Storage systems and their control methods

Abstract

The present invention provides a storage system and a storage system construction method, which ensures the availability when two or more storage nodes fail while avoiding the concentration of resource consumption. Each redundant group is composed of an activation program (storage control program of the activation program) and N (N is an integer greater than 2) standby programs. The N standby programs are respectively associated with a priority determined as a FO (failover) destination. FO from the activation program to the standby program based on the priority is performed in the same redundant group. With respect to multiple storage control programs including an activation program and a standby program that becomes activated due to FO in multiple redundant groups configured on the same node, each program is configured on a node different from each other for the standby storage control program that can become the FO destination.

Description

Technical Field

[0001] The present invention relates to a storage system and a control method thereof, and is preferably applicable to an information processing system including a plurality of storage nodes each of which is equipped with one or more SDSs (Software Defined Storage). Background Art

[0002] Currently, in information processing systems, a redundant structure of server devices is often used to improve availability and reliability.

[0003] For example, Patent Document 1 discloses a technology for effectively utilizing servers and improving the availability of storage control software by configuring the storage control software of an active system (active) belonging to a certain redundant group and the storage control software of a standby system (standby) belonging to another redundant group on the same server.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2019-101703 Summary of the invention

[0007] Problems to be solved by the invention

[0008] In order to ensure availability when a failure occurs in two or more servers, it is considered that the number of standby storage control software in each redundant group is set to 2 or more, that is, the number of storage control software constituting each redundant group is set to 3 or more. In this case, when two servers fail, one server can operate three active storage control software. As a result, there is a problem that the load is concentrated on one server and the I / O performance is reduced, and the memory consumption is increased.

[0009] In order to avoid such a problem, a method of transferring two activated storage control software that are already running to other servers in advance when the second server fails is considered. However, in this method, due to the transfer process of the storage control software, the failover of the active control software of the failed server cannot be started, thereby prolonging the I / O downtime.

[0010] As another method, when only one standby storage control software is left in a certain redundant group, a method of transferring the active control software of the server where the standby control software exists to another server is considered in advance. However, in this method, the I / O performance of the server that has not failed is reduced due to the transfer process of the storage control software.

[0011] In addition, as another method, when a server fails, a method is considered in which, based on the number of activated storage control software in each other server, any one of the plurality of standby storage control software in the redundant group including the activated storage control software in the failed server is selected for activation. However, in this method, when a storage node fails, inter-node communication is required to detect the number of activated storage control software in each other storage, and it takes time until the failover is completed, resulting in a prolonged I / O downtime.

[0012] Technical solutions to solve problems

[0013] With respect to each redundant group composed of (N+1) storage control programs, one storage control program is an activation program as an activated storage control program, and the remaining N storage control programs are all standby programs as standby storage control programs, and the N standby programs are respectively associated with a priority determined as a failover destination. In the event that a storage node configured with an activation program fails, a failover is performed within the redundant group from the activation program to the standby program with the highest priority. The configuration condition of redundant group α is that, among the N standby programs in the redundant group α, at most k are configured in the influence nodes within the kth among all the influence nodes of redundant group β with respect to redundant group α. Redundant group β with respect to redundant group α is a redundant group including an activation program configured in the mth influence node of redundant group α, where m is a natural number and m<N. The mth influence node of redundant group α is a storage node configured with a standby program with a priority m in redundant group α. The storage node configured with the activation program in redundant group α is the 0th influence node. The storage node configured with the standby program of priority order k in the redundancy group β with respect to the redundancy group α is the (m+k)th affected node of the redundancy group α, where k is a natural number and 1≤k≤(Nm).

[0014] Effects of the Invention

[0015] According to the present invention, it is possible to ensure availability when failures occur in two or more storage nodes while avoiding concentrated resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A configuration example of the information processing system according to the first embodiment is shown.

[0017] Figure 2 An example of a physical structure of a storage node according to the first embodiment is shown.

[0018] Figure 3 An example of a logical structure of a storage node according to the first embodiment is shown.

[0019] Figure 4An example of the program and data stored in the storage node of the first embodiment is shown.

[0020] Figure 5 An example of the arrangement of the storage control unit according to the first embodiment is shown.

[0021] Figure 6 An example of the configuration of the storage control unit according to the first embodiment is shown.

[0022] Figure 7 Indicates that the first storage node that fails is storage node 1.

[0023] Figure 8 This indicates that the second storage node that fails is storage node 3.

[0024] Fig. 9 Indicates that the second storage node that fails is storage node 2.

[0025] Fig.10 Indicates that the second storage node that fails is storage node 0.

[0026] Fig.11 A comparative example of the first embodiment is shown.

[0027] Fig.12 A comparative example of the first embodiment is shown.

[0028] Fig.13 A comparative example of the first embodiment is shown.

[0029] Fig.14 An example of the configuration of the storage control unit according to the first embodiment is shown.

[0030] Fig.15 An example of the arrangement of the storage control unit according to the first embodiment is shown.

[0031] Fig.16 An example of the configuration of the storage control unit according to the first embodiment is shown.

[0032] Fig.17 An example of a logical structure of a storage node according to the second embodiment is shown.

[0033] Fig.18 The concept of the influencing node and an example of a method of configuring the storage control unit in the second embodiment are shown.

[0034] Fig.19 An example of the configuration of the storage control unit according to the second embodiment is shown.

[0035] Fig. 20 An example of the configuration of the storage control unit according to the second embodiment is shown.

