Storage management system and management method

Abstract

The present invention provides a storage management system and a management method, which can appropriately perform data protection based on the specified data protection requirements. The storage management system includes a processor, which manages multiple storage devices, wherein the storage devices include multiple categories of components, and the multiple components are combined to perform redundancy of the data to be stored. The storage management system has component management information indicating the redundancy set for the components themselves, and the processor sets the data protection method of the storage device based on the component management information and the data protection requirements for the data to be stored in the storage device.

Description

Technical Field

[0001] The invention relates to a storage management system and a management method. Background Art

[0002] There is a hyper-converged infrastructure (HCI) that consists of multiple physical computers and runs two services, computing services and storage services, on each physical computer. In the HCI structure, container computing services can be run as containers on a container platform running on a physical computer or as virtual computers on a hypervisor running on a physical computer. Here, containers and virtual computers that perform computing services are referred to as application instances.

[0003] In the HCI structure, the storage service may be run as a process on a host OS or a virtual machine manager running in a physical computer, as a container on a container platform running in a physical computer, or as a virtual computer on a virtual machine manager running in a physical computer. Here, the process, container, or virtual computer that performs the storage service is referred to as a storage service instance. The storage service instance provides a volume to an application instance. As a data protection method in a storage service, for example, the method described in Patent Document 1 is known.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: U.S. Patent Application Publication No. 2020 / 0073552 Summary of the invention

[0007] Technical problem to be solved by the invention

[0008] The invention described in Patent Document 1 may over-protect data.

[0009] Technical means of solving problems

[0010] A storage management system according to a first aspect of the present invention includes a processor for managing a plurality of storage devices, wherein the storage devices include a plurality of categories of components, and a plurality of the components are combined to make data to be stored redundant. The storage management system has component management information indicating the redundancy set for the components themselves, and the processor sets a method for data protection of the storage devices based on the component management information and a requirement for data protection of the data to be stored in the storage devices.

[0011] The management method of the second aspect of the present invention is executed by a storage management system including a processor for managing multiple storage devices, wherein the storage device includes multiple categories of components, and the multiple components are combined to make the data to be saved redundant, and the processor has component management information indicating the redundancy set for the component itself, and sets the data protection method of the storage device based on the component management information and the data protection requirements for the data to be saved in the storage device.

[0012] Effects of the Invention

[0013] According to the present invention, data protection can be appropriately performed based on the specified data protection requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a structural diagram of a computer system.

[0015] Figure 2 This is a structural diagram of a separated computer cluster.

[0016] Figure 3 This is a hardware structure diagram of the cluster management computers and nodes.

[0017] Figure 4 A graph representing information stored in a node's memory.

[0018] Figure 5 This is a diagram showing information stored in the memory of the cluster management computer.

[0019] Figure 6 This is a diagram showing an example of a node management table.

[0020] Figure 7 This is a diagram showing an example of a backend device management table.

[0021] Figure 8 This is a diagram showing an example of an out-cluster data protection location management table.

[0022] Fig. 9 This is a diagram showing an example of a storage level management table.

[0023] Fig.10This is a diagram showing an example of a redundant relationship table.

[0024] Fig.11 This is a diagram showing an example of a volume management table.

[0025] Fig.12 This is a flowchart showing the storage level setting process executed by the storage level setting program.

[0026] Fig.13 Yes means Fig.12 Flowchart of the processing of step S1230 in .

[0027] Fig.14 : is a flowchart showing the operation rate calculation process.

[0028] Fig.15 This is a flowchart showing the volume creation process executed by the volume creation program.

[0029] Fig.16 This is a flowchart showing the data redundancy maintenance and recovery process executed by the data redundancy maintenance and recovery program.

[0030] Fig.17 This is a flowchart showing the redundancy processing executed by the redundancy processing program.

[0031] Fig.18 : is a flowchart showing the storage level setting process in the first modification. DETAILED DESCRIPTION

[0032] The embodiments are described with reference to the accompanying drawings. The embodiments described below do not limit the technical solutions claimed in the present application, and the elements and their combinations described in the embodiments are not all essential to the solution means of the invention.

[0033] In the following description, sometimes the information is described using the expression "AAA table", but the information can be expressed in any data structure. That is, in order to indicate that the information does not depend on the data structure, the "AAA table" can be referred to as "AAA information". In the following description, the "processor unit" includes one or more processors. At least one processor is typically a CPU (Central Processing Unit). The processor may also include a hardware circuit that performs part or all of the processing.

[0034] In the following description, sometimes the processing is described with "program" as the main body of the action, but since the program is executed by a processor (such as a CPU) to appropriately use storage resources (such as memory) and / or communication interface devices (such as ports) to perform specified processing, the main body of the processing can also be the processor. The processing described with the program as the main body of the action can also be changed to processing performed by a device including a processor. In addition, hardware circuits can also be included to perform part or all of the processing performed by the processor. The computer program can be installed in the device from the program source. The program source can be, for example, a program distribution server or a computer-readable storage medium.

