allocated resource amount of each application server 14 can be expressed by the following equation.
Allocation resource amount of each application server = User system allocation resource amount x Allocation resource ratio of each application server

  Thereafter, each application server 14 is connected to the front-end VLAN and the back-end VLAN. The IP address of each application server 14 is set in the IF on the front end VLAN side of each application server 14. In the virtualization server technology, the allocated resource amount is a guideline, and resources can be interchanged between application servers while each application server 14 is operating. Further, resources may be interchanged between user systems.

  Finally, “DNS setting” is performed. Specifically, matching information between the service disclosure host name and the service disclosure IP address is registered in the DNS. In the case of arranging in two DCs, two IP addresses are registered in one service disclosure host name, and DNS guides access from users by load balancing.

  In this way, the DC arrangement of the user system 3 is performed. FIG. 21 is a diagram illustrating an example of management information and values of the user system 3 in which DC is arranged, and FIG. 22 is a diagram illustrating an example of setting items and values determined according to the arrangement destination DC.

  According to the present system 1, since the degree of freedom of selection of the placement destination DC is high, the placement destination DC can be selected so that resource utilization efficiency is improved. FIG. 23 is an explanatory diagram of selection of a placement destination DC that improves resource utilization efficiency. As shown in FIG. 23, in the present system 1, for example, the placement destination DC can be selected so as to suppress the variation in the resource usage amount according to the time zone. Also, the placement destination DC can be selected so as to suppress variation in the usage amount for each resource.

  Further, according to the present system 1, it becomes possible to share backup resources. Conventionally, in order to quickly recover a service in the event of a failure that does not know when it occurs, it has been considered that a necessary amount of backup resources must be prepared at all times (slow when preparation is started after a failure occurs). Therefore, in order to enable one-to-one disaster recovery correspondence between the two regions, basically, the same amount of backup resources as the main resources are required for each user system 3.

  On the other hand, in the present system 1, backup resources at the time of failure can be shared and used among three or more regions. FIG. 24 is an explanatory diagram of the effect of sharing backup resources. As shown in FIG. 24, in disaster recovery by sharing backup resources among three or more regions, the ratio of backup resources to main resources is reduced, and equipment costs can be reduced. If it is assumed that a failure occurs simultaneously in different regions, the backup resource usage in the three-region configuration can reduce the backup resources even in the same main resource amount than in the two-region configuration.

  Furthermore, according to the present system 1, the user system 3 can be arranged in a somewhat free area or data center 2. FIG. 25 is a diagram showing an example of allocation of main usage and backup usage of resources in each region. As shown in FIG. 25, if a certain area is limited to backup use, the response speed of the system is longer than the user places for some reason (for example, the geographically close area A is placed in other areas). Therefore, it is not possible to cope with the case where the system is to be arranged in the area for the reason of wanting to arrange in the area A). The system 1 can flexibly respond to such user requests.

  The embodiments of the present invention have been described above by way of example, but the scope of the present invention is not limited to these embodiments, and can be changed or modified according to the purpose within the scope of the claims. is there.

  As described above, the management apparatus according to the present invention has an effect that the disaster recovery function for the user system can be surely provided when a failure such as a disaster depending on the region occurs, and is useful.

DESCRIPTION OF SYMBOLS 1 This system 2 Data center 3 User system 4 Management apparatus 5 Storage part 6 Input part 7 Processing part 8 Display part 9 Gateway server 10 DNS server 11 Virtualization server 12 Database server 13 Storage server 14 Application server 15 Data access gateway 16 Service gateway

Claims (25)

