Disk array apparatus and disk array apparatus control method

A journal write unit writes journal data into a third storage device. The journal data includes an identifier of a logical volume in a first storage device into which data has been written, information of a location in which the data is stored in the logical volume, update time which is current time acquired from a timing mechanism, and the data. A second write unit refers to update time of the journal data stored in the third storage device, selects journal data for which a difference between current time acquired from the timing mechanism and the update time is longer than a detection time stored in the third storage device, and writes the data into a place indicated by the location information, in a logical volume in the second storage device in the order of update time in the selected journal data.

CROSS-REFERENCE TO RELATED APPLICATION

The present application relates to and claims priority from Japanese Patent Application No. 2004-038169 filed on Feb. 16, 2004, the entire contents of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION

The present invention relates to a disk array apparatus and a disk array apparatus control method.

In recent years, information processing systems operated for 24 hours without halt, such as commodity sale systems using the Internet, have increased. Data used in such an information processing system are often stored in a database on a disk array apparatus as the data quantity increases and improvement of fault tolerance is requested. In information processing systems operated without halt, it is necessary to back up data stored in the database without stopping database update processing. Therefore, a method of providing a replica volume for backup in a disk array apparatus and storing data stored in the database in the replica volume for backup as well is used. It is possible to acquire a backup of the database at a certain point in time by stopping writing data into the replica volume and copying the data stored in the replica volume into an external storage medium such as magnetic tape.

U.S. Pat. No. 6,141,773 discloses resynchronization processing of writing data written into a database while writing data into a replica volume is stopped, into the replica volume after completion of backup.

While the resynchronization processing is being executed, contents of the replica volume are not ensured. In some cases, therefore, two replica volumes are provided for one database, and the two replica volumes alternately conduct the resynchronization processing. If in this case a hardware fault occurs in a data area for storing the database, the database can be recovered by using one of the replica volumes and a REDO log of the database.

Besides the hardware faults, in the database operation, illegal data is written into the database in some cases because of malfunction in software, a user's operation mistake, or the like. Such a fault is called software fault. If a software fault occurs, it is necessary to restore data at a certain point in time preserved on magnetic tape or the like, and recover the database by using the restored data and REDO log. Since a considerably long time is required to restore data from the magnetic tape or the like, the halt time of the system becomes long.

When a software fault has occurred, therefore, it is demanded to recover the database quickly by using data in the disk array apparatus without restoring data from the external storage medium such as magnetic tape. In the case where the above-described two replica volumes are used, a storage capacity which is three times that of the volume storing the database becomes necessary, and the cost required to introduce a disk array apparatus increases.

Therefore, it is demanded to reduce the storage capacity required to back up the database against a hardware fault or a software fault.

Furthermore, in the resynchronization processing, it is necessary to read out data to be written into the replica volume from the database. This results in a problem that the performance of external access to the database is degraded during the resynchronization processing. Therefore, it is demanded to quickly recover the database without lowering the performance of external access to the database.

Furthermore, apart from the quick recovery of the database, it is demanded to acquire a backup at a certain point in time to provide against an emergency, without stopping the database update processing.

SUMMARY OF THE INVENTION

The present invention has been achieved in order to solve the above-described problems.

It is a main object of the present invention to provide a disk array apparatus and a disk array apparatus control method capable of reducing the storage capacity required to back up the database against a hardware fault or a software fault, quickly restoring the database without lowering the performance of external access to the database, and acquiring a backup at a certain point in time to provide against an emergency, without stopping the database update processing.

In accordance with a main aspect of the present invention, the above-described object is achieved by a disk control apparatus connected to an information processing apparatus so as to be able to communicate with the information processing apparatus, the disk control apparatus writing/reading data into/from a first storage device having one or more logical volumes formed thereon, a second storage device having one or more logical volumes formed thereon, and a third storage device, the disk control apparatus including: a memory, association of identifiers of the logical volumes in the first storage device serving as identifiers of primary logical volumes with identifiers of the logical volumes in the second storage device serving as identifiers of secondary logical volumes being stored in the memory as a pair management table; a timing mechanism; a write request reception unit for receiving a write request of data for a logical volume in the first storage device and the data to be written, from the information processing apparatus; a first write unit responsive to reception of the write request, for writing the data into the logical volume in the first storage device; a journal write unit for writing journal data into the third storage device, the journal data comprising an identifier of the logical volume in the first storage device into which the data has been written, information of a location in which the data is stored in the logical volume, update time which is current time acquired from the timing mechanism, and the data; and a second write unit for referring to the update time of the journal data stored in the third storage device, selecting journal data for which a difference between current time acquired from the timing mechanism and the update time is longer than a predetermined time, referring to an identifier of the logical volume in the journal data, the location information and the data in order of the update time in the selected journal data, acquiring an identifier of a secondary logical volume having the identifier of the logical volume as an identifier of the primary logical volume from the pair management table, and writing the data into a place indicated by the location information, in the logical volume indicated by the identifier of the secondary logical volume, in the second storage device.

DESCRIPTION OF THE EMBODIMENTS

A first form of a disk array apparatus according to an embodiment is shown inFIG. 1. The disk array apparatus10includes a disk control device110and a plurality of hard disk drives120. The disk array apparatus10is connected to information processing apparatuses20via communication means. The communication means is, for example, a LAN (Local Area Network), a SAN (Storage Area Network), an iSCSI (Internet Small Computer System Interface), an ESCON (Enterprise Systems Connection) (registered trademark), and a FICON (Fiber Connection) (registered trademark).

The information processing apparatus20is a computer including a CPU (Central Processing Unit) and a memory. The information processing apparatus20is a computer such as a personal computer, a work station, or a main frame. The information processing apparatus20is formed of a plurality of linked computers in some cases. In the information processing apparatus20, an operating system is operating. On the operating system, application software is operating. The application software provides a function of, for example, an automatic teller machine system in a bank, or an airplane seat reservation system.

