JP2005085114A - Cluster system, upgrade method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To upgrade cluster software without stopping services. <P>SOLUTION: Cluster control parts are successively upgraded by; stopping cluster control parts other than at least one cluster control part while operating the cluster control part (step S16); upgrading software of a stopped cluster control part (step S18); and successively changing the stopped and upgraded cluster control part (step S24). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a cluster system including a plurality of computers, and in particular, a cluster control unit that executes cluster control and the cluster control unit are provided independently, and the plurality of cluster control units operate in synchronization. The present invention relates to a cluster system including an agent that operates under the control of a kernel as a virtual machine, an upgrade method and a program.

  In recent years, a system for providing a service (business) to a user (client terminal) by executing an application program on a computer has been operated. In this type of system, it is essential to provide a continuous service. Accordingly, high availability (server operation rate, business operation rate) is also required for the computer (server computer) executing the service. In view of this, a so-called cluster system has been developed in which a plurality of computers have a cluster configuration, and even if a failure occurs in some computers, the service is taken over by another computer and the entire system is prevented from being stopped ( For example, refer nonpatent literature 1).

  To configure a cluster system, a cluster manager is required on each computer. The cluster manager executes cluster control and control (service control) for starting and stopping an application. In a cluster system, cluster control is performed by a cluster manager distributed among a plurality of computers (nodes). Here, it is necessary that the cluster control is performed from the viewpoint of the entire cluster, that is, the cluster control performed in a distributed manner on each computer is a consistent control as a whole. Therefore, in the cluster system, cluster control in each computer is performed synchronously (in cooperation) while communicating with each other. That is, cluster control is performed by multiplexing in each computer. Thereby, high availability (high business operation rate) (High Availability, hereinafter abbreviated as HA) is realized.

  Conventionally, when it is necessary to upgrade cluster software in a system operating in a cluster configuration, it is necessary to stop a service operating under cluster control. This is because the cluster controller that configures and controls the cluster system and the agent are closely linked, so it is necessary to stop the cluster software in order to upgrade the cluster software. This is because it is necessary to stop the service. Specifically, the upgrade includes (1) stop of the active service, (2) stop processing of the active and standby cluster software, (3) upgrade of the cluster software, (4) start of the cluster software, (5) It is performed by processing of service activation (including automatic service start).

  In recent years, proposals have been made to shorten the service stop time (see, for example, Patent Document 1). The upgrades proposed here are: (1) Stop of active service, (2) Start of service in standby system (switchover or failover processing), (3) Stop processing of active clusterware, (4) Upgrade of active clusterware, (5) Start of active cluster software (stop of standby system service), (6) Start of service in active system (switchback or failback processing), (7) Standby system Cluster software stop processing, (8) standby cluster software upgrade, and (9) standby cluster software start processing.

In this case, the service stop time is a period from (1) to (2) and a period from (5) to (6), and the service stops temporarily, though only for a short time.

  The reason why the service must be switched over / switched back from the active system to the standby system is due to the failure detection mechanism of the cluster software. Conventionally, cluster software detects a failure by heartbeat as a mechanism for detecting a failure of another system. By detecting a heartbeat disruption from another system, it is determined that a failure has occurred in the other system, and the service availability is increased by switching over the service from the active system to the standby system.

If the cluster software on the active system is stopped without switching over the service to the standby system, the standby system erroneously detects a heartbeat disruption, and a takeover occurs. Arise. In order to prevent such a situation from occurring, the service is switched over from the active system to the standby system.
JP 2001-67331 (paragraph 0005) Tetsuo Kaneko, Yoshiya Mori, "Cluster Software", Toshiba Review, Vol.54 No.12 (1999), p.18-21

  As described above, in the conventional cluster system, when the cluster software needs to be upgraded, it is necessary to stop the service operating under the cluster control.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a cluster system, an upgrade method, and a program capable of upgrading cluster software with a short service stop.

  According to one aspect of the present invention, a cluster system including a plurality of computers is provided. The cluster system includes a plurality of agents that operate independently on at least some of a plurality of computers constituting the cluster system and perform service control for providing a service requested from a client terminal, and a cluster A cluster control unit that operates independently on at least a part of a plurality of computers constituting the system, and controls the agent in synchronization with the other cluster control units while communicating with other cluster control units. The cluster control unit is integrated with a plurality of cluster control units that perform consistent cluster control as one kernel, and the remaining cluster control units are stopped while at least one cluster control unit is operating. Upgrade the stopped cluster controller software. By the cluster control unit to upgrade the stopped sequentially changed, is to sequentially upgrade the cluster controller.