[0036] Fig.21 An example of the configuration of the storage control unit according to the second embodiment is shown.

[0037] Fig. 22 An example of the configuration of the storage control unit according to the second embodiment is shown.

[0038] Fig.23 An example of the configuration of the storage control unit according to the third embodiment is shown.

[0039] Fig.24 An example of the configuration of the storage control unit according to the third embodiment is shown. DETAILED DESCRIPTION

[0040] In the following description, an "interface device" may be one or more interface devices. The one or more interface devices may be at least one of the following.

[0041] One or more I / O (Input / Output) interface devices. An I / O (Input / Output) interface device is an interface device for at least one of an I / O device and a remote display computer. The I / O interface device for the display computer may be a communication interface device. The at least one I / O device may also be a user interface device, such as an input device such as a keyboard and a pointing device, or an output device such as a display device.

[0042] One or more communication interface devices. The one or more communication interface devices may be one or more communication interface devices of the same type (for example, one or more NICs (Network Interface Cards)), or two or more communication interface devices of different types (for example, a NIC and an HBA (Host Bus Adapter)).

[0043] In the following description, "memory" refers to one or more memory devices, typically a main memory device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0044] In the following description, a "storage device" is one or more permanent storage devices. The permanent storage device may be a non-volatile storage device (e.g., an auxiliary storage device), and may be, for example, a HDD (Hard Disk Drive), an SSD (Solid State Drive), an NVME (Non-Volatile Memory Express) drive, or an SCM (Storage Class Memory).

[0045] In addition, in the following description, a "processor" may be more than one processor device. Typically, at least one processor device may be a microprocessor device such as a CPU (Central Processing Unit), but may also be another type of processor device such as a GPU (Graphics Processing Unit). At least one processor device may be a single-core device or a multi-core device. At least one processor device may also be a processor core. At least one processor device may also be a generalized processor device such as a circuit as a collection of gate matrices that performs partial or full processing according to a hardware description language (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0046] In addition, in the following description, sometimes "program" is used as the subject to describe the processing, but the program is executed by using a processor, thereby performing a certain processing while appropriately using a storage device and / or an interface device, etc., and therefore, the subject of the processing may also be a processor (or a device such as a controller having the processor). The program may also be installed from a source program to a device such as a computer. The source program may also be, for example, a program distribution server or a computer-readable (e.g., non-temporary) recording medium. In addition, in the following description, two or more programs may be implemented as one program, and one program may also be implemented as two or more programs.

[0047] In the following description, when describing the same kind of elements without distinguishing them, reference signs may be used, and when describing the same kind of elements while distinguishing them, identification information (for example, signs or numbers) assigned to the elements may be used.

[0048] Hereinafter, several embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0049] (1) First Embodiment

[0050] (1-1) Configuration of the Information Processing System of the Present Embodiment

[0051] Figure 1 A configuration example of an information processing system according to the present embodiment is shown.

[0052] The information processing system includes a plurality of host devices 101 , a plurality of storage nodes 103 , and a management node 104 , which are interconnected via a network 102 formed of, for example, Fibre Channel, Ethernet (registered trademark), or LAN (Local Area Network).

[0053] The host device 101 is a general-purpose computer device that sends read requests or write requests (hereinafter referred to as I / O (Input / Output) requests) to the storage node 103 according to user operations and / or requests from installed applications. In addition, the host device 101 may also be a virtual computer device such as a virtual machine.

[0054] Specifically, for example, the storage node 103 is a physical server device that provides a storage area for reading and writing data to the host device 101. Figure 2 As shown, the system includes a CPU (Central Processing Unit) 1031, a memory 1032, a plurality of storage devices 1033, and a communication device 1034. The CPU 1031 is an example of a processor. The plurality of storage devices 1033 are an example of a storage device. The communication device 1034 is an example of an interface device.

[0055] The CPU 1031 is a device for managing the overall operation control of the storage node 103. In addition, the memory 1032 is composed of a volatile semiconductor memory such as SRAM (Static RAM (Random Access Memory)) or DRAM (Dynamic RAM), and is used to temporarily store various programs and necessary data. The CPU 1031 executes the program stored in the memory 1032 to perform various processes of the storage node 103 as a whole, which will be described later.

[0056] The storage device 1033 is composed of one or more large-capacity non-volatile storage devices such as an SSD (Solid State Drive), a SAS (Serial Attached SCSI (Small Computer System Interface)) hard disk drive, or a SATA (Serial ATA (Advanced Technology Attachment)) hard disk drive, and is configured according to the data from the host device 101 ( Figure 1 )'s write / read request (hereinafter referred to as I / O (Input / Output) request) provides a physical storage area for reading / writing data.

[0057] The communication device 1034 is used for storing the node 103 via the network 102 ( Figure 1 ) is an interface for communicating with the host device 101, other storage nodes 103 or management nodes 104, for example, it is composed of a NIC (Network Interface Card) or an FC (Fibre Channel) card. The communication device 1034 performs protocol control when communicating with the host device 101, other storage nodes 103 or management nodes 104.