The disk control device110takes charge of generally controlling the disk array apparatus10. The disk control device110exercises control on the hard disk drives120in obedience to a command received from an information processing apparatus20. For example, the disk control device110receives a data input/output request from an information processing apparatus20, and conducts processing for inputting/outputting data stored in a hard disk drive120.

The disk control device110includes channel control units131, disk control units132, a shared memory133, a cache memory134, a switching control unit135including a crossbar switch, which connects them so as to make possible communication, and a management terminal136. The units131to136included in the disk control device110may have redundancy in order to increase the fault tolerance.

The cache memory134is mainly used to temporarily store data transferred between a channel control unit131and a disk control unit132. For example, if a data input/output command received from an information processing apparatus20by a channel control unit131is a write command, the channel control unit131writes write data received from the information processing apparatus20into the cache memory134. Furthermore, the disk control unit132reads the write data from the cache memory134, and writes the write data into a hard disk drive120. The cache memory134may be made nonvolatile. In this case, when data received from the information processing apparatus20by the channel control unit131has been written into the cache memory134, a write completion notice may be transmitted to the information processing apparatus20.

A disk control unit132reads a data input/output request written into the shared memory133by a channel control unit131, and executes processing such as data writing or reading on a hard disk drive120in obedience with a command (such as a command according to the SCSI (Small Computer System Interface) standards) set in the data input/output request. The disk control unit132writes data read from the hard disk drive120into the cache memory134. Furthermore, the disk control unit132transmits a data write completion notice or a data read completion notice to the channel control unit131. In some cases, the disk control unit132has a function of controlling the hard disk drives120with RAID levels (such as0,1or5) prescribed in the so-called RAID (Redundant Array of Inexpensive Disks) scheme.

A storage area provided by each hard disk drive120is managed by taking a logical volume121, which is a volume logically set on the storage area, as the unit. Writing/reading data into/from the hard disk drive120can be conducted by specifying an identifier provided for a logical volume.

The management terminal136is a computer for maintaining and managing the disk array apparatus10. Alteration of software or a parameter executed in a channel control unit131or a disk control unit132is conducted under an order given by the management terminal136. The management terminal136may be incorporated in the disk array apparatus10or may be separated from it.

The shared memory133can be accessed from the channel control units131, the disk control units132and the management terminal136. The shared memory133is used for transfer of a data input/output request command between a channel control unit131and a disk control unit132. In addition, management information and so on of the disk array apparatus10are stored in the shared memory133.

FIG. 2is a block diagram showing a configuration of each channel control unit131. The channel control unit131includes an interface unit201, a memory202, a CPU203, a NVRAM (Nonvolatile Random Access Memory)204, and connectors205. They are formed as one-body unit on one circuit board or a plurality of circuit boards.

The interface unit201has an interface for conducting communication with an information processing apparatus20. The interface for conducting communication is, for example a connector corresponding to Fiber Channel or a connector corresponding to Ethernet (registered trademark).

The connectors205are connectors for connecting the channel control unit131to the disk array apparatus10. By coupling the connectors205to connectors of the disk array apparatus10side, a circuit board having the channel control unit131formed thereon is electrically connected to the disk array apparatus10. The channel control unit131is connected to the switching control unit135via the connectors205. As a result, the channel control unit131can access the shared memory133, the cache memory134, the disk control units132and so on.

The CPU203takes the charge of generally controlling the channel control unit131. The CPU203implements the function of the channel control unit131by executing various programs stored in the memory202and the NVRAM204. The NVRAM204is a nonvolatile memory for storing various programs and setting data. Contents of the various programs and the setting data stored in the NVRAM204can be rewritten in obedience to an order given by the management terminal136.

FIG. 3is a block diagram showing a configuration of each disk control unit132. The disk control unit includes an interface unit301, a memory302, a CPU303, a NVRAM304and connectors305. They are formed on one circuit board or a plurality of circuit boards as a one-body unit.

The interface unit301has an interface for conducting communication with hard disk drives120. The interface for conducting communication is, for example a connector conforming to the SCSI protocol or a connector conforming to the Fiber Channel protocol.

The connectors305are connectors for connecting the disk control unit132to the disk array apparatus10. By coupling the connectors305to connectors of the disk array apparatus10side, a circuit board having the disk control unit132formed thereon is electrically connected to the disk array apparatus10. The disk control unit132is connected to the switching control unit135via the connectors305. As a result, the disk control unit132can access the shared memory133, the cache memory134, the channel control units131and so on.

The CPU303takes the charge of generally controlling the disk control unit132. The CPU303implements the function of the disk control unit132by executing various programs stored in the memory302and the NVRAM304. The NVRAM304is a nonvolatile memory for storing various programs and setting data. Contents of the various programs and the setting data stored in the NVRAM304can be rewritten in obedience to an order given by the management terminal136.

A second form of a disk array apparatus in the present embodiment is shown inFIG. 4. The second form differs in configuration of the disk control device110from the first form shown inFIG. 1. The disk control device110includes a CPU141, a memory142, host interfaces143, disk interfaces144, a cache memory145and a data controller146.

The CPU141takes the charge of generally controlling the disk array apparatus10. The CPU141can implement various functions, such as management of the hard disk drives120and interpretation of a block access request, by executing a program stored in the memory142.

The host interface143is an interface for conducting communication with an information processing apparatus20. The host interface143has a function of accepting a block access request in accordance with Fibre Channel protocol.

The disk interface144is an interface for exchanging data with a hard disk drive120. The disk interface144has a function of transmitting a data input/output request to the hard disk drive120in accordance with a protocol, which prescribes, for example, a command for controlling the hard disk drive120. The disk interface144can transmit a data write command or a data read command to the hard disk drive in accordance with a protocol for SCSI, Fibre Channel or the like.

The cache memory145is a memory for storing data exchanged between a host interface143and a disk interface144.

