JP2011134070A - Redundant state inspection device and program - Google Patents

Abstract

A computer system having a redundant portion detects that a serious failure is caused when a failure occurs because the redundancy does not function effectively.
For a computer system to be verified having a redundant portion, redundancy such as information indicating whether or not the connection between a control device 60 of a disk device 56 and a logical disk is redundant is used. Various state information indicating the state of the conversion is acquired (102 to 126), and if the current process execution is the first time, the acquired state information is stored as a master (130), and if it is the second or subsequent execution, it is acquired The status information is compared with the master (132), and the contents of the status information of the mismatched items and the match / mismatch with each master of the status information are displayed on the terminal device (136).
[Selection] Figure 3

Description

  The present invention relates to a redundant state verification device and a program, and more particularly to a redundant state verification device for verifying the state of a computer system having a redundant portion, and a redundant state for causing a computer to function as the redundant state verification device. It relates to the verification program.

  In order to improve the fault tolerance of a computer system, redundancy of the system configuration is effective. In a computer system with a high level of requirement for stable operation, a standby system that switches to an operating state when the active system stops operation due to a failure. Generally, a system configuration to which is added is adopted. However, even in a redundant computer system, for example, when the system environment is changed, the change of the system environment has an unexpected effect, so that even if the active system stops operating, the standby system It may happen that the redundancy does not function effectively such that the system does not switch to the operating state. And when redundancy does not function effectively, the standby system is not normally operating and the administrator is often not aware. If this state is overlooked, the active system can stop operating. There was a problem that a large-scale system failure was caused by both systems becoming inactive without the standby system being switched to the active state.

  In relation to the above, Patent Document 1 receives a request for verifying a system configuration, obtains rule data for one or more rules for identifying a problem in the system configuration, and includes information related to the system configuration Techniques are disclosed for obtaining configuration data, verifying system configuration data against rule data, and generating verification results that identify all configuration problems for the system.

  Patent Document 2 compares the corresponding parts of the parameter configuration sheet describing the system configuration information used when constructing the computer system with the system configuration information which is the operating system information, and lists the comparison results. A technique for outputting a comparison report color-coded in (1) is disclosed.

JP 2003-330720 A JP 2007-241533 A

  The technique described in Patent Document 1 is a technique for verifying a system configuration based on rule data. However, Patent Document 1 describes anything about verification of a system configuration for a computer system having a redundant portion. There is a possibility that the active system is operating normally in the redundant part, but the standby system may not be switched to the operating state (the state where redundancy does not function effectively) There is no suggestion of identifying the state where redundancy does not function effectively as a system configuration problem or the contents of rule data necessary for the identification.

  In addition, the technique described in Patent Document 2 compares the system configuration information (parameter sheet describing the system configuration information used when the computer system is constructed) with the system configuration information acquired from the constructed computer system. This is to confirm whether or not the construction of the system has been performed as originally planned. This patent document 2 also applies to a computer system having a redundant portion, and the computer system is redundant. There is no description about the configuration for confirming whether or not the activation is a functioning state effectively.

  The present invention has been made in consideration of the above facts, and a computer system having a redundant portion is in a state where a serious failure is caused when a failure occurs because the redundancy does not function effectively. An object of the present invention is to obtain a redundant state verification device and a redundant state verification program that can detect the occurrence of failure.

  The inventor of the present application states that if a computer system having a redundant portion is in a state where redundancy is not functioning effectively, the redundancy does not function effectively when a failure occurs in the active system. The work of verifying the magnitude of the impact of something (the severity of system failure) was conducted. As a result, the magnitude of the effect that a failure does not function effectively when a failure occurs will vary greatly depending on which part of the system the redundancy does not function effectively. Became clear. A particularly serious system failure in a computer system including a storage device is a system failure in which communication between the computer and the storage device is interrupted. When a system failure is caused, the connection between the controller of the storage device and the storage medium body is made redundant, but the redundancy is not functioning effectively, and the computer of the system The path between the storage device and the storage medium main body of the storage device was made redundant, but it became clear that this redundancy was not functioning effectively.

  Based on the above, the redundant state verification device according to claim 1 inquires about the state of the redundant part in the computer system to be verified including the storage device, and the controller provided in the storage device and the controller First state information indicating whether or not the connection of the storage device to the storage medium body is redundant, and a path between the computer of the computer system to be verified and the storage medium body of the storage device Is acquired by the acquisition unit, the acquisition unit that acquires the state information including the second state information indicating whether or not is redundant, the storage unit that stores the state information acquired by the acquisition unit The state information is compared with the state information acquired in the past by the acquisition unit and stored in the storage unit. The redundant portion of the computer system, the redundancy is configured to include, and whether determining unit maintains the state of functioning effectively.

  According to the first aspect of the present invention, the connection between the controller provided in the storage device and the storage medium main body of the storage device is made by inquiring about the state of the redundant part in the computer system to be verified including the storage device. First state information indicating whether or not the state is redundant, and whether or not the path between the computer of the computer system to be verified and the storage medium body of the storage device is redundant The state information including the second state information representing is acquired by the acquisition unit, and the state information acquired by the acquisition unit is stored in the storage unit. The state information acquired by the acquisition unit is information indicating the current state of the redundant part of the computer system to be verified, and the determination unit stores the state information acquired by the acquisition unit in the past by the acquisition unit. Compared with the status information obtained and stored in the storage means, the redundant part of the computer system to be verified is in a state in which redundancy functions effectively (the active system has failed and is operating. When the system is stopped, it is determined whether or not the standby system is maintained in a state of switching to the operating state.

  Thereby, in the determination by the determination unit, is the state in which the redundancy of the connection between the controller of the storage device and the storage medium body of the storage device functions effectively based on the first state information acquired by the acquisition unit? A state in which the redundancy of the path between the computer of the computer system to be verified and the storage medium body of the storage device functions effectively based on the second state information acquired by the acquisition unit It is also determined whether or not the above is maintained. Therefore, according to the first aspect of the present invention, a computer system having a redundant portion including a storage device is in a state in which a serious failure is caused when a failure occurs because the redundancy does not function effectively. Can be detected.