[0058] The management node 104 is a computer device used by the system administrator to manage the entire information processing system. The management node 104 can also manage multiple storage nodes 103 as a group called a "cluster". Figure 1 In the figure, an example of only one cluster is shown, but multiple clusters may be set up in the information processing system. In addition, the management node 104 may also include, for example, an interface device, a storage device, a memory, and a processor connected to them. The storage device or the memory may also store information such as the structure information 51 and a program for implementing the configuration control unit 53. The structure information 5 may also include, for example, an identification number of each node and an identification number of each redundant group described later. The configuration control unit 53 may also be implemented by executing a program by a processor. The configuration control unit 53 may also determine which storage control unit is to be configured on which storage node 103 based on the structure information 51, and configure the storage control unit on the storage node 103 determined as the configuration destination. Instead of the configuration control unit 53 automatically configuring the storage control unit based on the structure information 51, the configuration control unit 53 may configure the storage control unit in response to an operation from a user (such as an administrator).

[0059] Figure 3 An example of the logical structure of the storage node 103 is shown.

[0060] If the Figure 3As shown, each storage node 103 includes a front-end driver 1081 and a back-end driver 1087 , one or more storage control units 1083 , and a capacity control unit 1086 .

[0061] The front-end driver 1081 is a device that controls the communication device 1034 ( Figure 2 ), and provides the storage control unit 1083 with an abstract interface for communicating with the host device 101, other storage nodes 103, or the management node 104 to the CPU 1031 ( Figure 2 In addition, the back-end driver 1087 is a software that has the function of controlling each storage device 1033 ( Figure 2 ) and provides an abstract interface for communicating with these storage devices 1033 to the functional software of CPU1031.

[0062] The storage control unit 1083 is software used as a controller of SDS (Software Defined Storage) and is an example of a storage control program. The storage control unit 1083 receives an I / O request from the host device 101 and issues an I / O command corresponding to the I / O request to the capacity control unit 1086 .

[0063] In the present embodiment, each storage control unit 1083 installed in a storage node 103 is managed to form a redundant group with two or more other storage control units 1083 arranged in two or more other storage nodes 103. Hereinafter, this group is referred to as a "redundant group".

[0064] also, Figure 3 , a case where three storage control units 1083 constitute one redundant group is shown. The following describes a case where three storage control units 1083 (ie, triplicated storage control units 1083) constitute a redundant group.

[0065] In the redundant group, one storage control unit 1083 is set to a state in which it can receive I / O requests from the host device 101 (the state of the current system, hereinafter referred to as the activation mode), and the remaining storage control units 1083 are respectively set to a state in which they do not receive read requests and write requests from the host device 101 (the state of the standby system, hereinafter referred to as the standby mode).

[0066] Furthermore, in the redundant group, when a storage control unit 1083 set to active mode (hereinafter referred to as active storage control unit 1083) or a storage node 103 equipped with the active storage control unit 1083 fails, the state of the storage control unit 1083 set to standby mode (hereinafter referred to as standby storage control unit 1083) is switched to active mode. In the redundant group including the active storage control unit 1083, failover is performed from the active storage control unit 1083 to the standby storage control unit 1083. Thus, when the active storage control unit 1083 fails to operate, the I / O processing executed by the active storage control unit 1083 can be taken over by the standby storage control unit 1083.

[0067] The capacity control unit 1086 is software that has the function of allocating the physical storage area provided by the storage device 1033 in this storage node 103 or in other storage nodes 103 to each redundant group, and reading / writing specified data to the corresponding storage device 1033 according to the above-mentioned I / O command assigned from the storage control unit 1083.

[0068] In this case, when allocating the physical storage area provided by the storage device 1033 in the other storage node 103 to the redundant group, the capacity control unit 1086 cooperates with the capacity control unit 1086 installed in the other storage node 103, and exchanges data with the capacity control unit 1086 via the network 102, thereby reading / writing the data to the storage area according to the I / O command assigned from the activation storage control unit 1083 of the redundant group.

[0069] In the information processing system having the above structure, Figure 4 As shown, the capacity control unit 1086 divides the physical storage area provided by each storage device 1033 in each storage node 103 into physical storage areas of a predetermined size (hereinafter referred to as physical blocks) for management.

[0070] Furthermore, the capacity control unit 1086 associates dedicated pools with each redundant group, appropriately allocates logical storage areas (hereinafter referred to as logical blocks) of the same size as physical blocks to these pools, and associates one or more physical blocks with the logical blocks.

[0071] Furthermore, one or more virtual logical volumes (hereinafter referred to as virtual volumes) are defined on the pool of each redundant group, and these virtual volumes are provided to the host device 101 .

[0072] Moreover, when writing data to the virtual volume, the host device 101 sends a write request that specifies the identifier (LUN (Logical Number Unit)) of the virtual volume that is the write destination of the data (hereinafter referred to as the write-target virtual volume) and the area in the write-target virtual volume that is the write destination of the data (hereinafter referred to as the write-destination area) to any storage node 103 in the corresponding cluster.

[0073] The front-end driver 1081 of the storage node 103 that receives the write request sends a write request to the active storage control unit 1083 ( Figure 3 ) or the front-end driver 1081 of each storage node 103 of the standby storage control unit 1083 transmits the write request and the data of the write object sent from the host device 101 together with the write request (hereinafter referred to as write data).

[0074] Furthermore, the front-end driver 1081 of the storage node 103 that has received the write request and write data transfers the write request and write data to the storage control unit 1083 of the corresponding redundant group via the write target virtual volume and pool specified in the write request.

[0075] The active storage control unit 1083 of the storage control unit 1083 that has received the write request and write data allocates a storage area (hereinafter referred to as a logical area) from the logical blocks constituting the pool corresponding to the write target virtual volume to the write destination area within the write target virtual volume as needed.