The data controller146conducts data transfer between a host interface143and the cache memory145or between the cache memory145and a disk interface144under the control of the CPU141. The data controller146may be, for example, a circuit forming a logic circuit in an IC intended for specific use.

If an information processing apparatus20transmits a data write request for a hard disk drive120to the disk array apparatus10, then in the disk array apparatus10a host interface143accepts a write request, and the data controller146transfers write data annexed to the write request to the cache memory145. If the write data is transferred to the cache memory145, then the data controller146reads out the write data from the cache memory145into a disk interface144, and the disk interface144transmits a write ordering command to the hard disk drive120.

By the way, the cache memory145may be made nonvolatile. In this case, when data received from the information processing apparatus20by the host interface143has been written into the cache memory145, the CPU141may transmit a write completion notice to the information processing apparatus20.

Heretofore, the configuration of the disk array apparatus10has been described. Besides the configuration heretofore described, the disk array apparatus10may be an apparatus functioning as a NAS (Network Attached Storage) configured so as to accept a data input/output request using file name specification from an information processing apparatus20in accordance with a protocol such as the NAS (Network File System).

==Operation Form of Database==

The operation form of the database constructed in the disk array apparatus10in the present embodiment will now be described.

FIG. 5is a diagram showing a database system including a client terminal30, a database server40and a disk array apparatus10. The database server40corresponds to an information processing apparatus20shown inFIGS. 1 and 4.

FIG. 6is a block diagram showing a configuration of the client terminal30. The client terminal30includes a CPU601, a memory602, a storage603, a port604, a recording medium reading device605, an input device606, and an output device607.

The CPU601takes the charge of generally controlling the client terminal30. The CPU601implements various functions by executing a program stored in the memory602or the storage603. The storage603is a storage such as a hard disk drive. The recording medium reading device605is a device for reading a program or data recorded on a recording medium608. The program or data thus read is stored in the memory602or the storage603. As the recording medium608, a flexible disk, a CD-ROM, a semiconductor memory, or the like can be used. The recording medium reading device605may be incorporated in the client terminal30, or may be provided externally to the client terminal30. The input device606is used by the operator or the like to input data to the client apparatus30. As the input device606, for example, a keyboard, a mouse or the like is used. The output device607is a device for outputting information to the outside. As the output device607, for example, a display device, a printer or the like is used. The port604is a device for conducting communication with the database server40.

FIG. 7is a block diagram showing a configuration of the database server40. The database server40includes a CPU701, a memory702, a storage703, a LAN interface704, a storage interface705and a recording medium reading device706.

The CPU701takes the charge of generally controlling the database server40. The CPU701implements various functions by executing a program stored in the memory702or the storage device703. The storage device703is a storage such as a hard disk drive. The recording medium reading device706is a device for reading a program or data recorded on a recording medium707. The program or data thus read is stored in the memory702or the storage device703. As the recording medium707, a flexible disk, a CD-ROM, a semiconductor memory, or the like can be used. The recording medium reading device706may be incorporated in the database server40, or may be provided externally to the database server40.

The LAN interface704is an interface for conducting communication with the client terminal30via communication means such as a LAN. The storage interface705is an interface for conducting communication with the disk array apparatus10via communication means such as a SAN or a LAN.

In database update processing, it is demanded to ensure update of a plurality of tables. For example, in the case of transfer between bank accounts, it is necessary to decrease the balance at the bank stored in a table for managing the account of transfer source and increase the balance at the bank stored in a table for managing the account of transfer destination. In other words, if the update of the table of the transfer source and the update of the table of the transfer destination are not completed, it is meant that the update processing has not been conducted correctly. The database server40has a function of thus ensuring the update of a plurality of tables. The client terminal30executes the update processing of a plurality of tables, and subsequently transmits a commit request for requesting the insurance of the update processing of the tables to the database server40. If any fault has occurred in the middle of the update processing of the tables, the database server40can restore the tables to their states obtained before the update.

FIG. 8is a flow chart showing processing of updating the tables503and504stored in the data area501. The client terminal30transmits an update request for the table503to the database server40(S801). The update request contains an update location and update data in the table503. Upon receiving the update request, the database server40stores the update data in the database buffer505on the basis of the update location information (S802). And the database server40stores the update location information and the update data in the REDO log buffer506(S803), and transmits an update completion notice to the client terminal30(S804). Subsequently, the client terminal30transmits an update request for the table504to the database server40(S805). The database server40updates the database buffer505and the REDO log buffer506in the same way (S806and S807), and transmits an update completion notice to the client terminal30(S808). Upon receiving the update completion notice for the table504, the client terminal30transmits a commit request for the update processing to the database server40(S809).

Upon receiving the commit request, the database server40transmits an update request to the disk array apparatus10in order to request writing the update location information and the update data in the update of the tables503and504stored in the REDO log buffer506into the REDO log area502(S810). The disk array apparatus10stores the update location information and the update data in the REDO log area502(S811), and transmits an update completion notice to the database server40(S812). Upon receiving an update completion notice for the REDO log area502from the disk array apparatus10, the database server40transmits a commit completion notice to the client terminal30(S813). The client terminal30receives a commit completion notice from the database server40(S814), and recognizes that the update of the tables503and504has been ensured.

Asynchronously to the series of processing (S801to S814) conducted between the database server40and the client terminal30, the update data stored in the database buffer505is stored in the data area501in the disk array apparatus501. First, the database server40transmits a request to the disk array apparatus10in order to request reading out the data obtained before the update from the data area501(S851). The disk array apparatus10reads out the data obtained before the update from the data area501, and transmits the data obtained before the update to the database server40(S852). The database server40transmits a request to the disk array apparatus10in order to request writing the data and the update location information obtained before the update into the REDO log area502(S853). The disk array apparatus10stores the data and the update location information obtained before the update in the REDO log area502(S854), and transmits an update completion notice to the database server40(S855). Upon receiving the update completion notice for the REDO log area502, the database server40transmits a request to the disk array apparatus10in order to request writing the update data stored in the database buffer505into the data area501(S856). And the disk array apparatus10stores the update data in the data area501(S857).

