Computer system and operation management method

Abstract

To provide a computer system that suppresses costs on hardware at a secondary site during steady time while maintaining the performance of I / O processing in a disaster recovery processing, and an operation management method for the computer system.SOLUTION: A computer system comprises: a regular site that possesses a regular volume and has an instance for executing data processing related to inputted / outputted data; and a secondary site that possesses a secondary volume and has an instance. A remote copy is set between the regular volume and the secondary volume. The instance at the regular site transfers data inputted / outputted to / from the regular volume to the secondary site, and the instance at the secondary site stores the transferred data into the secondary volume. A specification change unit is provided which changes the specification of the secondary site instance when executing a failover switching process or a failback switching process after the failover switching process regarding execution of data processing between the regular site and the secondary site.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a computer system and an operation management method, and is suitable for application to a computer system relating to a method for reducing the cost of a secondary site by reducing the amount of hardware usage during standby at the secondary site, for example. [Background technology]

[0002] In order to continue business even in the event of a disaster, a remote copy function is a technology that replicates data in a storage system between multiple geographically separated data centers. A storage system equipped with such a remote copy function is composed of multiple nodes. In this storage system, the site that processes business applications under normal circumstances is called the "primary site," and the site that switches over from the primary site to operate when a site-wide failure occurs on the primary site side and the storage system stops is called the "secondary site."

[0003] For example, Patent Document 1 discloses a technology for selecting a storage device at the secondary site so as to satisfy the performance and capacity requirements of the primary site when constructing a remote copy pair between a primary site and a secondary site in a configuration in which the secondary site is composed of multiple storage devices. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] US Patent Application Publication No. 2018 / 0032254 Summary of the Invention [Problem to be solved by the invention]

[0005] In the technology disclosed in Patent Document 1, in order to suppress the degradation of I / O processing performance after executing a failover switching process to switch from a primary site to a secondary site, the secondary site is provided with sufficient hardware to withstand the I / O processing after executing remote copy processing and failover switching processing. However, since the secondary site only needs to execute remote copy processing during normal operation, the hardware performance during normal operation becomes excessive, and the introduction cost of the secondary site becomes high. Furthermore, if pay-as-you-go hardware such as that provided by a cloud vendor is used for the secondary site, the hardware performance during normal operation becomes excessive, and the operation cost increases accordingly.

[0006] The present invention has been made in consideration of the above points, and aims to propose a computer system and an operation management method that can reduce the hardware costs of a secondary site during normal operation while maintaining I / O processing performance during disaster recovery processing. [Means for solving the problem]

[0007] In order to solve such problems, the present invention comprises a primary site which holds a primary volume and has an instance which executes data processing related to input / output data, and a secondary site which holds a secondary volume and has an instance, wherein remote copy is set between the primary volume and the secondary volume, the instance at the primary site transfers data which is input / output to the primary volume to the secondary site, and the instance at the secondary site stores the transferred data in the secondary volume, and a specification change unit is provided which changes specifications of the instance at the secondary site when a failover switching process is performed to switch execution of the data processing between the primary site and the secondary site from the primary site to the secondary site, or a failback switching process is performed to switch from the secondary site to the primary site after the failover switching process.

[0008] Furthermore, in the present invention, in a method for managing a computer system comprising a primary site which holds a primary volume and has an instance which executes data processing related to input / output data, and a secondary site which holds a secondary volume and has an instance, remote copy is set between the primary volume and the secondary volume, the instance at the primary site transfers data which is input / output to the primary volume to the secondary site, and the instance at the secondary site stores the transferred data in the secondary volume, and when a failover switching process is performed to switch the execution of the data processing between the primary site and the secondary site from the primary site to the secondary site, or a failback switching process is performed to switch from the secondary site to the primary site after the failover switching process, specifications of the instance at the secondary site are changed. Effect of the Invention

[0009] According to the present invention, in disaster recovery processing, it is possible to reduce the cost of hardware at the secondary site during normal operation while maintaining the performance of I / O processing. [Brief description of the drawings]

[0010] [Figure 1] 1 is a system configuration diagram showing an example of the overall configuration of a computer system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is an overall configuration diagram showing a list of management tables and programs stored in a storage system and a storage node. [Diagram 3] 1 is an overall configuration diagram showing a list of management tables and programs stored in a disaster recovery management system at a disaster recovery management site. FIG. [Figure 4A] 11 is a diagram showing an example of the configuration of a system configuration management table stored in a storage system of a primary site and a storage node of a secondary site. FIG. [Figure 4B] 11 is a diagram showing an example of the configuration of a storage device management table stored in a storage system of a primary site and a storage node of a secondary site. FIG. [Figure 4C] 11 is a diagram showing an example of the configuration of a port management table stored in a storage system of a primary site and a storage node of a secondary site. FIG. [Figure 5A] 11 is a diagram showing an example of the configuration of a volume management table stored in a storage system of a primary site and a storage node of a secondary site. FIG. [Figure 5B] 11 is a diagram showing an example of the configuration of a volume pair management table stored in a storage system of a primary site and a storage node of a secondary site. FIG. [Figure 5C] 4 is a diagram showing an example of the configuration of a path management table stored in a storage system of a primary site and a storage node of a secondary site according to the embodiment of the present invention. [Figure 6A] 11 is a diagram illustrating an example of the configuration of a site management table stored in a disaster recovery management system at a disaster recovery management site. FIG. [Figure 6B] 11 is a diagram illustrating an example of a configuration of an instance specification information management table stored in a disaster recovery management system at a disaster recovery management site. [Figure 6C] 11 is a diagram illustrating an example of the configuration of a site performance information management table stored in a disaster recovery management system at a disaster recovery management site. [Figure 7] FIG. 2 is a diagram showing an example of a pair configuration of multiple volumes constructed between a primary site and a secondary site. [Figure 8] FIG. 11 is a state transition diagram for explaining an example of state transition between a primary site and a secondary site. [Figure 9] FIG. 13 is a diagram illustrating an example of I / O processing by a host at a primary site during normal operation. [Figure 10] FIG. 13 is a diagram illustrating an example of I / O processing between a primary site and a secondary site. [Figure 11] 13 is a flowchart illustrating monitoring of the status of a primary site in a disaster recovery management site and issuing an instruction for switchover processing to a secondary site. [Figure 12] 13 is a flowchart illustrating a failover switching process in a secondary site. [Figure 13]13 is a flowchart illustrating monitoring of the status of a primary site and a secondary site in a disaster recovery management site and issuing an instruction for switchover processing to the primary site. [Figure 14] 13 is a flowchart illustrating a failback switching process at a secondary site. [Figure 15] 13 is a flowchart illustrating a failback switching process in a primary site. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0012] 1 is a system configuration diagram showing an example of the overall configuration of a computer system according to this embodiment. The computer system comprises a primary site 100, a secondary site 200, and a disaster recovery management site 300, which are interconnected via an external network 400.

[0013] The primary site 100 comprises a host computer (hereinafter simply referred to as "host") 100, a storage system 102, a site management system 103, and an internal network 104, and these host 101, storage system 102, and site management system 103 are connected to each other via the internal network 104. The host 101 and storage system 102 of the primary site 100 are each one or more computers, and the site management system 103 is one computer. The host 101 and site management system 103 of the primary site 100 may be configured with hardware virtualized by a virtualization support program (hypervisor) or the like. In the primary site 100, a primary volume, which will be described later, is managed in the storage system 102.

[0014] The host 101 is equipped with a processor 110, a memory 111, a port 112, and a storage device 113, and these processor 110, memory 111, port 112, and storage device 113 are interconnected by a bus 114. A single host 101 may be equipped with a plurality of each of the processors 110, memories 111, ports 112, and storage devices 113, and a configuration in which a redundancy is achieved by using a plurality of these may also be implemented.

[0015] The processor 110 has one or more execution modules (CPU cores) within one processor. The storage device 113 is a device capable of storing application programs and the like that run on the host 101. The storage device 113 is, for example, a hard disk drive (HDD), a solid state drive (SSD), or a device capable of making data permanent using non-volatile memory. The host 101 is connected to the internal network 104 of the primary site 100 via a port 112.

