There are a variety of ways to provide highly available (HA) computer processes or applications. Specifically, hardware and software techniques can be used either alone or in some combination to provide such processes. As an example, it is possible to connect two (or more) physical computers, such that one computer actively runs processes while the other computer (or computers) maintains operational state of the processes in an idle or in a standby mode, and is ready to transition to an active mode in the event that some function or process operating on the active host computer undergoes some a failure. In such HA computer systems, some portion or all of the information about the state of the active computer must be periodically saved to the standby computer so that the standby computer is able take over responsibility for running the processes from the point that the active computer experiences a failure. This example can be extended to the current practice of using a virtualized computing environment to run processes.
Virtualization is used in many areas to reduce the number of physical resources needed to perform particular functionality. In this regard, a single, physical host computer system can be designed to operate as though multiple different computers are operating on different processes as the same time. This is typically accomplished by operating multiple virtual computers or virtual machines (VM) as guests within the physical host computer. Each virtual machine can run under the control of its own virtual machine monitor (i.e., hypervisor) executing in memory on the host computer. Each virtual machine can execute one or more processes or applications, and access physical data storage and computer networks as required by the applications. In addition, each virtual machine may in turn act as the host computer system for another virtual machine.
Multiple virtual machines may be configured as a group to execute one or more of the same processes. Typically, one virtual machine in the group is the primary, or active virtual machine, and the remaining virtual machines are the secondary or standby virtual machines. If something goes wrong with the active virtual machine, one of the standby virtual machines can transition to become active, and take over and assume the formerly active virtual machine's role in the computing system. This redundancy allows the group of virtual machines to operate as a HA computing system. The primary virtual machine executes processes/applications, receives and sends network data, and reads and writes to data storage while performing automated or user initiated tasks or interactions. The standby virtual machine(s) have the same capabilities as the active virtual machine, but do not take over the relevant tasks and activities until the active virtual machine fails or is affected by an error.
For such a collection of virtual machines to function in a highly available computer system, the operating state, memory and data storage contents of a standby virtual machine should be equivalent to the operating state, memory and data storage contents of the active virtual machine. If this condition is met, the standby virtual machine may take over for the active virtual machine without the loss of any data. To assure that the state of the standby machine and its memory is equivalent to the state of the active machine and its memory, it is necessary for the active virtual machine to periodically transfer its state and memory contents to the standby virtual machine.
The periodic exchange of state to maintain synchrony between the virtual machines is termed checkpointing. A checkpoint cycle comprises the steps of identifying, acquiring, transferring, acknowledging, and committing. These cycles repeat with each checkpoint operation, defining a potential starting point for the standby virtual machine in the event of a failure of the active virtual machine.
In the event of an active VM failure, the standby VM is ‘rolled back’ to the most recently committed checkpoint and all pending (buffered) network egress frames from the failed active VM are discarded. This allows the standby VM to safely roll back and restart its processing without creating conflicting results to network clients. Any new network egress traffic is again buffered until the next checkpoint cycle ‘commit’ allows them to be released.