In this way, the database server40conducts time-consuming storage of the update data into the data area501at timing different from that of the storage of the update data into the database buffer505. Thereby, the database server40shortens the response time for the update request issued by the client terminal30.

Furthermore, if a fault occurs in the database server40, it is possible to restore the data to contents reflecting the commit request issued by the client terminal30, by confirming data (hereafter referred to as “REDO log”) stored in the REDO log area502. In other words, if update data consequent upon the commit request stored by the processing in S811is not present in the REDO log, and data obtained before the update and stored by the processing in S854is present in the REDO log, then the data obtained before the update is written into the data area501. This is referred to as rollback processing. If update data consequent upon the commit request stored by the processing in S811is present in the REDO log, and data obtained before the update and stored by the processing in S854is not present in the REDO log, then the data obtained before the update is written into the data area501. This is referred to as roll forward processing.

The processing of thus restoring the data in the data area501to the contents reflecting the commit request issued by the client terminal30is called database recovery processing. The recovery processing is not limited to the above-described procedure. For example, the recovery processing may be implemented by rolling back all data obtained before the update and rolling forward all update data consequent upon the commit request.

A typical restoration procedure of the data area501in the case where faults occur in a plurality of hard disk drives120and the data in the data area501cannot be restored by using the RAID redundancy or the like (hereafter referred to as “fault in data area”) will now be described with reference toFIG. 9.

FIG. 9shows the case where the REDO log recording is started at zero o'clock and a fault occurs in the data area501at twelve o'clock. The state of the data area501at six o'clock is backed up in a hard disk drive120different from a hard disk drive120forming the data area501or in a storage medium such as magnetic tape (S901). A general procedure for backing up the data in the data area501at a certain point in time (hereafter referred to as “static data”) will be described later.

If a fault in the data area501has occurred at twelve o'clock, then one or more hard disk drives120in which the fault has occurred are replaced, and the data at six o'clock backed up is restored in the data area501(S902). And in accordance with the above-described recovery processing, all data obtained before the update and after zero o'clock are rolled back (S903), and update data consequent upon the commit request between zero o'clock and occurrence of the fault are rolled forward (S904). As a result, the data area501can be restored to the state obtained immediately before the fault.

Also in the case where the data area501has become an illegal state because of a fault caused by a user's operation mistake or a software fault, the data area501can be restored by using the static data and the REDO log. “A fault caused by a user's operation mistake” is, for example, disappearance of the data area501caused by formatting the data area501on a file system. “A software fault” is, for example, a mismatch caused in data stored in the data area501by a trouble in an application program or the like. If such a fault has occurred, the fault time is discriminated to some degree and the roll forward processing using the REDO log is conducted until before the fault time. As a result, the data area501in the state obtained before the fault can be restored.

If a fault has occurred in the data area501, the data area501can be restored by using the static data and the REDO log. Furthermore, by retaining the static data in the disk array apparatus10, it is also possible to restore the data area501quickly without restoring data from magnetic tape or the like.

The data backup scheme will now be described.FIG. 10is a diagram showing a replica scheme, andFIG. 11is a diagram showing a snapshot scheme.

First, the replica scheme will now be described with reference toFIG. 10. In the replica scheme, a replica volume1001is provided as a storage area different from the data area501. The replica volume1001includes one or more hard disk drives120. Upon receiving an update request for the data area501from the database server40, the disk control device110writes update data in both the data area501and the replica volume1001. The state in which the update data has been written into both the data area501and the replica volume1001is referred to as synchronous state. The disk control device110receives a split ordering instruction for stopping writing the update data from the database server40or the like into the replica volume1001. Upon receiving the split ordering instruction, the disk control device110stops writing the update data into the replica volume1001. In other words, the replica volume1001is static data of the data area501at a point in time when the split ordering instruction has been received.

The disk control device110stores location information of the update data written into the data area501while the update of the replica volume1001is stopped, in a difference segment bit map1004in a memory1003. The memory1003is the shared memory133or the cache memory134shown inFIG. 1, the cache memory145shown inFIG. 4, or the like. Upon receiving a resynchronization ordering instruction for bringing the replica volume1001into the synchronous state from the database server40or the like, the disk control device110reads out data indicated by location information stored in the difference segment bit map1004from the data area501, and writes the data thus read out into the replica volume1001. Processing consequent upon the resynchronization ordering instruction is referred to as resynchronization processing.

If the data written into the data area501while the update is stopped is large in quantity, the resynchronization processing requires a considerably long time. In the resynchronization processing, the data in the replica volume1001is updated by taking a segment as the unit irrespective of the data update order in the data area501. In other words, during the execution of the resynchronization processing, the replica volume1001is not brought into the state of the data area501at a certain point in time. If a fault occurs in the data area501during the execution of the resynchronization processing, therefore, the replica volume1001cannot be used to restore the data area501.

In some cases, therefore, another replica volume1002is provided in the disk array apparatus10. By conducting the update stopping and the resynchronization processing alternately in the two replica volumes1001and1002in this case, static data of the data area501can be ensured in the disk array apparatus without fail.

The snapshot scheme will now be described with reference toFIG. 11. In the snapshot scheme, a pool1101is provided as a storage area different from the data area501. The pool1001includes one or more hard disk drives120. Furthermore, a virtual replica volume1102, which is a virtual replica volume, is provided. The disk control device110receives a creation order of the virtual replica volume1102from the database server40or the like. Upon receiving an update request for the data area501from the database server40, the disk control device110reads out the data obtained before the update and stored in the scheduled update location in the data area501, and writes the data into the pool1101. And the disk control device110writes the update data into the data area501, and stores the location information of the update data in the difference segment bit map1004in the memory1003. Upon receiving a read request for the virtual replica volume1102, the disk control device110refers to the difference segment bit map1004. If the location information of the read data is stored, the disk control device110reads out data from the pool1101. Otherwise, the disk control device110reads out data from the data area501. In other words, the virtual replica volume1102is static data for the data area501at a point in time when the creation order of the virtual replica volume1102has been received.