  According to the present invention, the service control and the cluster control are performed by the independent agent and the cluster control unit, respectively, so that only the cluster control unit needs to be stopped when the cluster software is upgraded. Since the agent does not stop in this way, the service can be continuously provided.

  Embodiments of the present invention will be described below with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing the configuration of the cluster system according to the first embodiment of the present invention. The cluster system of FIG. 1 is composed of a plurality of, for example, four server computers 10-1 (# 1), 10-2 (# 2), 10-3 (# 3), 10-4 (# 4). Is done. Server computers 10-1, 10-2, 10-3, 10-4 are interconnected by two networks 21, 22.

  On the server computers 10-1, 10-2, 10-3, 10-4, cluster control units 11-1 (# 1), 11-2 (# 2), 11-3 (# 3) for performing cluster control , 11-4 (# 4) operate. The cluster control units 11-1 to 11-4 are realized by the server computers 10-1 to 10-4 executing corresponding server programs (cluster control unit programs for cluster control).

  Further, on the server computers 10-2 and 10-3 among the server computers 10-1 to 10-4, agents 12-1 (# 1) and 12 that perform service control (that is, control for starting / stopping applications) are performed. -2 (# 2) works. The agents 12-1 and 12-2 are realized by the server computers 10-2 and 12-3 executing corresponding server programs (agent programs for service control).

  Each of the agents 12-1 and 12-2 includes a communication path switching control unit 122, a heartbeat transmission unit 124, and a service control unit 126, and manages control unique to the server computer. The communication path switching control unit 122 is a control unit for switching communication with any of the cluster control units 11-1 to 11-4. The heartbeat transmission unit 124 is a control unit for detecting heartbeat disruption with other agents. The service control unit 126 is a control unit that controls execution of the service 128.

  Connected to the network 22 is a client terminal 23 that requests the agents 12-1 and 12-2 to execute a service. Communication between the agents 12-1 and 12-2 and the client terminal 23 is performed via the network 22. 1 shows an example in which one client terminal 23 is connected to the network 22 for the sake of drawing. However, a plurality of client terminals are generally connected to the network 22.

  Each of the cluster control units 11-1 to 11-4 on the server computers 10-1 to 10-4 has a cluster control function similar to the cluster control function of the cluster manager that operates on each computer in the conventional cluster system. Integrate with other cluster control units (operate in a multiplexed manner) to execute control of the cluster system. The cluster control units 11-1 to 11-4 control the entire cluster such as service start requests, stop requests, switchover processing, and takeover processing according to priority. The integrated cluster control units 11-1 to 11-4 form one virtual machine (virtual execution environment) called a kernel 110. The kernel 110 is formed in cooperation with cluster control units 11-1 to 11-4 operating on the individual server computers 10-1 to 10-4. Therefore, the kernel 110 can be considered to exist across the server computers 10-1 to 10-4. That is, the individual cluster control units 11-1 to 11-4 are not kernels, but the cluster control units 11-1 to 11-4 are integrated to form the kernel 110. Therefore, only one kernel is included in the cluster system. Exists.

  For communication between the cluster control units 11-1 to 11-4 necessary for the cluster control units 11-1 to 11-4 to operate in synchronism (cooperation) as a whole (that is, operate in a multiplexed manner). The network 21 is used. Here, in order to speed up the multiplexing operation, a network faster than the network 22 used for communication between the agents 12-1 and 12-2 and the client terminal 23 is used as the network 21. If speeding up is not required, the network 22 may be used for communication between the cluster control units 11-1 to 11-4.

