SWITCHOVER CONTROL SYSTEM, SWITCHOVER CONTROL METHOD, AND PROGRAM

Abstract

Provided is a switchover control system, a switchover control method, and a program that enable even staff without specialized knowledge of IT infrastructure to easily perform a switchover. [Solution] The switchover control system 5 has an execution request receiving unit 500 that receives a switchover execution request sent from an administrator terminal 4, a database setting unit 5031 that executes database setting processing, a virtual server startup unit 5032 that executes virtual server startup processing, an application startup unit 5033 that executes application startup processing, and a communication target switching unit 504 that executes communication target switching processing, and the switchover processing including the database setting processing, virtual server startup processing, application startup processing, and communication target switching processing are executed sequentially in this order in response to the reception of the execution request.

Description

[Technical field]

[0001] The present invention relates to a switchover control system, a switchover control method, and a program. [Background technology]

[0002] In a system employing a redundant configuration including an active system and a standby system, switchover is known as a technique for switching from the active system to the standby system when an abnormality occurs in the active system due to a disaster or the like. In a switchover, switching from the active system to the standby system is manually performed, unlike a failover in which switching from the active system to the standby system is automatically performed by a computer when an abnormality in the active system is detected. Due to these characteristics, a switchover has the advantage of being able to flexibly switch systems while taking into consideration various circumstances when an abnormality occurs (such as fluctuations in traffic volume due to system switching and the possibility of false detection of an abnormality). Summary of the Invention [Problem to be solved by the invention]

[0003] It is not easy for staff (hereinafter referred to as "non-expert staff") who do not have specialized knowledge about IT infrastructure such as servers, databases, and clouds to perform a switchover. A switchover is usually performed by staff at a location other than the operating site where the operating system is located. However, for the convenience of system maintenance during normal times, staff (hereinafter referred to as "expert staff") who have specialized knowledge about IT infrastructure are often assigned to the operating site, and there may be a shortage or no expert staff at locations other than the operating site. In such cases, a situation may arise in which non-expert staff have no choice but to perform a switchover, but it is not easy for non-expert staff to perform a switchover that requires manual operations such as database settings, server startup, and network switching.

[0004] The present invention has been made in consideration of the above-mentioned problems, and one of its objectives is to provide a switchover control system, a switchover control method, and a program that enable even staff who do not have specialized knowledge of IT infrastructure to easily perform a switchover. [Means for solving the problem]

[0005] A switchover control system according to an embodiment of the present invention includes an active system that is located at an operating point, the active system including an activated active virtual server that runs one or more active applications, and an active database that is capable of reading and writing data based on instructions from the one or more active applications, an unactivated first standby virtual server on which one or more first standby applications that are copies of the one or more active applications are located, and a first standby database in which data is synchronized with the active database, the first standby system being located at a first standby point different from the active point, and an administrator terminal being located at a management point different from the active point, the switchover control system being located at one or more points different from the active point, the switchover control system controlling a switchover from the active system to the first standby system in a cloud system in which the first standby system is located at a first standby point different from the active point, and an administrator terminal being located at a management point different from the active point, are interconnected by a network, the switchover control system being located at one or more points different from the active point, the switchover control system including an execution request receiving means for receiving an execution request for the switchover transmitted from the administrator terminal, the first standby database and the first standby database, and configures the first standby database so that writing of data based on instructions from the one or more standby applications is possible, and configures the active database so that writing of data based on instructions from the one or more active applications is disabled; virtual server startup means executing virtual server startup processing to start the first standby virtual server; application startup means executing application startup processing to start the one or more first standby applications in the first standby virtual server; and communication target switching means executing communication target switching processing to switch the target of communication with one or more client terminals from the active system to the first standby system, and switchover processing including the database setting processing, the virtual server startup processing, the application startup processing, and the communication target switching processing are executed sequentially in this order in response to the acceptance of the execution request. Effect of the Invention

[0006] According to the present invention, even staff who do not have specialized knowledge of IT infrastructure can easily perform a switchover. [Brief description of the drawings]

[0007] [Figure 1A] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1B] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1C] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1D] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1E] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Figure 1F] FIG. 1 is a diagram illustrating an overview of a switchover control system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram illustrating a hardware configuration of a cloud system according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram showing functional configurations of an active system, a first standby system, and a second standby system. [Figure 4] 1 is a block diagram showing a functional configuration of a switchover control system according to an embodiment of the present invention. [Diagram 5] FIG. 11 is a diagram illustrating an example of access information. [Figure 6A] FIG. 2 is a flow diagram showing an example of a process executed in the switchover control system according to the embodiment of the present invention. [Figure 6B] FIG. 2 is a flow diagram showing an example of a process executed in the switchover control system according to the embodiment of the present invention. [Figure 6C]FIG. 2 is a flow diagram showing an example of a process executed in the switchover control system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0009] [1. Overview of the switchover control system] 1A to 1F are diagrams for explaining an overview of a switchover control system according to an embodiment of the present invention.

[0010] Systems that provide web services such as electronic commerce and financial transactions often employ redundant configurations to ensure that services can continue to be provided even in the event of an emergency such as a natural disaster, a cyber attack, or terrorism.

[0011] 1A shows an example of a cloud system S that employs such a redundant configuration. The cloud system S is a cloud system provided by a public cloud service such as AWS (Amazon Web Services) (registered trademark), Microsoft Azure (registered trademark), or Google Cloud Platform (registered trademark). Note that the cloud system S may also be an on-premise cloud system operated by the company that provides the service itself.

[0012] 1A, the cloud system S mainly includes an active system 1, a first standby system 2, a second standby system 3, and an administrator terminal 4. In the following general explanation, the active system 1 may be simply referred to as the "active system," and the first standby system 2 and the second standby system 3 may be collectively simply referred to as the "standby systems."

[0013] The active system 1 is a system that provides services under normal circumstances. In the active system 1, the virtual server is already started, and the service is provided by the function of the application running on the virtual server. Also, in the active system 1, it is possible to read and write data from and to the database based on instructions from the application. In the example shown in FIG. 1A, the active system 1 is deployed in Tokyo, which is the operating location. Note that deployment can also be rephrased as deployment.