A management device for placing a user system in one of a plurality of data centers,
Each data center includes at least one virtualization server,
The virtualization server is capable of operating a user system arranged by at least one virtual machine operating on the virtualization server,
The resources that each data center has can be used for either the purpose of being allocated as a primary resource for normal use by the user system or the purpose of being reserved as a backup resource in the event of a failure. ,
The management device
Storage means for storing first information regarding a current resource amount of each of the plurality of data centers;
An input means for inputting second information indicating a resource amount required by the user system as a user system arrangement request;
Assuming that a failure has occurred in an area to which a normal data center where the user system is located belongs, a resource amount sufficient to place the user system in a data center belonging to an area not affected by the failure is determined as a backup resource. Determination means for determining whether or not to ensure as follows based on the first information and the second information;
In response to the determination by the determination means that backup resources can be secured, the data center serving as a normal placement destination of the user system and information specifying the primary resource amount to be allocated to the user system in the data center are output, And an output unit that rejects the user system arrangement request in response to a determination that backup resources cannot be secured by the determination unit.   The determination means determines a total primary resource capacity that is a resource amount that is permitted to be used as a primary resource in the entire plurality of data centers based on the first information, and the user system indicated by the second information 2. The management apparatus according to claim 1, further comprising means for determining whether a required resource amount can be allocated within the range of the total primary resource capacity.   Assuming that a failure has occurred in a certain area, the total resource capacity is obtained by performing the process of totaling the resource capacities of the data centers belonging to the area not affected by the failure for a plurality of areas. 3. The management apparatus according to claim 2, wherein the smallest of these total resource capacities is determined as the total primary resource capacity.   The determination means determines an individual primary resource capacity that is a resource amount that is permitted to be used as a primary resource in a data center that is a normal location of the user system based on the first information, and the second information 4. The method according to claim 1, further comprising means for determining whether or not a resource amount required by the user system indicated by the information can be allocated within the range of the individual primary resource capacity. The management device described in the section.   5. The management apparatus according to claim 4, wherein the determination unit performs determination by using a data center selected according to a predetermined criterion as a candidate of a data center that is a normal placement destination of the user system.   When a failure occurs in an area to which a normal data center where the user system is located belongs, a data center at the time of the failure where the user system is located is selected from among data centers belonging to an area not affected by the failure. 6. The management apparatus according to claim 1, further comprising selection means for selecting.   7. The management apparatus according to claim 6, wherein a data center selected according to a predetermined criterion is selected by the selection means as a data center candidate to be an arrangement destination in the event of a failure of the user system.   The selection unit determines an individual backup resource capacity that is a resource amount that can be used as a backup resource in a data center that is an allocation destination in the event of a failure of the user system based on the first information, and the second information 8. The management apparatus according to claim 6, further comprising means for determining whether or not a resource amount required by the user system to be shown can be allocated within a range of the individual backup resource capacity. When making a determination by the determination means, make a selection by the selection means,
The output means outputs information for specifying a data center serving as a placement destination in the event of a failure of the user system, in addition to outputting information for identifying a data center serving as a regular placement destination of the user system. The arrangement for rejecting the user system placement request is rejected when the selection means cannot select a data center as a placement destination at the time of failure of the user system. 9. The management device according to any one of items 8. When the failure occurs, select by the selection means,
7. The data center as a placement destination at the time of a failure of the user system, and additional output means for outputting information for specifying a backup resource amount to be allocated to the user system in the data center. 9. The management device according to any one of items 8. The determination means assumes that the amount of resources up to the capacity of a resource of a data center that is a normal location of the user system is permitted to be used as a primary resource. Means for determining whether the required amount of resources can be allocated;
The selection means requires the user system in the data center within a capacity range obtained by subtracting the amount of resources currently used from the capacity of the resource of the data center that is the destination of the user system in the event of a failure. The management apparatus according to claim 6, further comprising means for determining whether or not a resource amount to be assigned can be allocated.   The other user system having the data center that is the normal location of the user system as the placement destination at the time of failure determines whether or not the resource amount required in the data center can be assigned, and is assigned. 12. The management apparatus according to claim 11, further comprising a re-selection unit that re-selects a data center that is an allocation destination in the event of a failure of the other user system if it is not possible. The determination means has a resource amount from a resource capacity of a data center serving as a normal placement destination of the user system to a capacity excluding a backup resource capacity reserved in advance as a backup resource in the data center, Means for determining whether or not the amount of resources required by the user system can be allocated in the data center as being permitted to be used as a primary resource;