  The agents 12-1 and 12-2 on the server computers 10-2 and 10-3 operate according to the control from the kernel 110, and control the start / stop of the service (application) 128. That is, the service 128 is executed in the agents 12-1 and 12-2. The service 128 will be described using a web service as an example. First, in order to execute a web service, a web server having a role of distributing contents in response to a request from the client terminal 23 for the service is required. In order to deliver a request from the client terminal to the web server, an address, for example, an IP (Internet Protocol) address is required. There is also a need for a file system for storing the provided content. That is, to provide a web service, physical or logical entities such as a web server, an IP address, and a file system are required. These entities are called “resources”. In other words, the agents 12-1 and 12-2 execute a service by combining and executing a plurality of resources. The agents 12-1 and 12-2 are means for actually starting and stopping resources. The agents 120-1 and 120-2 receive control instructions from the kernel 110, control resources accordingly, and return the results to the kernel 110.

  As described above, there are two agents 12-1 and 12-2 in the cluster system of FIG. 1, and each of them operates independently. Therefore, it is important how the kernel 110 controls and synchronizes the agents 12-1 and 12-2. Therefore, in the present embodiment, a configuration in which control of the cluster system is performed centrally by the kernel 110 is applied. The kernel 110 is a virtual machine that is multiplexed by the cluster control units 11-1 to 11-4. Therefore, control of the cluster system can be continued even when a failure occurs in some of the cluster control units 11-1 to 11-4. In addition, by separating the server computer (cluster software) into the cluster control unit 11 and the agent 12 that operate independently, the software can be upgraded without stopping the service 128 when the software of the cluster control unit 11 is upgraded. It becomes. Thereby, continuous service provision to the client terminal 23 becomes possible.

  As a multiplexing execution algorithm in the cluster control units 11-1 to 11-4, the 2/3 quorum algorithm described in Patent Document 1 that does not cause split brain is applied. The cluster system according to the present embodiment has n = 4 and f = 1, and is composed of the smallest number of computers to which the 2/3 quorum algorithm can be applied. That is, the cluster system of the present embodiment has a minimum cluster configuration to which the 2/3 quorum algorithm can be applied. As a result, fault tolerance can be realized not only for stop failures of f (= 1) cluster control units but also for Byzantine failures. As described above, the kernel 110 is an ultra-reliable virtual machine and realizes control of a highly reliable cluster system.

  In this embodiment, the cluster controllers 11-1 to 11-4 are operated on all server computers in the cluster system, that is, four server computers 10-1 to 10-4, and the kernel 110 is executed. Realized. Thus, as described above, the cluster system is constructed with the minimum number of computers (n = 4) necessary for applying the 2/3 quorum algorithm. In addition, the agents 12-1 and 12-2 are operated on two server computers 10-2 and 10-3 of the four server computers 10-1 to 10-4, and the cluster system service is provided. Is executed. For this reason, each of the server computers 10-2 and 10-3 requires resources necessary for the service and hardware / software corresponding to the resources, but the server computers 10-1 and 10-4 have a cluster control unit. Since only 11-1 and 11-2 operate, a relatively small computer is sufficient for the server computers 10-1 and 10-4.

  From the above, in the cluster system of FIG. 1, with respect to service control, an improvement in availability due to failover between the two agents 12-1 and 12-2 can be expected. On the other hand, with respect to cluster control, improvement in availability can be expected by the 2/3 quorum algorithm by the four cluster control units 11-1 to 11-4.

  Next, software upgrade in the present embodiment will be described. As described above, when the cluster software is separated into the cluster control unit 11 and the agent 12 and operated independently, the service 128 provided by the agent 12 is stopped when the cluster control unit 11 is upgraded. Upgrade is possible without any problems. As a result, the continuous service 128 can be provided to the client 23. Regarding the upgrade of the agent 12, since the agent 12 controls the provision of the service 128, switching between the active system and the standby meter by the service switchover is the same as in the conventional system.

  Hereinafter, an example of upgrade according to a specific example of service to be provided (configuration example of a cluster system) will be described.

  FIG. 2 shows a case where there are a cluster control unit 11 and an agent 12 in the same machine (server computer) 10 and one or more services are operating on a plurality of machines. The cluster control units 11-1 to 11-N cooperate to control the services 128-1 to 128-N. Note that the number of services and the number of cluster control units do not have to match.