[0035] In the following description, a "container" is sometimes described as a management object, but a "virtual computer (VM)" that simulates the virtualization of the hardware of a physical computer or the physical computer itself, i.e., a "bare metal" may be used as a management object instead of a container.

[0036] - First Embodiment -

[0037] Refer to the following Figure 1 to Figure 17 A first embodiment of the computer system will be described.

[0038] Figure 1 1 is a structural diagram of a computer system 100. The computer system 100 includes a first private cloud 102-1, a second private cloud 102-2, a first public cloud 103-1, and a second public cloud 103-2. The first public cloud 103-1 includes a first site 104-1 and a second site 104-2. The first site 104-1 includes a first availability zone 105-1 and a second availability zone 105-2. Figure 1 For the sake of convenience in illustration, the records of some sites and availability zones (hereinafter also referred to as "AZ") are omitted.

[0039] The first private cloud 102-1 includes a separate first computer cluster 111-1 and a first storage system 120-1. The second private cloud 102-2 includes an integrated first computer cluster 112-1. The first availability zone 105-1 in the first public cloud 103-1 includes a separate second computer cluster 111-2 and a second storage system 120-2. The second availability zone 105-2 in the first public cloud 103-1 includes an integrated second computer cluster 112-2. The second site 104-2 in the first public cloud 103-1 includes an integrated third computer cluster 112-3. The second public cloud 103-2 includes an integrated fourth computer cluster 112-4.

[0040] Hereinafter, the separate first computer cluster 111-1 and the separate second computer cluster 111-2 are collectively referred to as separate computer clusters 111. The first storage system 120-1 and the second storage system 120-2 are collectively referred to as storage systems 120. The integrated first computer cluster 112-1, the integrated second computer cluster 112-2, the integrated third computer cluster 112-3, and the integrated fourth computer cluster 112-4 are collectively referred to as integrated computer clusters 112.

[0041] Figure 2 1 is a block diagram of a separate computer cluster 111. The separate computer cluster 111 includes one or more nodes 201, a network switch 202, a cluster management computer 203, and a management terminal 204. Each node 201 includes one or more application containers 210, a storage service container 211, and a container management platform 212.

[0042] Figure 2 The example in which the cluster management computer 203 and the node 201 are configured separately is shown, but the cluster management computer 203 and the node 201 may be configured using a bare metal, that is, a physical computer. In addition, the node 201 and the cluster management computer 203 may be in the form of a virtual computer or a container configured using container virtualization technology. In addition, the cluster management computer 203 does not necessarily have to be an independent device, and its function may be included in one of the nodes 201.

[0043] The storage service container 211 is an example of a storage service instance that provides a volume service to the application container 210 . Figure 2 The storage service container 211 is composed of a single container running on a container platform that can simulate an independent OS space, but it can also be in the form of a virtual computer running on a virtual machine manager that simulates the hardware of a physical computer, or a storage service running on a virtual machine manager or host OS of a bare metal. In addition, the storage service can also be provided by multiple containers or multiple virtual computers.

[0044] The application container 210 is a container for users of the hyper-converged infrastructure and is an example of an application service instance. The application container 210 can be in the form of a virtual computer or an application running on a bare metal virtual machine manager or host OS. The container management platform 212 manages the application container 210 and the storage service container 211. Depending on the operation mode of the storage service and the application, the container management platform 212 can be in the form of a virtual computer management platform or a bare metal management platform.

[0045] The data protection process in the computer system 100 starts when the user inputs the storage level conditions using the management terminal 204. The storage level conditions are the requirements for data protection of the data to be stored in the storage device (storage). The data protection requirements include the combination of fault type and redundancy, the probability of availability, and the cost. However, each data protection requirement only needs to include at least one of these three items. In addition, hereinafter, the combination of fault type and redundancy is sometimes referred to as the "perspective of each component", and the probability of availability is referred to as the "perspective of the entire system".

[0046] When the user inputs a condition, the computer system 100 calculates a candidate data protection location that meets the condition (i.e., data is written to the location to be redundant to implement data protection) and stores it together with the storage class management number. Next, when the user specifies the storage class management number and the required volume size, the computer system 100 generates a volume. The generated volume stores the data specified by the user and the data generated by the application container 210 specified by the user.

[0047] Figure 3 This is a hardware diagram of the cluster management computer 203 and the node 201. Figure 3 The configuration of the node 201 will be described, but within the scope of the following description, the hardware configuration of the cluster management computer 203 is also the same.

[0048] Node 201 is composed of a computer such as a PC or a server, and includes a CPU (Central Processing Unit) 301 as an example of a processor unit, a memory 302, an HBA (Host Bus Adapter) 303, a NIC (Network Interface Card) 304, a USB (Universal Serial Bus) 305, a VGA (Video Graphic Array) 306, and a storage device. These components are connected via an internal bus and / or an external bus. As a storage device, for example, there are NVMe (Non-Volatile Memory Express) drivers 310, SAS (Serial Attached SCSI) drivers 311, SATA (Serial ATA) drivers 312, etc.