[0076] In addition, the activated storage control unit 1083 generates an I / O command that converts the address of the write destination area within the write object virtual volume specified in the write request into the block number of the logical block to which the logical area is assigned to the write destination area and the offset position of the logical area, and sends the generated I / O command together with the write data to the capacity control unit 1086 within the current storage node 103.

[0077] Furthermore, upon receiving an I / O command and write data, the capacity control unit 1086 stores the data in storage areas at corresponding offset positions within each storage device 1033 that provide each physical block corresponding to the logical block specified by the I / O command.

[0078] Thus, in the present information processing system, data from the host device 101 is redundantly stored in a plurality of physical blocks corresponding to corresponding logical blocks. Therefore, the number of physical blocks allocated to a logical block is determined according to the setting contents of the redundancy method in the information processing system.

[0079] For example, in a setting where data is multiplexed into three or more layers and stored, or in a setting where redundant data is created from data and stored as in Erasure-Coding, a necessary number of three or more physical blocks are associated with one logical block.

[0080] In addition, when multiple physical blocks correspond to one logical block and data is multi-stored in these multiple physical blocks, one physical block is set as "master" from the multiple physical blocks, and the remaining physical blocks are all set as "slave". Then, as described later, data reading from the physical block is performed from the physical block set as "master". In addition, in the case of EC (Erasure Coding), multiple physical blocks correspond to one logical block, and primary data and redundant data are stored in a predetermined pattern in these multiple physical blocks.

[0081] On the other hand, when reading data from a virtual volume, the host device 101 sends a read request specifying the LUN of the virtual volume (hereinafter referred to as the read-target virtual volume) and the storage area of ​​the read destination of the data in the read-target virtual volume (hereinafter referred to as the read-destination area) to any storage node 103 in the cluster including the read-destination virtual volume.

[0082] The front-end driver 1081 of the storage node 103 that receives the read request transmits the read request to each storage node 103 of the active storage control unit 1083 or the standby storage control unit 1083 configured with the corresponding redundant group via the read target virtual volume and pool specified in the received read request.

[0083] Furthermore, the front-end driver 1081 of the storage node 103 that has received the read request transfers the read request to the storage control unit 1083 of the corresponding redundant group via the read target virtual volume and pool specified in the read request.

[0084] In this way, the activated storage control unit 1083 in the storage control unit 1083 that has handed over the read request generates an I / O command that converts the address of the read destination area within the read object virtual volume into the block number of the logical block to which the logical area is assigned to the read destination area and the offset position of the logical area, and sends the generated I / O command to the capacity control unit 1086 in the current storage node 103.

[0085] When receiving an I / O command, the capacity control unit 1086 reads data from a storage area at an offset position specified by the I / O command in a physical block set as "primary" among each physical block corresponding to the logical block specified by the I / O command, and transmits the read data as read data to the active storage control unit 1083, which is the source of the I / O command. In this way, the read data is then transmitted to the host device 101, which is the source of the read request, via the network 102 by the active storage control unit 1083.

[0086] (1-2) Allocation of physical blocks to logical blocks

[0087] However, as described above, when a redundant method is adopted in which a plurality of physical blocks are associated with one logical block and data is made redundant by storing data in each of these physical blocks, from the viewpoint of data protection, it is desirable to select a plurality of physical blocks corresponding to one logical block from physical blocks provided by different storage nodes 103. This is because, for example, when a plurality of physical blocks in the same storage node 103 are associated with one logical block, data loss may occur when the storage node 103 cannot read data due to a failure or the like.

[0088] Therefore, in the present information processing system, the capacity control unit 1086 allocates a logical block to a redundant group, and when making a plurality of physical blocks correspond to the logical block, the capacity control unit 1086 selects these plurality of physical blocks from the physical blocks provided by a plurality of different storage nodes 103 .

[0089] On the other hand, when a physical block corresponding to a logical block is selected from a physical block in a storage node 103 different from a storage node 103 configured with an activated storage control unit 1083, when the capacity control unit 1086 (the capacity control unit 1086 in the same storage node 103 as the activated storage control unit 1083) receives an I / O command from the activated storage control unit 1083 and reads / writes data to the physical block, it is necessary to communicate with the storage node 103 that provides the physical block, and accordingly there is a problem that the response performance of the system as a whole deteriorates. Therefore, when a plurality of physical blocks are associated with a logical block, it is also desirable to select one of the physical blocks from the physical blocks provided by the storage device 1033 in the storage node 103 configured with the activated storage control unit 1083 from the viewpoint of the response performance of the system as a whole.

[0090] In addition, in the event that a failure occurs in a storage node 103 in the redundant group that is equipped with an activated storage control unit 1083, if it is considered that the standby storage control unit 1083 is switched to an activated mode, then based on the same reasons as above, from the perspective of the overall responsiveness of the system, one of the physical blocks corresponding to the logical block is also selected from the physical blocks provided by the storage device 1033 in the storage node 103 that is equipped with the standby storage control unit 1083.

[0091] Therefore, in the information processing system, the capacity control unit 1086 is equipped with a capacity priority allocation function. When the capacity control unit 1086 allocates a logical block to a redundant group and corresponds multiple physical blocks to the logical block, the physical block provided by the storage device 1033 in the storage node 103 of the activated storage control unit 1083 configured with the redundant group and the physical block provided by the storage device 1033 in the storage node 103 of the standby storage control unit 1083 configured with the redundant group are preferentially corresponded to the logical block.