[0016] The storage system 102 includes a processor 120, a memory 121, a port 122, and a storage device 123, which are connected to each other by a bus 124. A plurality of each of the processors 120, the memory 121, and the port 122 may be installed in one host 101, and a configuration for redundancy may be implemented using a plurality of these. The processor 120 has one or more execution modules (CPU cores) in one processor. The memory 121 may be a volatile memory equipped with a battery backup function for power failure resistance, or a nonvolatile memory, other than the case where only a volatile memory is used. The storage device 123 is a device that can store programs that run on the storage device 123, user data, and the like. The storage device 123 is, for example, a hard disk drive (HDD), a solid state drive (SSD), or a device that can make data permanent by using a nonvolatile memory. The storage system 102 is connected to an internal network 104 of the primary site 100 via a port 122.

[0017] The site management system 103 is equipped with a processor 110, a memory 111, a port 112, and a storage device 113. The site management system 103 has the same hardware configuration as the host 101. The site management system 103 is connected to an internal network 104 via the port 112.

[0018] The internal network 104 is connected to an external network 400 in order to connect the host 101, the storage system 102 and the site management system 103 to other sites via a network. The other sites referred to here are the secondary site 200 and the disaster recovery management site 300.

[0019] The secondary site 200 comprises a host computer (hereinafter simply referred to as "host") 201, a storage node 202, a site management system 203, an internal network 204, and a storage system 205, and these host 201, storage node 202, site management system 203, and storage system 205 are connected to each other via the internal network 204. In the secondary site 200, a secondary volume is managed in the storage node 202. The secondary volume is paired with a primary volume of the primary site 100 by data synchronization using remote copy, and the primary site 100 and the secondary site 200 store the same data.

[0020] In this embodiment, the storage node is also simply referred to as an "instance." Software runs in the instance. Since the instance is a virtual machine (virtual server), the specifications of the instance (instance specifications) can be easily changed. The specifications are the amount of computer resources allocated to the instance from the system, and the higher the specifications, the higher the cost and power consumption. The above-mentioned storage node 202 has a function corresponding to the storage system 102 on the primary site 100 side, but is different in that the storage system 102 is, for example, an on-premise physical storage system, while the storage node 202 runs as a virtual machine (virtual server) as described above.

[0021] The host 201 and storage node 202 of the secondary site 200 are one or more computers. The storage node 202 is made up of three or more nodes, and the site management system 203 is made up of one unit. The host 201 and the site management system 203 of the secondary site 200 may be configured with hardware that is virtualized by a virtualization support program (hypervisor) or the like.

[0022] The host 201 and the site management system 203 have the same configuration as the host 101 and the site management system 103 of the primary site 100 , respectively, and are connected to the internal network 204 via ports 212 and 222 .

[0023] The storage node 202 includes a processor 220, a memory 221, a port 222, and a storage device 223, and the processor 220, the memory 221, the port 222, and the storage device 223 are connected to each other by a bus 224. The storage device 223 is a device capable of storing programs of applications that run on the host 201, and the like. The storage device 223 is a device capable of making data permanent using, for example, a hard disk drive (HDD), a solid state drive (SSD), or a non-volatile memory. The host 201 is connected to the internal network 204 via a port 212. The storage node 202 is configured with hardware that is virtualized by, for example, a virtualization support program (hypervisor) provided by a cloud vendor, and is capable of changing the specifications of the hardware at least while the power supply of the storage node 202 is off. The virtualized hardware is, for example, pay-per-use hardware provided by a cloud vendor.

[0024] The storage system 205, like the storage system 102 of the primary site 100, is configured to include a processor 250, a memory 251, a port 252, and a storage device 253, and is a system that provides a virtual external volume provided by a cloud vendor. The storage system 205 is connected to the internal network 204 of the secondary site 200 via the port 252.

[0025] The internal network 204 is connected to an external network 400 in order to connect to other sites via networks. The other sites referred to here are the primary site 100 and the disaster recovery management site 300.

[0026] The disaster recovery management site 300 includes a disaster recovery management system 301 and an internal network 302. The disaster recovery management system 301 is a hardware configuration equipped with a processor 310, a memory 311, a port 312, and a storage device 313, similar to the hosts 101, 201 and the site management systems 103, 203 of the primary site 100 and the secondary site 200. The disaster recovery management system 301 is connected to the internal network 302 via the port 312. In this embodiment, the disaster recovery management system 301 is disposed as a site separate from the primary site 100 and the secondary site 200, but may be included as a part of the secondary site 200, for example, when the secondary site 200 is realized by a virtualization system provided by a cloud vendor. The internal network 302 is connected to an external network 400 in order to connect to other sites via a network. The other sites referred to here refer to the primary site 100 and the secondary site 200.

[0027] The internal networks 104, 204, 302 at each site may be connected to the external network 400 via a dedicated line or a general line such as a Wide Area Network (WAN). The internal networks 104, 204, 302 and the external network 400 realize data transfer between the sites using a network protocol such as TCP (Transmission Control Protocol) / IP (Internet Protocol).

[0028] 2 is an overall configuration diagram showing a list of management tables and programs stored in the storage system and storage node according to this embodiment. A table 130 and a program 140 are stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202, respectively. The table 130 and the program 140 are saved in a perpetual state in the storage device 123 mounted in the storage system 102 or the storage device 223 mounted in the storage node 202, and are loaded into the memories 121, 221 at startup.

[0029] The table 130 includes a system configuration management table 131, a storage device management table 132, a port management table 133, a volume management table 134, a volume pair management table 135, and a path management table 136. Details of these tables will be explained later with reference to Figs. 4 and 5.

[0030] The program 140 includes an I / O processing program 141, a failover switching processing program 142, and a failback switching processing program 143. The I / O processing program 141 executes at least data read processing and data write processing received from the hosts 101, 201 as an example of data processing related to input / output data, and may also execute storage functions such as compression / decompression, redundancy, and backup. The data processing executed by the I / O processing program 141 is executed in the primary site 100 before failover, but the function is taken over by the secondary site 200 after failover, and then returned to the primary site 100 after failback for execution. The primary site 100 operates as the receiving side of the remote copy of the secondary site 200 before failover and after failback. In addition, the secondary site 200 executes the above-mentioned data processing using data received by remote copy after failover and before failback. Specific processing contents will be described with reference to FIG. 9 and FIG. 10, which will be described later. The failover switching processing program 142 executes failover switching processing of the storage system 102 of the primary site 100 and the storage node 202 of the secondary site 200. Specific processing contents will be described later with reference to Fig. 12. The failback switching processing program 143 executes failback switching processing of the storage system 102 of the primary site 100 and the storage node 202 of the secondary site 200. Specific processing contents will be described later with reference to Figs. 14 and 15.

[0031] 3 is an overall configuration diagram showing a list of tables 330 and programs 340 stored in the disaster recovery management system 301 of the disaster recovery management site 300 according to this embodiment. The tables 330 and programs 340 are saved in a perpetuated state in the storage device 313 of the disaster recovery management site 300, and are loaded into the memory 311 when the processor 310 is started.

[0032] The table 330 includes a site management table 331, an instance specification information management table 332, and a site performance information management table 333. Details of these tables will be explained later with reference to Fig. 6. The program 340 includes a status monitoring program 341, a performance information collection program 342, a failover switching processing program 343, and a failback switching processing program 344.

[0033] The status monitoring program 341 is a program that monitors the status of the primary site 100 and the secondary site 200 by being started by the processor 310. At this time, the status monitoring program 341 periodically communicates with the primary site 100 and the secondary site 200 to obtain the status of each site, and updates the site management table 331 based on the obtained status of each site.

[0034] The performance information collection program 342 is a program that collects performance information of the primary site 100 and the secondary site 200 by being started by the processor 310. The performance information collection program 342 periodically communicates with the primary site 100 and the secondary site 200 to collect performance information of each site, and updates the site performance information management table 333 based on the collected performance information of each site.

[0035] The failover switching processing program 343 is a program that controls the failover switching processing of the primary site 100 and the secondary site 200 by being started by the processor 310. The specific processing contents will be explained later with reference to FIG.