[0049] The node 201 and the storage system 120 are connected via the NIC 304 and the HBA 303. Storage devices such as the NVMe drive 310 may be connected to the CPU 301 and the like via a RAID card (not shown).

[0050] Figure 4The diagram shows information stored in the memory 302 of the node 201. The memory 302 of the node 201 includes a container management platform memory area 410, a storage service container memory area 420, and an application container memory area 430. The storage service container memory area 420 stores a volume management table 421, a storage service processing program 422, a redundancy processing program 423, and a redundancy recovery processing program 424. The application container memory area 430 stores one or more application programs 431.

[0051] The volume management table 421 stores information about the data protection location of each volume. The storage service processing program 422 is a program that performs known processing for realizing the service of the hyper-converged infrastructure. The storage service processing program 422 outputs an action instruction to the redundancy processing program 423 as needed. The redundancy processing program 423 is a program that performs redundancy processing. For the actions of the redundancy processing program 423, refer to Fig.17 The redundancy recovery processing program 424 is called by the data redundancy maintenance recovery program 512 to write data to a designated data protection location in order to restore redundancy.

[0052] Figure 5 This diagram shows information stored in the memory 302 of the cluster management computer 203. The memory 302 of the cluster management computer 203 stores a node management table 501, a backend device management table 502, an out-of-cluster data protection location management table 503, a storage level management table 504, a redundancy relationship table 505, a storage level setting program 510, a volume creation program 511, and a data redundancy maintenance and recovery program 512.

[0053] The node management table 501 contains information about each node in a specific cluster. However, instead of storing the node management table 501 in the cluster management computer 203, information equivalent to the node management table 501 may be stored in each corresponding node. The backend device management table 502 contains information related to all machines included in a specific cluster. However, instead of storing the backend device management table 502 in the cluster management computer 203, information equivalent to the backend device management table 502 may be stored in each corresponding node. In addition, the backend device management table 502 is also referred to as "component management information" hereinafter.

[0054] The information of data storage areas in other clusters is stored in the out-of-cluster data protection location management table 503. A list of data protection location candidates for each data protection condition requested by the user is stored in the storage level management table 504. In order to ensure redundancy, the redundancy relationship table 505 shows components that can ensure the same redundancy in addition to the specified components.

[0055] The storage level setting program 510 starts operation by receiving storage level conditions from the management terminal 204, and records the candidates satisfying the specified conditions in the storage level management table 504. For the operation of the storage level setting program 510, refer to Fig.12 The volume generation program 511 generates a volume that satisfies the volume conditions specified by the management terminal 204. For the operation of the volume generation program 511, refer to Fig.15 The data redundancy maintenance and recovery program 512 detects a failure and performs data redundancy maintenance and recovery. For the operation of the data redundancy maintenance and recovery program 512, refer to Fig.16 Describe in detail.

[0056] Figure 6 It is a diagram showing an example of a node management table 501. The node management table 501 is composed of multiple records, each of which has fields for node number 601, fault resistance resources 602, operating rate 603, AFR604, MTBF605 and MTTR606. Node number 601 stores the identifier of each node. In this embodiment, the identifier of the node adopts a combination of "N" and a number. In the fault resistance resource 602, the category of fault resistance of the node is stored. For example, for a node with dual power supplies, "power supply" is recorded in the field of fault resistance resource 602. The node with node number "N1" indicates that it has fault resistance of power supply, fan and network.

[0057] The operation rate 603 stores the operation rate of the node. The AFR 604 stores the annual failure rate of the node. The MTBF 605 stores the mean time between failures of the node. The MTTR 606 stores the mean time to repair the node.

[0058] Figure 7 701, a node number 702, a redundancy 703, a fault-resistant resource 704, a snapshot image (SS-IMG) backup 705, an operating rate 706, an AFR 707, an MTBF 708, an MTTR 709, and a cost 710.

[0059] The device number 701 stores the identifier of each device. The node number 702 stores the identifier of the node to which the device belongs. Figure 6The redundancy 703 stores a value indicating the redundancy level of the device. For example, a device with a redundancy 703 of "1" indicates that it has no redundancy. In other words, in a device with a redundancy 703 of "2" or more, backend data protection, i.e., backend protection, which is not managed by the cluster management computer 203 and the storage service container 211, is performed.

[0060] The type of fault resistance of the device is stored in the fault resistance resource 704. For example, if a certain device has a built-in RAID card or the like and can perform mirror synchronization within the device, "device" is recorded in the fault resistance resource 704. In addition, if a volume of an external storage system or the like is used, and if the device realizes redundancy between nodes in the cluster, "node" is recorded in the fault resistance resource 704.