[0092] However, there is the following problem: when the storage node 103 configured with the activated storage control unit 1083 or the standby storage control unit 1083 constituting the redundant group is unrestrictedly matched to the physical block for the logical block in the pool allocated to a redundant group, the storage device 1033 in the storage node 103 cannot be matched to the physical block for the logical block of the other redundant group configured with the activated storage control unit 1083 or the standby storage control unit 1083 in the storage node 103.

[0093] Therefore, the capacity priority allocation function also includes a function of suppressing the capacity of physical blocks allocated to the redundant group from the storage node 103 of the active storage control unit 1083 configured with the redundant group and the storage node 103 of the standby storage control unit 1083 configured with the redundant group.

[0094] Next, the configuration method of the storage control unit 1083 and the failover destination standby selection method in this embodiment are described.

[0095] Thereafter, the storage control unit is represented as "SC", the SC belonging to the redundant group α (for example, α=X, Y, ...) is represented as "SC-α" (α is the mark or number of any redundant group), the activated SC is represented as "SC(A)", the standby SC is represented as "SC(S)", and the SC(S) operating in the standby (i) mode is represented as "SC(Si)". In each redundant group, "i" is the number assigned to the SC(S) (hereinafter referred to as the standby number), which is equivalent to the priority of becoming the failover destination. In the present embodiment, since there are two SC(S), there are SC(S1) and SC(S2) for each redundant group. For each redundant group, when SC(S1) and SC(S2) exist in two normal storage nodes, SC(S1) is the first priority SC(S), that is, the failover destination SC(S). For each redundant group, when no failure occurs in the storage node where SC(S2) exists, but a failure occurs in the storage node where SC(S1) exists (that is, when SC(S1) does not become the failover destination), SC(S2) becomes the first priority SC(S). In this way, for each redundant group, the standby number of SC(S) is equivalent to an example of the priority order of the SC(S) to become the failover destination.

[0096] Figure 5 It shows the SC configuration method in this embodiment.

[0097] According to the configuration method in this embodiment, when SC-X(A) and SC-Y(S1) are configured in the storage node P, SC-Y(S2) is configured in the storage node 130 other than the storage node Q configured with SC-X(S1).

[0098] In addition, according to the failover destination standby selection method of this embodiment, in each redundant group, the SC(S) with the smallest standby number among the operating SC(S) (i.e., the SC(S) existing in the normal storage node) is selected as the failover destination.

[0099] By adopting such a configuration method and failover destination standby selection method, no matter in what order failures occur on two storage nodes 130, SC (A) can be maintained in an inoperable state on more than three identical storage nodes 130 without the transfer of previous and / or subsequent SCs.

[0100] Figure 6An example of SC configuration is shown. In the following description, mod is a symbol for obtaining the remainder of division. In addition, on the storage node 130, a node number h (h is an integer and is a consecutive number (0, 1, ...) is assigned as an identification number. In addition, in the redundant group, a group number n (n is an integer and is a consecutive number (0, 1, ...) is assigned as an identification number. The structural information 51 includes information indicating the number of storage nodes (or the node number h of each storage node), the number of redundant groups (or the group number n of each redundant group), and the number of SC (S) of each redundant group (in this embodiment, the number of SC (S) is 2).

[0101] The configuration control unit 53 configures SC-n(A) on the storage node with node number n (h=n) based on the structure information 51. Next, the configuration control unit 53 configures SC-n(S1) on the storage node with node number ((n+1) mod 4) and SC-n(S2) on the storage node with node number ((n-1) mod 4) based on the structure information 51. In this way, Figure 6 SC configuration as an example in . In this paragraph, the "4" in "mod 4" is an example of the number of storage nodes.

[0102] Figure 7 to Figure 10 express Figure 6 The pattern of two node failures in the configuration example shown shows that even if two node failures occur in any order, three or more SCs (A) can be maintained in an inoperative state on one storage node without the transfer of the preceding or succeeding SCs.

[0103] Figure 7 Indicates the case where the first storage node to fail is storage node 1. Due to the failure of storage node 1, SC-1(A) causes the SC-1(S1) with the smaller standby number assigned to it among the remaining two SC-1(S1) and SC-1(S2) to fail over from SC-1(A) (the process of changing the state of SC(Si) from standby mode to active mode and handing over SC(A) belonging to the same redundancy group is expressed as "failover to SC(Si)"). At this moment, on storage node 2, SC2(A) that was originally operating and SC-1(A) that has switched modes again operate.

[0104] Figure 8 to Figure 10 Indicates the case where the second storage node that failed is storage node 0, 2, or 3. In either case, failover is performed on the SC(S) with the smallest standby number among the SC(S) in operation, but the maximum number of SC(A)s operating on each storage node is 2. In this paragraph, the "2" in "maximum 2" is an example of the upper limit of the SC(A) allowed to exist in one storage node.

[0105] Fig.11 A comparative example of this embodiment is shown.

[0106] In this comparative example, SC-n(A) is configured at storage node n (h=n), and SC-n(S1) is configured at storage node with node number ((n+1) mod 4). Figure 6 The examples shown are the same.