[0014] The first standby system 2 and the second standby system 3 are systems that are in a standby state during normal times. The virtual servers of the first standby system 2 and the second standby system 3 are not yet started, and copies of the applications related to the services are placed thereon. In addition, data in the databases of the first standby system 2 and the second standby system 3 is synchronized with the database of the active system 1. In the example shown in FIG. 1A, the first standby system 2 is placed in Osaka, which is the first standby point, and the second standby system 3 is placed in Nagaoka, which is the second standby point.

[0015] The manager terminal 4 is a terminal of a staff member who is a manager and who performs a switchover, which will be described later, when an abnormality occurs in the operational system 1. The manager terminal 4 is placed in Fukuoka, which is a management location.

[0016] Now, in a system that employs a redundant configuration as shown in Figure 1B, if an abnormality occurs in the active system, it is necessary to switch the subject of service provision from the active system to the standby system. Note that below, the switching of the subject of service provision from the active system to the standby system may be simply referred to as "system switching."

[0017] Known techniques for such system switching include failover and switchover. In a failover, when an abnormality is detected in the active system, the active system is automatically switched to the standby system by a computer. In contrast, in a switchover, the active system is manually switched to the standby system. A switchover has the advantage that it can flexibly switch systems in consideration of various circumstances when an abnormality occurs (such as fluctuations in traffic volume due to system switching and the possibility of erroneous detection of an abnormality).

[0018] However, it is not easy for non-specialized staff to perform a switchover. As mentioned above, a switchover is usually performed by staff in a location other than Tokyo (Fukuoka) where the production system is located. However, for the convenience of system maintenance during normal times, specialized staff are often assigned to Tokyo, and there may be a shortage or no specialized staff at locations other than Tokyo. In such a case, in order to continue services when an emergency such as a natural disaster occurs in Tokyo, non-specialized staff may have to perform a switchover instead of specialized staff in Tokyo. However, it is not easy for non-specialized staff to perform a switchover, which requires manual operations such as setting up a database, starting a virtual server, and switching a network.

[0019] In view of the above problems, the inventors of the present application have conceived of a switchover control system 5 according to this embodiment. In the switchover control system 5, switchover processing including a database setting process, a virtual server startup process, an application startup process, and a communication target switching process is executed. An overview of each process will be described below.

[0020] [Database setting process] Under normal circumstances, it is possible to read data from the database of the standby system, but it is not possible to write data to the database of the standby system. Therefore, when switching over, it is necessary to set up the standby system so that data can be written to the database. Also, in order to maintain the consistency of the database after switchover, it is necessary to stop synchronization between the database of the originally operating active system and the database of the standby system, and to set up so that data cannot be written to the database of the active system.

[0021] Therefore, in the switchover control system 5 of this embodiment, the database setting process is performed as follows: (1) synchronization between the database of the operational system and the database of the standby system is stopped, (2) setting is made so that data can be written to the database of the standby system, and (3) setting is made so that data cannot be written to the database of the operational system.

[0022] [Virtual server startup process / Application startup process] In public cloud services such as AWS, even if an application is not actually running on the virtual server of the standby system, i.e., even if the standby system is not providing a service, as long as the virtual server is running, fees for the use of the virtual server are incurred. Therefore, under normal circumstances, the virtual server of the standby system is simply placed in the standby system and is not running.

[0023] Therefore, in the switchover control system 5 according to the present embodiment, a virtual server startup process is executed to start up the virtual server of the standby system. Also, in the switchover control system 5, an application startup process is executed to start up an application in the started virtual server of the standby system.

[0024] [Communication target switching process] Under normal circumstances, the active system communicates with the client terminal (receiving requests from the client terminal, sending data to the client terminal, etc.), and therefore the active system is set as the target of communication with the client terminal.

[0025] Therefore, in the switchover control system 5 according to the present embodiment, the communication target switching process is configured to switch the target of communication with the client terminal from the active system to the first standby system.

[0026] In this embodiment, the switchover process described above is executed simply by sending a switchover execution request from the manager terminal 4 to the switchover control system 5 (more specifically, the switchover execution system 50). FIG. 1C shows an example of a screen G of the manager terminal 4 when sending a switchover execution request to the switchover control system 5. Even a non-specialist staff member can execute a switchover simply by pressing the "Execute" button on the screen G.

[0027] In this way, according to the switchover control system 5 according to this embodiment, even staff who do not have specialized knowledge of IT infrastructure can easily carry out a switchover.

[0028] In the switchover control system 5, database setting, virtual server startup, application startup, and communication target switching are automatically executed in sequence, but the timing to start the switchover itself is decided by the staff who will be performing the switchover. Therefore, even in the switchover control system 5, the advantage of switchover, that is, the ability to flexibly perform system switching, can still be enjoyed.

[0029] Incidentally, the switchover control system 5 of this embodiment also has a function for preventing erroneous detection of an abnormality in the operational system 1, a function for selecting an optimal switchover destination, and a function for changing the switchover destination depending on the state of the switchover destination.

[0030] [Preventing switchover due to false detection of anomaly in production system 1] In a system in which a switchover is performed based on monitoring results from a single location, a switchover can be erroneously performed not only when an abnormality occurs in the operational system 1, but also when the operational system 1 is operating normally but there is a problem with communication between the location in question and the operational system 1.

[0031] Therefore, in the switchover control system 5 according to this embodiment, as shown in Fig. 1D, monitoring devices 51-1, 51-2 arranged at a plurality of points respectively monitor whether the active system 1 is operating normally. In the switchover control system 5, based on the monitoring results of the active system 1 from each of the plurality of points, it is determined whether the active system 1 is operating normally, and if it is determined that the active system 1 is operating normally, a switchover is not executed.

[0032] With this configuration, whether the operating system 1 is operating normally is determined based on the monitoring results from multiple locations, thereby suppressing false detection of abnormalities caused by communication problems between a specific location and the operating system 1.