[0061] In the SS-IMG backup 705, information indicating whether the information stored in the device has been backed up as a snapshot image (SS-IMG) is stored. The operation rate 706, AFR 707, MTBF 708, and MTTR 709 are related to Figure 6 The information of the operation rate 603, AFR 604, MTBF 605 and MTTR 606 in FIG. 1 is the same, so the description is omitted. In the cost 710, the cost of storing data in the device is stored in US dollars, more specifically, the cost of storing 1 GB of data for 1 year. For example, it is shown that using the device D1 to store 1 GB of data for 1 year will incur a cost of 0.5 US dollars.

[0062] Figure 8 806, AFR807, and cost 808. Figure 7 The operating rate 706, AFR 707, and cost 710 are the same information, so their description is omitted.

[0063] In the protection location management number 801, the identifier of the data protection location outside the cluster is stored. In this embodiment, a combination of "P" and a number is used as the identifier of the data protection location. The location of the data protection location, such as an IP address, is stored in the connection information 802. The information stored in AZ803 is used to indicate whether the cluster with the data protection location management table 503 outside the cluster is the same as the availability zone of the data protection location. The information stored in site 804 is used to indicate whether the cluster with the data protection location management table 503 outside the cluster is the same as the site of the data protection location. The information stored in service operator 805 is used to indicate whether the cluster with the data protection location management table 503 outside the cluster is the same as the service operator of the data protection location.

[0064] The cluster-external data protection location management table 503 may also include other indicators related to reliability and availability, such as MTBF and MTTR. In AZ 803, site 804, and service operator 805, instead of storing information indicating whether they are identical, some identifiers may be stored. In this case, the IDs of the AZ, site, and service operator of the storage cluster under management are managed separately, and whether they are identical or different is determined based on the consistency or inconsistency of their IDs.

[0065] Fig. 9 This is a diagram showing an example of a storage level management table 504. The storage level management table 504 is composed of a plurality of records, each of which has fields for a storage level management number 901, a condition 902, and a data protection position candidate 903. The storage level management number 901 stores an identifier for the storage level. In the present embodiment, the storage level uses an identifier that is a combination of "C" and a number. In the condition 902, the condition for the storage level specified by the user, in other words, the requirement for data protection of the data to be stored in the storage device is stored. In the data protection position candidate 903, candidates for data protection positions that meet the requirements specified by the user are stored. The candidate may be a single candidate or a combination of candidates.

[0066] For example Fig. 9 The first record shown indicates that, for the storage class of management number "C1", the user requires dual redundancy that can withstand failures of equipment and AZ, which can be achieved by the combination of D3 and P5, and the combination of D4 and P5. When a storage class is added, all combinations that meet the conditions may be stored in the data protection position candidate 903, or a part of the combinations that meet the conditions may be stored in the data protection position candidate 903. In the latter case, when the free capacity decreases to below a specified threshold, a new data protection position is added to the data protection position candidate 903.

[0067] Fig.101 is a diagram showing an example of the redundancy relation table 505. The redundancy relation table 505 is composed of a plurality of records, each of which has fields for component category 1001 and alternative category 1002. The component category 1001 stores the category of the component to be made redundant. The alternative category 1002 stores the category of the component that can be made redundant as an alternative. Fig.10 The initial record shown shows that the redundancy of the storage device can be replaced by the redundancy of the node. Fig.10 The information shown can be summarized to show that the redundancy of a subordinate component in a network structure can be replaced by the redundancy of a superior component.

[0068] Fig.11 1 is a diagram showing an example of a volume management table 421. The volume management table 421 is composed of a plurality of records, each of which has a volume management number 1101, a storage level management number 1102, and a data protection location 1103 field. The volume management number 1101 stores the volume identifier. In this embodiment, a combination of "V" and a number is used as the volume identifier. The storage level management number 1102 and the data protection location 1103 are stored in the volume management number 1101. Fig. 9 The storage level management number 901 has the same meaning, so the description is omitted.

[0069] The identifier stored in the data protection location 1103 is an identifier of a device or the like storing volume information. Fig.11 In the example shown, volume management numbers V1 to V3 all correspond to storage class C1, V1 and V2 use a combination of D3 and P5, and V3 uses a combination of D4 and P5. In addition, when different parts of a volume have different protection positions, multiple information is stored in the data protection position.

[0070] (flow chart)

[0071] Fig.12 1 is a flowchart showing the storage level setting process executed by the storage level setting program 510. First, in step S1210, the CPU 301 receives the storage level condition from the management terminal 204. In the subsequent step S1220, the CPU 301 refers to the storage level management table 504 to determine a new management number, records the management number in the field of the storage level management number 901 of the storage level management table 504, and records the condition received in step S1210 in the field of the condition 902.

[0072] In the subsequent step S1230, the CPU 301 performs a redundant position selection process from the perspective of each component as described later, that is, determines a candidate data protection position that satisfies the conditions of the combination of the failure type and the redundancy. However, if the request received in step S1210 does not include the conditions from the perspective of the component, the CPU 301 does not execute step S1230.