  In the first aspect of the invention, the computer system to be verified is provided with a plurality of redundant controllers in the storage device as a redundant connection between the controller and the storage medium body, and a plurality of controllers are provided in each controller. Medium-side adapters are provided, and for each of the plurality of controllers, the individual medium-side adapters are connected to the storage medium body via different shared memories among the plurality of redundant shared memories. In the case of the configuration, for example, as described in claim 2, the acquisition unit represents, for each controller, a connection path between each of the plurality of controllers and the storage medium body of the storage device for each medium-side adapter. By transmitting a command for requesting information, the controller can be configured to acquire the information as first state information.

  Further, in the first aspect of the present invention, a plurality of computer systems to be verified are made redundant to the computer as a path redundancy between the computer of the computer system to be verified and the storage medium body of the storage device. A plurality of redundant host-side adapters connected to any of the plurality of host adapters, and connected to any of the plurality of host-side adapters, and storage of the storage device A plurality of medium-side adapters connected to the medium body and made redundant, and a predetermined program operating on the computer is transferred from each host adapter of the computer system to be verified to the storage medium body of the storage device. In the case of a configuration that manages the route and the operating state for each individual path to reach, the acquisition means, for example, As described in claim 3, a predetermined program is requested for information indicating a path and an operating state for each path from the individual host adapter of the computer system to be verified to the storage medium body of the storage device. By transmitting a command, the information can be acquired from the controller as the second state information.

  In addition, as a result of the above-described verification work by the present inventor, in a computer system including a computer connected to a network via a network connection device, a particularly serious system failure is a system failure in which communication between the computer and the network is interrupted. Yes, if the above system failure is caused when a failure occurs because redundancy is not functioning effectively, the IP address assignment to the network connection device has been made redundant. In the state where the networking is not functioning effectively, and the assignment of a plurality of the network connection devices constituting the single network connection device virtually to the network adapter is made redundant. Is in a state that does not function effectively. It became apparent.

  Based on the above, the redundant state verification apparatus according to the invention described in claim 4 inquires the current state of the redundant portion in the computer system to be verified including the computer connected to the network via the network connection device, Third state information indicating whether or not the assignment of the IP address to the network connection device is made redundant, and a plurality of network adapters of the network connection device that virtually configure a single network connection device Acquisition means for acquiring state information including fourth state information indicating whether or not the assignment to is redundant, storage means for storing the state information acquired by the acquisition means, and the acquisition means The status information acquired by the acquisition means in the past by the acquisition means By comparing with the state information stored in the storage means, it is determined whether or not the redundant portion of the computer system to be verified maintains a state in which the redundancy functions effectively Determination means.

  According to the fourth aspect of the present invention, the IP address is assigned to the network connection device by inquiring about the current state of the redundant portion in the computer system to be verified including the computer connected to the network via the network connection device. State information indicating whether or not a network is redundant, and a state in which assignment of a plurality of network connection devices constituting a single network connection device to network adapters is made redundant The state information including the fourth state information indicating whether or not is acquired by the acquisition unit, and the state information acquired by the acquisition unit is stored in the storage unit. The state information acquired by the acquisition unit is information indicating the current state of the redundant part of the computer system to be verified, and the determination unit stores the state information acquired by the acquisition unit in the past by the acquisition unit. Compared with the status information obtained and stored in the storage means, the redundant part of the computer system to be verified is in a state in which redundancy functions effectively (the active system has failed and is operating. When the system is stopped, it is determined whether or not the standby system is maintained in a state of switching to the operating state.

  Accordingly, in the determination by the determination unit, it is determined whether or not the state in which the redundancy of the IP address assignment to the network connection device is functioning effectively is maintained based on the third state information acquired by the acquisition unit. At the same time, based on the fourth state information acquired by the acquisition means, the state in which the redundancy of the assignment of the plurality of network connection devices constituting the single network connection device to the network adapter effectively functions effectively is maintained. It is also determined whether or not. Therefore, according to the fourth aspect of the present invention, a computer system including a computer connected to a network via a network connection device and having a redundant portion causes a failure because the redundancy does not function effectively. It is possible to detect that a serious failure is sometimes caused.

  In the invention according to claim 4, the computer system to be verified is provided with a plurality of network connection devices as redundant IP address assignment to the network connection devices, and each of the plurality of network connection devices is provided. In the configuration in which the IP address is assigned to each of the plurality of network connection devices, for example, the acquisition unit provides the operating system with information indicating the IP address assigned to each of the plurality of network connection devices. The information can be acquired from the operating system as the third state information by transmitting a command to be requested.

  Further, in the invention described in claim 4, the computer system to be verified is configured such that the network connection device is configured as a redundant allocation of a plurality of network connection devices constituting a single network connection device virtually to a network adapter. In the case where a plurality of network connection devices that are virtually provided and constitute a single network connection device are assigned to different network adapters, the acquisition means may, for example, operate as described in claim 6 Sending a command requesting information indicating to which network adapter each of the plurality of network connection devices is assigned to the system to acquire the information as fourth state information from the operating system Ni It can be.

  Further, in the invention according to claim 1 or claim 4, when the computer system to be verified has a configuration in which a single cluster is composed of a plurality of computers as redundancy of computers constituting the cluster, For example, as described in claim 7, the acquisition unit sends a command requesting the operating system to request information regarding the number of computers constituting the single cluster of the computer system to be verified and the operation status of each computer. By transmitting, the information is acquired from the operating system as fifth state information indicating whether or not a single cluster of the computer system to be verified is composed of a plurality of computers. It is preferable to configure.

According to the above-described verification work by the inventor of the present application, in a computer system made redundant by configuring a single cluster with a plurality of computers, the redundancy is not functioning effectively. In addition, it has been found that when a failure occurs in the active computer and the operation is stopped, the cluster itself is brought into an operation stop state, thereby causing a large-scale system failure. On the other hand, in the invention according to claim 7, it is also determined whether or not the redundancy of the computers constituting the single cluster is maintained effectively based on the fifth state information acquired by the acquiring means. Because it will be determined by means,
Detects that a redundant computer system consisting of multiple computers in a single cluster has entered a state in which a serious failure has occurred due to the failure of the redundancy. can do.