[0033] [Select the best switchover destination] One of the purposes of switchover, and therefore redundancy, is to continue providing services even if an abnormality occurs in the production system. If the switchover destination is not selected appropriately, the quality of service may be degraded after the switchover. For example, if the switchover destination is located away from an area with a high number of accesses to the original production system, the latency will be high after the switchover, resulting in a degradation of the quality of service.

[0034] Therefore, in the switchover control system 5 of this embodiment, as shown in Figure 1E, based on access information indicating the number of accesses to the operational system 1 from each of multiple regions, a system located at a point included in an area with a greater number of accesses to the operational system 1 is selected as the switchover destination.

[0035] With this configuration, the switchover destination will be a system located in an area with greater access to the original operational system 1, thereby suppressing increases in latency after switchover and, ultimately, deterioration in service quality.

[0036] [Change switchover destination depending on switchover destination status] In general, in a public cloud system such as AWS (registered trademark), a so-called multi-tenant architecture is adopted in which the systems of a plurality of businesses, called tenants, are arranged in data centers at various locations. In such a cloud system, for example, if a disaster occurs in Tokyo, it is expected that the systems related to each tenant arranged in the data center in Tokyo will be switched to standby systems arranged in data centers in other locations, such as Osaka, by failover or switchover. Here, if the switching destination of the systems is concentrated in one data center, the processing capacity of the systems arranged in the data center may be reduced due to the shortage of hardware resources in the data center and network congestion. If a switchover is performed to a system with reduced processing capacity in this way, it becomes difficult to appropriately handle requests sent from client terminals after the switchover, leading to a reduction in the quality of service.

[0037] Therefore, in the switchover control system 5 according to this embodiment, as shown in FIG. 1F, before starting the switchover process and during the switchover process, it is determined whether the system selected as the switchover destination can operate normally, and if it is determined that the system cannot operate normally, the switchover destination is changed and the switchover process is re-executed from the beginning.

[0038] According to this configuration, if it is determined that the system selected as the switchover destination cannot operate normally, the switchover destination is changed, thereby preventing a switchover to a standby system with reduced processing power and suppressing a deterioration in the quality of service.

[0039] The switchover control system 5 according to the present embodiment will be described in detail below.

[0040] [2. Hardware configuration] 2 is a diagram showing a hardware configuration of a cloud system S according to an embodiment of the present invention. The cloud system S includes an active system 1, a first standby system 2, a second standby system 3, an administrator terminal 4, a switchover control system 5, a network management system 6, and a plurality of client terminals 7. The active system 1, the first standby system 2, the second standby system 3, the administrator terminal 4, the switchover control system 5, the network management system 6, and a plurality of client terminals 7 are connected to each other by a network N. The network N includes networks such as the Internet, a WAN, and a LAN.

[0041] [2-1. Operational system] The operational system 1 is a computer system consisting of one or more computers installed in a data center in Tokyo. A data center is a facility in which computers, communication devices, etc. are installed. The operational system 1 includes a control unit 1a, a storage unit 1b, and a communication unit 1c.

[0042] The control unit 1a is a program control device such as a CPU that operates according to a program stored in the storage unit 1b. The storage unit 1b is a storage element such as a ROM or RAM, or a hard disk drive. The storage unit 1b stores programs executed by the control unit 1a. The communication unit 1c is a communication interface such as a network board or a wireless LAN module.

[0043] [2-2. First standby system] The first standby system 2 is a computer system consisting of one or more computers installed in a data center in Osaka. The first standby system 2 includes a control unit 2a, a storage unit 2b, and a communication unit 2c. The physical configurations of the control unit 2a, the storage unit 2b, and the communication unit 2c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0044] [2-3. Second standby system] The second standby system 3 is a computer system consisting of one or more computers installed in a data center in Nagaoka. The second standby system 3 includes a control unit 3a, a storage unit 3b, and a communication unit 3c. The physical configurations of the control unit 3a, the storage unit 3b, and the communication unit 3c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0045] [2-4. Administrator terminal] The administrator terminal 4 is a computer of a staff member who is an administrator who performs the switchover. The administrator terminal 4 is a personal computer, a tablet terminal, a smartphone, a wearable terminal, etc. In this embodiment, the administrator terminal 4 is installed in Fukuoka.

[0046] The administrator terminal 4 includes a control unit 4a, a storage unit 4b, a communication unit 4c, an operation unit 4d, and a display unit 4e. The physical configurations of the control unit 4a, the storage unit 4b, and the communication unit 4c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively. The operation unit 4d is an input device such as a keyboard, a mouse, or a touch panel. The display unit 4e is a display such as a liquid crystal display or an organic EL display.

[0047] [2-5. Switchover control system] The switchover control system 5 is a computer system including a plurality of computers. The switchover control system 5 includes a switchover execution system 50 and a monitoring system 51.

[0048] [2-5-1. Switchover execution system] The switchover execution system 50 is a computer system that is configured from one or more computers. In this embodiment, the one or more computers that configure the switchover execution system 50 are installed in Osaka.

[0049] The switchover execution system 50 includes a control unit 50a, a storage unit 50b, and a communication unit 50c. The physical configurations of the control unit 50a, the storage unit 50b, and the communication unit 50c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0050] [2-5-2. Surveillance system] The monitoring system 51 is a computer system composed of multiple computers (monitoring devices). Each monitoring device is composed of one or more computers. In this embodiment, as shown in FIG. 1D, the monitoring system 51 includes a monitoring device 51-1 installed in South Korea and a monitoring device 51-2 installed in the United States. Note that the monitoring system 51 may include three or more monitoring devices. Furthermore, the locations where the monitoring devices are installed are not limited to the above examples.

[0051] The monitoring system 51 includes a control unit 51a, a storage unit 51b, and a communication unit 51c. The physical configurations of the control unit 51a, the storage unit 51b, and the communication unit 51c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0052] [2-6. Network Management System] The network management system 6 is a computer system that is made up of one or more computers. The network management system 6 provides various network-related functions, such as a hub, a router, a firewall, a load balancer, and a DNS server.