[0073] In the subsequent step S1240, the CPU 301 performs redundant position selection processing from the perspective of the entire system, that is, determines the candidate data protection position that meets the probability condition of availability. Specifically, the CPU 301 performs this step when the request received in step S1210 includes the operating rate of the system, and determines the candidate data protection position in a manner that the operating rate of the system is greater than the required value. In addition, when there is a node or device for which the operating rate is not set in any of the node management table 501 and the back-end device management table 502, the CPU 301 calculates the operating rate through the processing described below.

[0074] In step S1250 , CPU 301 performs cost evaluation processing from the system point of view. Specifically, when the request received in step S1210 includes a cost condition, CPU 301 calculates the cost of the devices included in each candidate selected in steps S1230 and S1240 by adding up the costs of the devices included in each candidate.

[0075] In the subsequent step S1260, the CPU 301 stores the candidate satisfying all the conditions received in the step S1210 in the data protection position candidate 903 of the storage level management table 504, and ends the process. Fig.12 Specifically, when the condition received in step S1210 is only a combination of the fault type and the redundancy, the CPU 301 outputs the selection result in step S1230. When the condition received in step S1210 is only the condition of the operating rate, the CPU 301 outputs the selection result in step S1240. When the condition received in step S1210 includes the cost, the CPU 301 outputs the selection result in step S1250.

[0076] In addition, the storage level setting program 510 reads the data protection requirement in step S1210, so the storage level setting program 510 can also be called a "reading unit". In each of steps S1230 to S1250, the data protection method of the storage device is determined based on the user's data protection requirement from the perspective of components, the perspective of the system, and the perspective of cost, so the storage level setting program 510 can also be called a "determination unit".

[0077] Fig.13 Yes means Fig.12Step S1230 in the flowchart is a flowchart of the redundant position selection process from the perspective of each component. First, in step S1510, the CPU 301 generates a list of conditions from the perspective of each component. Then, the CPU 301 takes each item of the generated list as a processing object in turn and performs the processing of steps S1520 to S1540. In step S1520, the CPU 301 extracts and lists the candidate devices that meet the conditions as the processing object from the back-end device management table 502.

[0078] In the subsequent step S1530, the CPU 301 determines whether at least one candidate exists due to the processing of step S1520. If the CPU 301 determines that at least one candidate exists, the process proceeds to step S1550, and if it determines that no candidate exists, the process proceeds to step S1540. In step S1540, the CPU 301 refers to the redundancy relationship table 505, lists the candidates that meet the conditions under the component category that can be replaced and proceeds to step S1550.

[0079] In step S1550, CPU 301 determines whether all the conditions in the list generated in step S1510 have been processed. Then, if there are conditions that have not been processed, CPU 301 treats the unprocessed conditions as processing targets and executes the processing from step S1520 onwards. If CPU 301 determines that all the conditions in the list have been processed, the process ends. Fig.13 Processing shown.

[0080] Fig.14 It means in Fig.12 The flowchart of the operation rate calculation process called as needed in step S1240 of the CPU 301. The CPU 301 repeatedly executes the process of steps S1620 to S1640 for all devices without set operation rates. Specifically, the CPU 301 lists all devices without set operation rates, and processes them one by one as processing objects (hereinafter referred to as "processing object devices") and executes the process of steps S1620 to S1640.

[0081] In step S1620, CPU 301 calculates the MTBF of the serial using the MTBF of the processing target device and the MTBF of the node to which the processing target device is connected. Let the MTBF of the processing target device be X, the MTBF of the node to which the processing target device is connected be Y, and the MTBF of the calculation target, i.e., the serial, be Z, and calculate the value of Z that satisfies the relationship (1 / Z)=(1 / X)+(1 / Y).

[0082] In the subsequent step S1630, CPU301 sets the time required for redundancy recovery processing in the event of a node failure as MTTR. In the subsequent step S1640, CPU301 uses MTBF and MTTR to calculate the serial operating rate of nodes and devices. Specifically, CPU301 obtains the value of the operating rate by dividing the value of MTBF by the sum of MTBF and MTTR. After CPU301 repeatedly executes the processing of steps S1620 to S1640 for all devices that do not have a set operating rate, it proceeds to step S1660. In step S1660, CPU301 calculates the operating rate accordingly based on the serial or parallel status of each combination candidate, and ends. Fig.14 Processing shown.

[0083] Fig.15 The flowchart of the volume generation process performed by the volume generation program 511. The volume generation program 511 first receives the volume conditions specified from the management terminal 204 in step S1310. The conditions include at least the management number of the storage level, the storage level conditions that have been communicated in the past, and may also include the designation of the volume capacity. The conditions are, for example, "a 2TB volume with management number C1", "a 2TB volume with 2 redundant devices and 2 redundant AZs". If Fig. 9 These two conditions are the same if the storage level management table 504 shown is used as a premise.