[0107] However, SC-n(S2) is configured on a storage node with a node number ((n+2) mod 4). That is, in this comparative example, SC-0(A) and SC-3(S1) are configured on the same storage node 0, and SC-0(S1) and SC-3(S2) are configured on the same storage node 1. On the other hand, there are multiple SC pairs in which the node pairs of the storage node that becomes the starting point of the failover and the storage node that becomes the destination of the failover are the same, and the redundancy groups are different. An "SC pair" is a pair of the SC at the starting point of the failover and the SC at the destination of the failover, specifically, a pair of SC(A) and SC(S1) and a pair of SC(Si) and SC(S(i+1). According to Fig.12 For example, the pair of SC-1(A) and SC-1(S1) in redundancy group 1 and the pair of SC-0(S1) and SC-0(S2) in redundancy group 0 are SC pairs with different redundancy groups and the same node pairs (both storage node 1 is the failover starting point and storage node 2 is the failover destination).

[0108] Therefore, in this comparative example, when the second storage node fails, three SC (A) operations occur on the same storage node. Figure 12-13 An example of this situation is shown. That is, if storage node 1 first becomes faulty ( Fig.12 ), then storage node 0 becomes faulty ( Fig.13 ), SC(A) has three actions on storage node 2. Specifically, in the case of a failure in storage node 1, by performing a failover from SC-1(A) to SC-1(S1), on storage node 2, SC-1(S1) becomes SC-1(A), and as a result, there are two SC(A)s on storage node 2. Thereafter, in the case of a failure in storage node 0, since SC-0(S1) exists on the failed node 1, a failover from SC-0(A) to SC-0(S2) is performed, and on storage node 2, SC-0(S2) becomes SC-0(A), and as a result, there are three SC(A)s on storage node 2. Therefore, if SC(A) is not transferred after the failure of the first storage node 1 or after the failure of the second storage node 0, the problem of three SC(A)s acting on one storage node 2 cannot be avoided (i.e., the resource consumption such as the amount of storage is large and overloaded).

[0109] On the other hand, refer to Figure 6 to Figure 10 The SC configuration method of the present embodiment described above is effective when the number of storage nodes is 4 or more. Fig.14 This shows an example of SC configuration when the number of nodes is 6. In this example, SC-n(A) is first configured on storage node n (h=n). In addition, SC-n(S1) is configured on the storage node with node number ((n+1) mod 6), and SC-n(S2) is configured on the storage node with node number ((n-1) mod 6).

[0110] On the other hand, the SCs of the multiple SCs configured on the node can be transferred and configured on other nodes. For example, in multiple SC pairs where the redundancy groups are different and the nodes where the SCs of the failover origin are configured are the same, the nodes where the SCs of the failover destination are configured are different. Figure 6 to Figure 10 For example, for the pair of SC-1(A) and SC-1(S1) and the pair of SC-0(S1) and SC-0(S2), the SCs at the failover origin are both configured on storage node 1, but the SCs at the failover destination are configured on storage nodes 2 and 3, respectively. Figure 6 to Figure 10 and Fig.14 The SC configuration example shown is as follows. In the following, C is the number of storage nodes.

[0111] SC-n(A) is configured on storage node n (h=n).

[0112] SC-n(S1) is arranged on the storage node with the node number ((n+X1) mod C), and SC-n(S2) is arranged on the storage node with the node number ((n+X2) mod C). In the above example, X1=1, X2=-1.

[0113] The example of the SC configuration method of this embodiment is not limited to the above example. For example, Fig.15 For example, X1=1 and X2=3, Fig.16 This shows an example where X1=2 and X2=1. When the number of storage nodes C=4 or more, the reference Figure 5 Configuration conditions for the description.

[0114] Reference Figure 5An example of the effect of the SC configuration method of the present embodiment is described. First, when the first node failure occurs at node P, a failover is performed from the SC-X(A) existing on node P to the SC-X(S1) existing on node Q. Therefore, there are two SC(A)s on node Q. In this state, failover to the SC(S) existing on both node P and node Q cannot be performed in all nodes of the present information processing system. This is because, when node P fails, the number of SC(A)s existing on node Q reaches the upper limit (allowable number) "2" (in this example, the upper limit of the number of SC(A)s is "(K-1)" (K is the number of SCs configured on one storage node). Failover to the SC(S) of nodes other than nodes P and Q can be performed. Therefore, for each redundant group, there can be only one SC(S) on the storage nodes other than storage nodes P and Q.

[0115] According to the SC configuration method of the present embodiment, in each redundant group, namely, redundant group Y, other than redundant group X of SC(A) existing on the storage node P where the first node failure has occurred, SC-Y(S) is configured on storage nodes other than storage nodes P and Q, thereby maintaining a failover-capable state in the SC-Y standby remaining after the first node failure.

[0116] (2) Second Embodiment

[0117] Here, the second embodiment will be described. At this time, the differences from the first embodiment will be mainly described, and the description of the common points with the first embodiment will be omitted or simplified.

[0118] In this embodiment, each redundant group is composed of quadrupled SCs. That is, in this embodiment, a redundant group is composed of one SC (A) and three SCs (S).

[0119] Fig.17 FIG. 2 shows an example of a logical structure of a storage node 103 according to the second embodiment. Figure 3 The difference is that each SC is a redundant group consisting of four SCs. There are four SCs in each node.

[0120] Here, the concept of the next "influencing node" is defined for each SC. Hereinafter, N is the number of SCs (S). In this embodiment, N=3. In addition, hereafter, m is the standby number. α or β=X, Y, Z, ...

[0121] The storage node configured with SC-α(A) is the 0th influenced node (0th-order influenced node) of SC-α.

[0122] The storage node configured with SC-α (Sm) is the mth influencing node of SC-α.

