Switchover control system, switchover control method, and program

Abstract

To provide a switchover control system, a switchover control method, and a program, which enable even a staff member who does not have specialized knowledge about IT infrastructure to easily execute switchover.SOLUTION: A switchover control system 5 includes: an execution request reception section 500 that receives an execution request for switchover transmitted from an administrator terminal 4; a database setting section 5031 that executes database setting processing; a virtual server activation section 5032 that executes virtual server activation processing; an application activation section 5033 that executes application activation processing; and a communication target switching section 504 that executes communication target switching processing. Switchover processing, including the database setting processing, the virtual server activation processing, the application activation processing, and the communication target switching processing, is executed sequentially in this order in response to receiving the execution request.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a switchover control system, a switchover control method, and a program. [Background technology]

[0002] In systems that employ a redundant configuration including an active system and a standby system, switchover is known as a technique for switching from the active system to the standby system when an abnormality occurs in the active system due to a disaster or other reason. Unlike failover, in which a computer automatically switches from the active system to the standby system when an abnormality is detected in the active system, switchover is performed manually. Because of this characteristic, switchover has the advantage of being able to flexibly switch systems, taking into account various factors in the event of an abnormality (such as fluctuations in traffic volume due to system switching and the possibility of false detection of an abnormality). Summary of the Invention [Problem to be solved by the invention]

[0003] Switchovers are not easy for staff without specialized knowledge of IT infrastructure, such as servers, databases, and cloud computing (hereinafter referred to as "non-specialist staff"). Switchovers are typically performed by staff located at locations other than the production site where the active system is located. However, for the convenience of maintaining systems during normal operations, staff with specialized knowledge of IT infrastructure (hereinafter referred to as "specialist staff") are often assigned to the production site, and there may be a shortage or no specialized staff at locations other than the production site. As a result, situations may arise where non-specialist staff are forced to perform switchovers. However, it is not easy for non-specialist staff to perform switchovers, which require manual operations such as database configuration, server startup, and network switching.

[0004] The present invention has been made in consideration of the above-mentioned problems, and one of its objectives is to provide a switchover control system, a switchover control method, and a program that allow even staff who do not have specialized knowledge of IT infrastructure to easily perform switchover. [Means for solving the problem]

[0005] A switchover control system according to one embodiment of the present invention is a switchover control system disposed at one or more locations different from the operating location, the switchover control system controlling a switchover from the operating system to the first standby system in a cloud system in which the operating system includes an operating virtual server that is activated to run one or more operating applications, and an operating database that is capable of reading and writing data based on instructions from the one or more operating applications, the operating system being disposed at an operating location; a first standby virtual server that is not activated and on which one or more first standby applications that are copies of the one or more operating applications are disposed; and a first standby database in which data is synchronized with the operating database, the first standby system being disposed at a first standby location different from the operating location and an administrator terminal that is disposed at a management location different from the operating location, the switchover control system being disposed at one or more locations different from the operating location, the switchover control system controlling a switchover from the operating system to the first standby system, the switchover control system including: an execution request receiving means that receives a request to execute the switchover sent from the administrator terminal; and a database setting means for executing a database setting process to stop synchronization of data between the active system and the first standby database, to configure the first standby database so that data can be written based on instructions from the one or more standby applications, and to configure the active database so that data cannot be written based on instructions from the one or more active applications; a virtual server startup means for executing a virtual server startup process to start the first standby virtual server; an application startup means for executing an application startup process to start the one or more first standby applications in the first standby virtual server; and a communication target switching means for executing a communication target switching process to switch the target of communication with one or more client terminals from the active system to the first standby system, wherein the switchover process including the database setting process, the virtual server startup process, the application startup process, and the communication target switching process is executed sequentially in this order in response to the acceptance of the execution request. [Effects of the Invention]

[0006] According to the present invention, even staff members who do not have specialized knowledge of IT infrastructure can easily perform switchover. [Brief explanation of the drawings]

[0007] [Figure 1A] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1B] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1C] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1D] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1E] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1F] 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 2] FIG. 1 is a diagram illustrating a hardware configuration of a cloud system according to an embodiment of the present invention. [Figure 3] FIG. 2 is a block diagram showing the functional configuration of an active system, a first standby system, and a second standby system. [Figure 4] 1 is a block diagram showing a functional configuration of a switchover control system according to an embodiment of the present invention. [Figure 5] FIG. 10 is a diagram illustrating an example of access information. [Figure 6A] FIG. 2 is a flow chart showing an example of processing executed in the switchover control system according to the embodiment of the present invention. [Figure 6B] FIG. 2 is a flow chart showing an example of processing executed in the switchover control system according to the embodiment of the present invention. [Figure 6C]FIG. 2 is a flow chart showing an example of processing executed in the switchover control system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0009] [1. Overview of the switchover control system] 1A to 1F are diagrams illustrating an overview of a switchover control system according to an embodiment of the present invention.

[0010] Systems that provide web services such as e-commerce and financial transactions often employ redundant configurations to ensure that services can continue to be provided even in the event of an emergency such as a disaster, cyberattack, or terrorism.

[0011] FIG. 1A shows an example of a cloud system S that employs such a redundant configuration. The cloud system S is a cloud system provided by a public cloud service such as AWS (Amazon Web Services) (registered trademark), Microsoft Azure (registered trademark), or Google Cloud Platform (registered trademark). Note that the cloud system S may also be an on-premise cloud system operated by the company that provides the service.

[0012] As shown in FIG. 1A, the cloud system S mainly includes an active system 1, a first standby system 2, a second standby system 3, and an administrator terminal 4. In the following general explanation, the active system 1 may be simply referred to as the "active system," and the first standby system 2 and the second standby system 3 may be collectively simply referred to as the "standby systems."