  Further, in the invention according to claim 1 or claim 4, the computer system to be verified includes a storage device, and as a redundant connection between the computer of the computer system to be verified and the storage device, When a plurality of redundant host adapters are provided, and the paired host adapters are connected to different controllers among the redundant controllers provided in the storage device. For example, as described in claim 8, the acquisition unit transmits a command requesting information indicating which of the plurality of host adapters is connected to each of the plurality of host adapters to the controller. The information is obtained from a plurality of host adapters that form a pair of host adapters. It is preferably configured to obtain a sixth state information indicating whether the state of being connected to different controllers.

  According to the above-described verification work by the inventor of the present application, a configuration in which a storage device is included and the connection between the computer and the storage device is made redundant, that is, the computer is provided with a plurality of redundant host adapters, A state in which the redundancy does not function effectively in a computer system having a configuration in which a pair of host adapters are connected to different controllers among a plurality of redundant controllers provided in the storage device. Even in such a case, it has become clear that when a failure occurs in the connection of the active system, a large-scale system failure that causes the communication between the computer and the storage device to be interrupted is caused. On the other hand, in the invention described in claim 8, based on the sixth state information acquired by the acquisition means, it is also determined whether or not the state in which the redundancy of the connection between the computer and the storage device functions effectively is maintained. Therefore, the computer system in which the connection between the computer and the storage device is made redundant is in a state where a serious failure is caused when a failure occurs because the redundancy does not function effectively. It can be detected.

  Further, in the invention according to any one of claims 1 to 8, for example, as described in claim 9, the redundancy portion of the computer to be verified functions effectively by the determination means. When it is determined that the state to be maintained is not maintained, it is preferable to further provide output means for outputting information for notifying the current state of the redundant portion represented by the state information acquired by the acquisition means. As a result, a user such as an administrator can easily grasp the current state of the portion of the computer to be verified that is determined not to maintain a state in which redundancy is functioning effectively. Therefore, it is possible to easily take measures for recovering to a state where redundancy is effectively functioning.

  The redundant state verification program according to the invention described in claim 10 constitutes a computer system to be verified including a storage device, or is connected to the computer system to be verified and includes a storage means. By inquiring about the state of the redundant part in the target computer system, it is determined whether the connection between the controller provided in the storage device and the storage medium body of the storage device is in a redundant state. 1 state information and state information including second state information indicating whether or not the path between the computer of the computer system to be verified and the storage medium body of the storage device is made redundant And the status information acquired by the acquisition unit is acquired in the past by the acquisition unit. By comparing with the state information stored in the storage means, it is determined whether or not the redundant portion of the computer system to be verified maintains a state in which the redundancy functions effectively It functions as a determination means.

  According to a tenth aspect of the present invention, there is provided a redundant state verification program that configures a computer system to be verified that includes a storage device or is connected to the computer system to be verified and includes a computer having storage means. And the computer executes the redundant state verification program according to the invention described in claim 10, so that the computer executes the redundant state verification program according to claim 10. As in the first aspect of the invention, a computer system having a redundant portion including a storage device has a serious failure when a failure occurs because the redundancy does not function effectively. It is possible to detect that the state has been raised.

  The redundant state verification program according to the invention described in claim 11 constitutes a computer system to be verified including a computer connected to a network via a network connection device or is connected to the computer system to be verified, The computer having the storage means is inquired about the current state of the redundant portion in the computer system to be verified, thereby indicating whether or not the assignment of the IP address to the network connection device is made redundant. State including third state information and fourth state information indicating whether the assignment of a plurality of network connection devices constituting a single network connection device to a network adapter is made redundant. Acquisition means for acquiring information, and the acquisition means; By comparing the status information acquired in this way with the status information acquired in the past by the acquisition means and stored in the storage means, the redundant portion of the computer system to be verified is , And functioning as a determination means for determining whether or not the redundancy is maintained in a functioning state.

  The redundant state verification program according to the invention of claim 11 constitutes a computer system to be verified including a computer connected to a network via a plurality of network adapter ports, or is connected to the computer system to be verified. Since the computer having the storage unit functions as the acquisition unit and the determination unit, the computer executes the redundancy state verification program according to the invention described in claim 11, thereby The computer functions as the redundant state verification device according to claim 4, and has a redundant portion including the computer connected to the network via the network connection device as in the invention according to claim 4. The computer system functions effectively with the above redundancy It is possible to detect that a serious failure in a state that is caused in the event of a failure by the absence.

  As described above, the present invention makes the connection between the controller of the storage device and the storage medium main body redundant by inquiring about the state of the redundant portion in the computer system to be verified including the storage device. First state information indicating whether or not, and state information including second state information indicating whether or not the path between the computer and the storage medium body is redundant, and the acquired state information Is compared with the state information acquired in the past to determine whether the redundant portion of the computer system maintains a state in which the redundancy functioning effectively. The computer system having a part can detect that a serious failure is caused when a failure occurs because the redundancy does not function effectively. It was having an effect.

  In addition, the present invention makes it possible to make redundant assignment of IP addresses to network connection devices by inquiring about the current state of the redundancy part in a computer system to be verified including a computer connected to a network via a network connection device. Third state information indicating whether or not the network is connected, and whether or not the assignment of a plurality of network connection devices constituting a single network connection device to the network adapter is made redundant The state information including the fourth state information is obtained, and the obtained state information is compared with the state information obtained in the past, so that the redundant part of the computer system To determine whether or not the network is connected via the network connection device. The computer system having a redundant part including a connected computer can detect that a serious failure is caused when a failure occurs because the redundancy does not function effectively. It has the effect.

It is a block diagram which shows schematic structure of the computer system which concerns on this embodiment. It is a block diagram which shows schematic structure of the web service provision system as a computer system of a verification object. It is a flowchart which shows the content of the redundancy structure verification process. It is an image figure which shows an example of the screen displayed on the display of a terminal device.

  Hereinafter, an example of an embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a computer system 10 according to the present embodiment. The computer system 10 includes a web service providing system 12 as a computer system to be verified, and the web service providing system 12 is connected to a terminal device 16 used as a management device via a network 14 including an intranet. It is configured.

  The terminal device 16 includes a PC (Personal Computer) and the like, and includes a CPU 16A, a memory 16C including a ROM and a RAM, a nonvolatile storage unit 16C including a HDD (Hard Disk Drive) and a flash memory, and a communication I / F (interface). The communication I / F unit 16D is connected to the network 14. The storage unit 16C is installed with an OS (Operating System) program (not shown) and a browser (web browsing software) program. The terminal device 16 is connected to a display 18 such as an LCD, a mouse 20 and a keyboard 22.