The replica scheme and the snapshot scheme heretofore described have the following drawbacks. In the replica scheme, it is necessary to read out data stored in the data area501at the time of resynchronization processing. Therefore, competition with the update processing of the data area501consequent upon the update request for the data area received from the database server40occurs, and the performance of access from the database server40to the data area501is degraded. Furthermore, if the two replica volumes1001and1002are provided, a storage capacity that is three times that of the data area501is needed and the introduction cost of the disk array apparatus10becomes high.

In the snapshot scheme, it is necessary to read out data stored in the data area501when reading out the virtual replica volume1102, which is the static data. In the same way as the replica scheme, therefore, competition with the update processing for the data area501consequent upon the update request for the data area501received from the database server40occurs, and consequently the performance of the access from the database server40to the data area501is degraded. Furthermore, if a fault occurs in the data area501, static data for the data area501is not present in the disk array apparatus10. Therefore, the data area501cannot be restored quickly.

A data backup scheme according to the present embodiment improved as compared with the replica scheme and the snapshot scheme will now be described with reference toFIG. 12.

The disk array apparatus10includes a first storage device1201storing the data area501, a second storage device1202, and a third storage device1203. Each of the first to third storage devices1201to1203includes one or more hard disk drives120. In each of the first storage device1201and the second storage device1202, one or more logical volumes121are formed. The hard disk drive120forming the first storage device1201is physically different from the hard disk drive120forming the second storage device1202and the third storage device1203. By the way, the REDO log is stored in a hard disk drive120different from a hard disk drive120forming the first storage device1201included in the disk array apparatus10. The REDO log may be stored in a storage device external to the disk array apparatus10. The disk control device110includes a clock device1204. The clock device1204provides date and hour in response to an external request. The clock device1204is a timing circuit for counting time by using a clock signal. In a memory1003, detection time1205, which is predetermined time, is stored. The detection time1205is registered from the management terminal136, an information processing apparatus20, or the like.

An outline of data update processing in the present scheme will be described. The disk control device110receives an update request for a logical volume121in the first storage device1201from the database server40. Upon receiving the update request, the disk control device110writes update data into the logical volume in the first storage device1201. And the disk control device110writes journal data, which includes the update data written into the first storage device, information representing a location where the update data is written, and update time, into the third storage device. The disk control device110refers to the journal data written into the third storage device at predetermined intervals. With respect to journal data for which the difference between the update time and the current time exceeds the detection1205, the disk control device110writes the update data into the logical volume121in the second storage device in the order of the update time. The logical volume121in the second storage device1202assumes the state assumed by the logical volume121in the first storage device1201earlier by the detection time1205. In other words, if a fault has occurred in the first storage device1201, the first storage device1201can be restored by using the second storage device1202and the third storage device1203or the REDO log.

FIG. 13is a block diagram showing a function of implementing the above-described data update processing in the disk control device110according to the present embodiment. The disk control device110includes a write request reception unit1301, a first writing unit1302, a journal writing unit1303, a second writing unit1304, a split ordering instruction reception unit1305, a split canceling instruction reception unit1306, a split order storage unit1307, a split cancel storage unit1308, an unreflected information storage unit1309, a read request reception unit1310, an identifier acquisition unit1311, an overlap range acquisition unit1312, a virtual logical volume readout unit1313, and a read data transmission unit1314. The units1301to1314are implemented by execution of programs stored in the memory202,302or142or the NVRAM204or304by the CPU203or the CPU303in the disk array apparatus10shown inFIGS. 1 to 3, or the CPU141in the disk array apparatus10shown inFIG. 4.

FIG. 14is a diagram showing a relation between the logical volumes121in the first storage device1201and the logical volumes121in the second storage device1202. The logical volumes121in the first storage device1201are associated with the logical volumes121in the second storage device1202. In this association, the logical volumes121in the first storage device1201are referred to as primary logical volumes, and the logical volumes121in the second storage device1202are referred to as secondary logical volumes. This association is called pair. Identifiers in the primary logical volume and identifiers in the secondary logical volume are associated with each other and stored in a pair management table1501shown inFIG. 15. Furthermore, the logical volumes121in the first storage device1201form groups each including one or more logical volumes121. Each group is formed for, for example, each database server or each database instance provided by the database server40. In other words, it can be said that the database server40uses the logical volumes121in the first storage device1201by taking a group as the unit. Therefore, it becomes necessary to back up the logical volumes121in the first storage device1201by taking a group as the unit. Each group is provided with a group ID indicating the group. Association of identifiers of the logical volumes121with group IDs is stored in a group management table1601shown inFIG. 16. The pair management table1501and the group management table1601are stored in the memory1003, and registration is conducted from the management terminal136, the information processing apparatus20, or the like.

FIG. 17is a diagram showing journal data written into the third storage device1203. Journal data1701includes a journal section1702and an update stream section1703.

The journal section1702includes a group ID, a sequence ID, update time, update location information, and update stream offset. Upon receiving a request for writing update data into a logical volume121in the first storage device1201from the database server40, the disk control device110stores the journal data1701in the third storage device1203. The group ID is a group ID of a group to which the logical volume121belongs. The sequence ID indicates an update sequence of update data in the first storage device1201, and it is a sequential number managed from group to group. Update data stored in the journal data1701are written into the logical volume121in the second storage device1202in the order of the sequence ID from group to group. The update time is date and time acquired from the clock device1204when the disk control device110stores the journal data1701. Therefore, the order of the sequence ID is the same as the order of the update time. In the update location information, the identifier of the logical volume121and information of location in which the update data is stored in the logical volume121are stored. By the way, the information of location in which data is stored is, for example, information indicated by a start address and a data length from the start address. Location information of the update data in the update stream section1703is stored in the update stream offset. In the update stream section1703, update data is stored in the location indicated in the update stream offset.