[0053] The network management system 6 includes a control unit 6a, a storage unit 6b, and a communication unit 6c. The physical configurations of the control unit 6a, the storage unit 6b, and the communication unit 6c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively.

[0054] [2-7. Client terminal] Each of the multiple client terminals 7 is a client computer that receives a service from the operational system 1. Each of the multiple client terminals 7 is a personal computer, a tablet terminal, a smartphone, a wearable terminal, etc. Note that the number of client terminals 7 may be one.

[0055] Each of the multiple client terminals 7 includes a control unit 7a, a storage unit 7b, a communication unit 7c, an operation unit 7d, and a display unit 7e. The physical configurations of the control unit 7a, the storage unit 7b, and the communication unit 7c may be similar to those of the control unit 1a, the storage unit 1b, and the communication unit 1c, respectively. The physical configurations of the operation unit 7d and the display unit 7e may be similar to those of the operation unit 4d and the display unit 4e, respectively.

[0056] The programs stored in the storage units 1b, 2b, 3b, 4b, 50b, and 51b may be supplied via the network N. Also, the programs stored in a computer-readable information storage medium may be supplied via a reading unit (e.g., an optical disk drive or a memory card slot) that reads the information storage medium, or an input / output unit (e.g., a USB port) that inputs and outputs data to and from an external device.

[0057] [3. Functional configuration of the active system, the first standby system, and the second standby system] FIG. 3 is a block diagram showing the functional configuration of the active system 1, the first standby system 2, and the second standby system 3. As shown in FIG.

[0058] [3-1. Operational system] The active system 1 includes an active virtual server 10 and an active database 11 .

[0059] The active virtual server 10 is a started virtual server that runs a plurality of active applications 100. The active virtual server 10 is virtualized by a virtualization technology such as a hypervisor method or a container method (not shown) that runs on the hardware shown in FIG.

[0060] The multiple operating applications 100 are applications that provide functions related to the service. In this embodiment, the multiple operating applications 100 include, as an example, an operating e-commerce application 100-1 and an operating financial transaction application 100-2. During normal times when the operating system 1 operates normally, each operating application 100 provides a function related to the service. Note that there may be only one operating application 100.

[0061] The active database 11 is a database that can read and write data based on instructions from multiple active applications 100. Each active application 100 reads and writes data from and to the active database 11 via a database management system (DBMS) (not shown).

[0062] [3-2. First standby system] The first standby system 2 includes a first standby virtual server 20 and a first standby database 21 .

[0063] The first standby virtual server 20 is an unactivated virtual server on which a plurality of first standby applications 200 are arranged. Like the active virtual server 10, the first standby virtual server 20 is also virtualized using a virtualization technology such as a hypervisor method or a container method.

[0064] The multiple first standby applications 200 are copies of the multiple active applications 100. In this embodiment, the first standby applications 200 include, as an example, a first standby e-commerce application 200-1 and a first standby financial transaction application 200-2. Each of the first standby applications 200 is installed in the storage unit of the first standby virtual server 20, but does not provide a function related to the service during normal operation when the active system 1 operates normally. Note that there may be only one first standby application 200.

[0065] The first standby database 21 is a database whose data is synchronized with the active database 11. The synchronization of data between the first standby database 21 and the active database 11 is periodically performed by a database management system (DBMS). During normal times when the active system 1 is operating normally, it is possible to read data from the first standby database 21, but it is not possible to write data to the first standby database 21.

[0066] [3-3. Second standby system] The second standby system 3 includes a second standby virtual server 30 and a second standby database 31 .

[0067] The second standby virtual server 30 is an unactivated virtual server on which a plurality of second standby applications 300 are arranged. Like the active virtual server 10, the second standby virtual server 30 is also virtualized using a virtualization technology such as a hypervisor method or a container method.

[0068] The multiple second standby applications 300 are copies of the multiple active applications 100. In this embodiment, the second standby applications 300 include, as an example, a second standby e-commerce application 300-1 and a second standby financial transaction application 300-2. Each second standby application 300 is installed in the storage unit of the second standby virtual server 30, but does not provide a function related to the service during normal operation when the active system 1 operates normally. Note that there may be only one second standby application 300.

[0069] The second standby database 31 is a database whose data is synchronized with the active database 11. The synchronization of data between the second standby database 31 and the active database 11 is periodically performed by a database management system (DBMS). During normal times when the active system 1 is operating normally, it is possible to read data from the second standby database 31, but it is not possible to write data to the second standby database 31.

[0070] [4. Functional configuration of switchover control system] 4 is a block diagram showing a functional configuration of a switchover control system 5 according to an embodiment of the present invention. The switchover control system 5 controls a switchover from the operating system 1 to either the first standby system 2 or the second standby system 3. In the following description, in addition to the switchover control system 5, an administrator terminal 4 will also be mentioned, but the administrator terminal 4 is not included in the switchover control system 5 in this embodiment.

[0071] [4-1. Administrator terminal] 4, the administrator terminal 4 functionally includes an execution request transmission unit 400. The execution request transmission unit 400 is realized mainly by the control unit 4a.

[0072] The execution request sending unit 400 sends a switchover execution request to the switchover execution system 50. Specifically, the execution request sending unit 400 sends a switchover execution request to the switchover execution system 50 in response to pressing of the "Execute" button on screen G shown in Fig. 1C. Of course, the screen related to the transmission of the switchover execution request is not limited to the example shown in Fig. 1C.

[0073] The execution request transmission unit 400 may perform authentication as to whether or not the user attempting to transmit the execution request is an administrator or a person approved by the administrator, and transmit the switchover execution request to the switchover execution system 50 on condition that the authentication is successful. This makes it possible to prevent erroneous transmission of a switchover execution request. The authentication itself may be performed by a known authentication means.