  On the other hand, the web service providing system 12 is a computer system that provides a predetermined web service to a user via a network (this network may be the network 14 or another network such as the Internet). The system includes two DB (DataBase) servers 26 and 28 and two AP (APplication) servers 30 and 32. Each of the servers 26 to 32 includes a CPU 34, a memory 36 including a ROM and a RAM, a nonvolatile storage unit 38, and a communication I / F unit 40. The communication I / F unit 40 is connected to the network 14, and the storage unit 38. OS (Operating System) program (not shown), redundant configuration verification program, and path management software program are respectively installed. The redundancy configuration verification program and the path management software program are read from the storage unit 38 when the servers 26 to 32 are started up and stored in the memory 36, respectively. The path management software program is always executed by the CPU 34, and is made redundant. The configuration verification program is executed by the CPU 34 when necessary (when instructed from the terminal device 16; details will be described later). The path management software program is an example of a predetermined program according to claim 3.

  The redundant configuration verification program is an example of the redundant state verification program according to the present invention, and each of the servers 26 to 32 is executed by the CPU 34 as the redundant configuration verification program. Function. Although details will be described later, the storage unit 38 of each server 26 to 32 is actually constituted by a disk device 56 (logical disk) described later, and the communication I / F unit 40 of each server 26 to 32 is actually used. The network adapters 52A and 52B and network connection devices 54A and 54B, which will be described later.

  The web service providing system 12 is a computer system having a high level of demand for stable operation, and each part is made redundant. That is, in the web service providing system 12, the DB server is made redundant, the DB servers 26 and 28 constitute a single cluster, the DB server 26 is the active system that operates normally, and the DB server 28 has a failure. Therefore, when the DB server 26 stops operating, the standby system is started. In addition, the AP server is also made redundant, and the AP servers 30 and 32 constitute a single cluster. The AP server 30 is active during normal operation, and the AP server 32 is activated when a failure occurs. It is a standby system that starts operation when it stops.

  On the other hand, as shown in FIG. 2, the DB server 26 and the AP server 30 are mounted on the server chassis 42, and the DB server 28 and the AP server 32 are mounted on the server chassis 44, and the DB server 26 and the AP server 30 include Power is supplied from a power supply unit (not shown) mounted on the server chassis 42, and power is supplied to the DB server 28 and the AP server 32 from a power supply unit (not shown) mounted on the server chassis 44.

  In addition, two IOA modules 46 and 48 are mounted on the server chassis 42. The IOA modules 46 and 48 include an HBA (Host Bus Adapter) 50A for connecting the DB server 26 to the disk device 56 via an optical fiber, and an HBA 50B for connecting the AP server 30 to the disk device 56 via an optical fiber. A network adapter (network connection card) 52A for connecting the DB server 26 to the network 14, and a network adapter (network connection card) 52B for connecting the AP server 30 to the network 14. The DB server 26 and the AP server 30 are connected to the IOA modules 46 and 48, respectively. In addition, two network connection devices (network connection boards) 54A and 54B are attached to the individual network adapters 52A and 52B. The HBAs 50A and 50B are examples of the host adapter according to claims 3 and 8.

  In addition, two IOA modules 56 and 58 are mounted on the server chassis 44. The IOA modules 56 and 58 include an HBA 50A for connecting the DB server 28 to the disk device 56 via an optical fiber, an HBA 50B for connecting the AP server 32 to the disk device 56 via an optical fiber, and the DB server 28. A network adapter (network connection card) 52A for connecting to the network 14 and a network adapter (network connection card) 52B for connecting the AP server 32 to the network 14 are provided, respectively. The server 32 is connected to the IOA modules 56 and 58, respectively. In addition, two network connection devices (network connection boards) 54A and 54B are attached to the individual network adapters 52A and 52B.

  In the web service providing system 12 according to the present embodiment, all the network connection devices 54A, 54B provided in the IOA modules 46, 48, 56, 58 are provided as redundancy of IP address assignment to the network connection devices 54A, 54B. Is assigned an IP address.

  In the present embodiment, as a redundant connection between the servers 26 to 32 and the network 14, a total of four network connection devices 54 are provided for each server. A single virtual network connection device is constructed (referred to as bonding) with the other network connection device 54 as the active system and the other network connection device 54 as the standby system. Two sets of virtual network connection devices are provided for each server, and two network connection devices 54 constituting a single virtual network connection device are attached to different network adapters 52. A network connection device 54 is used.

  For example, with respect to the DB server 28, a single virtual connection is made by a network connection device 54A attached to the network adapter 52A of the IOA module 46 and a network connection device 54A attached to the network adapter 52A of the IOA module 48. The network connection device 54B is attached to the network adapter 52A of the IOA module 48 and the network connection device 54B is attached to the network adapter 52A of the IOA module 48. A typical network connection device is configured.

  On the other hand, the disk device 56 includes a large number of disk drives driven by a disk drive unit (DKU) 58. A large number of disk drives are connected to each other so as to form a plurality of redundant logical disks. The disk device 56 is provided with a disk controller (DKC) 60. The disk controller (DKC) 60 is provided with two redundant clusters 62A and 62B, one of the clusters 62A and 62B being the active system and the other being the standby system. Each cluster 62A, 62B has a channel adapter group 66, 68 provided with a plurality of channel adapters (CHA) 64, and a disk adapter provided with a plurality of disk adapters (DKAs) 70, respectively. A cache switch (CSW) 74 for connecting the group 72, the individual channel adapter (CHA) 64 of the channel adapter group 66, 68 and the individual disk adapter (DKA) 70 of the disk adapter group 72 is provided. It has been. The disk device 56 is provided with a pair of redundant shared memories 76A and 76B.

  Each logical disk of the disk drive is connected to each one of the cluster adapters (DKA) 70 of the clusters 62A and 62B. In this embodiment, the disk controller (DKC) 60 and the disk drive (logical disk) are connected. Each logical disk is connected to any one disk adapter (DKA) 70 of the cluster 62A via the shared memory 76A, while any one disk of the cluster 62B is connected. The adapter (DKA) 70 is connected via the shared memory 76B.