[0013] The production system 1 is a system that provides services under normal circumstances. In the production system 1, the virtual server is already started, and services are provided by the functions of the applications running on the virtual server. In addition, the production system 1 is capable of reading and writing data from and to the database based on instructions from the application. In the example shown in FIG. 1A, the production system 1 is deployed in Tokyo, which is the operating location. Note that deployment can also be referred to as deployment.

[0014] The first standby system 2 and the second standby system 3 are systems that are in a standby state under normal circumstances. The virtual servers of the first standby system 2 and the second standby system 3 are not started, and copies of the applications related to the services are placed on them. In addition, the databases of the first standby system 2 and the second standby system 3 are synchronized with the database of the active system 1. In the example shown in FIG. 1A, the first standby system 2 is placed in Osaka, which is the first standby location, and the second standby system 3 is placed in Nagaoka, which is the second standby location.

[0015] The administrator terminal 4 is a terminal of a staff member who is an administrator and who performs a switchover, which will be described later, when an abnormality occurs in the operational system 1. The administrator terminal 4 is located in Fukuoka, which is a management location.

[0016] As shown in Figure 1B, in a system that employs a redundant configuration, if an abnormality occurs in the active system, it is necessary to switch the entity providing the service from the active system to the standby system. Note that, below, the switching of the entity providing the service from the active system to the standby system may be simply referred to as "system switching."

[0017] Known techniques for such system switching include failover and switchover. In a failover, when an abnormality is detected in the active system, a computer automatically switches from the active system to a standby system. In contrast, in a switchover, the switch from the active system to the standby system is manually performed. Switchover has the advantage of being able to flexibly switch systems, taking into account various circumstances when an abnormality occurs (such as fluctuations in traffic volume due to system switching and the possibility of false detection of an abnormality).

[0018] However, implementing a switchover is not easy for non-specialized staff. As mentioned above, switchovers are typically performed by staff located in locations other than Tokyo (e.g., Fukuoka) where the production system is located. However, for the convenience of system maintenance during normal times, specialized staff are often assigned to Tokyo, and there may be a shortage or no specialized staff at locations other than Tokyo. As a result, in the event of an emergency such as a natural disaster in Tokyo, a situation may arise in which non-specialized staff are forced to implement a switchover instead of the specialized staff in Tokyo in order to maintain service. However, implementing a switchover, which requires manual operations such as database configuration, virtual server startup, and network switching, is not easy for non-specialized staff.

[0019] In view of the above-mentioned problems, the inventors of the present application have devised a switchover control system 5 according to this embodiment. The switchover control system 5 executes switchover processing including database setting processing, virtual server startup processing, application startup processing, and communication target switching processing. An overview of each processing will be described below.

[0020] [Database setting process] Under normal circumstances, it is possible to read data from the standby system's database, but it is not possible to write data to it. Therefore, when switching over, it is necessary to configure the standby system so that data can be written to the database. Furthermore, to maintain database consistency after switchover, it is necessary to stop synchronization between the database of the original active system and the database of the standby system, and to configure the standby system so that data cannot be written to the active system's database.

[0021] Therefore, in the switchover control system 5 of this embodiment, the database setting process is as follows: (1) synchronization between the database of the operating system and the database of the standby system is stopped, (2) setting is made so that data can be written to the database of the standby system, and (3) setting is made so that data cannot be written to the database of the operating system.

[0022] [Virtual server startup process / Application startup process] In public cloud services such as AWS, even if an application is not actually running on the virtual server of the standby system, i.e., even if the standby system is not providing a service, charges for using the virtual server will be incurred as long as the virtual server is running. Therefore, under normal circumstances, the virtual server of the standby system is simply placed on the standby system and is not running.

[0023] Therefore, the switchover control system 5 according to this embodiment is configured to execute a virtual server startup process for starting up a virtual server of the standby system. Also, the switchover control system 5 is configured to execute an application startup process for starting up an application on the started virtual server of the standby system.

[0024] [Communication target switching process] Under normal circumstances, the operating system communicates with the client terminal (receiving requests from the client terminal, sending data to the client terminal, etc.), and therefore the operating system is set as the target of communication with the client terminal.

[0025] Therefore, in the switchover control system 5 according to this embodiment, the communication target switching process is performed to switch the target of communication with the client terminal from the active system to the first standby system.

[0026] In this embodiment, the switchover process described above is executed simply by sending a switchover execution request from the administrator terminal 4 to the switchover control system 5 (more specifically, the switchover execution system 50). FIG. 1C shows an example of a screen G of the administrator terminal 4 when sending a switchover execution request to the switchover control system 5. Even non-specialist staff can execute a switchover simply by pressing the "Execute" button on the screen G.

[0027] In this way, according to the switchover control system 5 of this embodiment, even staff members who do not have specialized knowledge of IT infrastructure can easily perform switchover.

[0028] In the switchover control system 5, database configuration, virtual server startup, application startup, and communication target switching are automatically performed in sequence, but the timing of starting the switchover itself is determined by the staff member performing the switchover. Therefore, even in the switchover control system 5, the advantage of switchover, that is, the ability to flexibly switch systems, can still be enjoyed.

[0029] Incidentally, the switchover control system 5 according to this embodiment also has a function for preventing false detection of abnormalities in the operational system 1, a function for selecting the optimal switchover destination, and a function for changing the switchover destination depending on the state of the switchover destination.

[0030] [Preventing switchover due to false detection of an abnormality in production system 1] In a system where switchover is performed based on monitoring results from a single location, switchover can be performed erroneously not only when an abnormality occurs in the operational system 1, but also when the operational system 1 is operating normally but there is a problem with communication between the location in question and the operational system 1.

[0031] Therefore, in the switchover control system 5 according to this embodiment, as shown in Fig. 1D, monitoring devices 51-1 and 51-2 located at a plurality of points are used to monitor whether the active system 1 is operating normally. The switchover control system 5 determines whether the active system 1 is operating normally based on the monitoring results of the active system 1 from each of the plurality of points, and if it is determined that the active system 1 is operating normally, switchover is not executed.