[0074] [4-2. Switchover Execution System] 4, the switchover execution system 50 functionally includes an execution request receiving unit 500, an access information storage unit 501, a switchover destination selection unit 502, a switchover execution unit 503, an operation information acquisition unit 504, an operation feasibility determination unit 505, and a switchover destination change unit 506. The execution request receiving unit 500, the switchover destination selection unit 502, the switchover execution unit 503, the operation information acquisition unit 504, the operation feasibility determination unit 505, and the switchover destination change unit 506 are implemented mainly in the control unit 50a. The access information storage unit 501 is implemented mainly in the storage unit 50b.

[0075] The execution request receiving unit 500 receives a switchover execution request sent from the manager terminal 4 .

[0076] The access information storage unit 501 stores access information indicating the number of accesses to the operating system 1 from each of a plurality of regions.

[0077] Fig. 5 is a diagram showing an example of the access information. As shown in Fig. 5, the access information is data in which each of a plurality of regions is associated with the number of accesses from the region to the operating system 1. The access information may be created, for example, by identifying the location of a plurality of client terminals 7 based on the IP addresses corresponding to each of the client terminals 7 that accessed the operating system 1 during a predetermined period. Fig. 5 shows, as an example, a case in which each region is a regional block in the seven regional divisions, such as "Kanto" and "Kansai," but each region may also be a prefecture, city, town, or village, etc.

[0078] The switchover destination selection unit 502 selects either the first standby system 2 or the second standby system 3 as the switchover destination.

[0079] Specifically, the switchover destination selection unit 502 selects, based on the access information, as the switchover destination, one of the first standby system 2 or the second standby system 3, which is located at a point included in the area with the greater number of accesses to the active system 1. Specifically, the switchover destination selection unit 502 refers to the contents stored in the access information storage unit 501, and acquires a first number of accesses to the active system 1 from the area including the point where the first standby system 2 is located, and a second number of accesses to the active system 1 from the area including the point where the second standby system 3 is located. Then, the switchover destination selection unit 502 compares the first number of accesses with the second number of accesses to determine the area with the greater number of accesses to the active system 1, and selects, as the switchover destination, one located at a point included in that area.

[0080] In this embodiment, the switchover destination selection unit 502 selects, as the switchover destination, the first standby system 2 located in Osaka, which is included in the Kansai region and has a higher number of accesses to the operating system 1, as shown in FIG. 5. Therefore, in the following explanation, it is assumed that the switchover destination is the first standby system 2. However, the following explanation also applies to the case where the switchover destination is the second standby system 3. Therefore, in the following explanation, the "first standby virtual server 20" and the "first standby database 21" can be read as the "second standby virtual server 30" and the "second standby database 31".

[0081] The switchover execution unit 503 executes switchover processing. The switchover processing includes database setting processing, virtual server startup processing, application startup processing, and communication target switching processing. The switchover processing including the database setting processing, virtual server startup processing, application startup processing, and communication target switching processing is executed in this order in response to the acceptance of the execution request.

[0082] The switchover execution unit 503 includes a database setting unit 5031 , a virtual server activation unit 5032 , an application activation unit 5033 , and a communication target switching unit 5034 .

[0083] The database setting unit 5031 executes a database setting process to (1) stop synchronization of data between the active database 11 and the first standby database 21, (2) set the first standby database 21 so that writing of data based on instructions from the multiple first standby applications 200 is possible, and (3) set the active database 11 so that writing of data based on instructions from the multiple active applications 100 is impossible. Specifically, the database setting unit 5031 transmits a request to the DBMS to execute the database setting process.

[0084] Furthermore, the database setting unit 5031 determines whether the operating system 1 is operating normally based on the monitoring results of the operating system 1 from each point by the alive monitoring unit 510 of the monitoring system 51 described later, and does not execute the database setting process if it is determined that the operating system 1 is operating normally. Specifically, if the number of monitoring results indicating that the operating system 1 is operating normally is equal to or greater than a predetermined number, the database setting unit 5031 determines that the operating system 1 is operating normally and does not execute the database setting process. Note that the database setting unit 5031 executes the database setting process if it is determined that the operating system 1 is not operating normally.

[0085] The virtual server startup unit 5032 executes a virtual server startup process to start up the first standby virtual server 20. Specifically, the virtual server startup unit 5032 transmits a request to the first standby system 2 to execute the virtual server startup process. Upon receiving the request from the virtual server startup unit 5032, the first standby system 2 executes processes such as allocation of computing resources such as a CPU and memory to the first standby virtual server 20, and setting and starting up the OS, thereby starting up the first standby virtual server 20.

[0086] The application starting unit 5033 executes an application starting process for starting the multiple first standby applications 200 in the first standby virtual server 20. Specifically, the application starting unit 5033 transmits a request to the OS of the first standby virtual server 20 to start the multiple first standby applications 200 in the first standby virtual server 20. The OS of the first standby virtual server 20 that has accepted the request from the application starting unit 5033 starts the multiple first standby applications 200 in the first standby virtual server 20 by loading the multiple first standby applications 200 into the memory of the first standby virtual server 20.

[0087] The communication target switching unit 5034 executes a communication target switching process for switching the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. Specifically, the communication target switching unit 5034 transmits a request to the network management system 6 to switch the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. The network management system 6 that has received the request from the communication target switching unit 5034 updates the routing settings of the load balancer included in the network management system 6, thereby switching the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2. The network management system 6 may also switch the target of communication with the multiple client terminals 7 from the active system 1 to the first standby system 2 by updating the settings of a DNS server included in the network management system 6.

[0088] The operation information acquisition unit 504 acquires operation information indicating whether the first standby system 2 can operate normally. Specifically, the operation information acquisition unit 504 acquires operation information stored in a storage unit of a management system (not shown) of the cloud system S. For example, the management system may create the operation information by determining whether the first standby system 2 can operate normally based on the amount of computational resources available to the first standby virtual server 20. The management system may create the operation information by determining whether the first standby system 2 can operate normally based on the communication status between the data center in which the first standby system 2 is located and the multiple client terminals 7. In addition, the operation information acquisition unit 504 may acquire various metrics including golden signals such as a request response error rate, a response time, and a throughput in the target standby system as an example of the operation information.