  Each HBA 50A, 50B is connected to one of the channel adapters (CHA) 64 via an optical fiber cable 78. In this embodiment, each server 26 to 32 and the disk device 56 (disk controller ( DKC) 60) for redundancy of connection, two HBAs 50 that connect a single server to the disk device 56 are made redundant (one is the active system and the other is the standby system). The HBAs 50 are connected to channel adapters (CHAs) 64 of different clusters 62. For example, of the two HBAs 50A that connect the DB server 26 to the disk device 56, the HBA 50A provided in the IOA module 46 is connected to the channel adapter (CHA) 64 of the cluster 62A, while provided in the IOA module 48. The HBA 50A thus connected is connected to the channel adapter (CHA) 64 of the cluster 62B.

  The disk controller (DKC) 60 is an example of a controller according to claims 1 to 3 and 8, and the clusters 62A and 62B are examples of a plurality of controllers according to claims 2 and 8, and a disk adapter. (DKA) 70 is an example of a medium-side adapter according to claims 2 and 3, and channel adapter (CHA) 64 is an example of a host-side adapter according to claim 3.

  Next, as an explanation of the operation of the present embodiment, the administrator of the computer system 10 including the web service providing system 12 verifies the redundant configuration from the terminal device 16 to each of the servers 26 to 32 of the web service providing system 12. Referring to FIG. 3, the redundant configuration verification processing realized by executing the redundant configuration verification program by the CPU 34 of each of the servers 26 to 32 will be described.

  When the administrator completes the construction of the web service providing system 12 and starts the operation of the web service providing system 12, the administrator once verifies the redundant configuration for the purpose of obtaining state information used as a master (described later). Web services such as replacement of part of hardware constituting the web service providing system 12, change of some settings, version upgrade of programs installed in the servers 26 to 32, etc. Each time the environment or part of the configuration of the providing system 12 is changed, the redundant portion of the web service providing system 12 is redundant for the purpose of confirming whether or not the redundancy is functioning effectively. Instructs verification of the configuration. Each time the servers 26 to 32 are instructed to verify the redundant configuration, the redundant configuration verification processing described below is performed.

  In the redundant configuration verification process, first, in step 100, the state information acquired when the redundant configuration verification process was executed last time is deleted from a predetermined area of the storage unit 38. When the redundant configuration verification process is executed for the first time, since the state information is not stored in the predetermined area of the storage unit 38, the execution of the above step 100 is omitted. In the next step 102, with respect to the OS running on the local server, the number of servers constituting the cluster to which the local server belongs and the operating state (for example, “active” / “standby” / “stopped”). A predetermined command for requesting information indicating any one of the above.

  The OS holds information indicating the number of servers constituting the cluster to which the server belongs and identification information. When the OS receives the command, the OS represents the number of servers constituting the cluster to which the server belongs and identification information. As for the operating status of other servers that read the information and constitute the same cluster as the own server, the OS running on the other server based on the identification information of the other server included in the read information For example, if there is no response, the operation status of the other server is determined as “stopped”. If a response is received, the operation of the other server is performed according to the operation status notified by the response. The status is determined as “in operation” or “standby”. Then, the OS performs processing for handing over the information indicating the number of servers constituting the cluster to which the server belongs and the operating status including the determined operating status of the other server to the redundancy configuration verification program.

  In the redundant configuration verification process, when the above information is delivered from the OS, the process proceeds to step 104. First, the delivered information includes information (for example, the current date and time) whose contents differ every time it is executed. If the relevant information is included, the relevant information is deleted, and then the delivered information is stored in the memory 36 as state information. Here, the information stored as the state information is an example of the fifth state information described in claim 7, and steps 102 and 104 are an example of the processing by the acquisition means described in claim 7.

  In the next step 106, the cluster 62 in which the two HBAs 50 corresponding to the own server are connected to the disk control unit (DKC) 60 of the disk unit 56 via the optical fiber cable 78 is selected from the clusters 62A and 62B. A predetermined command requesting information indicating whether or not is transmitted. The disk controller (DKC) 60 holds and manages information indicating to which HBA 50 each channel adapter (CHA) 64 provided in the clusters 62A and 62B is connected, and receives the above command. Then, information indicating which channel adapter (CHA) 64 of which cluster 62 is connected to the two HBAs 50 corresponding to the command transmission source server is extracted from the information, and the extracted information is transmitted to the command. Send to the original server.

  In the redundant configuration verification process, when the above information is received from the disk controller (DKC) 60, the process proceeds to step 108, and it is searched whether or not the received information includes information that differs in content every time it is executed. If the corresponding information is included, the corresponding information is deleted, and the received information is stored in the memory 36 as status information. Here, the information stored as the state information is an example of sixth state information described in claim 8, and steps 106 and 108 are an example of processing by the acquisition means described in claim 8.

  Subsequently, in step 110, the individual disk adapters provided in the clusters 62A and 62B are connected to the disk control unit (DKC) 60 of the disk unit 56 by connecting the connection paths between the clusters 62A and 62B and the logical disks of the disk unit 56. (DKA) A predetermined command for requesting information represented for each 70 is transmitted. The disk controller (DKC) 60 determines whether each of the clusters 62A and 62B is connected to the logical disks of the clusters 62A and 62B via the shared memories 76A and 76B. Information held for each adapter (DKA) 70 is held and managed, and when the command is received, the information is transmitted to the server that sent the command.

  In the redundant configuration verification process, when the above information is received from the disk controller (DKC) 60, the process proceeds to step 112, and it is searched whether or not the received information includes information that differs in content every time it is executed. If the corresponding information is included, the received information is stored in the memory 36 as state information after being deleted. Here, the information stored as the state information is an example of the first state information described in claims 1 and 2, and steps 110 and 112 are an example of the processing by the acquisition means described in claims 1 and 2. .

  In the next step 114, for the path management software running on the local server, the path and operating status of the two paths from the two HBAs 50 corresponding to the local server to the logical disk of the disk unit 56 are displayed. A predetermined command for requesting management information to be managed is transmitted. The path management software, for the two paths from the two HBAs 50 corresponding to its own server to the logical disk of the disk device 56, the path (between the HBA 50 and the channel adapter (CHA) 64 and the disk adapter ( DKA) Management information indicating whether each path between the 70 and the logical disk is not duplicated) and an operating state (for example, “in operation” / “standby” / “stopped”) When the command is received, the management information is transferred to the redundant configuration verification program.