[0032] With this configuration, whether the operating system 1 is operating normally is determined based on monitoring results from multiple locations, thereby preventing false detection of abnormalities caused by communication problems between a specific location and the operating system 1.

[0033] [Select the best switchover destination] One of the purposes of switchover, and therefore redundancy, is to continue providing services even if an abnormality occurs in the production system. However, if the switchover destination is selected inappropriately, the quality of service may be degraded after the switchover. For example, if the switchover destination is located away from an area with high access to the original production system, latency will increase after the switchover, resulting in a degradation of the quality of service.

[0034] Therefore, in the switchover control system 5 of this embodiment, as shown in Figure 1E, based on access information indicating the number of accesses to the operating system 1 from each of multiple regions, a system located at a point included in an area with a higher number of accesses to the operating system 1 is selected as the switchover destination.

[0035] With this configuration, the switchover destination will be a system located in an area with a higher number of accesses to the original operating system 1, thereby preventing an increase in latency after the switchover and, ultimately, a decrease in service quality.

[0036] [Change the switchover destination depending on the state of the switchover destination] Public cloud systems such as AWS (registered trademark) generally employ a multi-tenant architecture, in which systems from multiple service providers (called tenants) are deployed in data centers in various locations. In such a cloud system, if a disaster occurs in Tokyo, for example, the systems associated with each tenant deployed in the Tokyo data center are expected to be switched over to standby systems deployed in data centers in other locations, such as Osaka, through a failover or switchover. If systems are concentrated in a single data center, the processing power of the systems deployed in that data center may be reduced due to a shortage of hardware resources at the data center or network congestion. Executing a switchover to a system with reduced processing power makes it difficult to properly handle requests from client terminals after the switchover, resulting in a degradation in service quality.

[0037] Therefore, in the switchover control system 5 according to this embodiment, as shown in FIG. 1F, before starting the switchover process and during the switchover process, it is determined whether the system selected as the switchover destination can operate normally, and if it is determined that the system cannot operate normally, the switchover destination is changed and the switchover process is re-executed from the beginning.

[0038] With this configuration, if it is determined that the system selected as the switchover destination cannot operate normally, the switchover destination is changed, thereby preventing switchover to a standby system with reduced processing power and suppressing a decline in service quality.

[0039] The switchover control system 5 according to this embodiment will be described in detail below.

[0040] [2. Hardware configuration] 2 is a diagram showing the hardware configuration of a cloud system S according to an embodiment of the present invention. The cloud system S includes an active system 1, a first standby system 2, a second standby system 3, an administrator terminal 4, a switchover control system 5, a network management system 6, and a plurality of client terminals 7. The active system 1, the first standby system 2, the second standby system 3, the administrator terminal 4, the switchover control system 5, the network management system 6, and a plurality of client terminals 7 are interconnected by a network N. The network N includes networks such as the Internet, a WAN, and a LAN.

[0041] [2-1. Operational System] The operational system 1 is a computer system consisting of one or more computers installed in a data center in Tokyo. A data center is a facility where computers, communication devices, etc. are installed. The operational system 1 includes a control unit 1a, a memory unit 1b, and a communication unit 1c.

[0042] The control unit 1a is a program-controlled device such as a CPU that operates according to a program stored in the storage unit 1b. The storage unit 1b is, for example, a storage element such as a ROM or RAM, or a hard disk drive. The storage unit 1b stores programs and the like to be executed by the control unit 1a. The communication unit 1c is a communication interface such as a network board or a wireless LAN module.

[0043] [2-2. First standby system] The first standby system 2 is a computer system consisting of one or more computers installed in a data center in Osaka. The first standby system 2 includes a control unit 2a, a storage unit 2b, and a communication unit 2c. The physical configurations of the control unit 2a, the storage unit 2b, and the communication unit 2c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0044] [2-3. Second standby system] The second standby system 3 is a computer system consisting of one or more computers installed in a data center in Nagaoka. The second standby system 3 includes a control unit 3a, a storage unit 3b, and a communication unit 3c. The physical configurations of the control unit 3a, the storage unit 3b, and the communication unit 3c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0045] [2-4. Administrator terminal] The administrator terminal 4 is a computer of a staff member who is an administrator who will implement the switchover. The administrator terminal 4 is a personal computer, a tablet terminal, a smartphone, a wearable terminal, etc. In this embodiment, the administrator terminal 4 is installed in Fukuoka.

[0046] The administrator terminal 4 includes a control unit 4a, a storage unit 4b, a communication unit 4c, an operation unit 4d, and a display unit 4e. The physical configurations of the control unit 4a, the storage unit 4b, and the communication unit 4c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively. The operation unit 4d is an input device such as a keyboard, a mouse, or a touch panel. The display unit 4e is a display such as a liquid crystal display or an organic EL display.

[0047] [2-5. Switchover Control System] The switchover control system 5 is a computer system made up of a plurality of computers. The switchover control system 5 includes a switchover execution system 50 and a monitoring system 51.

[0048] [2-5-1. Switchover Execution System] The switchover execution system 50 is a computer system made up of one or more computers. In this embodiment, the one or more computers making up the switchover execution system 50 are installed in Osaka.

[0049] The switchover execution system 50 includes a control unit 50a, a storage unit 50b, and a communication unit 50c. The physical configurations of the control unit 50a, the storage unit 50b, and the communication unit 50c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0050] [2-5-2. Monitoring System] The monitoring system 51 is a computer system made up of multiple computers (monitoring devices). Each monitoring device is made up of one or more computers. In this embodiment, as shown in FIG. 1D, the monitoring system 51 includes a monitoring device 51-1 installed in South Korea and a monitoring device 51-2 installed in the United States. Note that the monitoring system 51 may include three or more monitoring devices. Furthermore, the locations where the monitoring devices are installed are not limited to the above example.