[0036] The failback switching processing program 344 is a program that controls the failover switching processing of the primary site 100 and the secondary site 200 by being started by the processor 310. The specific processing contents will be explained later with reference to FIG.

[0037] FIG. 4A is a diagram showing an example of the configuration of a system configuration management table stored in the storage system of the primary site 100 and the storage node 202 of the secondary site 200 according to this embodiment.

[0038] The system configuration management table 131 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202. The system configuration management table 131 has an entry for each storage system 102 and storage node 202 present in the computer system. Each entry includes items such as ID 131A, status 131B, storage device ID list 131C, and port ID list 131D.

[0039] The ID 131A is a unique identifier within the computer system. For example, "0" is stored in the ID 131A. The status 131B indicates the status of the storage system 102 and the storage node 202. For example, when the storage system 102 or the storage node 202 is normal, "normal" is stored in the status 131B, whereas when the storage system 102 or the storage node 202 is stopped due to a site down or the like, "stopped" is stored.

[0040] The storage device ID list 131C is a list of IDs of the storage devices 123, 223 managed by the storage system 102 and the storage node 202. For example, "0, 1, 2" is stored in the storage device ID list 131C as the ID list of the storage device 123. The port ID list 131D is a list of IDs of the ports 122, 222 managed by the storage system 102 and the storage node 202. For example, "0, 1" is stored in the port ID list 131D as the ID list of the storage system 102.

[0041] FIG. 4B is a diagram showing an example of the configuration of the storage device management table 132 stored in the storage system of the primary site 100 and the storage node of the secondary site according to this embodiment.

[0042] The storage device management table 132 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202, and has an entry for each storage system 102 and storage node 202 present in the computer system, with each entry including the items ID 132A, status 131B, and size 132C.

[0043] The ID 132A is a unique identifier within the computer system. For example, "0" is stored in the ID 132A. The status 132B indicates the status of the storage device 123 of the storage system 102 or the storage device 223 of the storage node 202. For example, "normal" is stored in the status 132B when access to the storage device 123 of the storage system 102 is normal, whereas "failure" is stored in the status 132B when access to the storage device 123 of the storage system 102 is impossible. The size 132C indicates the capacity of the storage device 123 or the storage device 223. For example, "1400 GB" is stored in the size 132C as the capacity of the storage device 123.

[0044] 4C is a diagram showing an example of the configuration of a port management table stored in a storage system of a primary site and a storage node of a secondary site according to this embodiment. The port management table 133 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202 in order to manage the port 122 of the storage system 102 and the port 222 of the storage node 202. The port management table 133 has an entry for each storage system 102 and storage node 202 present in the computer system. Each entry includes items of ID 133A, status 133B, and address 133C.

[0045] The ID 133A is a unique identifier within the computer system. For example, "0" is stored in the ID 133A. The status 133B indicates the status of the port 122 of the storage system 102 and the port 222 of the storage node 202. For example, "normal" is stored in the status 133B when access to the port 122 of the storage system 102 is normal, whereas "failure" is stored in the status 133B when access to the port 122 of the storage system 102 is not possible. The address 133C indicates an IP address assigned to the port 122 or the port 222. For example, "172.12.16.200" is stored in the address 133C as the address assigned to the port 122.

[0046] FIG. 5A is a diagram showing an example of the configuration of the volume management table 134 stored in the storage system 102 of the primary site 100 and the storage node 202 of the secondary site 200 according to this embodiment.

[0047] The volume management table 134 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202. The volume management table 134 has an entry for each storage system 102 and storage node 202 present in the computer system according to this embodiment. Each entry includes the following items: ID 134A, owner ID 134B, retreat destination ID 134C, size 134D, and attribute 134E. The owner ID 134B is, for example, an ID indicating the responsible instance.

[0048] The ID 134A is a unique identifier within the computer system according to this embodiment. For example, "0" is stored in the ID 134A. The owner ID 134B is an identifier of the storage system 102 or storage node 202 in which the volume is located. For example, if the volume is located in the storage system 102, "0" is stored in the owner ID 134B as the identifier of the storage system 102.

[0049] The retreat destination ID 134C is an identifier of the arrangement destination of the redundant pair of the volume. For example, when the information of the owner ID 134B is "1" indicating the ID of the storage node 202, "2" is stored in the retreat destination ID 134C as the identifier of the storage node of the arrangement destination of the redundant pair of the volume. When the information of the owner ID 134B is "0" indicating the ID of the storage system 102, the same "0" as the information stored in the owner ID 134B is stored in the retreat destination ID 134C.

[0050] The size 134D indicates the capacity of the volume. For example, "500 GB" is stored in the size 134D as the capacity of the volume. The attribute 134E indicates the attribute of the volume. For example, the attribute 134E stores "normal VOL" if the volume is not paired, stores "PVOL" if the volume is paired and is the primary volume, stores "SVOL" if the volume is paired and is the secondary volume, and stores "JNLVOL" if the volume is a journal volume.

[0051] FIG. 5B is a diagram showing an example of the configuration of the volume pair management table 135 stored in the storage system 102 of the primary site 100 and the storage node 202 of the secondary site 200 according to this embodiment.

[0052] The volume pair management table 135 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202 in order to manage pairs of volumes present in a computer system. The volume pair management table 135 has an entry for each storage system 102 and storage node 202 present in the computer system. Each entry includes the following items: ID 135A, primary journal volume ID 135B, primary volume ID 135C, secondary journal volume ID 135D, secondary volume ID 135E, path ID 135F, and status 135G.

[0053] The ID 135A is a unique identifier within the computer system. For example, "0" is stored in the ID 135A. The primary journal volume ID 135B is the identifier of the journal volume used by the primary volume of the volume pair. For example, "2" is stored in the primary journal volume ID 135B as the identifier of the journal volume used by the primary volume of the volume pair.

[0054] The primary volume ID 135C is the identifier of the primary volume of the volume pair. For example, "1" is stored in the primary volume ID 135C as the identifier of the primary volume of the volume pair. The secondary journal volume ID 135D is the identifier of the journal volume used by the secondary volume of the volume pair. For example, "2" is stored in the secondary journal volume ID 135D as the identifier of the journal volume used by the secondary volume of the volume pair.

[0055] The secondary volume ID 135E is an identifier of the secondary volume of the volume pair. For example, "1" is stored in the secondary volume ID 135E as the identifier of the secondary volume of the volume pair. The path ID 135F is an identifier of a communication path used by the volume pair in data transfer between the primary volume and the secondary volume. For example, "0" is stored in the path ID 135F as the identifier of a communication path used by the volume pair in data transfer between the primary volume and the secondary volume. The status 135G indicates the status of the volume pair. For example, "normal" is stored in the status 135G when the volume pair is normal, "copying" is stored when the volume pair is copying, and the status of "copying stopped" is stored when the volume pair is copying stopped.

[0056] FIG. 5C is a diagram showing an example of the configuration of the path management table 136 stored in the storage system 102 of the primary site 100 and the storage node 202 of the secondary site 200 according to this embodiment.

[0057] The path management table 136 is a table stored in the memory 121 of the storage system 102 and the memory 221 of the storage node 202 in order to manage paths present in the computer system according to this embodiment. The path management table 136 has an entry for each storage system 102 and storage node 202. Each entry includes the following items: ID 136A, protocol information 136B, address 136C, access policy 136D, and preferred path 136E.

[0058] The ID 136A is a unique identifier within the computer system. For example, "0" is stored in the ID 136A. The protocol information 136B is a data communication protocol used in the path. For example, "iSCSI" is stored in the protocol information 136B as the data communication protocol used in the path. The address 136C is the address of the destination port. The address 136C is basically two or more addresses that are made redundant using a plurality of ports. For example, "172.12.16.202" and "172.12.16.203" are stored in the address 136C as the two addresses of the destination port.