  In the redundant configuration verification process, when the above management information is delivered from the path management software, the process proceeds to step 116, and it is searched whether or not the delivered management information includes information that differs in content every time it is executed. If the corresponding information is included, it is deleted, and the transferred management information is stored in the memory 36 as status information. Here, the information stored as the state information is an example of the second state information described in claims 1 and 3, and steps 114 and 116 are an example of the processing by the acquisition means described in claims 1 and 3. .

  In step 118, a command requesting notification of IP addresses assigned to the four network connection devices 54 corresponding to the server is transmitted to the OS running on the server. The OS holds and manages the IP address assigned to each of all the network connection devices 54 corresponding to the server as IP address management information, and when the command is received, the IP address management information is made redundant. Performs processing to pass to the configuration verification program.

  In the redundant configuration verification process, when the above IP address management information is delivered from the OS, the process proceeds to step 120. If the delivered IP address management information includes information whose contents differ every time it is executed, After the information is deleted, the delivered IP address management information is stored in the memory 36 as status information. Here, the information stored as the status information is an example of the third status information described in claims 4 and 5, and steps 118 and 120 are an example of the processing by the acquisition means described in claims 4 and 5. .

  In the next step 122, a command for requesting information indicating which network adapter 52 each of the four network connection devices 54 corresponding to the own server is assigned to the OS running on the own server. Send. The OS holds and manages allocation management information representing the network adapter 52 to which each of the network connection devices 54 corresponding to the server itself is allocated. When the OS receives the command, the OS makes the allocation management information redundant. Performs processing to pass to the configuration verification program.

  In the redundant configuration verification process, when the above allocation management information is delivered from the OS, the process proceeds to step 124, and if the delivered allocation management information includes information whose contents differ every time it is executed, the information is displayed. After the deletion, the transferred allocation management information is stored in the memory 36 as status information. Here, the information stored as the state information is an example of the fourth state information described in claims 4 and 6, and steps 118 and 120 are an example of the processing by the acquisition means described in claims 4 and 6. .

  In the next step 126, status information indicating the status of the other redundant part in the web service providing system 12 is converted into a management unit (for example, an OS or a disk controller (DKC) 60, which manages the status of the other part). A program such as a path management software), and receives status information from the management unit and stores it in the memory 36. An example of the state information acquired in step 126 will be described later.

  In the next step 128, it is determined whether or not the current redundant configuration verification process is executed for the first time (execution when the operation of the web service providing system 12 is started). This determination can be made by determining whether or not the state information is stored in a predetermined storage area for storing the state information master in the storage unit 38. When this determination is affirmed, the process proceeds to step 130, and the state information stored in the memory 36 in step 102 to step 126 (the state information acquired in the current process) is stored in the storage unit 38 as the state information master. The data is stored in a predetermined storage area, and the redundant configuration verification process is terminated.

  On the other hand, if the determination in step 128 is negative, the process proceeds to step 132, and the state information (the state information acquired in the current process) stored in the memory 36 in steps 102 to 126 is stored for each type. Compared with the master of the status information stored in the predetermined storage area of the unit 38, if there is status information that does not match the master, the type and content are extracted. In the next step 134, the output target of the status information instructed by the administrator is determined, and the process branches to step 136 or step 138 depending on the determination result.

  In the present embodiment, as the output target of the state information, “comparison result” between the current state information and the master and “all contents” of the state information can be selected, and the administrator outputs via the terminal device 16. When “comparison result” is selected as the target, the process proceeds from step 134 to step 136. As shown in FIG. 4A as an example, for each item of the state information, the current state information and the master “○” is displayed if the comparison results match, “x” is displayed if they do not match, and a comparison result display screen that displays the contents of items that do not match the master is also generated, and the generated comparison result display By transmitting the screen data to the terminal device 16, a comparison result display screen as shown in FIG. 4A is displayed on the display 18 of the terminal device 16.

  As described above, in the web service providing system 12, as a redundant connection between the disk controller (DKC) 60 and the disk drive (logical disk), each logical disk is one of the disks in the cluster 62A. While connected to the adapter (DKA) 70 via the shared memory 76A, the disk adapter (DKA) 70 of any one of the clusters 62B is connected via the shared memory 76B. When the logical disk or shared memory 76 or the disk adapter (DKA) 70 (or cluster 62) is replaced, the disk controller (DKC) 60 and the disk drive (logical disk ) May not work effectively.

  On the other hand, in this embodiment, when the state falls into the above state, the state information acquired in the previous step 112 becomes inconsistent with the state information of the master. Will be notified. The administrator performs an operation to restore the state in which the redundancy of the connection between the disk controller (DKC) 60 and the disk drive (logical disk) functions effectively, so that the disk controller can be used when a failure occurs. Since the redundancy of the connection between the (DKC) 60 and the disk drive (logical disk) is not functioning effectively, a serious system failure is prevented from occurring.

  Further, in the web service providing system 12, two HBAs 50 are provided for each server as a redundant path from each of the servers 26 to 32 to the logical disk of the disk device 56. There are two paths to the logical disk. However, for example, when a failure occurs in a device on the path of one path, some of the paths of the two paths overlap. There is a possibility that the redundancy of the path from each of the servers 26 to 32 to the logical disk of the disk device 56 does not function effectively, such as the state of one path is “stopped”. is there.

  On the other hand, in the present embodiment, when the state falls into the above state, the state information acquired in the previous step 116 does not match the state information of the master, so that it is detected that the state has fallen into the above state, and the administrator Will be notified. Then, the administrator performs an operation of restoring the path from the corresponding server to the logical disk of the disk device 56 to a state in which redundancy of the function is effectively functioning, so that any of the servers 26 to 32 is detected when a failure occurs. Since the redundancy of the path from the disk device 56 to the logical disk in the disk device 56 is not functioning effectively, it is possible to prevent a serious system failure from occurring.

  Further, in the web service providing system 12, as a redundant IP address assignment to the network connection device 54, IP addresses are assigned to all four network connection devices 54 provided for each server (however, The same IP address is assigned to a set of two network connection devices 54 constituting a single virtual network connection device). For example, one of the network connection devices 54 is replaced due to a failure or the like. In this case, there is a possibility that the IP address allocation to the network connection device 54 does not function effectively (invalid state) because the IP address is not allocated to the network connection device 54 after replacement. There is.

