Restarting method using a snapshot

[0001] The present invention relates to a failover method of a computing system including a server which is booted from an external disk device.

[0002] In general, a computing system such as a server is configured in such a manner that the OS (Operating System) installed in a built-in disk is booted and then business work is performed on the OS. Examples of methods for enhancing reliability of such a server include one method in which a backup server having the same configuration is provided and the main server is switched over to the backup server when the main server fails. With this method, however, since it is not possible to take over data concerning the business work stored in the disk, it is necessary to execute the work processing in progress over again. Further, another method is to transfer data concerning work among a plurality of servers via a network and, to take over the whole data concerning the business work in case either one server fails. Use of such a method enables the backup server to continue work that is in progress. Although the former method has an advantage that it is applicable to all sorts of business program, it cannot take over business work. On the other hand, the latter method has an advantage that it can take over business work in progress, but it is required to arrange that a business application should have a mechanism that transfers business data to a backup server, which restricts application of the method to all business applications.

[0003] Examples of methods for solving the disadvantages of the above-described two methods for enhancing reliability include a method, as stated in U.S. Patent Application Publication Nos. 2005/0060607A1 and 2003/0188115A1, wherein booting of the OS is accelerated by booting the OS from a snapshot that is acquired in advance. Here, the term “snapshot” means information including memory status where the OS or a business program is in operation. By storing a snapshot in a disk or the like and by booting a server by using the snapshot, it is possible to resume the OS or the business program at high-speed. Thus, by using the snapshot and booting a server at high-speed when the server fails, it is possible to recover the server while ensuring the active status of the OS or the business program.

[0004] Although the above-stated conventional arts can recover the server along while ensuring the active status of the OS or the business program by booting the server by using a snapshot at a high speed when the server fails, the failover function does not work depending on a snapshot to be used. For example, when a server acquired a snapshot during a time period when the sever is in failure, even if the server is recovered by using the snapshot and the OS or the business program is resumed, there will be a problem in reliability since the sever is booted in failed and unstable memory status. Therefore, the fact in which status of a server a snapshot was acquired constitutes a very important issue and, to ensure failover function, a snapshot that is acquired under normal operating status becomes mandatory.

[0005] To solve the above-stated problems, a server notifies an administration server of its own operating status and the administration server executes acquisition of a snapshot and copying of a disk according to a policy established by a user. A plurality of copy destinations of a disk and a snapshot will be prepared in advance, and history of not only a snapshot in a status that a failure occurred, but also snapshots under various statuses such as a snapshot under normal status right after operation and a normal and latest snapshot existed right before occurrence of failure will be acquired.

[0006] Further, when switching is made from an active sever to a backup server due to a failed server or disk, the administration server choose a backup server, and a disk and a snap to be booted which are in correct status according to the policy, and boots them.

[0027] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0028] FIG. 1 is a configuration example of the first embodiment according to the present invention. Referring to FIG. 1, active servers A102, B103, backup servers A104, B105 and an administration server 106 are connected to a network 101 and a switch 109. The switch 109 is connected to a disk array apparatus 110. An administration server 108 includes a policy management function 107 which operates in accordance with a policy defined by a user and an alert management function 180 which administrates an alert that is transmitted from the active server A102 or the active server B103. The disk array apparatus 110 includes a storage mapping function 111 which executes connection between servers and the disk array apparatus 110, and a disk copying function 112 which copies an active disk 113 on status storage disks A114, B115 and C116.

[0029] Here, the term “active server” means a server that is currently in operation for certain business work, and the term “backup server” means a server that is switched over to take over business work when the server in operation fails.

[0030] FIG. 2 is a block diagram of a server. A server 102 includes a memory 201; a CPU 202; a snapshot creation function 202 which creates a snapshot from the memory 201; a BMC 204 which includes a power supply control function 205 that controls power supply of the server 102 and an alert detection function 206 that detects and transmits an alert of the server 102, and which is connected to the network 101; and an HBA 207 which is connected to a switch 109. Here, the term “snapshot” means information containing status of the memory 201 while the server 102 is in operation and further means to back up information of a disk drive (LU), etc. in a specified timing. By reading the snapshot, it is possible to develop information of the memory 201 to the server 102, thus putting the server 102 in the status when the snapshot is acquired.