[0059] Access policy 136D is a port usage policy when two or more ports are used. For example, in the asymmetric access policy 136D, "asymmetric" is stored when there are multiple ports with preferred paths, and "symmetric" is stored when there is no priority among multiple ports and any port may be used. Here, "targeted" indicates that two ports (paths) are switched in a round-robin manner. On the other hand, "non-targeted" indicates that only one port is used, and if that port becomes unavailable, the other port is used.

[0060] The priority path 136E is the address of a port that is prioritized when the information of the access policy 136D is "asymmetric." For example, when the information of the access policy 136D is "asymmetric," the priority path 136E stores "172.12.16.202" as the address of a port that is prioritized. When the information of the access policy 136D is "symmetric," "-" is stored in the priority path 136E as information indicating that the path is not used.

[0061] 6A is a diagram showing an example of the configuration of a site management table 331 stored in the disaster recovery management system 301 of the disaster recovery management site 300 according to this embodiment. The site management table 331 is a table stored in the memory 311 of the disaster recovery management system 301 of the disaster recovery management site 300 in order to manage the primary site 100 and the secondary site 200. The site management table 331 has an entry for each storage system 102 and storage node 202 present in the computer system. Each entry includes items such as a site type 331A, a site status 331B, a disaster recovery status 331C, an address 331D, and an instance type 331E.

[0062] The site type 331A is a type for determining whether the target of management of the disaster recovery management site 300 is the primary site 100 or the secondary site 200. For example, when the target of management of the disaster recovery management site 300 is the primary site 100, "primary" is stored in the site type 331A. The site status 331B is the status of the site that is the target of management of the disaster recovery management site 300. For example, when the secondary site 200 that is the target of management of the disaster recovery management site 300 is operating normally, "normal" is stored in the site status 331B, and when the primary site 100 that is the target of management of the disaster recovery management site 300 is stopped due to a failure or the like, "stopped" is stored.

[0063] The disaster recovery status 331C is the disaster recovery status of the site that is the management target of the disaster recovery management site 300. For example, when the primary site 100 that is the management target of the disaster recovery management site 300 is undergoing failover, "failover in progress" is stored in the disaster recovery status 331C. The specific status of each site and the transition to each status will be described later with reference to FIG. 8.

[0064] The address 331D is the address of a port for accessing a site that is the object of management of the disaster recovery management site 300. In the address 331D, for example, “172.12.16.200” and “172.12.16.201” are stored as the addresses of the port 122 of the primary site 100 that is the object of management of the disaster recovery management site 300.

[0065] The instance type 331E is the type used when "secondary" is stored in the site type 331A, and is the type of the instance specification information management table 332 used in the secondary site 200. For example, "2" is stored in the instance type 331E as the type of the instance specification information management table 332. Note that when "primary" is stored in the site type 331A, the instance type is not used, so "-" is stored in the site type 331A.

[0066] 6B is a diagram showing an example of the configuration of an instance specification information management table 332 stored in the disaster recovery management system 301 of the disaster recovery management site 300 according to this embodiment. The instance specification information management table 332 is a table stored in the memory 311 of the disaster recovery management system 301 of the disaster recovery management site 300 in order to manage the operation specifications (hereinafter also simply referred to as "specs" or "instance specifications") of instances executable on the secondary site 200. The instance specification information management table 332 has an entry for each storage system 102 and storage node 202 present in the computer system. Each entry includes items such as type 332A, cost 332B, CPU 332C, memory 332D, and network bandwidth 332E.

[0067] The type 332A is an identifier that uniquely identifies one instance spec among a plurality of instance specs. For example, if the instance spec is the second (middle spec) of three types of instance specs (high spec, middle spec, low spec), then “2” is stored in the type 332A.

[0068] Cost 332B is the usage fee for each instance specification, for example, the price per hour. For example, "2$ / h" is stored as the usage fee for the second instance specification (middle specification) in cost 332B. CPU 332C is the CPU frequency and number of cores available for each instance specification. For example, "3Ghz" is stored as the CPU frequency and number of cores available for the second instance specification (middle specification) in CPU 332C.

[0069] The memory 332D is the memory capacity (memory amount) available for each instance specification. For example, "256 GiB" is stored in the memory 332D as the memory capacity available for the second instance specification (middle specification). The network bandwidth 332E is the network bandwidth available for each instance specification. For example, "20 GiB" is stored in the network bandwidth 332E as the network bandwidth available for the second instance specification (middle specification).

[0070] 6C is a diagram showing an example of the configuration of the site performance information management table 333 stored in the disaster recovery management system 301 of the disaster recovery management site 300 according to this embodiment. Note that the site performance information management table 333 is a table that is updated periodically.

[0071] The site performance information management table 333 is a table stored in the memory 311 of the disaster recovery management system 301 in the disaster recovery management site 300 in order to manage the performance of the primary site 100 and the secondary site 200. The site performance information management table 333 has an entry for each storage system 102 and storage node 202. Each entry includes items such as site type 333A, status 333B, maximum CPU operating rate 333C, maximum memory usage 333D, and maximum network bandwidth usage 333E.

[0072] The site type 333A is a type for determining whether the management target of the disaster recovery management site 300 is the primary site 100 or the secondary site 200. For example, when the management target of the disaster recovery management site 300 is the primary site 100, "primary" is stored in the site type 331A. The status 333B is the disaster recovery status of the site that is the management target of the disaster recovery management site 300, and each entry exists for each disaster recovery status. For example, when the disaster recovery status of the primary site 100 is in a steady state, "normal" is stored in the status 333B.

[0073] The maximum CPU operating rate 333C is the maximum operating rate of the CPU used in the storage system 102 of the primary site 100 or the storage node 202 of the secondary site 200 that are managed by the disaster recovery management site 300. For example, "3 GHz, 24 cores in use" is stored as the maximum CPU operating rate of the storage system 102 of the primary site 100 in the maximum CPU operating rate 333C.

[0074] The maximum memory usage 333D is the maximum memory usage of the memory used by the storage system 102 of the primary site 100 or the storage node 202 of the secondary site 200 that are subject to the management of the disaster recovery management site 300. In the maximum memory usage 333D, for example, “128 GiB” is stored as the maximum memory usage of the memory 121 of the storage system 102 of the primary site 100.

[0075] The maximum network bandwidth usage 333E is the maximum network bandwidth of the storage system 102 of the primary site 100 or the storage node 202 of the secondary site 200 that are subject to the management of the disaster recovery management site 300. In the maximum network bandwidth usage 333E, for example, "10 Gbps" is stored as the maximum network bandwidth usage of the storage system 102 of the primary site 100.

[0076] Here, the computer system according to this embodiment comprises a primary site 100 having a primary volume and an instance that executes data processing related to data input / output to the primary site 100, and a secondary site 200 having a secondary volume that is paired with the primary volume through data synchronization by remote copy and having an instance, remote copy is set between the primary volume and the secondary volume, the instance at the primary site 100 transfers data input / output to the primary volume to the secondary site 200, and the instance at the secondary site 200 stores the transferred data in the secondary volume, and has a specification change function (specification change unit) that changes the specifications (instance specifications) of an instance running at the secondary site when performing a failover switching process that switches the execution of data processing between the primary site 100 and the secondary site 200 from the primary site 100 to the secondary site 200, or a failback switching process that switches from the secondary site 200 to the primary site 100 after the failover switching process.

[0077] In the computer system according to this embodiment, the specification change function increases the specifications of the instance that executes data processing at the secondary site 200 when a failure occurs at the primary site 100 and failover switching processing is executed to switch from the primary site 100 to the secondary site 200.

[0078] When the computer system according to this embodiment executes failover switching processing, the instance of the secondary site 200 processes input / output data, and inputs / outputs the data to / from the secondary volume.

[0079] When the computer system according to this embodiment executes failover switching processing, the instance of the secondary site 200 performs data input / output using the secondary volume that was data-synchronized with the primary volume by remote copy before the failover switching processing.

[0080] The computer system according to this embodiment stops remote copying when failover switching processing is executed.

[0081] In the computer system of this embodiment, when the primary site 100 recovers from a failure and a failback switching process is performed to switch the processing that was switched from the primary site 100 to the secondary site 200 by the failover switching process back to the primary site 100, the specifications of the instance of the secondary site 200 are lowered.

