As computer systems having high availability, HA clusters (High Availability clusters) and FT servers (Fault Tolerant servers) of a hot standby structure have been known.
An HA cluster is intended to make a system redundant by connecting a plurality of servers with one another. If a failure occurs in the currently used (active) server, processing is taken over by another server prepared as a standby system, so it seems that the cluster operates normally as a whole. Main methods thereof include an active-standby method and a replication method.
In an HA cluster of an active-standby method, the active system and the standby system share a storage. The active system writes application-dependent information necessary for synchronizing the standby system in the shared storage, and the standby system performs recovery processing with use of such information at the time of failover. As such, it is impossible to achieve availability transparently, when viewed from the applications and the OS. Further, it takes time for failover, and the services cannot be provided during that time.
In an HA cluster of a replication method, each of the active system and the standby system has a storage, independently. A request which reaches the application of the working system is transferred to the standby system, causing the standby system to have state transition which is the same as the active system. In general, making the states of a plurality of systems conform with each other is called synchronization. When a failure occurs in the working system and the working system stops, as the application state of the standby system is synchronized with the active system, it is possible to separate the active system and switch the processing to the standby system to thereby continue the service. However, as the replication mechanism must be added to each of the applications to be clustered, it is impossible to achieve the availability transparently when viewed from the applications and the OS.
As described above, in an HA cluster, it is necessary to add availability-conscious mechanism to the applications and the OS. On the other hand, in the case of an FT server, it is possible to continue services transparently without the need for particular processing by the applications and the OS. The approaches to realize an FT server include a hardware approach and a software approach.
In an FT server of a hardware approach, main hardware components such as a CPU, a memory, and a storage are made redundant, and if a failure occurs in any of the components, such a component is separated so as to continue operation. Under a definition that a module including a CPU, a memory, and a chip set is a CPU subsystem, and that a module including various IO devices is an IO subsystem, in a typical FT server in which components are duplexed, the methods for duplexing the CPU subsystem and for duplexing the IO subsystem are different. In the CPU subsystems, the operations of the hardware are caused to conform with each other completely in clock units. This is called lock-step. As the duplex CPU subsystems perform completely the same operations, when a failure occurs, the CPU subsystem in which the failure has occurred is separated logically, and the operation is instantly switched to the normal CPU subsystem to continue operation. In the IO subsystems, although they do not operate in lock-step, when a failure occurs, the operation is immediately switched to the other IO subsystem. An FT server of a hardware approach is able to realize an extremely high availability. However, as it is configured of special hardware, it takes a higher introduction cost compared with general servers of similar performance.
On the other hand, an FT server of a software approach uses a virtual technique which enables one or a plurality of OSs to operate on a physical computer. A computer virtually constructed on a physical computer is called a virtual computer or a virtual machine. In an FT server of a software approach, physical computers are made redundant, and a virtual computer of an active system and a virtual computer of a standby system are arranged on different physical computers, respectively. When a failure such as a hardware error occurs on the physical computer to which the virtual computer of the active system belongs, the processing performed by the virtual computer is continuously performed by the virtual computer of the standby system on the other physical computer. In order to continue the service transparently when viewed from the application and the OS, the FT server of the software approach performs processing to conform the states of the virtual computers of the active system and the standby system with each other, namely, synchronization.
Methods for synchronizing the virtual computers of the active system and the standby system mainly include two methods, namely a virtual lock-step method and a checkpoint method. In a virtual lock-step method, an input to the virtual computer of the active system is also given to the virtual computer of the standby system so as to make the state of the virtual computer of the standby system transit in the same manner as that of the virtual computer of the active system. This method has an advantage that the quantity of data required for synchronization between the virtual computers is small. However, if the types of the CPUs of the active system and the standby system are different, there is a problem that the systems do not operate.
On the other hand, in a checkpoint method, images of the virtual computer of the active system (CPU, memory, storage, etc.) are periodically transmitted to the standby system so as to make the state of the virtual computer of the standby system conform with the state of the virtual computer of the active system. In the checkpoint method, implementation is relatively easy compared with the virtual lock-step method, and as it does not depend on a particular function of the CPU, there is an advantage that this method can be implemented in a variety of products. However, as images of the virtual computer have a large quantity of data, there is a problem that overhead for one time of synchronization is larger than that of the virtual lock-step method.
In order to solve this problem, a technique of transmitting only images of the virtual computer of the active system, which are updated after the previous checkpoint, has been proposed as first related art of the present invention (see Non-Patent Document 1 shown below, for example). In the first related art, when a checkpoint comes, the virtual computer of the active system is suspended so as to interrupt update to the main memory, and a local copy of all of the dirty pages, which are pages in the main memory having been updated after the previous checkpoint, is created in the buffer provided in the main memory. When a local copy has been created, the suspended virtual computer of the active system is restarted, and along with it, the copied dirty pages are transferred from the buffer to the standby system.    Non-Patent Document 1: Brendan Cully, and 5 others, “Remus: High Availability via Asynchronous Virtual Machine Replication”, [online], [searched on Sep. 5, 2012], Internet <URL: http://www.cs.ubc.ca/{tilde over ( )}andy/papers/remus-nsdi-final.pdf>
However, creating local copies of all of the pages to be transferred in the memory requires a reasonable processing time. In the above-described first related art of the present invention, updating of the memory must be suspended until the entire data to be transferred has been copied completely. As such, the performance of the computer deteriorates.