[0031] FIG. 3 is a block diagram of an administration server. An administration server 106 includes a policy management function 301 and an alert management function 310. The policy management function 301 includes a policy table 302 which manages policies defined by a user; a disk management table 303 which manages information of snapshots stored in the disk array apparatus 110; a status storage disk creation unit 304 which creates a status storage disk; and a backup server switching unit 307 which switches an active server to a backup server. The status storage disk creation unit 304 includes a snapshot execution unit 305 which requests the server 102 to create a snapshot and a disk copy execution unit 306 which requests the disk array apparatus 110 to copy a disk. The backup server switching unit 307 includes a server management table 308 which manages information of an active server or a backup server and a storage mapping update unit 309 which requests the disk array apparatus 110 to update storage mapping. The alert management function 310 includes an alert table 311 which manages information of an alert ID and an alert level and an alert reception unit 312 which receives an alert which is transmitted by a server.

[0032] FIG. 4 illustrates the policy table 302 which is owned by the administration server 106. In the policy table 302, policies defined by a user are managed, and each policy includes a policy identifier 401; a description of policy 402; acquisition of snapshot 403 which defines whether or not a snapshot is to be acquired; automatic switching to backup server 404 which defines whether switching from an active server to a backup server should be performed or not; and a to-be-used disk 405 which indicates which disk should be used when switching is made to a backup server. The description of policy 402 includes those to be applied at the time of: logging on; starting up of the OS; regular time; after the elapse of a certain operation time; within CPU load; exceeding the update rate of snapshot by a certain rate; frequent cautions and warnings; exceeding a certain numbers of cautions and warnings; occurrence of a failure; request by a user, etc. The to-be-used disk 405 includes items similar to the description of policy 402, and the generation and date of acquisition may be specified in addition to descriptions. For business work that constantly uses latest information and thus is not permitted to stop, a policy to acquire a snapshot at regular times and a policy to reboot the server by using a snapshot that is acquired at regular times, when a failure occurs can be used. On the other hand, for business work for which resumption of the work is only required, a policy to acquire a snapshot when starting up the OS and a policy to reboot the server with the snapshot acquired at the time of OS startup, when a failure occurs can be used. It is also possible to initiate restarting under the status existed right before the failure occurrence by acquiring a snapshot when cautions and warnings occur frequently and by restarting the server with the snapshot acquired before cautions and warnings occurred frequently, when a failure occurs.

[0033] FIG. 5 shows a disk management table owned by the administration server 106. The disk management table 303 manages information of a disk on which snapshots are stored, and for each disk it includes an LU 501; a snapshot 502 which is a snapshot name; an acquisition source LU 503 which shows from which LU a snapshot is acquired; a type 504 which shows for what alert a snapshot is acquired; generation 505 which is used to discriminate snapshots when the same type of snapshots are created from the same server; and an acquisition date 506 of a snapshot.

[0034] FIG. 6 shows a server management table owned by the administration server 106. A server management table 308 manages information of active or backup servers, and for each server it includes a server identifier 601, a WWN 602, an LU 603, a backup server 604, operational duration 605, an operation rate 606 and an introduction date 607. Here, operation duration 605 means total time when a server is turned on, the operation rate 606 means a value obtained by dividing average failure time with the sum of the average failure time and average recovery time, and the introduction date 607 means the date when a server is purchased and introduced into the system.

[0035] FIG. 7 shows an alert table owned by the administration server 106. The alert table 311 manages alert IDs and alert levels and, for each alert, it includes an alert ID 701 and an alert level 702. An alert contains several types and levels such as log off and excess of the CPU load by a certain extent, in addition to information, caution, warning, failure, OS startup and shutdown, and handling methods to be described on the policy table 302 vary according to the alert level 702.