[0051] The monitoring system 51 includes a control unit 51a, a storage unit 51b, and a communication unit 51c. The physical configurations of the control unit 51a, the storage unit 51b, and the communication unit 51c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0052] [2-6. Network Management System] The network management system 6 is a computer system made up of one or more computers. The network management system 6 provides various network-related functions, such as a hub, a router, a firewall, a load balancer, and a DNS server.

[0053] The network management system 6 includes a control unit 6a, a storage unit 6b, and a communication unit 6c. The physical configurations of the control unit 6a, the storage unit 6b, and the communication unit 6c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0054] [2-7. Client terminal] Each of the multiple client terminals 7 is a client computer that receives services from the operating system 1. Each of the multiple client terminals 7 is a personal computer, a tablet terminal, a smartphone, a wearable terminal, etc. Note that the number of client terminals 7 may be one.

[0055] Each of the multiple client terminals 7 includes a control unit 7a, a storage unit 7b, a communication unit 7c, an operation unit 7d, and a display unit 7e. The physical configurations of the control unit 7a, the storage unit 7b, and the communication unit 7c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively. The physical configurations of the operation unit 7d and the display unit 7e may be similar to those of the operation unit 4d and the display unit 4e, respectively.

[0056] The programs stored in the storage units 1b, 2b, 3b, 4b, 50b, and 51b may be supplied via the network N. Also, the programs stored in a computer-readable information storage medium may be supplied via a reading unit (for example, an optical disk drive or a memory card slot) that reads the information storage medium, or via an input / output unit (for example, a USB port) that inputs and outputs data to and from an external device.

[0057] [3. Functional configuration of the active system, first standby system, and second standby system] FIG. 3 is a block diagram showing the functional configuration of the operating system 1, the first standby system 2, and the second standby system 3. As shown in FIG.

[0058] [3-1. Operational System] The active system 1 includes an active virtual server 10 and an active database 11 .

[0059] The active virtual server 10 is a started virtual server that runs a plurality of active applications 100. The active virtual server 10 is virtualized using a virtualization technology such as a hypervisor method or a container method (not shown) that runs on the hardware shown in FIG.

[0060] The multiple active applications 100 are applications that provide functions related to the service. In this embodiment, the multiple active applications 100 include, as an example, an active e-commerce application 100-1 and an active financial transaction application 100-2. Under normal circumstances when the active system 1 operates normally, each active application 100 provides a function related to the service. Note that there may be only one active application 100.

[0061] The active database 11 is a database that can read and write data based on instructions from multiple active applications 100. Each active application 100 reads and writes data from and to the active database 11 via a database management system (DBMS) (not shown).

[0062] [3-2. First standby system] The first standby system 2 includes a first standby virtual server 20 and a first standby database 21.

[0063] The first standby virtual server 20 is an unactivated virtual server on which a plurality of first standby applications 200 are deployed. Like the active virtual server 10, the first standby virtual server 20 is also virtualized using a virtualization technology such as a hypervisor method or a container method.

[0064] The multiple first standby applications 200 are copies of the multiple active applications 100. In this embodiment, the first standby applications 200 include, as an example, a first standby e-commerce application 200-1 and a first standby financial transaction application 200-2. Each first standby application 200 is installed in the storage unit of the first standby virtual server 20, but does not provide any service-related functions during normal operation when the active system 1 is operating normally. Note that there may be only one first standby application 200.

[0065] The first standby database 21 is a database whose data is synchronized with the active database 11. The synchronization of data between the first standby database 21 and the active database 11 is periodically performed by a database management system (DBMS). During normal times when the active system 1 is operating normally, it is possible to read data from the first standby database 21, but it is not possible to write data to the first standby database 21.

[0066] [3-3. Second standby system] The second standby system 3 includes a second standby virtual server 30 and a second standby database 31.

[0067] The second standby virtual server 30 is an unactivated virtual server on which a plurality of second standby applications 300 are deployed. Like the active virtual server 10, the second standby virtual server 30 is also virtualized using a virtualization technology such as a hypervisor method or a container method.

[0068] The multiple second standby applications 300 are copies of the multiple active applications 100. In this embodiment, the second standby applications 300 include, as an example, a second standby e-commerce application 300-1 and a second standby financial transaction application 300-2. Each second standby application 300 is installed in the memory unit of the second standby virtual server 30, but does not provide any service-related functions during normal operation when the active system 1 is operating normally. Note that there may be only one second standby application 300.

[0069] The second standby database 31 is a database whose data is synchronized with the active database 11. The synchronization of data between the second standby database 31 and the active database 11 is performed periodically by a database management system (DBMS). During normal times when the active system 1 is operating normally, it is possible to read data from the second standby database 31, but it is not possible to write data to the second standby database 31.

[0070] [4. Functional configuration of switchover control system] 4 is a block diagram showing the functional configuration of a switchover control system 5 according to an embodiment of the present invention. The switchover control system 5 controls switchover from the active system 1 to either the first standby system 2 or the second standby system 3. In the following description, in addition to the switchover control system 5, an administrator terminal 4 will also be mentioned, but the administrator terminal 4 is not included in the switchover control system 5 in this embodiment.

[0071] [4-1. Administrator terminal] 4, the administrator terminal 4 functionally includes an execution request transmission unit 400. The execution request transmission unit 400 is realized mainly by the control unit 4a.

[0072] The execution request sending unit 400 sends a switchover execution request to the switchover execution system 50. Specifically, the execution request sending unit 400 sends a switchover execution request to the switchover execution system 50 in response to pressing of the "Execute" button on screen G shown in Fig. 1C. Of course, the screen related to sending the switchover execution request is not limited to the example shown in Fig. 1C.