[0084] In the subsequent step S1320, CPU301 refers to the storage class management table 504 to obtain the combination candidates of the storage class specified in the condition. For example, in the previous example, CPU301 obtains the combination of D3 and P5, the combination of D4 and P5, and the combination of D4 and P5 as candidates. In the subsequent step S1330, CPU301 determines whether there is sufficient free capacity in at least one of the candidates obtained in step S1320. Sufficient free capacity refers to free capacity above the capacity specified in step S1310, and a predetermined capacity such as 1TB of free capacity when no capacity is specified in step S1310.

[0085] If the CPU 301 determines that there is sufficient free space, the process proceeds to step S1340. If the CPU 301 determines that there is no free space in any of the candidates, the process outputs an error in step S1360 and ends the process. Fig.15 In step S1340, CPU 301 determines the combination candidate that satisfies the free capacity among the candidates obtained in step S1320 as the data protection position. In the subsequent step S1350, CPU 301 ensures the capacity at the data protection position determined in step S1340 and ends the process. Fig.15In the case of thick provisioning, the capacity of the determined protection position is ensured, and in the case of thin provisioning, only the minimum necessary area is ensured.

[0086] In addition, in step S1330, if there is no single combination candidate that satisfies the free capacity, a different combination candidate may be used for each subvolume. Similarly, if it is determined in step S1330 that the free capacity is insufficient, an error may not be output, but whether there is a newly added component may be confirmed, and if there is a new combination candidate that satisfies the storage class specification, the storage class management table 504 may be updated, and the volume generation process may be executed again.

[0087] Fig.16 Flowchart showing the data redundancy maintenance and recovery process performed by the data redundancy maintenance and recovery program 512. The CPU 301 first detects the failure of the node, device, or data protection location outside the cluster of each table in step S1410. In the subsequent step S1420, the CPU 301 determines whether a certain failure is detected in step S1410. The CPU 301 proceeds to step S1430 if it is determined that a certain failure is detected, and returns to step S1410 if it is determined that no failure is detected.

[0088] In step S1430, the CPU 301 refers to the volume management table 421 to identify the volume whose failure location is designated as the data protection location. For example, when the failure of the device D3 is detected in step S1410, the volume management table 421 is referred to to identify volumes V1 and V2.

[0089] In the subsequent step S1440, CPU301 generates a list of volumes determined in step S1430, and executes the processing of steps S1450 to S1470 for each volume in turn as a processing object. In step S1450, CPU301 refers to the storage level management table 504, determines the storage level management number 1102 corresponding to the volume as the processing object, and determines other combination candidates of data protection positions. When the volume of the processing object is V1, D4+P5 with the same storage level management number C1 can be determined. In addition, in the selection of data protection positions, by selecting a combination that includes more replication sources that are repeated with the original combination candidates, the recovery cost of data redundancy can be reduced.

[0090] In subsequent step S1460, CPU 301 registers the data protection location candidate newly selected in step S1450 in volume management table 421 for managing volumes. In subsequent step S1470, CPU 301 instructs redundancy recovery processing program 424 of the node managing the volume to copy to the newly selected data protection location, and proceeds to step S1480.

[0091] In step S1480, the CPU 301 determines whether the processing of steps S1450 to S1470 has been executed for all the volumes determined in step S1430. If the CPU 301 determines that the processing of steps S1450 to S1470 has been executed for all the volumes determined in step S1430, the CPU 301 returns to step S1410. If the CPU 301 determines that there are unprocessed volumes, the CPU 301 changes the processing target and returns to step S1450.

[0092] Fig.17 4 is a flowchart showing the redundancy process executed by the redundancy process program 423. The CPU 301 first receives write data, that is, data to be written for redundancy, from the storage service process program 422 in step S1710.

[0093] In the subsequent step S1720, CPU 301 refers to volume management table 421 and sends the write data received in step S1710 to the data protection location. In the subsequent step S1730, CPU 301 determines whether the write completion report has been received from all the data protection locations that need to be written synchronously. CPU 301 stops at step S1730 when it determines that the completion report has not been received, and ends when it determines that the completion report has been received. Fig.17 Processing shown.

[0094] According to the above-described first embodiment, the following effects can be obtained.

[0095] (1) The storage management system, i.e., the computer system 100, includes a processor, i.e., a CPU 301, which manages a plurality of storage devices included in the storage system 120 and / or the integrated computer cluster 112. The storage device includes a plurality of types of components, and the plurality of components are combined to make the data to be stored redundant. The computer system 100 has a backend device management table 502, which is component management information indicating the redundancy set for the component itself. The CPU 301 sets a method for data protection of the storage device based on the candidate device management table 502 and the data protection requirements for the data to be stored in the storage device (storage level setting program 510: Fig.12 Therefore, data protection can be appropriately performed based on the specified data protection requirements.