[0089] When executing database setting processing and application startup processing, the operation feasibility determination unit 505 determines, based on the operation information, whether the first standby system 2 (either the first standby system 2 or the second standby system 3, whichever is selected as the switchover destination by the switchover destination selection unit 502) can operate normally.

[0090] The operation feasibility determination unit 505 may determine whether or not a standby system selected as a switchover destination by the switchover destination selection unit 502 can operate normally based on an error rate of a request response in a data center including the standby system. The error rate changes according to the number of accesses (corresponding to the degree of access congestion). The operation feasibility determination unit 505 may perform the determination based on a time series change (time evolution) of the error rate. Specifically, when the change amount of the error rate per unit time in the data center including the standby system exceeds or falls below a predetermined value, the operation feasibility determination unit 505 may determine that the standby system can operate normally. Based on the change amount of the error rate per unit time in each of one or more standby systems, the operation feasibility determination unit 505 may determine that a standby system with a relatively large or small change amount can operate normally. The operation feasibility determination unit 505 may obtain a predicted value of the error rate by performing a time series analysis based on a statistical model or a machine learning model such as a Bayesian structure time series model, and may determine that a standby system whose predicted value is greater than or less than a predetermined value can operate normally. The operation feasibility determination unit 505 may perform the determination based on a metric including the number of accesses instead of the error rate. There is no limitation on the metric as long as it is a metric that the operation information acquisition unit 504 can acquire. The operation feasibility determination unit 505 may present the standby system that has been determined to be able to operate normally as a candidate when the switchover destination change unit 506 described later changes the switchover destination. In this case, the switchover destination change unit 506 may change the standby system that has been determined to be able to operate normally to the switchover destination. At this time, the operation feasibility determination unit 505 performs the determination for each of one or more standby systems that have been determined in advance.

[0091] When it is determined that the first standby system 2 (the one selected as the switchover destination by the switchover destination selection unit 502) cannot operate normally, the switchover destination change unit 506 changes the switchover destination to the second standby system 3 (the other of the first standby system 2 or the second standby system 3) and re-executes the switchover process from the beginning.

[0092] [4-3. Surveillance system] 4, the monitoring system 51 includes monitoring devices 51-1 and 51-2. Functionally, the monitoring devices 51-1 and 51-2 include alive / dead monitoring units 510-1 and 510-2, respectively. The alive / dead monitoring units 510-1 and 510-2 are implemented mainly by the control unit 51a.

[0093] The alive / dead monitoring units 510-1 and 510-2 monitor whether the active system 1 is operating normally from each of a plurality of points. In this embodiment, the monitoring device 51-1 is installed in Korea, and the monitoring device 51-2 is installed in the United States, so the alive / dead monitoring units 510-1 and 510-2 monitor whether the active system 1 is operating normally from each of Korea and the United States. Specifically, the alive / dead monitoring units 510-1 and 510-2 periodically monitor whether the active system 1 is operating normally by Ping monitoring using a Ping command. The alive / dead monitoring units 510-1 and 510-2 may monitor whether the active system 1 is operating normally by various known monitoring means such as Ping monitoring, SNMP monitoring, port monitoring, etc. In addition to Ping monitoring, the monitoring devices 51-1 and 51-2 transmit the monitoring results by the alive / dead monitoring units 510-1 and 510-2 to the switchover execution system 50 periodically or in response to a request from the switchover execution system 50.

[0094] [5. Switchover Control System Processing] 6A to 6C are flow diagrams showing an example of a process executed in the switchover control system according to the embodiment of the present invention. In FIG. 6A to FIG. 6C, "switchover" is abbreviated to "SO" due to space limitations.

[0095] 6A, the administrator terminal 4 transmits a switchover execution request to the switchover execution system 50 (S6000), and ends the process. The switchover execution system 50 accepts the switchover execution request transmitted from the administrator terminal 4 (S6001).

[0096] Next, the monitoring system 51 transmits the monitoring results, obtained by monitoring whether or not the active system 1 is operating normally, from each of a plurality of points to the switchover execution system 50 (S6002), and ends the process. When the switchover execution system 50 receives the monitoring results (S6003), it judges whether or not the active system 1 is operating normally (S6004). When it is judged that the active system 1 is operating normally (S6004; N), the switchover execution system 50 ends the process as is.

[0097] 6B, when it is determined that the active system 1 is not operating normally (S6004; N), the switchover execution system 50 refers to the contents stored in the access information storage unit 501 and determines, based on the access information, which of the first standby system 2 and the second standby system 3 is located at a location included in an area with a higher number of accesses to the active system 1 (S6005). When it is determined that the system located at a location included in an area with a higher number of accesses to the active system 1 is the first standby system 2, the switchover execution system 50 determines the first standby system 2 as the switchover destination (S6006a). On the other hand, when it is determined that the system located at a location included in an area with a higher number of accesses to the active system 1 is the second standby system 3, the switchover execution system 50 determines the second standby system 3 as the switchover destination (S6006b).

[0098] 6C, the switchover execution system 50 acquires operation information indicating whether the first standby system 2 can operate normally (S6008). The switchover execution system 50 judges whether the one selected as the switchover destination in S6005, of the first standby system 2 or the second standby system 3, can operate normally (S6009). If it is judged that the one selected as the switchover destination cannot operate normally (S6009; N), the switchover execution system 50 changes the switchover destination (S6010) and executes the process of S6011 described later. If it is judged that the one selected as the switchover destination can operate normally (S6009; Y), the switchover execution system 50 executes the process of S6011 described later.