[0082] In the computer system according to this embodiment, the specifications include the amount of hardware resources used by the instance.

[0083] In the computer system according to this embodiment, the amount of hardware resources includes at least one of a processor, a memory, and a network.

[0084] When executing failover switching processing or failback switching processing, the computer system according to this embodiment stops and restarts the secondary site 200, and changes are made to the specifications of the instance that executes the above-mentioned data processing at the time of restart.

[0085] More specifically, in the computer system according to this embodiment, the disaster recovery management system 301 refers to the site performance information management table 333 and the instance specification information management table 332 during failover switching processing and failback switching processing, and selects the instance specification of the secondary site 200 that can withstand the load after the transition and has the lowest cost.

[0086] At the primary site 100, the storage node processes input and output data, and transfers the data to the secondary site 200 by remote copy, and at the secondary site 200, the storage node receives and stores the data. The data processing at the primary site 100 includes processing with a heavy load, whereas the secondary site 200 stores data and has a light load. For example, when a mid-spec instance specification is adopted at the secondary site 200, if a failure occurs at the primary site 100, first, a failover switching process is executed as a transition from the primary site 100 to the secondary site 200, and the storage node at the secondary site 200 takes over the processing of the storage node at the primary site. At this time, the remote copy is stopped. Here, the mid-spec instance specification indicates, for example, an instance specification with the type 332A of the instance specification information management table 332 being "2".

[0087] At this time, for example, the fact that the maximum CPU operating rate 333C of the secondary site 200 has exceeded "32 cores" is recorded in the site performance information management table 333 as the peak load of the storage node 202 at the secondary site 200. If it is assumed that a CPU core count of "32 cores or more but less than 64 cores" is required, the disaster recovery management system 301 adopts high-spec instance specifications as instance specifications at the secondary site 200 as instance specifications capable of withstanding the load after the transition. Here, a high-spec instance indicates, for example, an instance specification with type 332A of "3" in the instance specification information management table 332. In other words, as a result of the failover switching process being executed, the instance specifications are raised by one stage.

[0088] When the primary site 100 returns to a normal state after the failover switching process is completed, a failback switching process is executed as a transition from the secondary site 200 to the primary site 100, and the process taken over by the storage node of the secondary site 200 in the failover is returned to the instance of the primary site 100. At this time, if, for example, the maximum CPU operating rate 333C of the secondary site 200 is less than "32 cores", the maximum memory usage 333D is less than "256 GiB", and the maximum network usage bandwidth 333E is less than "20 Gbps" as the peak load of the storage node 202 in the secondary site 200 is recorded in the site performance information management table 333, the disaster recovery management system 301 adopts the mid-range instance specification as the instance specification in the secondary site 200 as the instance specification capable of withstanding the load after the transition. Here, the mid-range instance specification indicates, for example, an instance specification with the type 332A of the instance specification information management table 332 being "2". In other words, as a result of the execution of the failback switching process, the instance specifications are lowered by one level.

[0089] When, for example, the maximum CPU operating rate 333C of the secondary site 200 is "3 GHz, 16 cores" or less, the maximum memory usage 333D is "128 GiB" or less, and the maximum network bandwidth usage 333E is "10 Gbps" or less as the peak load of the storage node 202, is recorded in the site performance information management table 333, the disaster recovery management system 301 can adopt low-spec instance specifications as instance specifications at the secondary site 200 as instance specifications that can withstand the load after the transition. Here, the low-spec instance specifications indicate, for example, an instance specification whose type 332A in the instance specification information management table 332 is "1".

[0090] 7 is a diagram showing an example of a pair configuration of multiple volumes constructed between the primary site 100 and the secondary site 200. Note that the reason why multiple volumes are used as shown in the figure is to configure the primary volume 510 of the primary site 100 to be copied to the journal volume 521 of the secondary site 200 simultaneously at a specified checkpoint.

[0091] A primary volume (PVOL: Primary Volume) 510 is disposed in the storage system 102 of the primary site 100. A secondary volume (SVOL: Secondary Volume) 521 that is paired with the primary volume 510 by data synchronization through the above-mentioned remote copy is disposed in the storage node 202 of the secondary site 200.

[0092] During normal operation, the host 101 executes I / O processing on the primary volume 510 of the primary site 100. At this time, update operation data 530 for the primary volume 510 is recorded as update operation data 531 in a journal volume (JNL0 to JNLB) 520 on the storage system 102 in which the primary volume 510 is located.

[0093] Thereafter, the update operation data 531 recorded in the journal volume 520 on the primary volume 510 side is transferred to the storage node 202 of the secondary site 200 via, for example, two systems of iSCSI, and recorded as update operation data 532 in the journal volume 521 arranged in the storage node 202. Thereafter, by an update operation on the journal volume 521 of the secondary site 200, the update operation data 532 recorded in the journal volume 521 is reflected in the secondary volume 511 paired with the primary volume 510 by data synchronization by the above-mentioned remote copy. The journal volume 521 has information regarding the difference in data written to the primary volume 510 (PVOL).

[0094] A series of operations for reflecting the update operation data recorded in the primary volume 510 of the primary site 100 in the secondary volume 511 of the secondary site 200 can be asynchronous or synchronous, but either may be executed. In the asynchronous case, when the I / O processing of the host 101 is completed to record in the journal volume 520 of the primary site 100, the storage system 102 responds with the result of the I / O processing to the host 101, and then reflects the update operation data 532 in the secondary volume 511 of the secondary site 200. In the synchronous case, in the I / O processing of the host 101, after the reflection of the update operation data 532 in the secondary volume 511 is completed, the storage system 102 responds with the result of the I / O processing to the host 101. The computer system according to this embodiment supports a consistency group in which a plurality of primary volumes 510 and secondary volumes 511 are bundled and grouped.

[0095] 8 is a state transition diagram for explaining an example of state transitions between the primary site 100 and the secondary site 200 according to this embodiment. There are five states for the primary site 100 and the secondary site 200: a steady state 601, a failover in progress state 602, only the secondary site in operation S603, data synchronization between sites in progress S604, and failback in progress S605.

[0096] Immediately after the introduction of the primary site 100 and the secondary site 200, the initial states of the primary site 100 and the secondary site 200 become a steady state 601. If the primary site 100 stops in the steady state 601, the states of the primary site 100 and the secondary site 200 transition to a failover in progress state 602. Stopping of the primary site 100 includes a failure of the primary site 100 and a maintenance stop of the primary site 100.

[0097] When the states of the primary site 100 and the secondary site 200 are in a failover in progress state 602, a failover switching process is executed as a process of switching from the primary site 100 to the secondary site 200. When the failover switching process is completed, the states of the primary site 100 and the secondary site 200 transition to a secondary site 200 only in operation state 603. In the secondary site 200 only in operation state 603, only the secondary site 200 is executing the above-mentioned data processing, and the primary site 100 has stopped the data processing. After the failover, the secondary site 200 inputs and outputs data using a secondary volume that was remote-copied from the primary volume of the primary site 100 before the failover. The specific contents of the failover switching process will be described later with reference to FIG. 11 and FIG. 12.

[0098] Thereafter, when recovery of the primary site 100 is complete, the states of the primary site 100 and the secondary site 200 transition to an inter-site data synchronizing state 604. In the inter-site data synchronizing state 604, the contents of the update processing to the secondary volume 511 executed at the secondary site 200 while the primary site 100 was stopped are reflected in the primary volume 510 arranged at the primary site 100 by data synchronization using remote copy, and data synchronization processing is executed to match the contents of the primary volume 510 and the secondary volume 511.

[0099] When the data synchronization process is completed, the states of the primary site 100 and the secondary site 200 transition to a failback state 605. In the failback state 605, a failback switching process is executed as a switching process from the secondary site 200 to the primary site 100. When the failback switching process is completed, the states of the primary site 100 and the secondary site 200 transition to a steady state 601. During failback, a process is performed to reflect, in the primary volume of the primary site 100, data that was written only to the secondary volume of the secondary site 200 while the primary site 100 was unable to operate due to a failure and was failed over. The specific contents of the failback switching process will be described later with reference to Figs. 13 to 15.