[0096] (2) The CPU 301 sets the data protection method of the storage device so that the sum of the redundancy of the component itself recorded in the backend device management table 502 and the redundancy set by combining multiple components satisfies the data redundancy included in the data protection requirement.

[0097] (3) Data protection requirements include a combination of the failure category of the component that protects the data and the data redundancy for that failure. Fig. 9 The storage level management table 504 shown in the example in FIG. 5 includes the storage levels C1 and C3 in which the storage level management numbers 901 are C1 and C3, and includes the combination of the failure type and the redundancy. Fig.12 Step S1230 is Fig.13 The process shown selects a combination of devices that meets the required combination of failure categories and redundancy. Therefore, the computer system 100 can perform data protection that meets the required combination of failure categories and redundancy.

[0098] (4) Data protection requirements include the probability of availability. For example, Fig. 9 The storage level management table 504 shown in the example in FIG. 5 includes the probability of availability, that is, the operation rate. The storage level setting program 510 is executed by Fig.12 The processing shown in step S1240, and as needed by Fig.14 The process shown is used to select a combination of devices that satisfies the required availability probability. Therefore, the computer system 100 can perform data protection that satisfies the required availability condition.

[0099] (5) Data protection requirements include the costs of data protection. Fig. 9 The storage level management table 504 shown in the example includes the cost in the storage level with the storage level management number 901 of C3. Fig.12 The computer system 100 selects a combination of devices that meets the required cost by performing the processing of step S1250. Therefore, the computer system 100 can perform data protection that meets the condition of the required cost.

[0100] (6) In at least one storage device included in the plurality of storage devices, back-end data protection, i.e., back-end protection, which is not managed by the storage management system, is performed. Determination unit (storage level setting program 510: Fig.12Step S1230) determines the data protection method of the storage device based on the requirements of backend protection and data protection. Therefore, when using a device that implements backend protection, excessive protection can be prevented. For example, when the required protection condition is 2 redundancy for device failure, Figure 7 For the case where the device number D2 has the fault resistance of "device", the condition has been met, so the data is saved without further protection, thereby suppressing excessive protection. For example, on a public cloud, a service operator will provide data protection for the device as a standard or optional feature, and sometimes also provide backend protection at the region or site level. When using such a public cloud device, excessive (excessive) protection can be prevented by considering the protection at the backend.

[0101] (7) The computer system 100 has a data redundancy maintenance and recovery program 512, which detects failures in multiple storage devices and saves the data stored in the storage device where the failure is detected to any storage device among the multiple storage devices except the storage device where the failure is detected, according to the data protection requirements of the data. Therefore, when a storage device fails, appropriate data protection can be performed without any more or less.

[0102] (8) A plurality of storage devices are managed by any one of two or more nodes. Fig.13 In step S1540), the redundancy of the node can be selected instead of the redundancy of the storage device. Therefore, the user's requirements can be met with different protection levels.

[0103] (9) A management method executed by the cluster management computer 203 included in the computer system 100 manages a plurality of storage devices included in the computer system 100 as described below. That is, it includes: reading a data protection request for data to be stored ( Fig.12 Step S1210), wherein the data is to be stored in at least one storage device included in the plurality of storage devices, and a method for determining data protection of the storage device based on a data protection requirement ( Fig.12 Therefore, data protection can be appropriately performed based on the specified data protection requirements.

[0104] (Variant 1)

[0105] The storage level setting program 510 may further consider data protection of the application that outputs the data. For example, if the application saves data in multiple available zones and the required protection condition is 2 redundancy for AZ failure, the storage level setting program 510 uses the device with redundancy of "1" as the data protection location alone. This is because the application has already performed duplication, so if the storage level setting program 510 performs further protection, it will result in over-protection.

[0106] In this variation, the user uses the management terminal 204 to input storage level conditions, volume generation, and data protection methods for applications that are expected to write to the volume (hereinafter referred to as "estimated applications"). The data protection method is a concept corresponding to the conditions for data protection, indicating how to protect data. For example, data protection methods include: device protection, that is, storing the same data in different devices; node protection, that is, storing the same data in different nodes; AZ protection, that is, storing the same data in different AZs.

[0107] Alternatively, instead of the user inputting the data protection method of the estimated application, the user may input identification information of the estimated application, and the storage level setting program 510 may refer to a correspondence table (not shown) between the identification information and the data protection method.

[0108] Fig.18 is a flowchart showing the storage level setting process in Modification 1, which is equivalent to the first embodiment. Fig.12 The following mainly describes Fig.12 Difference. In step S1215 executed initially, CPU301 receives not only the conditions of the storage level but also the information of the estimated application from the management terminal 204 and proceeds to step S1220. In step S1225 executed after step S1220, CPU301 reads the data protection method of the application written to the volume generated according to the storage level. In the case where the information of the estimated application received in step S1215 is the data protection method of the estimated application, the information is used directly. In the case where the information of the estimated application received in step S1215 is the identification information of the estimated application, the data protection method is read with reference to the correspondence table between the above identification information and the data protection method. In steps S1230 and S1240, CPU301 determines the method of data protection of the storage device based on the data protection method of the application and the data protection requirements.