[0036] FIG. 8 shows a conceptual diagram in which the servers 102, 103, 104 and 105 and the disk array apparatus 110 are mapped by the switch 109. The storage mapping function 111 owned by the disk array apparatus 110 is a function that enables flexible association between the disks 113 to 116 in the disk array apparatus 110 and the servers 102 to 105. For example, the active server A102 and the backup server A104 are connected to the active disk 113 and the status storage disk C116, respectively, and enable to boot the OS through the storage mapping function 111 of the disk array apparatus 110. As stated above, since the association between the servers 102 to 105 and the disks 113 to 116 can be established flexibly, it is possible to flexibly control booting of the OS which is stored in the servers 102 to 105 and the disks 113 to 116.

[0037] FIG. 9 shows a conceptual diagram illustrating how the active disk 113 is copied on a status storage disk. The disk copying function 112 owned by the disk array apparatus 110 is a function in which copying among the disks 113, 114, 115 and 116 in the disk array apparatus 110 can be performed without using the servers 102, 103, 104 and 105. In general, to copy a disk, a server reads data of a copy source disk and writes the data on a copy destination disk. On the other hand, with the disk copying function, copying can be performed within a disk array apparatus instead of using a server. Since copying can be performed within the disk array apparatus 110, high-speed disk copying can be realized. The active disk 113 is copied by the disk copying function 112 on to the status storage disk A114, B115 or C116. In addition, the term “remote copying” means a function to copy a disk of a disk array apparatus on a disk of a different disk array apparatus. If the remote copying function is used, then the copy destination is not limited to the disk array apparatus in which the active disk 113 is incorporated, but it may be a different disk array apparatus that is located at a remote place.

[0038] FIG. 10 shows a conceptual diagram for creating a snapshot of the active server A102. The active server A102 stores a snapshot of a memory 201 on the active disk 113 by using a snapshot creation function 203. When the snapshot is read to the active server A102, information that was available at the time of acquiring the snapshot is expanded in the memory 201, which enables to start up the active server 102A at high-speed.

[0039] FIG. 11 shows a sequence to execute creation of a snapshot and disk copying, as being triggered by occurrence of an alert in an active server. In an active server 1101, when an alarm occurs in Step 1104, an administration server 1102 receives the alert in Step 1105. In Step 1106, the administration server 1102 refers to a type of alert on the alert table 311 and, in Step 1107, it refers to policies on the policy table 302 based on the type of the alert. In Step 1108, according to the policy the administration server 1102 issues a request to the snapshot execution unit 305 for creating a snap shot. The active server 1101 creates a snapshot by using the snapshot creation function 203 in Step 1109. The administration server 1102, upon completing creation of a snapshot in Step 1109, searches the disk management table 303 for a disk copy destination in which the snapshot is stored in Step 1110 and requests the disk copying function 1103 via the disk copy execution unit 306 to copy the disk. In Step 1111, the disk copying function 1103 copy the active disk on a status storage disk by using the disk copying function 112, and the administration server 1102 registers information of the snapshot in the disk management table 303 in Step 1112.

[0040] FIG. 12 shows a sequence diagram illustrating how a backup server restarts business work using a snap shot in response to the occurrence of a failure alert at an active server. In an active server 1206, upon occurrence of a failure alert in Step 1204, the active server 1201 acquires a dump in Step 1206 and shuts itself down in Step 1207. On the other hand, an administration server 1202 receives the failure alert in Step 1205, refers to types of alert in the alert table 311 in Step 1208, and, in Step 209, it also refers to policies in the policy table 302 based on the type of the alert. In Step 1210, the administration server 1202 chooses a backup server associated with the active server in the server management table 308, and searches the disk management table 303 for a disk of the snapshot to be used for the backup server according to an LU 603 of the server management table 308 and the to-be-used disk 405 of the policy table 302. Here, for choice of the backup server, it can be acquired from the field of backup server 604 in the server management table 380. However, operational duration 605, operation rate 606, introduction date 607, etc. may also be used. In Step 1212, the administration server 1202 issues a request for updating storage mapping via the storage mapping update unit 309, and the storage mapping function 1203 updates mapping of storage in Step 1213. The administration server 1202, after the update of storage mapping, issues a request for startup to a backup server in Step 1214, and the storage server 1215 starts up in Step 1215 and resumes business work in Step 1217. Alternatively, in Step 1210, the administration server 1202 chooses one more backup server in addition to the backup server for resuming business work and searches for a snapshot created at the time of occurrence of the failure in Step 1211. Then, after the storage mapping in Step 1213, the administration server 1202 can prepare another server for analyzing failure in addition to the server for resuming business work. The server for analyzing failure can also be booted through the stepwise execution. Here, the term “stepwise execution” means that operation is carried out by using a debug mode.