[0100] 9 is a diagram for explaining an example of normal I / O processing by the host 101 of the primary site 100 according to this embodiment. When the host 101 of the primary site 100 executes a data write process as normal I / O processing, the program 140 running on the host 101 sends a write request to the storage system 102 to write the target data (arrow 700). This write request includes, for example, a volume ID, an address, a data size, and update data.

[0101] The storage system 102 that has received the write request records data 151 including update data and its management information in the target primary volume 510 based on the received write request (arrow 701). Next, the storage system 102 writes the data 151 recorded in the primary volume 510 to the journal volume 520 as update operation data 152 for the primary volume 510. After that, the storage system 102 transmits the update operation data 152 to the storage node #0 202 having the secondary volume 511 of the secondary site 200 as update operation data 153. The primary volume 510 and the journal volume 520 are managed on a storage pool 170 of the storage system 102. The storage pool 170 protects data by making it redundant among a plurality of storage devices mounted in the storage system 102. In this case, for example, RAID (Redundant Array of Independent Disks) is used as data protection having an area in which a protection area is virtualized.

[0102] The storage node #0 202 receives the update operation data 153 transmitted as described above, records it in the journal volume 521 as update operation data 154, and reflects the recorded update operation data 154 in the secondary volume 511 as update operation data 155. The journal volume 521 and the secondary volume 511 are managed by the storage pool 270 of the storage node #0 202. The storage pool 270 protects these data 154, 155 by making them redundant between the storage devices 254 for storing user data. Examples of data protection include mirroring and erasure codes. The secondary volume 511 and the journal volume 521 form a redundancy group between two or more different storage nodes, and among these storage nodes, the secondary volume on one storage node is managed as active, and the secondary volume on the other storage node is managed as standby.

[0103] In this embodiment, the #0 storage node 202 is active, and the #1 storage node 202 is standby. The update operation data 154 recorded in the journal volume 521 is recorded as data to which management information has been added. Furthermore, a data update is requested to other standby nodes belonging to the redundancy group. The #1 storage node 202 that is on standby writes the update operation data 155. The #1 storage node 202 records the update operation data 155 by making it redundant between redundancy groups.

[0104] Next, data read processing will be described. When the host 101 of the primary site 100 executes data read processing as normal I / O processing, the program 140 running on the host 101 sends a read request for the target data to the storage system 102. The storage system 102 sends the data of the primary volume 510 specified in the read request to the host 101.

[0105] 10 is a diagram for explaining an example of I / O processing between the primary site 100 and secondary site 200 according to this embodiment. When executing I / O processing (e.g., data write processing) in the inter-site data synchronization in progress state 604, the application 240 running on the host 201 sends a write request to the target data to the storage node #0 202 (arrow 720). The write request includes, for example, a volume ID, address, data size, and update data 160.

[0106] When storage node #0 202 receives a write request from host 201, it records update data 160 and data 161 including its management information in the secondary volume 511 that is the target of the write request based on the received write request. Next, storage node #0 202 writes update operation data 162 for the secondary volume 511 to the journal volume 521 of the storage node 202 (arrow 721). Next, storage node #0 202 transmits the update operation data 162 to the storage system 102 having the primary volume 510 of the primary site 100 (arrow 722). Here, the redundancy processing between storage nodes is the same as the I / O processing during normal operation.

[0107] When the storage system 102 receives the update operation data 162 from the storage node #0 202, it records the received update operation data 162 in the journal volume 520 and reflects the update operation data 163 in the primary volume 510 based on the update operation (arrow 723).

[0108] On the other hand, when executing I / O processing (e.g., data write processing) in the state 603 where only the secondary site 200 is in operation, if the storage node 202 #0 receives a write request from the host 201, it records the update data 160 and data 161 including its management information in the secondary volume 511 that is the target of the write request based on the received write request, and writes the update operation data 162 for the secondary volume 511 to the journal volume 521 of the storage node 202 (arrow 721). After that, when the storage node 202 #0 completes writing the update operation data 162 to the secondary volume 511, it skips processing for the primary site 100 thereafter and responds to the host 201 with the result of the data write processing. After that, when the states of the primary site 100 and the secondary site 200 transition to the inter-site data synchronization in progress state 604, the storage node 202 #0 transmits the update operation data 162 recorded in the journal volume 521 in the state 603 where only the secondary site is in operation to the primary site 100. The update operation data 162 transmitted to the primary site 100 is reflected in the primary volume 510 via the journal volume 520 of the primary site 100 on the primary site side.

[0109] Next, when performing I / O processing (eg, data read processing) in the inter-site data synchronizing state 604, the application 240 running on the host 201 transmits a read request for the target data to the storage node #0 202 (arrow 720).

[0110] When the storage node #0 202 receives a read request from the host 201, it transmits the data 161 of the secondary volume 511 specified in the received read request to the host 201. Note that the data read process in the Only secondary site in operation state 603 is similar to the data read process in the Inter-site data synchronization in progress state 604.

[0111] 11 is a flowchart for explaining the monitoring of the status of the primary site in the disaster recovery management site according to this embodiment and the instruction of the switching process to the secondary site. The disaster recovery management system 301 in the disaster recovery management site 300 acquires the status of the primary site 100 via the external network 400 (step S801).

[0112] In this embodiment, the disaster recovery management system 301 of the disaster recovery management site 300 and the site management system 103 of the primary site 100 execute network communication via an external network (WAN) 400, and the disaster recovery management system 301 periodically acquires the status of the primary site 100 from the site management system 103 of the primary site 100. As an alternative method, the site management system 103 of the primary site 100 may periodically transmit the status of the primary site 100 to the disaster recovery management system 301 of the disaster recovery management site 300.

[0113] The disaster recovery management system 301 of the disaster recovery management site 300 checks the information of the primary site 100 acquired from the primary site 100 and judges whether the primary site 100 is down or not (step S802). If the primary site 100 is not down in step S802, that is, if the primary site 100 is normal, the disaster recovery management system 301 ends the processing of this routine, whereas if the primary site 100 is down in step S802, that is, if a failure has occurred in the primary site 100, the disaster recovery management system 301 instructs the site management system 203 of the secondary site 200 to switch to the secondary site 200 (step S803).

[0114] Thereafter, the disaster recovery management system 301 waits for a response from the site management system 203 of the secondary site 200 regarding the result of the switching process (step S804), and after receiving the result, it sets only the secondary site 200 of the primary site 100 and secondary site 200 to an operating state, and ends the processing of this routine. Thereafter, the disaster recovery management system 301 waits for the primary site 100 to resume operation, and when the primary site 100 resumes operation, it starts inter-site data synchronization between the primary site 100 and the secondary site 200.

[0115] 12 is a flowchart for explaining the failover switching process at the secondary site according to this embodiment. The site management system 203 of the secondary site 200 starts the failover switching process on the condition that an instruction for switching to the secondary site 200 is received from the disaster recovery management system 301 of the disaster recovery management site 300 (step S820).

[0116] The site management system 203 of the secondary site 200 instructs all the hosts 201 of the secondary site 200 to suspend I / O processing, and causes all the hosts 201 to suspend I / O processing (step S821).

[0117] When the specification change of the instance by restart is set, the site management system 203 instructs the storage cluster of the secondary site 200 to stop (step 822B) and stops the storage cluster (step S823). The site management system 203 is an example of a specification determination unit, and for example, collects at least load information of the secondary site 200 during normal operation, and determines the instance specification so that the secondary site 200 can withstand the peak load based on the collected load information. This instance specification includes the amount of hardware resources used by the instance. The amount of hardware resources here includes, for example, the amount of at least one of the resources of the arithmetic processing unit (CPU (Central Processing Unit) etc.), the main storage device (memory etc.) and the network (for example, a network interface card).

[0118] After this, the site management system 203 judges whether the specification change is due to restart (S821). At this time, the site management system 203 checks the setting of the method for changing the instance specification, and if the method for changing the instance specification due to restart is set, proceeds to step S822, and if the specification change while on is set, proceeds to step S826.