[0109] According to this modification example 1, the following effects can be obtained.

[0110] (10) The data protection requirement includes information on data protection implemented by an estimated application, wherein the estimated application is an application that is estimated to use the storage device. Fig.18Steps S1530 to S1550) determine the data protection method of the storage device based on the estimated data protection implemented by the application and the data protection requirements. Therefore, the computer system 100 can take into account the data protection method of the application writing to the volume to achieve appropriate data protection.

[0111] In the above-mentioned embodiments and variations, the structure of the functional modules is only an example. Some functional structures represented as different functional modules may be integrated, or a structure represented by a functional block diagram may be divided into two or more functions. In addition, a part of the functions of each functional module may be possessed by other functional modules.

[0112] Description of Reference Numerals

[0113] 100……Computer Systems

[0114] 111...Separate computer cluster

[0115] 112……All-in-one computer cluster

[0116] 120... Storage system

[0117] 201...node

[0118] 203...Cluster management computer

[0119] 204……Management terminal

[0120] 210... Application Container

[0121] 211...Storage Service Container

[0122] 410... Storage area for container management platform

[0123] 420 ... Storage area for storage service container

[0124] 421...Volume Management Table

[0125] 422... Storage Service Handler

[0126] 423... Redundancy Processing Procedure

[0127] 424... Redundancy recovery process

[0128] 430 ... storage area for application container

[0129] 431... Application

[0130] 501...Node Management Table

[0131] 502...Backend device management table

[0132] 503...Cluster-external data protection location management table

[0133] 504... Storage Level Management Table

[0134] 505... Redundant relation table

[0135] 510... Storage level setting program

[0136] 511...Volume Creation Program

[0137] 512...Data redundancy maintenance recovery procedure

Claims

1. A storage management system, comprising a processor, for managing a plurality of storage devices, characterized in that: The storage device includes a plurality of types of components, and a plurality of the components are combined to make the data to be stored redundant. The storage management system has component management information indicating the redundancy set for the component itself. The processor determines a combination of the components in the storage device to store data based on the component management information and a requirement for data protection of the data to be stored in the storage device. The data protection requirements include at least data redundancy requirements. The processor determines a combination of the components so that a sum of the redundancy of the component itself recorded in the component management information and the redundancy set by combining a plurality of the components satisfies the data redundancy included in the data protection requirement.

2. The storage management system according to claim 1, characterized in that: In at least one storage device included in the plurality of storage devices, back-end data protection, i.e., back-end protection, which is not managed by the storage management system, is performed; The requirement to be protected by the back-end protection is excluded from the requirements for data protection, and a combination of the components to store data in the storage device is determined in such a manner as to satisfy the remaining requirements.

3. The storage management system according to claim 1, wherein: The data protection requirements include a combination of failure type and redundancy. The processor determines the combination of the components so as to have the redundancy included in the data protection requirement in response to the failure type included in the data protection requirement.

4. The storage management system according to claim 1, wherein: The data protection requirements include operating rate, The processor determines the combination of the components so as to satisfy the operation rate included in the data protection requirement.

5. The storage management system according to claim 1, wherein: The data protection requirements include the costs required for data protection. The processor determines the combination of the components in a manner that satisfies the cost condition included in the data protection requirement.

6. The storage management system according to claim 1, characterized in that: The data protection requirement includes information on data protection implemented by an estimated application, namely, application protection, wherein the estimated application is an application that is estimated to use the storage device. The processor excludes the requirement to be protected by the application protection from the requirements for data protection and determines a combination of the components in the storage device to store data in such a manner as to satisfy the remaining requirements.

7. The storage management system according to claim 1, characterized in that: Able to perform recovery processing, In the recovery process, a fault in the multiple storage devices is detected, and the data stored in the storage device where the fault is detected is stored in any storage device among the multiple storage devices except the storage device where the fault is detected, in accordance with the data protection requirements for the data.

8. The storage management system according to claim 1, characterized in that: The components include nodes and storage devices.

9. A management method, executed by a storage management system including a processor and managing a plurality of storage devices, characterized in that: The storage device includes a plurality of types of components, and a plurality of the components are combined to make the data to be stored redundant. having component management information indicating a redundancy set for the component itself, comprising a determination process in which a combination of the components in which data is to be stored in the storage device is determined based on the component management information and a requirement for data protection of the data to be stored in the storage device, The data protection requirements include at least data redundancy requirements. In the determination process, the combination of the components is determined so that the sum of the redundancy of the component itself recorded in the component management information and the redundancy set by combining a plurality of the components satisfies the data redundancy included in the data protection requirement.

Images