[0099] After executing the database setting process (S6011), the switchover execution system 50 executes the virtual server startup process (S6012). The switchover execution system 50 acquires operation information (S6013) and judges whether one of the first standby system 2 or the second standby system 3 selected as the switchover destination in S6005 (if the switchover destination is changed in S6010, the changed switchover destination) can operate normally (S6014). If it is judged that the one selected as the switchover destination cannot operate normally (S6014; N), the switchover execution system 50 changes the switchover destination (S6015) and re-executes the process from S6011 onwards. If it is judged that the one selected as the switchover destination can operate normally (S6014; Y), the switchover execution system 50 executes the application startup process as it is (S6016). Finally, the switchover execution system 50 executes the communication target switching process (S6017) and ends the process.

[0100] According to the switchover control system 5 described above, even staff who do not have specialized knowledge of IT infrastructure can easily carry out a switchover.

[0101] [6. Modifications] The present invention is not limited to the above-described embodiment. It can be modified as appropriate within the scope of the present invention.

[0102] For example, the locations where the active system 1, the first standby system 2, the second standby system 3, and the administrator terminal 4 are located are not limited to the above example, and may be any locations.

[0103] Also, for example, in this embodiment, a redundant configuration consisting of three systems, namely, an operating system 1, a first standby system 2, and a second standby system 3, has been exemplified, but a redundant configuration consisting of two systems, namely, an operating system and a standby system, may also be adopted.

[0104] Also, for example, in this embodiment, a case has been described in which the administrator terminal 4 and the switchover execution system 50 are configured by different computers, but the computer configuring the administrator terminal 4 and the computer configuring the switchover execution system 50 may be the same computer.

[0105] Also, for example, the switchover execution system 50 may be configured by a plurality of computers. When the switchover execution system 50 is configured by a plurality of computers, each computer may be installed at a different location. In other words, a distributed configuration may be adopted in which the program related to the switchover execution system 50 is divided into a plurality of subprograms, and each subprogram is executed by a computer installed at each of a plurality of locations.

[0106] Also, for example, the operation possibility determination unit 505 may determine whether the first standby system 2 can operate normally only when executing either the database setting process or the application startup process. Also, the operation possibility determination unit 505 may determine whether the first standby system 2 can operate normally only when executing the application startup process related to a part of the first standby application 200. For example, the operation possibility determination unit 505 may determine whether the first standby system 2 can operate normally only when starting up the first standby e-commerce application 200-1 and only when starting up the first standby financial transaction application 200-2.

[0107] In this embodiment, the switchover control in a financial transaction service is exemplified, but the same switchover control can be realized in various services including payment management, account management, financial product management, electronic commerce, and point management. The electronic commerce includes commerce related to tangible items such as goods, and commerce related to intangible items such as facility reservations. The financial products include stocks and bonds traded in securities exchanges, insurance products, and the like.

[0108] Furthermore, the specific character strings and numerical values ​​described above, as well as the specific character strings in the drawings, are merely examples, and the present invention is not limited to these character strings and numerical values.

[0109] [7. Notes] (1) an active system that is located at an operating site and includes an active virtual server that runs one or more active applications and an active database that is capable of reading and writing data based on instructions from the one or more active applications; a first standby system including an unactivated first standby virtual server on which one or more first standby applications that are copies of the one or more active applications are placed, and a first standby database whose data is synchronized with the active database, the first standby system being placed at a first standby location different from the active location; An administrator terminal disposed at a management point different from the operation point; A switchover control system that controls a switchover from the operating system to the first standby system in a cloud system in which the operating system and the first standby system are connected to each other via a network and is disposed at one or more locations different from the operating site, an execution request receiving means for receiving a request to execute the switchover transmitted from the manager terminal; a database setting means for executing a database setting process, which stops data synchronization between the active database and the first standby database, and sets the first standby database so that data can be written based on an instruction from the one or more standby applications, and sets the active database so that data cannot be written based on an instruction from the one or more active applications; A virtual server startup means for executing a virtual server startup process for starting the first standby virtual server; an application startup means for executing an application startup process for starting the one or more first standby applications in the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; having The switchover process including the database setting process, the virtual server startup process, the application startup process, and the communication target switching process is executed in this order in response to the acceptance of the execution request. Switchover control system. (2) A monitoring means for monitoring whether the operational system is operating normally from each of a plurality of points. Further comprising: the database setting means determines whether the operating system is operating normally based on the monitoring results of the operating system from each of the locations, and does not execute the database setting process when it is determined that the operating system is operating normally; 13. A switchover control system as described in (1). (3) The cloud system includes: A second standby system including an unactivated second standby virtual server on which one or more second standby applications that are copies of the one or more active applications are placed, and a second standby database whose data is synchronized with the active database, the second standby system being placed at a second standby point different from the active point and the first standby point. Further comprising: The switchover control system includes: controlling a switchover from the working system to either the first standby system or the second standby system; a switchover destination selection means for selecting either the first standby system or the second standby system as a switchover destination; Further comprising A switchover control system according to (1) or (2). (4) an access information storage means for storing access information indicating the number of accesses to the operating system from each of a plurality of regions; Further comprising: The switchover destination selection means comprises: selecting, as a switchover destination, one of the first standby system and the second standby system, which is located in a location included in the area having a greater number of accesses to the operating system, based on the access information; (3) A switchover control system as described in (1). (5) an operation information acquiring means for acquiring operation information indicating whether the first standby system can operate normally; an operation feasibility determination means for determining whether or not one of the first standby system or the second standby system selected as a switchover destination by the switchover destination selection means can operate normally based on the operation information when the database setting process is executed and / or when the application startup process related to at least a part of the one or more first standby applications is executed; a switchover destination changing means for changing the other of the first standby system or the second standby system as the switchover destination and re-executing the switchover process from the beginning when it is determined that one selected as the switchover destination by the switchover destination selecting means cannot operate normally; Further comprising A switchover control system according to (3) or (4). [Explanation of symbols]

[0110] S cloud system, N network, 1 active system, 2 first standby system, 2c communication unit, 3 second standby system, 4 administrator terminal, 5 switchover control system, 50 switchover execution system, 51 monitoring system, 51-1, 51-2 monitoring device, 6 network management system, 7 client terminal, 10 active virtual server, 11 active database, 20 first standby virtual server, 21 first standby database, 30 second standby virtual server, 31 second standby database, 100 active application, 200 first standby application, 300 second standby application, 400 execution request transmission unit, 500 execution request reception unit, 501 access information storage unit, 502 switchover destination selection unit, 503 switchover execution unit, 504 operation information acquisition unit, 505 operation feasibility determination unit, 506 switchover destination change unit, 510 An alive monitoring unit, 5031 a database setting unit, 5032 a virtual server startup unit, 5033 an application startup unit, 5034 a communication target switching unit, and a G screen.