[0073] The execution request sending unit 400 may perform authentication to determine whether the user attempting to send the execution request is an administrator or a person approved by the administrator, and, on the condition that the authentication is successful, send the switchover execution request to the switchover execution system 50. This makes it possible to prevent the switchover execution request from being sent erroneously. The authentication itself may be performed by a known authentication means.

[0074] [4-2. Switchover Execution System] 4, the switchover execution system 50 functionally includes an execution request reception unit 500, an access information storage unit 501, a switchover destination selection unit 502, a switchover execution unit 503, an operation information acquisition unit 504, an operation feasibility determination unit 505, and a switchover destination change unit 506. The execution request reception unit 500, the switchover destination selection unit 502, the switchover execution unit 503, the operation information acquisition unit 504, the operation feasibility determination unit 505, and the switchover destination change unit 506 are implemented mainly in the control unit 50a. The access information storage unit 501 is implemented mainly in the storage unit 50b.

[0075] The execution request receiving unit 500 receives a switchover execution request sent from the administrator terminal 4.

[0076] The access information storage unit 501 stores access information indicating the number of accesses to the operating system 1 from each of a plurality of regions.

[0077] Fig. 5 is a diagram showing an example of access information. As shown in Fig. 5, the access information is data in which each of a plurality of regions is associated with the number of accesses to the operating system 1 from that region. The access information may be created, for example, by identifying the location of each of a plurality of client terminals 7 that accessed the operating system 1 during a predetermined period, based on the IP addresses corresponding to those client terminals 7. Fig. 5 shows, as an example, a case in which each region is a regional block in the seven regional divisions, such as "Kanto" and "Kansai," but each region may also be a prefecture, city, town, village, etc.

[0078] The switchover destination selection unit 502 selects either the first standby system 2 or the second standby system 3 as the switchover destination.

[0079] Specifically, the switchover destination selection unit 502 selects, as the switchover destination, one of the first standby system 2 or the second standby system 3, which is located in a location included in an area with a higher number of accesses to the active system 1, based on the access information. Specifically, the switchover destination selection unit 502 references the contents stored in the access information storage unit 501, and obtains a first number of accesses to the active system 1 from an area including the location where the first standby system 2 is located, and a second number of accesses to the active system 1 from an area including the location where the second standby system 3 is located. Then, the switchover destination selection unit 502 compares the first number of accesses with the second number of accesses to determine the area with a higher number of accesses to the active system 1, and selects, as the switchover destination, the system located in a location included in that area.

[0080] In this embodiment, as shown in FIG. 5, the switchover destination selection unit 502 selects the first standby system 2 located in Osaka, which is included in the Kansai region and has a higher number of accesses to the active system 1, as the switchover destination. Therefore, in the following explanation, it is assumed that the switchover destination is the first standby system 2. However, the following explanation also applies when the switchover destination is the second standby system 3. Therefore, in the following explanation, the terms "first standby virtual server 20" and "first standby database 21" can be read as "second standby virtual server 30" and "second standby database 31."

[0081] The switchover execution unit 503 executes switchover processing. The switchover processing includes database setting processing, virtual server startup processing, application startup processing, and communication target switching processing. The switchover processing including the database setting processing, virtual server startup processing, application startup processing, and communication target switching processing is executed sequentially in this order in response to the acceptance of the execution request.

[0082] The switchover execution unit 503 includes a database setting unit 5031 , a virtual server activation unit 5032 , an application activation unit 5033 , and a communication target switching unit 5034 .

[0083] The database setting unit 5031 executes a database setting process to (1) stop synchronization of data between the active database 11 and the first standby database 21, (2) set the first standby database 21 so that data can be written based on instructions from the multiple first standby applications 200, and (3) set the active database 11 so that data cannot be written based on instructions from the multiple active applications 100. Specifically, the database setting unit 5031 sends a request to the DBMS to execute the database setting process.

[0084] Furthermore, the database setting unit 5031 determines whether the operating system 1 is operating normally based on the monitoring results of the operating system 1 from each point by the alive monitoring unit 510 of the monitoring system 51, which will be described later, and does not execute the database setting process if it is determined that the operating system 1 is operating normally. Specifically, if the number of monitoring results indicating that the operating system 1 is operating normally is equal to or greater than a predetermined number, the database setting unit 5031 determines that the operating system 1 is operating normally and does not execute the database setting process. Note that if it is determined that the operating system 1 is not operating normally, the database setting unit 5031 executes the database setting process.

[0085] The virtual server startup unit 5032 executes a virtual server startup process to start the first standby virtual server 20. Specifically, the virtual server startup unit 5032 transmits a request to the first standby system 2 to execute the virtual server startup process. Upon receiving the request from the virtual server startup unit 5032, the first standby system 2 executes processes such as allocating computing resources such as a CPU and memory to the first standby virtual server 20, and setting and starting the OS, thereby starting the first standby virtual server 20.

[0086] The application launch unit 5033 executes an application launch process to launch a plurality of first standby applications 200 in the first standby virtual server 20. Specifically, the application launch unit 5033 transmits a request to the OS of the first standby virtual server 20 to launch the plurality of first standby applications 200 in the first standby virtual server 20. Upon receiving the request from the application launch unit 5033, the OS of the first standby virtual server 20 launches the plurality of first standby applications 200 in the first standby virtual server 20 by loading the plurality of first standby applications 200 into the memory of the first standby virtual server 20.

[0087] The communication target switching unit 5034 executes a communication target switching process to switch the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. Specifically, the communication target switching unit 5034 transmits a request to the network management system 6 to switch the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. Upon receiving the request from the communication target switching unit 5034, the network management system 6 updates the routing settings of a load balancer included in the network management system 6, thereby switching the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. The network management system 6 may also switch the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2 by updating the settings of a DNS server included in the network management system 6.