  The upgrade procedure in this case is shown in the flowchart of FIG. As shown in step S12, one or more services 128-1 to 128-N are implemented by the servers 10-1 to 10-N. In step S14, 1 is set to the variable i. In step S16, the cluster control unit 11-i of the server 10-i is stopped. Other cluster controllers continue to operate. In step S18, the cluster software of the stopped cluster control unit 11-i is upgraded. In step S20, the upgraded cluster control unit 11-i is restarted. In step S22, it is determined whether or not all the cluster control units 11 have been upgraded. If not, the variable i is incremented by 1 in step S24, and the processing from step S16 is executed again for the next i (+1 added i).

  In this way, the cluster control units 11-1 to 11-N of the server computers 10-1 to 10-N constituting the cluster system are upgraded one by one so that they are operating on the agents 12-1 to 12-N. The cluster software can be upgraded without stopping the services 128-1 to 128-N. In addition, since the other cluster control units 11-1 to 11-N are operating during the upgrade of the cluster software, even if a failure occurs in the services 128-1 to 128-N, other servers (cluster control units) Can be taken over and the service is prevented from stopping. In the flowchart of FIG. 3, the number of cluster control units 11 to be stopped for upgrading is one by one, but it is sufficient that at least one cluster control unit is operating during the upgrade, and multiple units are upgraded together. May be.

  In FIG. 4, the cluster control unit 11 and the agent 12 are in separate machines (server computers) 10-1 to 10-4, and only one service 128 is operating on one machine 10-1 (other machines). 10-2 indicates a case where the service 128 is not operating. The cluster control units 11-1 to 11-2 cooperate to control one service 128.

  The upgrade procedure in this case is shown in the flowchart of FIG. As shown in step S32, the service 128-1 is executed on the machine 10-1. In step S34, the cluster control unit 11-1 of the machine 10-3 is stopped. The other cluster control unit 11-2 continues to operate. In step S36, the cluster software of the stopped cluster control unit 11-1 is upgraded. In step S38, the upgraded cluster control unit 11-1 is restarted. Next, in step S340, the cluster control unit 11-2 of the machine 10-4 is stopped. The cluster control unit 11-1 continues to operate. In step S42, the cluster software of the stopped cluster control unit 11-2 is upgraded. In step S44, the upgraded cluster control unit 11-2 is restarted.

  In this way, by upgrading the cluster control units 11-1 to 11-2 constituting the cluster system one by one, the cluster software can be installed without stopping the service 128-1 running on the agent 12-1. It becomes possible to upgrade. In addition, since other cluster control units are operating during the upgrade of the cluster software, even if a failure occurs in the service 128, it is possible to take over to another server (cluster control unit) and the service will stop. Is prevented. Furthermore, since the agent 12-2 stands by in the hot standby state with respect to the service 128-1, even when a failure occurs in the agent 12-1, the agent can be switched immediately and the availability can be increased. .

  FIG. 5 shows a case where the cluster control unit 11 and the agent 12 are in separate machines (server computers) 10 and one or more services are operating on a plurality of machines. The cluster control units 11- (N + 1) to 11- (N + M) control the services 128-1 to 128-N in cooperation. N and M may be the same or different.

  The upgrade procedure in this case is shown in the flowchart of FIG. As shown in step S62, one or more services 128-1 to 128-N are executed by the machines 10- (N + 1) to 10- (N + M). In step S64, 1 is set to the variable i. In step S66, the cluster control unit 11- (N + i) of the machine 10- (N + i) is stopped. Other cluster controllers continue to operate. In step S68, the cluster software of the stopped cluster control unit 11- (N + i) is upgraded. In step S70, the upgraded cluster control unit 11- (N + i) is restarted. In step S72, it is determined whether or not all the cluster control units 11 have been upgraded. If not, the variable i is incremented by 1 in step S74, and the processing from step S76 is executed again for the next i (+1 added i).

  In this way, the agents 12-1 are upgraded by upgrading the cluster controllers 11-1 to 11-M of the machines 10- (N + 1) to 10- (N + M) constituting the cluster system one by one. It becomes possible to upgrade the cluster software without stopping the services 128-1 to 128-N that are running at ~ 12-N. Further, since the other cluster control units 11- (N + 1) to 11- (N + M) are operating during the upgrade of the cluster software, even when a failure occurs in the services 128-1 to 128-N. The takeover to another server (cluster control unit) is possible, and the service is prevented from stopping. As in the example of FIG. 3, a plurality of units may be upgraded together.