Claims

1. an active system that includes an active virtual server that runs one or more active applications and an active database that can read and write data based on instructions from the one or more active applications, the active system being located at an active site; a first standby system including: an unactivated first standby virtual server on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; An administrator terminal disposed at a management point different from the operation point; A switchover control system that controls a switchover from the operating system to the first standby system in a cloud system in which the operating system and the first standby system are connected to each other via a network and is disposed at one or more locations different from the operating site, the administrator terminal has an execution request sending means for sending a switchover execution request to the switchover control system in response to a user operation, The switchover control system includes: an execution request receiving means for receiving a request to execute the switchover transmitted from the manager terminal; a database setting means for executing a database setting process, which stops data synchronization between the active database and the first standby database, and sets the first standby database so that data writing based on an instruction from the one or more standby applications is possible, and sets the active database so that data writing based on an instruction from the one or more active applications is disabled; a virtual server startup means for executing a virtual server startup process for starting the first standby virtual server; an application startup means for executing an application startup process for starting the one or more first standby applications in the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; having The switchover process including the database setting process, the virtual server startup process, the application startup process, and the communication target switching process is executed in this order in response to the acceptance of the execution request. Switchover control system.

2. A monitoring means for monitoring whether the operational system is operating normally from each of a plurality of points. Further comprising: the database setting means determines whether the operating system is operating normally based on the monitoring results of the operating system from each of the locations, and does not execute the database setting process when it is determined that the operating system is operating normally; The switchover control system of claim 1 .

3. The cloud system includes: A second standby system including: an unactivated second standby virtual server on which one or more second standby applications that are copies of the one or more active applications are placed; and a second standby database in which data is synchronized with the active database, the second standby system being placed at a second standby point different from the active point and the first standby point. Further comprising: The switchover control system includes: controlling a switchover from the working system to either the first standby system or the second standby system; a switchover destination selection means for selecting either the first standby system or the second standby system as a switchover destination; Further comprising 3. A switchover control system according to claim 1 or 2.

4. an access information storage means for storing access information indicating the number of accesses to the operating system from each of a plurality of regions; Further comprising: The switchover destination selection means comprises: selecting, as a switchover destination, one of the first standby system and the second standby system, which is located in a location included in the area where the number of accesses to the operating system is greater, based on the access information; The switchover control system of claim 3.

5. an operation information acquiring means for acquiring operation information indicating whether the first standby system can operate normally; an operation feasibility determination means for determining whether or not one of the first standby system or the second standby system selected as a switchover destination by the switchover destination selection means can operate normally based on the operation information when the database setting process is executed and / or when the application startup process related to at least a part of the one or more first standby applications is executed; a switchover destination changing means for changing the other of the first standby system or the second standby system as the switchover destination and re-executing the switchover process from the beginning when it is determined that one of the systems selected as the switchover destination by the switchover destination selecting means cannot operate normally; Further comprising The switchover control system of claim 3.

6. an active system that includes an active virtual server that runs one or more active applications and an active database that can read and write data based on instructions from the one or more active applications, the active system being located at an active site; a first standby system including: an unactivated first standby virtual server on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; An administrator terminal disposed at a management point different from the operation point; 1. A switchover control method in a cloud system in which multiple systems are connected to each other via a network, the method comprising: controlling a switchover from the operating system to the first standby system by a computer located at one or more locations different from the operating location, the administrator terminal transmits a switchover execution request to the computer in response to a user operation; The switchover control method includes: an execution request receiving step of receiving a request to execute the switchover transmitted from the manager terminal; a database setting step of stopping data synchronization between the active database and the first standby database, setting the first standby database so that data writing based on an instruction from the one or more standby applications is possible, and setting the active database so that data writing based on an instruction from the one or more active applications is disabled; a virtual server startup step of starting up the first standby virtual server; an application startup step of starting the one or more first standby applications on the first standby virtual server; a communication target switching step of switching a target of communication with one or more client terminals from the active system to the first standby system; having the database setting step, the virtual server startup step, the application startup step, and the communication target switching step are sequentially executed in this order in response to the acceptance of the execution request. Switchover control method.

7. an active system that includes an active virtual server that runs one or more active applications and an active database that can read and write data based on instructions from the one or more active applications, the active system being located at an active site; a first standby system including: an unactivated first standby virtual server on which one or more first standby applications that are copies of the one or more active applications are placed; and a first standby database whose data is synchronized with the active database; and the first standby system system is placed at a first standby location different from the active location; An administrator terminal disposed at a management point different from the operation point; A program for causing a computer located at one or more locations different from the operating location to execute control of a switchover from the operating system to the first standby system in a cloud system in which the operating system and the first standby system are connected to each other via a network, the administrator terminal transmits a switchover execution request to the computer in response to a user operation; The program is an execution request receiving means for receiving a request to execute the switchover transmitted from the manager terminal; a database setting means for executing a database setting process, which stops synchronization of data between the active database and the first standby database, sets the first standby database so that writing of data based on an instruction from the one or more standby applications is possible, and sets the active database so that writing of data based on an instruction from the one or more active applications is disabled; a virtual server startup means for executing a virtual server startup process for starting up the first standby virtual server; an application startup means for executing an application startup process for starting the one or more first standby applications in the first standby virtual server; a communication target switching means for executing a communication target switching process for switching a target of communication with one or more client terminals from the active system to the first standby system; having the database setting process, the virtual server startup process, the application startup process, and the communication target switching process are executed in this order in response to the acceptance of the execution request; program.

Images