If the disk control device110has received a split ordering instruction described later, data indicating that the split ordering instruction has been received is stored in the update location information. In the “group ID,” a group. ID specified in the split ordering instruction is stored. In the “sequence ID,” a sequence ID of the group ID specified by the split ordering instruction is stored. In the “update time,” date and time acquired from the timing mechanism1201are stored. The data thus written into the journal section1701in accordance with the split ordering instruction is referred to as split ordering data. If the disk control device110has received a split canceling instruction described later, data indicating that the split canceling instruction has been received is stored in the “update location information.” The data thus written into the journal section1701consequent upon the split canceling instruction is referred to as split cancel data.

A storage area in the journal data1701indicating update data completed in reflection to the logical volume121in the second storage device1202is managed as an empty area, and reused as a storage area in the journal data1701indicating different update data.

An outline of creation of static data and backup of data in the present embodiment will now be described.FIG. 18is a diagram showing state transition of the disk array apparatus10in the case where the split ordering instruction for creating static data has been received.

First, in the normal operation state (S1801), update data for which the difference between the update time and the current time exceeds the detection time1205is extracted from the journal data1701in the third storage device1203, and written into the second storage device1202.

Upon receiving the split ordering instruction from the database server40, a backup server1803or the like, the disk array apparatus10makes a transition to a state (S1802) for creating a virtual device1801. The backup server1803is an apparatus corresponding to the information processing apparatus10shown inFIGS. 1 and 4. The backup server1803has a function of reading out data stored in the disk array apparatus10and creating its backup in an external storage medium.

S1802inFIG. 18shows a state in which five minutes has elapsed since the disk array apparatus10received the split ordering instruction at eighteen o'clock (split time). In the example shown inFIG. 18, the detection time is two hours. In the S1802, update data obtained until 16:05 which is two hours earlier than the current time is reflected in the second storage device1202. In other words, update data obtained between 16:05 and 18:00 are not yet reflected in the second storage device1202, and are stored in the third storage device1203.

As static data for the first storage device at 18:00, therefore, the virtual device1801is provided. Virtual logical volumes are provided in the virtual device1801. Association between identifiers of virtual logical volumes and identifiers of the logical volumes121in the second storage device1202is stored in a virtual logical volume management table1901. The virtual logical volume management table1901is stored in the memory1003, and registration is conducted from the management terminal136or the information processing apparatus20.

The disk control device110extracts update location information of the journal data1701for which the update time is earlier than the split time, and stores the update location information in the memory1003as unreflected information. A storage scheme of the unreflected information is, for example, a bit map scheme in which a storage area in the second storage device1202is divided into a plurality of segments and it is indicated by taking a segment as the unit whether unreflected update data is present. Upon receiving a data read request for a virtual logical volume from a backup server1802, the disk control device110reads data from the third storage device1203with respect to data stored in a location indicated by unreflected information. With respect to data stored in a location other than the location indicated by unreflected information, the disk control device110reads out the data from the second storage device. As a result, static data at eighteen o'clock for the first storage device1201can be provided for the backup server1802.

Also while the virtual device1801is being provided, reflection of update data from the third storage device1203into the second storage device1202is conducted. In order to make the virtual device1801static data, therefore, the disk control device110does not reflect the update data for which the update time is later than the split time into the second storage device1202. S1803indicates this case. In the S1803, update data obtained until 18 o'clock which is the split time is reflected into the second storage device1202. Therefore, the second storage device1202coincides with the virtual device1801.

Upon receiving the split canceling instruction from the database server40, the backup server1801, or the like, the disk array apparatus10resumes reflection of the update data for which the difference between the update time and the current time exceeds the detection time1205, stored in the third storage device1203, into the second storage device1202. S1804indicates this state. If this reflection is completed, the disk array apparatus returns to the normal operation state (S1801).

Upon receiving the split ordering instruction, the disk control device110may reflect update data for which the update time is earlier than the split time into the second storage device1202, without using the virtual device1801irrespective of whether the difference between the update time and the current time exceeds the detection time1205. In this case, the backup server1802reads out data not from the virtual device1801but from the second storage device1202, and conducts backup.

Operation of the units1301to1314in the disk control device110for implementing the backup scheme in the present embodiment heretofore described will now be described.

==Writing into Third Storage Device==

FIG. 20is a flow chart showing processing conducted when the disk control device110has received a data write request for a logical volume121in the first storage device1201from the database server40.

The write request reception unit1301receives a data write request and write data for the logical volume121in the first storage device1201from the database server40(S2001). The first write unit1302writes the data into the logical volume121specified by the write request in the first storage device1201(S2002). The journal write unit1303writes the journal data1701for the data into the third storage device1203(S2003). And the journal write unit1303transmits a write completion notice of the data to the database server40(S2004).

Generation of the journal data is conducted as described below. The journal write unit1303acquires a group ID corresponding to the identifier of the logical volume from the group management table1601, and sets the acquired group ID in the “group ID” in the journal data1701. The journal write unit1303adds one to the sequence ID provided last time in the acquired group ID, and sets a result in the “sequence ID” in the journal data1701. The journal write unit1303acquires the current date and hour from the clock device1204, and sets the acquired current date and hour in the “update time” in the journal data1701. The journal write unit1303sets the identifier of the logical volume and information of the location in which the data is written in the “update location information” in the journal data1701. The journal write unit1303sets a location in the update stream unit1703in which the data is to be subsequently stored, in the “update stream offset” in the journal data1701. And the journal write unit1303stores the data in the update stream unit1703.