  On the other hand, in the present embodiment, when the state falls into the above state, the state information acquired in the previous step 120 becomes inconsistent with the state information of the master, thereby detecting that the state has fallen into the above state. Will be notified. Then, the administrator performs the work of assigning an IP address to the network connection device 54 to which the IP address is not assigned, so that the network connection device 54 to which the IP address is not assigned exists when a failure occurs. Therefore, it is possible to prevent a serious system failure from occurring.

  Further, in the web service providing system 12, as a redundant connection between the servers 26 to 32 and the network 14, a single virtual connection is made by a set of two network connection devices 54 attached to different network adapters 52. Although the network connection device is configured, for example, when the network connection device 54 or the network adapter 52 is replaced, redundancy of the connection between the servers 26 to 32 and the network 14 due to a mistake in connection restoration work after the replacement, etc. There is a possibility that the computer will not function effectively.

  On the other hand, in this embodiment, when the state falls into the above state, the state information acquired in the previous step 124 becomes inconsistent with the state information of the master. Will be notified. Then, the administrator performs an operation to restore the state in which the redundancy of the connection between the corresponding server and the network 14 functions effectively, so that any of the servers 26 to 32 and the network 14 can be connected when a failure occurs. Since the redundant connection is not functioning effectively, it is possible to prevent a serious system failure.

  Further, in the web service providing system 12, servers constituting a single cluster are made redundant, a single cluster is constituted by the DB servers 26 and 28, and a single cluster is constituted by the AP servers 30 and 32. However, for example, when a failure occurs in the hardware of a standby server, the operating status of the server changes from “standby” to “stopped”. There is a possibility that redundancy will not work effectively.

  On the other hand, in this embodiment, when the state falls into the above state, the state information acquired in the previous step 104 becomes inconsistent with the state information of the master. Will be notified. Then, the administrator performs work to restore a server that is in a “stopped” state to “standby” by, for example, exchanging a failed hard air, so that a single cluster can be created when a failure occurs. Since the redundancy of the servers to be configured does not function effectively, a serious system failure can be prevented from occurring.

  In the web service providing system 12, two HBAs 50 for connecting a single server to the disk device 56 as a redundant connection between the servers 26 to 32 and the disk device 56 (disk control device (DKC) 60). Are connected to channel adapters (CHA) 64 of different clusters 62. However, when the HBA 50 or the channel adapter (CHA) 64 (or the cluster 62) is replaced, for example, the connection restoration work error after replacement is incorrect. For example, there is a possibility that the redundant connection between the servers 26 to 32 and the disk device 56 (disk control device (DKC) 60) does not function effectively.

  On the other hand, in the present embodiment, when the state falls into the above state, the state information acquired in the previous step 108 becomes inconsistent with the state information of the master, so that it is detected that the state has fallen into the above state. Will be notified. Then, the administrator performs an operation to restore the state in which the redundancy of the connection between the corresponding server and the disk device 56 (disk control device (DKC) 60) functions effectively, so that when the failure occurs, the server Since the redundancy of the connection between any one of 26 to 32 and the disk device 56 (disk control device (DKC) 60) does not function effectively, it is possible to prevent a serious system failure from occurring. .

  On the other hand, when the administrator desires to confirm the entire contents of the status information, the administrator selects “all contents” of the status information as an output target via the terminal device 16. In this case, the process proceeds from step 134 to step 138, and as shown in FIG. 4B as an example, a content display screen displaying the contents of the master and the current state information for each item of the state information is generated. Then, the generated content display screen data is transmitted to the terminal device 16 to display the content display screen as shown in FIG. 4B on the display 18 of the terminal device 16. Steps 134 to 138 are an example of processing by the output means according to claim 9. Further, when the comparison of the status information by the administrator or the confirmation of all contents is completed, the process proceeds to step 140, and it is determined whether or not the administrator has instructed to update the master of the status information. Normally, this determination is negative and the redundant configuration verification process is terminated.

  By the way, the reason why the current status information is inconsistent with the master is that, as described above, redundancy in any part of the web service providing system 12 does not function effectively due to a mistake in connection restoration work or the like. In addition to the case, the configuration may be changed intentionally, for example, in accordance with the specification change of the web service providing system 12. In this case, since the web service providing system 12 is subsequently operated with the changed configuration, the administrator instructs the update of the status information master. In this case, the determination at step 140 is affirmed and the routine proceeds to step 142 where the current state information is overwritten on the master of the state information stored in the predetermined storage area of the storage unit 38 to verify the redundant configuration. The process ends. In this case, the current state information will be used as the state information master.

  Next, the state information to be acquired (or possibly) in step 126 described above will be described. In a computer system having a redundant portion, it is possible to use the state information acquired in steps 102 to 124 as a determination item as to whether or not the redundancy is maintaining a functioning state. In addition to these items, for example, the determination items shown in the following Table 1 are listed.

  Whether or not each of the above items needs to be determined differs depending on the individual items depending on the redundancy configuration in the computer system to be verified. Therefore, a determination item suitable for the computer system to be verified is selected. It is only necessary to select in advance and obtain state information capable of determining the selected determination item in the previous step 126.

  Note that the computer system 10 to be verified is not limited to the configuration shown in FIG. 2, and the present invention is applicable to any computer system having a redundant portion.

  Moreover, although the above demonstrated the aspect which makes the computer (server 26-32) which comprises the web service provision system 12 as a computer system of verification object function as a redundant state verification apparatus based on this invention, it is limited to this. Instead of this, another computer connected to the computer system to be verified can be made to function as the redundant state verification apparatus according to the present invention.

  In the above description, the redundant configuration verification program according to the present invention is stored (installed) in advance in the storage unit 38 of each of the servers 26 to 32. However, the redundant state verification program according to the present invention is a CD- It is also possible to provide the information recorded in a recording medium such as a ROM or a DVD-ROM.