[0123] ·When the storage node P is the mth influencing node of SC-α (where m<N), the storage node SC-β(Sk) (where 1≤k≤(Nm)) in which SC(A) is configured on the storage node P is the (m+k)th influencing node of SC-α.

[0124] In the SC configuration method of this embodiment, for each redundancy group, k SC-α(S) in the redundancy group α configures a maximum of k standby nodes in the kth and lower influential nodes of all redundancy groups β related to the redundancy group α.

[0125] Fig.18 The concept of the influencing node and an example of the SC configuration method in this embodiment are shown.

[0126] There are four influencing nodes of SC-X. That is, node P configured with SC-X(A) is the 0th influencing node of SC-X. Node Q configured with SC-X(S1) is the first influencing node of SC-X. Node R of SC-Y(S) (SC-Y(S1) as an example) configured with redundant group Y (the redundant group of SC(A) configured on the first influencing node Q of SC-X) is the second influencing node of SC-X. Node S configured with SC-X(S2) is also the second influencing node of SC-X. According to the SC configuration method of this embodiment, all SC-Zs are configured with SC-Z(S) greater than 0 and less than 2 on the above four influencing nodes P, Q, R and S of SC-X.

[0127] An example of the effect of this embodiment. The first affected node of SC-X is a node that SC(A) may become two or more if the 0th affected node of SC-X (i.e., the node configured with SC-X(A)) fails. The second affected node of SC-X is a node that SC(A) may become two or more if the first affected node of SC-X fails. Generally speaking, the kth affected node of SC-X is a node that SC(A) may become two or more due to the failure of the (k-1)th affected node of SC-X.

[0128] Next, the concept of a fault root node is defined. If the storage node where the node failure occurs is the first one, the fault node is set as the first fault root node. In the case where the storage node P where the node failure occurs is an impact node within the kth of the existing kth fault root node Q, instead of making node P a fault root node, the ranking number (number of times) of the kth fault root node Q is increased to become the (k+1)th fault root node. In the event of a node failure, if the node is not an impact node of any fault root node, the node is set as the first fault root node.

[0129] Each fault root node and the affected nodes within s when the ranking number (number of times) of the fault root node is s may be a faulty node or a node where two SC(A) exist, and failover may not be possible.

[0130] After the failure of the t-th node in the information processing system, there are multiple fault root nodes in the system, and the total ranking number (number of times) of these fault root nodes is t. Here, for each fault root node, if its ranking number is set to s, the number of SCs (S) configured on the influencing nodes within the s-th node of the fault root node is s for all SCs. Therefore, in the system total, there are t SCs (S). Therefore, for all SCs, the number of SCs (S) configured on the influencing nodes of the fault root node and which may not be able to fail over is t. Therefore, if the number of fault nodes is less than (N-1), it is guaranteed that there are (N-number of fault nodes) SCs (S) that can fail over for each redundant group.

[0131] Figure 19 to Figure 21 This is a specific example of arrangement in this embodiment. As in the first embodiment, when the number of nodes is C, the arrangement destination node number of SC(S) can be expressed as follows, for example.

[0132] The placement destination of SC-n(A) is the storage node with the node number n (h=n).

[0133] The configuration destination of SC-n(Si) is the node number (((n+X i )mod C)'s storage node.

[0134] Fig.19 This is an example of X1=1, X2=3, X3=5. Fig. 20 Indicates a case where node 2 becomes the second fault root node as an example. The SC with a circle represents the SC (A) at the node where the fault occurred or the SC (S) that becomes the failover destination. The SC (S) without a circle configured on the storage node where the SC (S) with a circle exists may become the SC (S) that cannot failover. Taking the redundant group 2 (SC-2) as an example, storage nodes 2, 3, 4 and 5 become the impact nodes for the redundant group 2. Because there is no redundant group with more than three SC (S) configured on the four nodes, the SC configuration condition in this embodiment is met. Fig.19 The configuration method shown can also be generalized to more than five layers by i Set the value of X i =i*2-1, which satisfies the configuration conditions of this embodiment.

[0135] Fig.21 An example in which X1=3, X2=2, and X3=1 is shown. Fig. 22 Indicates the situation where node 2 becomes the second fault root node (the meaning of the SC with a circle is the same as Fig. 20 Taking redundant group 2 (SC-2) as an example, storage nodes 2, 4, 5, and 8 become the influencing nodes for redundant group 2. Since there is no redundant group with more than three SCs (S) configured in the four nodes, the SC configuration condition in this embodiment is met.

[0136] (3) Third Embodiment

[0137] Here, the third embodiment will be described. At this time, the differences from the first and second embodiments will be mainly described, and the description of the common points with the first and second embodiments will be omitted or simplified.

[0138] In the third embodiment, a five-fold redundancy group is used.

[0139] Fig.23 An example of SC configuration of the third embodiment is shown. There are four SC(S), according to Fig.23 For example, X1=4, X2=3, X3=2, X4=1. Fig.24 This is an example of a situation where node 2 becomes the third fault root node. The affected nodes are 7 nodes (nodes 1, 2, 4, 5, 6, 9, and 10). Since there is no redundant group with more than four SCs (S) configured on these 7 nodes, the SC configuration condition in this embodiment is met. Fig.21 and Fig.23 The configuration method shown can be generalized to N layers by i The value of is set to Xi=N-i+1, which meets the configuration conditions of the implementation method.

[0140] As an example of summarizing the above description, the following expression is possible. That is, there are a plurality of storage nodes and storage devices. A plurality of redundant groups composed of SCs that are multiplexed are arranged in the plurality of storage nodes. Each redundant group is as follows.