The selection means allocates a resource amount required by the user system in the data center within a range of backup resource capacity reserved in advance as a backup resource in a data center that is an allocation destination in the event of a failure of the user system. The management apparatus according to claim 6, further comprising means for determining whether or not it is possible.   By allocating a total backup resource capacity, which is a resource amount secured as a backup resource in the entire plurality of data centers, to the plurality of data centers, the backup resource capacity secured in advance as a backup resource in each data center is determined. The management apparatus according to claim 13, wherein   Assigning primary resource amounts by selecting two or more data centers as data centers where the user systems are normally arranged and allocating the resource amounts required by the user systems to the two or more data centers. The management apparatus according to claim 1, further comprising a dividing unit that makes it possible.   The failure occurred by selecting two or more data centers as the data center where the user system is located at the time of failure, and allocating the resource amount required by the user system to the two or more data centers. 15. The management apparatus according to claim 1, further comprising a dividing unit that enables allocation of a backup resource amount at the time. The second information includes information indicating a minimum divided resource amount to be allocated at least in each data center when the resource amount required by the user system is allocated to two or more data centers,
17. The management apparatus according to claim 15, wherein the dividing unit includes a unit that allocates a resource amount with reference to the second information. The output means outputs information for specifying a data center serving as a placement destination in the event of a failure of the user system, in addition to outputting information for identifying a data center serving as a regular placement destination of the user system. And
The allocation unit further includes a reselection unit that re-selects a data center that is an allocation destination in the event of a failure of another user system when the allocation according to the minimum division resource amount cannot be performed in the division unit. The management device according to claim 17.   The condition of the minimum divided resource amount when allocating the resource amount required by the user system to the data center that is the allocation destination in the case of two or more failures is more than the condition when allocating to the data center that is the normal allocation destination The management apparatus according to claim 17, wherein the management apparatus is set to be relaxed. The user system includes at least one application server and means for making the application server accessible from a client via a network,
The management apparatus according to claim 1, wherein the application server is realized by the virtual machine.   By registering the correspondence between the name for publishing the service of the user system and the address at which the data center where the user system is located can be identified in the network to the name resolution server in the network, The management apparatus according to claim 20, further comprising means for enabling access. Stores third information that indicates the relationship between the faulted area and the affected data center when a fault that occurred in one area may affect data centers that belong to one or more different areas Further comprising storage means for
The management apparatus according to claim 1, wherein the determination unit includes a unit that performs a determination with reference to the third information. The plurality of data centers are grouped by region so that failures that occur in one group do not affect the data centers of other groups,
Allow the largest of the total resources of the data centers in each group to be subtracted from the resources of the plurality of data centers as a primary resource in the plurality of data centers. The management apparatus according to any one of claims 1 to 21, wherein the management apparatus sets a resource amount to be processed. A management method for placing a user system in one of a plurality of data centers,
Each data center includes at least one virtualization server,
The virtualization server is capable of operating a user system arranged by at least one virtual machine operating on the virtualization server,
The resources that each data center has can be used for either the purpose of being allocated as a primary resource for normal use by the user system or the purpose of being reserved as a backup resource in the event of a failure. ,
The management method is:
Storing first information regarding a current resource amount of each of the plurality of data centers;
As a user system placement request, input second information indicating the amount of resources required by the user system,
Assuming that a failure has occurred in an area to which a normal data center where the user system is located belongs, a resource amount sufficient to place the user system in a data center belonging to an area not affected by the failure is determined as a backup resource. Based on the first information and the second information, whether or not
Depending on the determination that the backup resource can be secured, the data center serving as the normal placement destination of the user system and the information specifying the primary resource amount to be allocated to the user system in the data center are output, and the backup resource cannot be secured. And rejecting the user system arrangement request according to the determination. A management program for operating a computer as a management device for placing a user system in one of a plurality of data centers,
Each data center includes at least one virtualization server,
The virtualization server is capable of operating a user system arranged by at least one virtual machine operating on the virtualization server,
The resources that each data center has can be used for either the purpose of being allocated as a primary resource for normal use by the user system or the purpose of being reserved as a backup resource in the event of a failure. ,
The management device
Storage means for storing first information regarding a current resource amount of each of the plurality of data centers;
An input means for inputting second information indicating a resource amount required by the user system as a user system arrangement request;
Assuming that a failure has occurred in an area to which a normal data center where the user system is located belongs, a resource amount sufficient to place the user system in a data center belonging to an area not affected by the failure is determined as a backup resource. Determination means for determining whether or not to ensure as follows based on the first information and the second information;
In response to the determination by the determination means that backup resources can be secured, the data center serving as a normal placement destination of the user system and information specifying the primary resource amount to be allocated to the user system in the data center are output, A management program comprising: an output unit that rejects a request to arrange the user system in response to a determination that the determination unit cannot secure a backup resource.