Before being written into the logical volume121in the third storage device1203, the journal data1701is written into the memory1003. If the memory1003has a redundant configuration and is nonvolatile, the journal write unit1303may transmit a write completion notice of the data to the database server40when the journal data1701has been written into the memory1003.

FIG. 21is a flow chart showing processing conducted when the disk control device110has received a split ordering instruction.

The split ordering instruction reception unit1305receives a split ordering instruction from the database server40, the backup server1801or the like (S2101). The split order storage unit1307writes split order data into the third storage device1203(S2102). Generation of the split order data is conducted as described below. The split order storage unit1307sets the group ID specified by the split ordering instruction in the “group ID” in the split order data. The split order storage unit1307adds one to the sequence ID provided last time in the group ID, and sets a result in the “sequence ID” in the split order data. The split order storage unit1307acquires the current date and hour from the clock device1204, and sets the acquired current date and hour in the “update time” in the split order data. The split order storage unit1307sets data indicating that a split order instruction has been received in the “update location information” in the split order data.

The unreflected information storage unit1309stores unreflected information, which is the update location information in the journal data1701earlier in update time than the split time, in the memory1003(S2103). By the way, the determination whether the update time is earlier than the split time may be conducted by conducting the direct comparison of the update time or may be conducted by conducting comparison of the sequence ID.

FIG. 22is a flow chart showing processing conducted when the disk control device110has received a split canceling instruction.

The split canceling instruction reception unit1306receives a split canceling instruction from the database server40, the backup server1801or the like (S2201). The split cancel storage unit1308writes split cancel data into the third storage device1203(S2202). In other words, the split cancel storage unit1308sets data indicating that a split canceling instruction has been received in the “update location information” in the split order data having a group ID specified by the split ordering instruction and set therein.

==Reflection of Update Data into Second Storage Device==

FIG. 23is a flow chart showing processing of reflecting the update data stored in the third storage device1203into the second storage device1202conducted by the disk control device110.

The second write unit1304acquires the detection time1205stored in the memory1003(S2301). The second write unit1304acquires the date and hour (current time) from the clock device1204(S2302). The second write unit1304refers to the journal data1701stored in the third storage device1203(S2303), and determines whether there is split order data and there is no split cancel data (S2304).

If there is split order data and there is no split cancel data, the second write unit1304selects journal data for which the split ordering data and the group ID are the same, the difference between the update time and the current time exceeds the detection time1205, and the update time is earlier than the split time (S2305). If journal data1701meeting the conditions is not present, processing beginning with S2302is executed again.

The second write unit1304acquires an identifier of a secondary logical volume corresponding to an identifier of the logical volume121set in the update location information of the selected journal data1701from the pair management table1501(S2307). The second write unit1304writes update data of the selected journal data1701into a place which is included in the logical volume121in the second storage device1202indicated by the acquired identifier in the secondary logical volume and which is indicated by location information in the journal data1701(S2308). If there are a plurality of journal data1701, the second write unit1304writes the update data in the logical volume121in the second storage device1202in the order of sequence ID, i.e., in the order of update time. If writing into the logical volume121in the second storage device1202is completed, the second write unit1304deletes unreflected information of the update data stored in the memory1003(S2309).

By changing the S2305step so as to make the second write unit1304select journal data earlier in update time than the split time without comparing the update time with the current time, the second storage device1202can be used as static data of the first storage device1201.

==Readout of Virtual Logical Volume==

FIG. 24is a flow chart showing processing conducted when the disk control device110has received a read request for a virtual logical volume in the virtual device1801.

The read request reception unit1310receives a read request in which an identifier of a virtual logical volume in the virtual device1801is specified, from the backup server1802(S2401). The identifier acquisition unit1311acquires an identifier of the logical volume121corresponding to an identifier of a virtual logical volume specified by a read request, from the virtual logical volume management table1901(S2402). The overlap range acquisition unit1312acquires an overlap range of location information specified by the read request and location information in the unreflected information stored in the memory1003(S2403). If the unreflected information is indicated by the start address and the block length, the overlap range is an overlapping portion of the range indicated by the location information specified by the read request and the range indicated by the location information in the in the unreflected information. If the unreflected information is represented by a bit map with a segment taken as the unit, the overlap range is segments which are included in the range indicated by location information specified by the read request and for which the nonreflection bit is set in the bit map of the unreflected information.

The virtual logical volume read unit1313reads out an overlapping range from journal data1701stored in the third storage device1203(S2404). As for a nonoverlapping range, the virtual logical volume read unit1313reads it from the logical volume121in the second storage device1202(S2405). And the read data transmission unit1314transmits the read data to the backup server1802(S2406).

Heretofore, operation of the units1301to1314in the disk control device110for implementing the backup scheme in the present embodiment has been described.

As a result, the logical volume121in the second storage device1202can be brought into the state that the logical volume121in the first storage device1201assumed the detection time1205earlier. If illegal data has been written into the logical volume121in the first storage device1201, the illegal data is not written into the logical volume121in the second storage device1202during the detection time1205.

For example, it is now supposed that an information processing apparatus20is the database server40and the logical volume121in the first storage device1201is a data storage area of the database. In such a case, the database server40stores a REDO log for data written into the logical volume121in the first storage device1201beginning from a certain point in time, in a different storage area. If illegal data has been written into the logical volume121in the first storage device1201, therefore, the logical volume121in the first storage device1201can be restored to the state obtained immediately before illegal data is written, by using the data obtained the detection time1205earlier and stored in the logical volume121in the second storage device1202and using the REDO log. In other words, data in the logical volume121in the first storage device1201can be restored by using the data in the disk array apparatus10without using data preserved on a medium such as magnetic tape. Therefore, the time required for the restoration work can be shortened.