[0041] FIG. 13 is a flow chart illustrating snapshot creation and disk copying processes to be executed in the status storage disk creation unit 304. The status storage disk creation unit 304, upon receiving an alert in Step 1301, refers to types of alert in Step 1302. In Step 1303, the unit 304 refers to a policy according to the type of alert, and if a snapshot is to be created in accordance with the policy in Step 1304, the unit 304 advances the process to Step 1305. If a snapshot is not required, the unit 304 terminates the process. In Step 1305, the status storage disk creation unit 304 executes the snapshot and determines where to copy the disk in Step 1306. The unit 304 executes disk copying in Step 1307. As a result, the LU 501 which contains the description of policy 402, as the type 504, which was referred to in the policy table 302, is added to the disk management table 303. By cross-checking the alert from a server with the policy table 302 and referring to policies in Step 1303, it becomes possible to create snapshots for various conditions according to types or levels of importance of business work, thus enabling flexible dealing with user requirements. Further, when only the latest snapshot is required to be kept, by designating the generation to be acquired as the first generation in the description of policy 402 in the policy table 302, the snapshot can be overwritten and saved in the same LU 501 in the disk management table 303. On the other hand, when previous snapshots are also required to be kept, by designating the generation to be acquired as the third generation in the description of policy 402 in the policy table 302, the snapshots can be saved in sequence in the three LUs 501 in the disk management table 303. With such arrangement, it is possible to restrict the number or volume of snapshots.

[0042] FIG. 14 is a flow chart illustrating processes to search a backup server and update storage mapping in the backup server switching unit 307. The backup server switching unit 307, upon receiving an alert in Step 1401, refers to the types of alert in Step 1402. In Step 1403, the unit 307 refers to a policy according to the type of alert, and if the server is to be switched over to a backup server in accordance with the policy in Step 1404, the unit 307 advances the process to Step 1405. If the switching is not required, it terminates the process. In Step 1405, the backup server switching unit 307 searches backup servers and, in Step 1406, the unit 307 chooses the LU 501 in the disk management table 303, as a disk to be started up with the backup server, which has the disk to be used 405 in the policy table 302 as the type 504 among LUs that were used by the active server. Other examples of methods for choosing a disk include: in addition to the method stated above, a method for choosing the LU 501 at around the specified time by using the date of acquisition 506; a method for choosing the latest LU 501 irrespective of the type 504; and a method for choosing the LU 501 that existed right before the occurrence of a failure. In Step 1407, the backup server switching unit 307 updates storage mapping and, in Step 1408, it stats up a backup server. By cross-checking the alert from a server with the policy table 302 and referring to policies in Step 1403, it becomes possible to switch the server to a backup server under various conditions according to types or levels of importance of business work, thus enabling to flexibly deal with user requirements. When the latest business work is required to be taken over with the backup server, by designating the field of the to-be-used disk 405 in the policy table 302 as the latest disk, it is possible, when necessity of switching occurs, to start up the server by using the latest LU 501 based on the acquisition date 506 in the disk management table 303, thus enabling resumption of business work while taking over the data that existed right before the switching. When business-related important work occurs at 17:00 every day, by designating 18:00 on the field of the to-be-used disk 405 in the policy table 302, it is possible to initiate startup by using the LU 501 designated at 18:00 from the acquisition date 506 in the disk management table 303 when necessity of switching occurs, thus enabling resumption of business work while taking over the data available after the end of the important work.