  Note that the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine the component covering different embodiment suitably.

1 is a block diagram showing a configuration of a cluster system according to a first embodiment of the present invention. The block diagram which shows the example of 1 structure of the cluster system for demonstrating one specific example of upgrade. The flowchart for demonstrating the upgrade process of the structural example of FIG. The block diagram which shows the other structural example of the cluster system for demonstrating the other specific example of upgrade. 5 is a flowchart for explaining an upgrade process of the configuration example of FIG. 4. The block diagram which shows the further another structural example of the cluster system for demonstrating the other specific example of upgrade. 7 is a flowchart for explaining an upgrade process of the configuration example of FIG.

Explanation of symbols

  10-1 to 10-4 ... server computer, 11-1 to 11-4 ... cluster control unit, 12-1 to 12-2 ... agent, 21, 22 network, 23 ... client terminal, 110 ... kernel, 122 ... communication Route switching control unit, 124... Heart bead transmission unit, 126... Service control unit.

Claims (8)

A cluster system composed of a plurality of computers,
A plurality of agents that operate independently on at least some of the plurality of computers constituting the cluster system and perform service control for providing a service requested from a client terminal;
A cluster control unit that operates independently on at least some of the plurality of computers constituting the cluster system, and controls the agent synchronously while communicating with other cluster control units. A plurality of cluster control units that perform consistent cluster control as a single kernel together with other cluster control units,
Cluster control by stopping the remaining cluster control units while at least one cluster control unit is operating, upgrading the software of the stopped cluster control units, and sequentially changing the cluster control units to be stopped and upgraded Means for sequentially upgrading parts,
A cluster system comprising: Each of the plurality of computers includes an agent and a cluster control unit,
The plurality of agents respectively control a plurality of services,
The cluster system according to claim 1, wherein the upgrade unit stops each cluster control unit and upgrades the cluster control unit part by part. The plurality of computers include a first computer that includes an agent and does not include a cluster control unit, and a second computer that includes a cluster control unit and does not include an agent.
The plurality of agents includes a first agent that controls a service and a second agent in a standby state that does not control the service;
The cluster system according to claim 1, wherein the upgrade unit stops each cluster control unit and upgrades the cluster control unit part by part. The plurality of computers include a first computer that includes an agent and does not include a cluster control unit, and a second computer that includes a cluster control unit and does not include an agent.
The plurality of agents respectively control a plurality of services,
The cluster system according to claim 1, wherein the upgrade unit stops each cluster control unit and upgrades the cluster control unit part by part.   2. The cluster system according to claim 1, wherein only one of the cluster control unit and the agent operates on each computer.   Each of the plurality of agents switches a communication with the cluster control unit, a communication path switching control unit for communicating with any one of the cluster control units, and a heartbeat transmission for detecting a heartbeat interruption with another agent The cluster system according to claim 1, further comprising: a service control unit configured to control execution of the service. A cluster system composed of a plurality of computers,
A plurality of agents that operate independently on at least some of the plurality of computers constituting the cluster system and perform service control for providing a service requested from a client terminal;
A cluster control unit that operates independently on at least some of the plurality of computers constituting the cluster system, and controls the agent synchronously while communicating with other cluster control units. In the upgrade method of a cluster system including a plurality of cluster control units that perform consistent cluster control as one kernel integrated with other cluster control units,
Cluster control by stopping the remaining cluster control units while at least one cluster control unit is operating, upgrading the software of the stopped cluster control units, and sequentially changing the cluster control units to be stopped and upgraded Upgrade method of cluster system, wherein upgrade is performed sequentially. A cluster system composed of a plurality of computers,
A plurality of agents that operate independently on at least some of the plurality of computers constituting the cluster system and perform service control for providing a service requested from a client terminal;
A cluster control unit that operates independently on at least some of the plurality of computers constituting the cluster system, and controls the agent synchronously while communicating with other cluster control units. In a cluster system program comprising a plurality of cluster control units that perform consistent cluster control as one kernel integrated with other cluster control units,
By stopping at least one cluster control unit in the computer and stopping the remaining cluster control unit, upgrading the software of the stopped cluster control unit, and sequentially changing the cluster control unit to stop and upgrade, A cluster system program that upgrades the cluster controller sequentially.

Images