[0119] Next, the site management system 203 acquires the specifications of the secondary site 200 during I / O processing from the above-mentioned instance specification information management table 332, and changes the specifications of all instances in the storage cluster based on the acquired specifications (step S824). When changing the specifications of an instance, for example, the site management system 203 of the secondary site 200 uses an instance management API provided by the cloud to request the cloud to change the specifications.

[0120] Next, the site management system 203 of the secondary site 200 restarts the storage cluster (step S825) and waits for the completion of the restart of the storage cluster. For example, the site management system 203 of the secondary site 200 requests the cloud to power on all instances of the storage cluster using an instance management API provided by the cloud to restart the storage cluster. After all instances of the storage cluster have started, the storage cluster is restarted by a storage cluster restart process.

[0121] Next, after the restart of the storage cluster is completed, the site management system 203 of the secondary site 200 instructs the storage cluster to execute a failover switching process (step S826).

[0122] Next, the site management system 203 of the secondary site 200 instructs all hosts 201 of the secondary site 200 to resume I / O, causing all hosts 201 to resume I / O (step S827), and then responds with the result to the disaster recovery management system 301 (step S828).

[0123] Next, the site management system 203 of the secondary site 200 determines whether the specifications were changed while on (step S829), and if the specifications were not changed while on, ends the processing in this routine, and if the specifications were changed while on, proceeds to step S830. That is, when the site management system 203 of the secondary site 200 checks the setting of the method for changing the instance specifications in step S822, if the setting is to change the specifications while on, it responds with the result to the disaster recovery management system 301, then changes the specifications of the instance of the storage cluster of the secondary site 200 (step S830), and then ends the processing in this routine.

[0124] The computer system according to this embodiment includes a host 101 that executes I / O processing for a primary volume 510, and a plurality of instances are running at a secondary site 200. The above-mentioned specification change function changes the instance specifications of each instance at the secondary site 200, for each of the plurality of instances, one at a time, while continuing I / O processing, for example, in disaster recovery processing.

[0125] Furthermore, in this embodiment, the above-mentioned spec modification function modifies the instance specifications of the secondary site 200 one by one while continuing I / O processing after executing failback switching processing.

[0126] That is, the specification of the instance is changed for each storage node in a redundancy group constructed between multiple storage nodes, while continuing I / O processing. Specifically, in this embodiment, the storage nodes are stopped one by one, the instance specification of the storage node is changed, and then restarted one by one. The method of changing the specification of the instance is the same as the method of changing the description. This is performed for all storage nodes in the storage cluster.

[0127] 13 is a flowchart for explaining status monitoring of the primary site 100 and the secondary site 200 in a disaster recovery management site according to this embodiment and instruction of switchover processing to the primary site 100. When monitoring the status of the primary site 100 and the secondary site 200, the disaster recovery management system 301 of the disaster recovery management site 300 acquires the inter-site data synchronization status of the primary site 100 and the secondary site 200 (step S840).

[0128] At this time, in this embodiment, the disaster recovery management system 301 of the disaster recovery management site 300, the site management system 103 of the primary site 100, and the site management system 203 of the secondary site 200 execute network communication via an external network (WAN) 400, and the disaster recovery management system 301 of the disaster recovery management site 300 periodically acquires status from the site management system 103 of the primary site 100 and the site management system 203 of the secondary site 200. As an alternative method, the site management system 103 of the primary site 100 and the site management system 203 of the secondary site 200 may periodically transmit their status to the disaster recovery management system 301 of the disaster recovery management site 300.

[0129] The disaster recovery management system 301 of the disaster recovery management site 300 checks the acquired inter-site data synchronization status and determines whether or not inter-site data resynchronization has been completed (step S841). If it determines in step S841 that inter-site data resynchronization has not been completed, i.e., if inter-site data synchronization is currently running, it terminates the processing of this routine, and if it determines in step S841 that inter-site data resynchronization has been completed, i.e., if inter-site data synchronization has been completed, it instructs the site management system 103 of the primary site 100 and the site management system 203 of the secondary site 200 to perform switching processing from the secondary site 200 to the primary site 100 (step S842).

[0130] Thereafter, the disaster recovery management system 301 of the disaster recovery management site 300 waits for a response regarding the results of the switching process from the site management system 103 of the primary site 100 and the site management system 203 of the secondary site 200 (step S843), and after receiving the results, terminates processing in this routine.

[0131] 14 is a flowchart for explaining the failback switching process in the secondary site 200 according to this embodiment. The site management system 203 of the secondary site 200 starts the failback switching process on the condition that an instruction for switching to the primary site 100 is received from the disaster recovery management system 301 of the disaster recovery management site 300 (step S860).

[0132] The site management system 203 of the secondary site 200 instructs all hosts 201 of the secondary site 200 to temporarily suspend I / O, temporarily suspending I / O of all hosts 201 (step S861). After this, the site management system 203 judges whether the specification change is due to restart (step S862). At this time, the site management system 203 checks the setting of the method of changing the instance specifications, and if the method of changing the instance specifications due to restart is set, proceeds to step S863, and if the specification change while on is set, proceeds to step S866.

[0133] If a specification change of the instance due to restart is set, the site management system 203 of the secondary site 200 instructs the storage cluster of the secondary site 200 to perform a planned shutdown, and shuts down the storage cluster (step S863).

[0134] Next, the site management system 203 acquires the specifications of the secondary site I / O in progress from the specification management table of the instance of the secondary site 200, and changes the specifications of all instances in the storage cluster based on the acquired values ​​(step S864). When changing the specifications of an instance, for example, the site management system 203 of the secondary site 200 requests the cloud to change the specifications using an instance management API provided by the cloud.

[0135] Next, the site management system 203 of the secondary site 200 restarts the storage cluster (step S865) and waits for the completion of the restart of the storage cluster. For example, the site management system 203 of the secondary site 200 requests the cloud to power on all instances of the storage cluster using an instance management API provided by the cloud to restart the storage cluster. After all instances of the storage cluster have started, the storage cluster is restarted by a storage cluster restart process.

[0136] Next, after the restart of the storage cluster is completed, the site management system 203 of the secondary site 200 instructs the storage cluster to execute a failback switching process (step S866).

[0137] Next, the site management system 203 of the secondary site 200 instructs all hosts 201 of the secondary site 200 to resume I / O, causing all hosts 201 to resume I / O (step S867), and then responds with the result to the disaster recovery management system 301 (step S868).

[0138] Next, the site management system 203 of the secondary site 200 determines whether the specifications were changed while on (step S869), and if the specifications were not changed while on, ends this failback switching process, and if the specifications were changed while on, executes step S870. That is, in step S870, when the site management system 203 of the secondary site 200 checks the setting of the method for changing the instance specifications in step S862, if the setting is to change the specifications while on, it changes the specifications of the instance of the storage cluster of the secondary site 200 after responding to the result to the disaster recovery management system 301, and then ends this failback switching process.

[0139] As described above, instance specifications are changed for each storage node in a redundant group constructed between multiple storage nodes, while continuing remote copying associated with I / O processing. One storage node is stopped in a planned manner, the instance specifications of that storage node are changed, and the node is restarted. The method for changing instance specifications is the same as the method for changing descriptions. This is carried out for all storage nodes in the storage cluster.

[0140] 15 is a flowchart for explaining the failback switching process at the primary site according to this embodiment. The site management system 103 at the primary site 100 starts the failback switching process at the primary site 100 on the condition that an instruction for switching process from the secondary site 200 to the primary site 100 is received from the disaster recovery management system 301 at the disaster recovery management site 300 (step S880).

[0141] The site management system 103 of the primary site 100 instructs the storage system 102 of the primary site 100 to perform switching processing from the secondary site 200 to the primary site 100, and waits for the completion of this switching processing (step S881).

[0142] Next, the site management system 103 of the primary site 100 instructs the host 101 of the primary site 100 to perform switching processing to the host 101 of the primary site 100, and waits for the completion of this switching processing (step S882).