[0088] The operation information acquiring unit 504 acquires operation information indicating whether the first standby system 2 can operate normally. Specifically, the operation information acquiring unit 504 acquires operation information stored in a storage unit of a management system (not shown) of the cloud system S. For example, the management system may create the operation information by determining whether the first standby system 2 can operate normally based on the amount of computational resources available to the first standby virtual server 20. The management system may create the operation information by determining whether the first standby system 2 can operate normally based on the communication status between a data center in which the first standby system 2 is located and multiple client terminals 7. Furthermore, the operation information acquiring unit 504 may acquire, as examples of operation information, various metrics including golden signals such as a request response error rate, response time, and throughput of the target standby system.

[0089] When executing database setting processing and application startup processing, the operation feasibility determination unit 505 determines, based on operation information, whether the first standby system 2 (either the first standby system 2 or the second standby system 3, whichever is selected as the switchover destination by the switchover destination selection unit 502) can operate normally.

[0090] The operability determination unit 505 may determine whether the standby system selected as the switchover destination by the switchover destination selection unit 502 can operate normally based on the error rate of request responses in a data center including the standby system. The error rate changes depending on the number of accesses (corresponding to the degree of access congestion). The operability determination unit 505 may also make this determination based on the time-series change (time evolution) of the error rate. Specifically, if the change in the error rate per unit time in the data center including the standby system exceeds or falls below a predetermined value, the operability determination unit 505 may determine that the standby system can operate normally. Based on the change in the error rate per unit time in each of one or more standby systems, the operability determination unit 505 may determine that a standby system with a relatively large or small change in the error rate can operate normally. The operability determination unit 505 may also obtain a predicted value of the error rate by performing time series analysis based on a statistical model or a machine learning model, such as a Bayesian structure time series model, and determine that a standby system whose predicted value is above or below a predetermined value can operate normally. The operability determination unit 505 may make this determination based on metrics including the number of accesses instead of the error rate. There are no restrictions on the metrics as long as they are metrics that can be acquired by the operation information acquisition unit 504. The operability determination unit 505 may present a standby system that has been determined to be able to operate normally as a candidate when the switchover destination change unit 506, described below, changes the switchover destination. In this case, the switchover destination change unit 506 may change the standby system that has been determined to be able to operate normally as the switchover destination. At this time, the operability determination unit 505 makes this determination for each of one or more predetermined standby systems.

[0091] If it is determined that the first standby system 2 (one selected as the switchover destination by the switchover destination selection unit 502) cannot operate normally, the switchover destination change unit 506 changes the switchover destination to the second standby system 3 (the other of the first standby system 2 or the second standby system 3) and re-executes the switchover process from the beginning.

[0092] [4-3. Monitoring System] 4, monitoring system 51 includes monitoring devices 51-1 and 51-2. Functionally, monitoring devices 51-1 and 51-2 include alive-checking units 510-1 and 510-2, respectively. Alive-checking units 510-1 and 510-2 are implemented mainly in control unit 51a.

[0093] The alive / dead monitoring units 510-1 and 510-2 monitor whether the active system 1 is operating normally from each of multiple locations. In this embodiment, the monitoring device 51-1 is installed in South Korea and the monitoring device 51-2 is installed in the United States, so the alive / dead monitoring units 510-1 and 510-2 monitor whether the active system 1 is operating normally from each of South Korea and the United States. Specifically, the alive / dead monitoring units 510-1 and 510-2 periodically monitor whether the active system 1 is operating normally by Ping monitoring using a Ping command. The alive / dead monitoring units 510-1 and 510-2 may monitor whether the active system 1 is operating normally by various known monitoring means, such as Ping monitoring, SNMP monitoring, or port monitoring, in addition to Ping monitoring. The monitoring devices 51-1 and 51-2 periodically or in response to a request from the switchover execution system 50, transmit the monitoring results of the alive / dead monitoring units 510-1 and 510-2 to the switchover execution system 50.

[0094] [5. Switchover Control System Processing] 6A to 6C are flow diagrams showing an example of processing executed in a switchover control system according to an embodiment of the present invention. Note that in Fig. 6A to 6C, "switchover" is abbreviated to "SO" due to space limitations.

[0095] 6A, the administrator terminal 4 transmits a switchover execution request to the switchover execution system 50 (S6000), and ends the processing. The switchover execution system 50 accepts the switchover execution request transmitted from the administrator terminal 4 (S6001).

[0096] Next, the monitoring system 51 monitors whether the active system 1 is operating normally from each of the multiple locations and transmits the monitoring results to the switchover execution system 50 (S6002), thereby ending the process. Upon receiving the monitoring results (S6003), the switchover execution system 50 determines whether the active system 1 is operating normally (S6004). If the switchover execution system 50 determines that the active system 1 is operating normally (S6004; N), it simply ends the process.

[0097] 6B, if the switchover execution system 50 determines that the active system 1 is not operating normally (S6004; N), it refers to the contents of the access information storage unit 501 and determines, based on the access information, whether the first standby system 2 or the second standby system 3 is located in a location that is included in an area with a higher number of accesses to the active system 1 (S6005). If it is determined that the system located in a location that is included in an area with a higher number of accesses to the active system 1 is the first standby system 2, the switchover execution system 50 determines the first standby system 2 as the switchover destination (S6006a). On the other hand, if it is determined that the system located in a location that is included in an area with a higher number of accesses to the active system 1 is the second standby system 3, the switchover execution system 50 determines the second standby system 3 as the switchover destination (S6006b).

[0098] 6C, the switchover execution system 50 acquires operation information indicating whether the first standby system 2 can operate normally (S6008). The switchover execution system 50 determines whether the one selected as the switchover destination in S6005, out of the first standby system 2 or the second standby system 3, can operate normally (S6009). If it is determined that the one selected as the switchover destination cannot operate normally (S6009; N), the switchover execution system 50 changes the switchover destination (S6010) and executes the processing of S6011, which will be described later. If it is determined that the one selected as the switchover destination can operate normally (S6009; Y), the switchover execution system 50 simply executes the processing of S6011, which will be described later.