As compared with the conventional data backup scheme in which the logical volume121in the first storage device1201is used as primary logical volume and two secondary logical volumes (replica volumes) for the primary logical volume are provided, the storage capacity can be reduced. In the conventional data backup scheme in which two secondary logical volumes are provided, the primary logical volume and the secondary logical volumes need a storage capacity which is three times the storage capacity of the first storage device1201. The storage capacity needed in the present invention scheme depends upon the quantity of the journal data stored in the third storage device1203. Typically, in many cases, the database update quantity per day is less than 20% of the primary logical volume. In other words, if the detection time1205is set equal to one day, it is sufficient for the third storage device1203to have 25% of the storage capacity of the first storage device1201. Therefore, it is sufficient for the first storage device1201, the second storage device1202and the third storage device1203to have a storage capacity which is 2.25 times that of the first storage device1201. If the detection time1205can be set equal to several hours, the necessary storage capacity can be further decreased. In other words, in the backup scheme in which when a fault has occurred the logical volume121in the first storage device1201is restored by using data present in the disk array apparatus10, the required storage capacity can be reduced and the introduction of the disk array apparatus10can be reduced.

Since the detection time1205is stored in the memory1003, it becomes possible to register the detection time1205from the management terminal136, the information processing apparatus20, or the like. In other words, the time required to detect that illegal data has been written into the logical volume121in the first storage device1201because of a trouble in software or an artificial operation mistake can be altered according to the characteristics of the business or software. Therefore, the storage capacity required to store the journal data1701in the third storage device1203can be altered according to the characteristics of the business or software.

A hard disk drive120forming the first storage device1201can be made physically different from a hard disk drive120forming the second storage device1202. Even if a hardware fault has occurred in the hard disk drive120forming the first storage device1201, data stored in the logical volume121in the first storage device1201the detection time1205earlier is stored in the second storage device1202. If the information processing apparatus20is the database server40and the REDO log written into the logical volume121in the first storage device1201is present in the disk array apparatus10, then the data in the logical volume121in the first storage device1201can be restored by using the logical volume121in the second storage device1202and the REDO log. Since data preserved on a medium such as magnetic tape is not used for data restoration, the time required for restoration work can be shortened.

In other words, the data in the logical volume121in the first storage device1201can be restored quickly by using the continuously updated second storage device1202, without using static data in the logical volume121in the first storage device1201at a certain point in time.

Furthermore, a hard disk drive120forming the first storage device1201can be made physically different from hard disk drives120forming the second storage device1202and the third storage device1203. When updating the logical volume121in the second storage device1202by using the journal data1701stored in the third storage device1203, it is not necessary to read out data from the first storage device1201. In other words, the influence on the performance of the data input/output processing conducted from the information processing apparatus20to the first storage device1201is slight.

If a hardware fault has occurred in a hard disk drive120included in the first storage device1201, the data in the logical volume121in the first storage device1201can be restored by using the logical volume121in the second storage device1202and the journal data1701stored in the third storage. In this case as well, data preserved on a medium such as magnetic tape is not used for data restoration, and consequently the time required for the restoration work can be shortened.

After the detection time has elapsed from the split time, it becomes possible to create the state of the first storage device1201at the split time on the second storage device1202. In this state, it becomes possible to back up the logical volume121in the second storage device1202on a storage medium such as magnetic tape. Therefore, it becomes possible to back up data by way of precaution against a fault over the whole disk array apparatus10, a wide area disaster, or the like.

Immediately after the split order, it is possible to back up data in the logical volume121in the first storage device1201at the split time, on magnetic tape or the like by using the virtual logical volume in the volume121in the second storage device1202. In other words, it is not necessary to wait for reflection of the journal data stored in the third storage device1203having the update time earlier than the split time into the logical volume in the second storage device1202. As a result, it becomes possible to back up data easily.

Upon receiving the split ordering instruction, it is also possible to reflect the update data of the journal data having the update time earlier than the split time into the logical volume121in the second storage device1202irrespective of the detection time. As a result, it is possible to back up data in the logical volume121in the first storage device1201at the split time, on magnetic tape or the like by using the logical volume121in the second storage device1202. In other words, since it is not necessary to form a virtual logical volume during the back up processing, the load on the disk array apparatus10is lightened and the backup processing time is shortened.

The split ordering instruction can be given by specifying a group ID in the logical volume121in the first storage device1201. In the case where a plurality of information processing apparatuses20are using the first storage device1201or a plurality of business applications are running on an information processing apparatus20, it becomes possible to back up data by taking a group ID as the unit by giving a group ID to the logical volume121every information processing apparatus20or business application.

For example, it is now supposed that the information processing apparatus is the database server and there are two database instances used by the database server. Different group IDs are given to the logical volumes121in the first storage device1201used as data storage areas by the database instances. The split ordering instruction and the split canceling instruction are issued by taking the group ID as the unit. In other words, it becomes possible to back up data by taking the database instance as the unit. Furthermore, for example, if logical volumes121in use are different from business application to business application, it becomes possible to back up data by taking business application as the unit.

Also in the case where the group ID is considered, it is possible to back up data in the logical volume121in the first storage device1201at the split time, on magnetic tape or the like by using a virtual logical volume for the group ID. In other words, before starting backup, it is not necessary to wait for reflection of the journals data stored in the third storage device having update time earlier than the split time into the logical volume in the second storage device. As a result, it becomes possible to conduct data backup easily.

Also in the case where the group ID is considered, upon receiving the split ordering instruction, it is also possible to reflect the update data of the journal data having the update time earlier than the split time into the logical volume121in the second storage device1202, for the group ID irrespective of the detection time. As a result, it is possible to back up data in the logical volume121in the first storage device1201at the split time, on magnetic tape or the like by using the logical volume121in the second storage device1202. In other words, since it is not necessary to form a virtual logical volume during the back up processing, the load on the disk array apparatus10is lightened and the backup processing time is shortened.

Heretofore, the present embodiment has been described. The embodiment has been shown to facilitate appreciation of the present invention, and it is not intended to limit and construe the present invention. The present invention can be modified and improved without departing from the spirit thereof, and the present invention includes equivalents thereof.