[0143] Next, the site management system 103 of the primary site 100 instructs the host 101 of the primary site 100 to resume I / O processing, causing the host 101 to resume I / O processing (step S883), and then responds with the results of the I / O processing to the disaster recovery management system 301 of the disaster recovery management site 300 (step S884), and then terminates this failback switching process.

[0144] As described above, the computer system according to this embodiment comprises a primary site 100 which holds a primary volume and has an instance which executes data processing related to data input / output to the primary site 100, and a secondary site 200 which holds a secondary volume 511 which is paired with the primary volume by data synchronization through remote copy and has an instance, remote copy is set between the primary volume and the secondary volume, the instance at the primary site 100 transfers data input / output to the primary volume to the secondary site 200, and the instance at the secondary site 200 stores the transferred data in the secondary volume, and a specification change function is provided which changes the specification of the instance at the secondary site 200 when performing a failover switching process for switching execution of data processing between the primary site 100 and the secondary site 200 from the primary site 100 to the secondary site 200, or a failback switching process for switching from the secondary site 200 to the primary site 100 after the failover switching process (specification change step).

[0145] In this way, the instance specifications of the secondary site 200 in normal operation can be kept to a minimum, thereby reducing the cost of operating the secondary site 200 in normal operation. Therefore, in disaster recovery processing, the cost of the hardware of the secondary site 200 in normal operation can be reduced while maintaining the performance of I / O processing.

[0146] In the computer system according to this embodiment, when a failure occurs in the primary site 100 and failover switching processing is performed to switch from the primary site 100 to the secondary site 200, the specification change function increases the specifications of the instance that executes data processing at the secondary site 200. In this way, during disaster recovery processing, the secondary site 200 can ensure operating specifications of instances with more sufficient performance than in normal times.

[0147] When the computer system according to this embodiment executes failover switching processing, the instance of the secondary site 200 processes input / output data, and inputs / outputs the data to / from the secondary volume.

[0148] When the computer system according to this embodiment executes failover switching processing, the instance of the secondary site 200 performs data input / output using the secondary volume that was data-synchronized with the primary volume by remote copy before the failover switching processing.

[0149] The computer system according to this embodiment stops remote copying when failover switching processing is executed.

[0150] In the computer system according to this embodiment, when the primary site 100 recovers from a failure and a failback switching process is executed to switch the processes that were switched from the primary site 100 to the secondary site 200 by the failover switching process from the secondary site 200 to the primary site 100, the instance specifications at the secondary site 200 are lowered. In this way, after the failback switching process is executed, the secondary site 200 has the minimum instance specifications required for the secondary site 200 in a normal state, and the cost and power consumption at the secondary site 200 can be suppressed.

[0151] In the computer system according to this embodiment, the specifications include the amount of hardware resources used by the instance. In this way, the operating costs of the hardware of the secondary site 200 during normal operation can be kept to a minimum, and power consumption can also be reduced.

[0152] In the computer system according to this embodiment, the amount of hardware resources includes at least one of the processor, memory, and network. In this way, the operating cost of the hardware of the secondary site 200 during normal operation can be minimized, and power consumption can also be reduced.

[0153] In this embodiment, when a failover switching process or a failback switching process is executed, the specification change function stops and restarts the secondary site 200, and changes the specifications of the instance that executes the above data processing at the time of restart. In this way, data inconsistency between the primary volume on the primary site 100 side and the secondary volume on the secondary site 200 side can be made less likely to occur.

[0154] In the computer system according to this embodiment, a plurality of instances are running at the secondary site 200, and the specification change function changes the specifications of the plurality of instances at the secondary site 200 one by one while continuing I / O processing in disaster recovery processing. In this way, the specifications of each instance can be reliably changed while minimizing the impact on I / O processing in disaster recovery processing.

[0155] The computer system according to this embodiment includes a host 101 that executes I / O processing for a primary volume, and a plurality of instances are running at a secondary site 200, and the specification change function changes the operating specifications of the instances at the secondary site 200, changing the specifications of the instances one by one while continuing I / O processing after executing a failback switching process. In this way, the specifications of each instance can be changed reliably while minimizing the impact on I / O processing after executing a failback switching process.

[0156] In this embodiment, the secondary site 200 includes a site management system 203, which collects at least load information of the primary site 100 during normal operation and determines instance specifications based on the collected load information so that the primary site 100 can withstand peak loads. In this way, the secondary site 200 can ensure the minimum instance specifications necessary to withstand peak loads, and therefore does not need to hold unnecessary instance specifications, minimizing operational costs and reducing power consumption.

[0157] It should be noted that the present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the spirit and scope of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations.

[0158] In addition, each of the configurations, functions, etc. described above may be realized in hardware, for example by designing some or all of them as an integrated circuit, or may be realized in software by a processor interpreting and executing a program that realizes each function.

[0159] Information such as programs, tables, files, etc. that realize each function can be stored in storage devices such as memory, hard disks, and SSDs (Solid State Drives), or recording media such as IC (Integrated Circuit) cards, SD (Secure Digital) cards, and DVDs (Digital Versatile Discs). [Industrial Applicability]

[0160] The present invention can be applied to a computer system relating to a method for reducing the cost and power consumption at a secondary site by reducing the amount of hardware usage at the secondary site during standby. [Explanation of symbols]

[0161] 100...main site, 101...host, 102...storage system, 103...site management system, 104...internal network, 113, 123...storage device, 200...secondary site, 201...host, 202...storage node, 203...site management system, 205...storage system, 213, 223, 253...storage device, 300...disaster recovery management site, 301...disaster recovery management system, 313...storage device

Claims

1. a primary site having an instance that holds a primary volume and executes data processing related to input / output data; a secondary site having a secondary volume and an instance; a remote copy is set between the primary volume and the secondary volume, an instance at the primary site transfers data input / output to the primary volume to the secondary site, and the instance at the secondary site stores the transferred data in the secondary volume; A specification change unit is provided which changes the specification of the instance at the secondary site when a failover switching process is performed between the primary site and the secondary site to switch the execution of the data processing from the primary site to the secondary site, or a failback switching process is performed to switch the execution of the data processing from the secondary site to the primary site after the failover switching process.

1. A computer system comprising:

2. When a failure occurs in the primary site and the failover switching process is performed to switch from the primary site to the secondary site, the specifications of the instance that executes the data processing in the secondary site are increased.

2. The computer system according to claim 1 .

3. When the failover switching process is executed, the instance at the secondary site processes the input / output data and inputs / outputs the data to / from the secondary volume.

3. The computer system according to claim 2.

4. When the failover switching process is executed, the instance at the secondary site performs data input / output using the secondary volume that was data-synchronized with the primary volume by the remote copy before the failover switching process.

3. The computer system according to claim 2.

5. When the failover switching process is executed, the remote copy is stopped.

3. The computer system according to claim 2.

6. When the primary site recovers from a failure and the failback switching process is executed to switch the process that was switched from the primary site to the secondary site by the failover switching process from the secondary site to the primary site, the specification of the instance at the secondary site is reduced.

3. The computer system according to claim 2.

7. The specs are: Includes the amount of hardware resources used by the instance 2. The computer system according to claim 1 .

8. The amount of hardware resources includes at least one of a processor, a memory, and a network.

8. The computer system according to claim 7,

9. When performing the failover switching process or the failback switching process, the secondary site is stopped and restarted; The specification of the instance that executes the data processing is changed at the time of the restart.

2. The computer system according to claim 1 .

10. The secondary site is: A specification determination unit that collects load information of at least the primary site during normal operation and determines the specifications of the instance based on the collected load information so that the primary site can withstand a peak load.

2. The computer system according to claim 1 .

11. a primary site having an instance that holds a primary volume and executes data processing related to input / output data; A method for managing an operation of a computer system comprising: a remote copy is set between the primary volume and the secondary volume, an instance at the primary site transfers data input / output to the primary volume to the secondary site, and the instance at the secondary site stores the transferred data in the secondary volume; When a failover switching process for switching the execution of the data processing between the primary site and the secondary site from the primary site to the secondary site or a failback switching process for switching the execution of the data processing from the secondary site to the primary site after the failover switching process is performed, the specification of the instance at the secondary site is changed.

23. A computer system operation management method comprising:

Images