[0099] After executing database setting processing (S6011), the switchover execution system 50 executes virtual server startup processing (S6012). The switchover execution system 50 acquires operation information (S6013) and determines whether one of the first standby system 2 or the second standby system 3 selected as the switchover destination in S6005 (if the switchover destination was changed in S6010, the changed switchover destination) can operate normally (S6014). If it is determined that the one selected as the switchover destination cannot operate normally (S6014; N), the switchover execution system 50 changes the switchover destination (S6015) and re-executes the processing from S6011 onwards. If it is determined that the one selected as the switchover destination can operate normally (S6014; Y), the switchover execution system 50 executes application startup processing as is (S6016). Finally, the switchover execution system 50 executes communication target switching processing (S6017) and ends the processing.

[0100] According to the switchover control system 5 described above, even staff members who do not have specialized knowledge of IT infrastructure can easily perform a switchover.

[0101] [6. Modifications] The present invention is not limited to the above-described embodiment. It can be changed as appropriate within the scope of the present invention.

[0102] For example, the locations where the active system 1, the first standby system 2, the second standby system 3, and the administrator terminal 4 are located are not limited to the above example, and may be any locations.

[0103] Furthermore, for example, in this embodiment, a redundant configuration consisting of three systems, namely, an operating system 1, a first standby system 2, and a second standby system 3, has been exemplified, but a redundant configuration consisting of two systems, namely, an operating system and a standby system, may also be adopted.

[0104] Also, for example, in this embodiment, the case where the administrator terminal 4 and the switchover execution system 50 are configured by different computers has been described, but the computer that configures the administrator terminal 4 and the computer that configures the switchover execution system 50 may be the same computer.

[0105] Furthermore, for example, the switchover execution system 50 may be configured with multiple computers. When the switchover execution system 50 is configured with multiple computers, each computer may be installed at a different location. In other words, a distributed configuration may be adopted in which the program related to the switchover execution system 50 is divided into multiple subprograms, and each subprogram is executed by a computer installed at each of multiple locations.

[0106] Furthermore, for example, the operation feasibility determination unit 505 may determine whether the first standby system 2 can operate normally only when executing either the database setting process or the application startup process. Furthermore, the operation feasibility determination unit 505 may determine whether the first standby system 2 can operate normally only when executing the application startup process related to a part of the first standby application 200. For example, the operation feasibility determination unit 505 may determine whether the first standby system 2 can operate normally each time the first standby e-commerce application 200-1 and the first standby financial transaction application 200-2 are started.

[0107] While this embodiment illustrates switchover control in a financial transaction service, similar switchover control can be implemented in various services, including payment management, account management, financial product management, electronic commerce, and point management. The electronic commerce includes transactions involving tangible items such as goods, and intangible items such as facility reservations. The financial products include stocks and bonds traded in securities exchanges, as well as insurance products.

[0108] Furthermore, the specific character strings and numerical values ​​described above, as well as the specific character strings in the drawings, are merely examples, and the present invention is not limited to these character strings and numerical values.

[0109] [7. Notes] (1) an active system located at an operating location, the active system including an active virtual server that runs one or more active applications and an active database that can read and write data based on instructions from the one or more active applications; a first standby system including: a first standby virtual server that is not yet started and on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location that is different from the active location; an administrator terminal located at a management point different from the operation point; a switchover control system that controls a switchover from the active system to the first standby system in a cloud system in which the active system and the first standby system are connected to each other via a network, the switchover control system being disposed at one or more locations different from the active system; an execution request receiving means for receiving a switchover execution request transmitted from the manager terminal; a database setting means for executing a database setting process that stops data synchronization between the active database and the first standby database, and sets the first standby database so that data can be written based on instructions from the one or more standby applications, and sets the active database so that data cannot be written based on instructions from the one or more active applications; a virtual server startup means for executing a virtual server startup process for starting the first standby virtual server; application startup means for executing an application startup process for starting the one or more first standby applications on the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; and the switchover process including the database setting process, the virtual server startup process, the application startup process, and the communication target switching process is executed sequentially in this order in response to the acceptance of the execution request; Switchover control system. (2) A monitoring means for monitoring whether the operational system is operating normally from each of a plurality of points. and the database setting means determines whether the operating system is operating normally based on the monitoring results of the operating system from each of the locations, and does not execute the database setting process if it is determined that the operating system is operating normally; (1) A switchover control system according to (1). (3) The cloud system includes: a second standby system including: a second standby virtual server that is not yet started and on which one or more second standby applications that are copies of the one or more active applications are placed; and a second standby database whose data is synchronized with the active database, the second standby system being placed at a second standby point different from the active point and the first standby point; Further comprising: The switchover control system includes: controlling a switchover from the working system to either the first standby system or the second standby system; a switchover destination selection means for selecting either the first standby system or the second standby system as a switchover destination; Further comprising: A switchover control system according to (1) or (2). (4) access information storage means for storing access information indicating the number of accesses to the operational system from each of a plurality of regions; and The switchover destination selection means selecting, based on the access information, one of the first standby system and the second standby system that is located in a location included in the area where the number of accesses to the active system is greater, as a switchover destination; (3) A switchover control system as described in (3). (5) an operation information acquisition means for acquiring operation information indicating whether the first standby system can operate normally; an operation feasibility determination means for determining whether one of the first standby system or the second standby system selected as the switchover destination by the switchover destination selection means can operate normally based on the operation information when the database setting process is executed and / or when the application startup process related to at least a part of the one or more first standby applications is executed; a switchover destination change means for, when it is determined that one of the systems selected as the switchover destination by the switchover destination selection means cannot operate normally, changing the other of the first standby system or the second standby system as the switchover destination and re-executing the switchover process from the beginning; Further comprising: A switchover control system according to (3) or (4). [Explanation of symbols]