[0043] According to the first embodiment, it becomes possible, in accordance with the policy created by a user, to create snapshot for various conditions, and to choose a snapshot when the active server is switched to a backup server, thus enabling flexible high-speed booting by using the snapshot.

[0044] FIG. 15 is a configuration example of a system according to a second embodiment according to the present invention. The second embodiment differs from the first embodiment in that the disk copying function 112 that has been included in the disk array apparatus 110 is included in an administration server 106. The disk copying function 112 included in the administration server 108 copies an active disk 113 on status storage disks A114, B115 and C116.

[0045] FIG. 16 is a sequence diagram illustrating processes, in the second embodiment, to create a snapshot and copy a disk, as being triggered by occurrence of an alert in an active server. In an active server 1601, when an alert occurs in Step 1604, an administration server 1602 receives the alert in Step 1605. In Step 1606, the server 1602 refers to the types of alert in the alert table 311 and, in Step 1607, the server 1602 refers to policies in the policy table 302 based on the type of the alert. The administration server 1602 issues a request for crating the snapshot 203 through the snapshot execution unit 305, and the active server 1601 creates a snapshot by using the snapshot creation function 203 in Step 1609. The administration server 1602, upon completion of creation of the snapshot in Step 1609, searches, in the disk management table 303, the copy destination disk in which the snapshot is to be saved, copies the active disk on the status storage disk by using the disk copying function 112 and registers information of the snapshot in the disk management table 303 in Step 1612.

[0046] According to the second embodiment, even if only the disk array apparatus 110 that does not include the disk copying function 112 is available, it is possible to obtain the same effect as that of the first embodiment by allowing the administration server 106 to read data of the copy source disk and write the data on the copy destination disk.

[0047] FIG. 17 shows a configuration example of a system according to a third embodiment of the present invention. The third embodiment differs from the first embodiment in that the third embodiment does not have the administration server 106 and a table management disk 117 includes the policy table 302, disk management table 303, server management table 308 and alert table 311 which were included in the administration server 106.

[0048] FIG. 18 is a block diagram of a server according to the third embodiment. The third embodiment differs from the first embodiment in that a server 102 includes the policy management function 301 that was included in the administration server 106. The server 102, upon detecting an alert, creates a snapshot by using the snapshot creation function 203 according to the policy in the table management disk 117 and copies a disk in the disk copy execution unit 306. Upon detection of a failure alert, the server 102 chooses a backup server and a disk according to the policy in the table management disk 117 and switches the server to a backup server through the storage mapping update unit 309.

[0049] According to the third embodiment, even if the administration server 106 is not available separately, servers 102, 103, 104 and 105 can execute creation of a snapshot or storage mapping while referring to the table management disk 117, thus offering the same effect as that of the first embodiment.

[0050] FIG. 19 shows a configuration example of a system according to the fourth embodiment of the present invention. The fourth embodiment differs from the first embodiment in that a memory 201 of a server 102 includes a virtual server A 209, a virtual server B 210, a server virtualization mechanism 208 which manages the virtual server A 209 and B 210, and a snapshot creation function to create a snapshot of the virtual servers. The snapshots of the virtual servers A 209 and B 210 can also be saved as is the case with the first embodiment.

[0051] According to the fourth embodiment, even if a sever is a virtual server, not a physical server, then high-speed restarting of the virtual servers A 209 and B 210 can be possible by using the snapshots, thus offering the same effect as that of the first embodiment.

[0052] Even in a case where a failure occurs in a server in service or a disk and its booting is conducted by switching the server to a backup server by using a snapshot to take over business work, a backup server, a snapshot which is in the normal status and a disk that conform to the user policy can be chosen for use among the history of snapshots that had been acquired previously in various statuses, thus enabling to offer a system that can activate the failover function.

[0053] While the invention has been described in its preferred embodiments, it is to be understood that the words which have been used are words of description rather than limitation and that changes within the purview of the appended claims may be made without departing from the true scope and spirit of the invention in its broader aspects.