[0141] The multiplexed SCs that constitute the redundant group and perform storage control, that is, three or more SCs, are arranged on different storage nodes among the plurality of storage nodes.

[0142] One or more SCs among the multiple SCs are SC(A), and the remaining two or more SCs are SC(S) that are failover destinations of SC(A).

[0143] Each of the two or more SCs (S) is associated with a priority order determined as a failover destination of the SC (A).

[0144] When a storage node where SC(A) is arranged fails, failover is performed within the redundant group from SC(A) to SC(S) based on the priority order.

[0145] For multiple SCs including SC (A) and SC (S) activated by failover in multiple redundant groups arranged on the same storage node, each SC is arranged on a node different from the SC (S) that can become the failover destination.

[0146] Some embodiments have been described above, which are examples for illustrating the present invention, and do not limit the scope of the present invention to the contents of these embodiments. For example, other physical resources may be used to replace storage nodes, and other logical resources may be used to replace SCs. For example, data may be redundant on multiple drives, and one of them may be set as accessible activation, and the other may be set as access standby only when the activation fails, forming a redundant group consisting of copies of the same data, namely activation and standby. Alternatively, multiple paths such as network switches or lines may be bundled together for redundancy, activating the path that the communication subject normally accesses, and making the other redundant groups standby.

[0147] Description of Reference Numerals

[0148] 103…Storage node.

Claims

1. A storage system comprising a plurality of storage nodes and a storage device, wherein each of the plurality of storage nodes has a memory and a processor, and the storage system is characterized in that: The plurality of storage nodes include more than four storage nodes, A plurality of redundant groups each consisting of a triple storage control program are configured on the plurality of storage nodes, in, The triple storage control programs constituting the redundant group and each of which is executed by a processor to perform storage control are configured in three different storage nodes among the plurality of storage nodes, and the three storage nodes form different combinations for each redundant group. One of the three storage control programs is an activation program serving as an active storage control program, and the other two storage control programs are standby programs serving as standby storage control programs. The two standby programs are respectively associated with priority orders determined as failover destinations, and include a first standby program that preferentially performs failover and a second standby program that performs failover from the active program and the first standby program. When a storage node where the activation program is configured fails, failover is performed within the redundancy group from the activation program to the standby program with the highest priority. In the case where two of the three storage nodes of the three storage control programs configured with two redundant groups are identical storage nodes, the activation programs of the two redundant groups are respectively configured in each of the two identical storage nodes, or the second standby programs of the two redundant groups are respectively configured in each of the two identical storage nodes, In a case where two storage nodes among three first redundant group storage nodes configured with three storage control programs of a first redundant group and two storage nodes among three second redundant group storage nodes configured with three storage control programs of a second redundant group are the same storage nodes, the activation programs of the two redundant groups are respectively configured in each of the two same storage nodes, or the second standby programs of the two redundant groups are configured in each of the two same storage nodes, One storage node among the three first redundancy group storage nodes and one storage node among the three second redundancy group storage nodes are different storage nodes.

2. The storage system according to claim 1, characterized in that: The priority 1 standby program of the redundant group β is arranged in the 0th influence node of the redundant group α, and the priority 2 standby program of the redundant group β is arranged in any storage node other than the 1st influence node of the redundant group α.

3. The storage system according to claim 1, characterized in that: The number of storage nodes is the same as the number of redundancy groups. An activation program is configured on each storage node.

4. The storage system according to claim 1, characterized in that: Each storage node is assigned a node number h which is a serial number. Each redundant group is assigned a group number n which is a consecutive number. Regarding redundant group n, the active program is configured to the storage node with node number n, where h=n, and the standby program with priority order m is configured to the storage node with node number ((n+X m )mod C), where C is the number of storage nodes.

5. A storage system construction method, characterized in that: The computer refers to structure information indicating a structure about a plurality of storage nodes, wherein the plurality of storage nodes includes more than four storage nodes, Based on the configuration information, the computer configures a plurality of redundant groups, each consisting of a triple storage control program, to the plurality of storage nodes. The triple storage control programs constituting the redundant group and each of which is executed by a processor to perform storage control are configured in three different storage nodes among the plurality of storage nodes, and the three storage nodes form different combinations for each redundant group. One of the three storage control programs is an activation program serving as an active storage control program, and the other two storage control programs are standby programs serving as standby storage control programs. The two standby programs are respectively associated with priority orders determined as failover destinations, and include a first standby program that preferentially performs failover and a second standby program that performs failover from the active program and the first standby program. When a storage node where the activation program is configured fails, failover is performed within the redundancy group from the activation program to the standby program with the highest priority. In the case where two of the three storage nodes of the three storage control programs configured with two redundant groups are identical storage nodes, the activation programs of the two redundant groups are respectively configured in each of the two identical storage nodes, or the second standby programs of the two redundant groups are respectively configured in each of the two identical storage nodes, In a case where two storage nodes among three first redundant group storage nodes configured with three storage control programs of a first redundant group and two storage nodes among three second redundant group storage nodes configured with three storage control programs of a second redundant group are the same storage nodes, the activation programs of the two redundant groups are respectively configured in each of the two same storage nodes, or the second standby programs of the two redundant groups are configured in each of the two same storage nodes, One storage node among the three first redundancy group storage nodes and one storage node among the three second redundancy group storage nodes are different storage nodes.

Images