[0110] S cloud system, N network, 1 active system, 2 first standby system, 2c communication unit, 3 second standby system, 4 administrator terminal, 5 switchover control system, 50 switchover execution system, 51 monitoring system, 51-1, 51-2 monitoring device, 6 network management system, 7 client terminal, 10 active virtual server, 11 active database, 20 first standby virtual server, 21 first standby database, 30 second standby virtual server, 31 second standby database, 100 active application, 200 first standby application, 300 second standby application, 400 execution request sending unit, 500 execution request receiving unit, 501 access information storage unit, 502 switchover destination selection unit, 503 switchover execution unit, 504 operation information acquisition unit, 505 operation feasibility determination unit, 506 switchover destination change unit, 510 Alive monitoring unit, 5031 database setting unit, 5032 virtual server startup unit, 5033 application startup unit, 5034 communication target switching unit, G screen.

Claims

1. an active system located at an operating location, the active system including: an active virtual server that runs one or more active applications; and an active database that can read and write data based on instructions from the one or more active applications; a first standby system including: a first standby virtual server that is not yet started and on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; an administrator terminal located at a management point different from the operation point; a switchover control system that controls a switchover from the active system to the first standby system in a cloud system in which the active system and the first standby system are connected to each other via a network, the switchover control system being disposed at one or more locations different from the active system; an execution request receiving means for receiving a switchover execution request transmitted from the manager terminal; a database setting means for executing a database setting process that stops data synchronization between the active database and the first standby database, and sets the first standby database so that data can be written based on instructions from the one or more standby applications, and sets the active database so that data cannot be written based on instructions from the one or more active applications; a virtual server startup means for executing a virtual server startup process for starting the first standby virtual server; application startup means for executing an application startup process for starting the one or more first standby applications on the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; and the switchover process including the database setting process, the virtual server startup process, the application startup process, and the communication target switching process is executed sequentially in this order in response to the acceptance of the execution request; Switchover control system.

2. A monitoring means for monitoring whether the operational system is operating normally from each of a plurality of points. and the database setting means determines whether the operating system is operating normally based on the monitoring results of the operating system from each of the locations, and does not execute the database setting process if it is determined that the operating system is operating normally; The switchover control system of claim 1 .

3. The cloud system includes: a second standby system including: a second standby virtual server that is not yet started, on which one or more second standby applications that are copies of the one or more active applications are placed; and a second standby database whose data is synchronized with the active database, the second standby system being placed at a second standby point different from the active point and the first standby point; Further comprising: The switchover control system includes: controlling a switchover from the working system to either the first standby system or the second standby system; a switchover destination selection means for selecting either the first standby system or the second standby system as a switchover destination; Further comprising:

3. The switchover control system according to claim 1 or 2.

4. access information storage means for storing access information indicating the number of accesses to the operational system from each of a plurality of regions; and The switchover destination selection means selecting, as a switchover destination, one of the first standby system and the second standby system, which is located in a location included in the area where the number of accesses to the active system is greater, based on the access information; The switchover control system of claim 3 .

5. an operation information acquiring means for acquiring operation information indicating whether the first standby system can operate normally; an operation feasibility determination means for determining whether one of the first standby system or the second standby system selected as the switchover destination by the switchover destination selection means can operate normally based on the operation information when the database setting process is executed and / or when the application startup process related to at least a part of the one or more first standby applications is executed; a switchover destination change means for, when it is determined that one of the systems selected as the switchover destination by the switchover destination selection means cannot operate normally, changing the other of the first standby system or the second standby system as the switchover destination and re-executing the switchover process from the beginning; Further comprising: The switchover control system of claim 3 .

6. an active system located at an operating location, the active system including: an active virtual server that runs one or more active applications; and an active database that can read and write data based on instructions from the one or more active applications; a first standby system including: a first standby virtual server that is not yet started and on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; an administrator terminal located at a management point different from the operation point; 1. A switchover control method in a cloud system in which multiple systems are connected to each other via a network, the method comprising: controlling a switchover from the active system to the first standby system by a computer located at one or more locations different from the active system; an execution request receiving step of receiving a request to execute the switchover transmitted from the administrator terminal; a database setting step of stopping data synchronization between the active database and the first standby database, setting the first standby database to enable writing of data based on instructions from the one or more standby applications, and setting the active database to disable writing of data based on instructions from the one or more active applications; a virtual server activation step of activating the first standby virtual server; an application startup step of starting the one or more first standby applications on the first standby virtual server; a communication target switching step of switching a target of communication with one or more client terminals from the active system to the first standby system; and the database setting step, the virtual server activation step, the application activation step, and the communication target switching step are sequentially executed in this order in response to the acceptance of the execution request; Switchover control method.

7. an active system located at an operating location, the active system including: an active virtual server that runs one or more active applications; and an active database that can read and write data based on instructions from the one or more active applications; a first standby system including: a first standby virtual server that is not yet started and on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; an administrator terminal located at a management point different from the operation point; a program for causing a computer located at one or more locations different from the operating location to execute control of a switchover from the operating system to the first standby system in a cloud system in which the operating system and the first standby system are interconnected via a network, an execution request receiving means for receiving a request to execute the switchover transmitted from the manager terminal; a database setting means for executing a database setting process, which stops data synchronization between the active database and the first standby database, and sets the first standby database so that data can be written based on instructions from the one or more standby applications, and sets the active database so that data cannot be written based on instructions from the one or more active applications; a virtual server startup means for executing a virtual server startup process for starting the first standby virtual server; application startup means for executing an application startup process for starting the one or more first standby applications on the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; and The database setting process, the virtual server startup process, the application startup process, and the communication target switching process are executed sequentially in this order in response to the acceptance of the execution request. program.

Images