10 Computer system 12 Web service providing system 16 Terminal device 18 Display 26, 28 DB server 30, 32 AP server 50A, 50B HBA
52 Network Adapter 54A, 54B Network Connection Device 60 Disk Controller (DKC)
62A, 62B Cluster 64 Channel Adapter (CHA)
70 Disk adapter (DKA)

Claims (11)

Whether the connection between the controller provided in the storage device and the storage medium main body of the storage device is made redundant by inquiring about the state of the redundant part in the computer system to be verified including the storage device First state information indicating whether or not, and second state information indicating whether or not the path between the computer of the computer system to be verified and the storage medium body of the storage device is redundant Acquisition means for acquiring state information including;
Storage means for storing the status information acquired by the acquisition means;
By comparing the state information acquired by the acquisition unit with the state information acquired in the past by the acquisition unit and stored in the storage unit, the redundancy of the computer system to be verified is obtained. Determining means for determining whether or not the portion maintains a state in which the redundancy functions effectively;
A redundant state verification device including: The computer system to be verified is provided with a plurality of redundant controllers in the storage device as a redundant connection between the controller and the storage medium body, and a plurality of medium side adapters are provided in each of the controllers. Are provided, and for each of the plurality of controllers, each medium-side adapter is connected to the storage medium body via a different shared memory among a plurality of redundant shared memories. Yes,
The acquisition means transmits a command requesting information indicating the connection path between each of the plurality of controllers and the storage medium main body of the storage device for each of the medium-side adapters to the controller. The redundant state verification device according to claim 1, wherein the information is acquired from the controller as the first state information. The computer system to be verified is provided with a plurality of redundant host adapters in the computer as a path redundancy between a computer of the computer system to be verified and a storage medium body of the storage device. A plurality of redundant host-side adapters connected to any of the plurality of host adapters to the controller of the storage device; and a storage medium body of the storage device connected to any of the plurality of host-side adapters A plurality of medium-side adapters connected to each other and made redundant, and a predetermined program operating on the computer is transferred from each host adapter of the computer system to be verified to a storage medium of the storage device It is a configuration that manages the route and operating status for each path to the main unit,
The acquisition means requests the predetermined program for information indicating a path and an operation state for each path from each host adapter of the computer system to be verified to the storage medium body of the storage device. The redundant state verification apparatus according to claim 1, wherein the information is acquired as the second state information from the controller by transmitting a command. A state in which the IP address assignment to the network connection device is made redundant by inquiring about the current state of the redundant portion in the computer system to be verified including the computer connected to the network via the network connection device Third status information indicating whether or not, and fourth indicating whether or not the assignment of a plurality of network connection devices constituting a single network connection device to network adapters is made redundant Acquisition means for acquiring state information including state information;
Storage means for storing the status information acquired by the acquisition means;
By comparing the state information acquired by the acquisition unit with the state information acquired in the past by the acquisition unit and stored in the storage unit, the redundancy of the computer system to be verified is obtained. Determining means for determining whether or not the portion maintains a state in which the redundancy functions effectively;
A redundant state verification device including: The computer system to be verified is provided with a plurality of network connection devices as a redundant IP address assignment to the network connection devices, and an IP address is assigned to each of the plurality of network connection devices. The configuration
The acquisition means transmits a command requesting information representing an IP address assigned to each of the plurality of network connection devices to the operating system, thereby obtaining the information from the operating system. The redundant state verification apparatus according to claim 4, which is acquired as state information. The computer system to be verified is provided with a plurality of network connection devices as a redundancy of assignment of a plurality of network connection devices constituting a single network connection device to the network adapter. A plurality of network connection devices constituting a single network connection device are assigned to different network adapters,
The acquisition means transmits the command from the operating system to the operating system by sending a command requesting information indicating to which network adapter each of the plurality of network connection devices is assigned. The redundant state verification apparatus according to claim 4, which is acquired as the fourth state information. The computer system to be verified is a configuration in which a single cluster is composed of a plurality of computers as redundancy of computers constituting the cluster,
The acquisition unit transmits a command requesting information indicating the number of computers constituting a single cluster of the computer system to be verified and each operation state to the operating system. 5. The information according to claim 1, wherein the information is acquired as fifth status information indicating whether or not a single cluster of the computer system to be verified is configured by a plurality of computers. Redundant state verification device. The computer system to be verified includes a storage device, and a plurality of redundant host adapters are provided in the computer as a redundant connection between the computer of the computer system to be verified and the storage device. A pair of host adapters among the plurality of host adapters are connected to different controllers among a plurality of redundant controllers provided in the storage device,
The acquisition unit transmits the information to the controller by requesting information indicating which of the plurality of host adapters each of the plurality of host adapters is connected to. 5. The redundant state verification according to claim 1, wherein the redundant state verification is acquired as sixth state information indicating whether or not a pair of host adapters is connected to a different one of the plurality of controllers. apparatus.   The state information acquired by the acquisition unit when the determination unit determines that the redundant portion of the computer to be verified does not maintain a state in which the redundancy functions effectively. The redundant state verification apparatus according to claim 1, further comprising output means for outputting information for notifying a current state of the redundant portion represented by A computer comprising a storage device, comprising a computer system to be verified or connected to the computer system to be verified, and comprising a storage means;
Whether or not the connection between the controller provided in the storage device and the storage medium body of the storage device is made redundant by inquiring about the state of the redundant portion in the computer system to be verified State information including first state information to be expressed and second state information to indicate whether or not a path between the computer of the computer system to be verified and the storage medium body of the storage device is redundant Acquisition means to acquire,
And the redundancy of the computer system to be verified by comparing the state information acquired by the acquisition unit with the state information acquired in the past by the acquisition unit and stored in the storage unit A redundant state verification program for causing the determined portion to function as a determination unit that determines whether or not the redundancy is functioning effectively. A computer comprising a computer system to be verified including a computer connected to a network via a network connection device or connected to the computer system to be verified and having a storage means,
Third state information indicating whether or not the assignment of the IP address to the network connection device is made redundant by inquiring about the current state of the redundant portion in the computer system to be verified; and virtual Acquisition means for acquiring state information including fourth state information indicating whether or not assignment of a plurality of network connection devices constituting a single network connection device to network adapters is made redundant;
And the redundancy of the computer system to be verified by comparing the state information acquired by the acquisition unit with the state information acquired in the past by the acquisition unit and stored in the storage unit A redundant state verification program for causing the determined portion to function as a determination unit for determining whether or not the state in which the redundancy is functioning effectively is maintained.

Images