Graceful degradation designing system and method

When information about a failed physical server is inputted, the number of processing programs which are insufficient to meet an availability requirement specified in advance is calculated for each subsystem executing on a computer system, and a graceful degradation which meets the availability requirement is determined by changing the quantity of computer resources allocated to processing programs.

The present application is the National Phase of PCT/JP2008/072437, filed Dec. 10, 2008, which claims priority from Japanese patent application No. 2007-334442, filed Dec. 26, 2007, which is incorporated herein by reference in its entirety.

TECHNICAL FIELD

The present invention relates to a graceful degradation designing system and method intended to degrade a redundant computer system constructed using virtual machine technology, in case of failure.

BACKGROUND ART

In a computer system which is constantly required to operate in a stable manner, such as a mission-critical system of a data center or company, reliability is increased by providing redundant servers. By operating redundant servers in addition to minimum necessary servers, even if some of the servers fail, the computer system can provide services stably using the remaining servers.

Regarding conventional server redundancy techniques, for example, Patent Document 1 (Japanese Patent Laid-Open No. 2002-55840A) describes dual-redundancy, N+M configuration, and N+1 configuration. The dual-redundancy involves providing a redundant server (physical server) for every server. The N+M configuration involves providing M redundant physical servers for N servers. A configuration in which M=1, in particular, is referred to as an N+1 configuration.

Even if a physical server fails, the redundancy technique described in Patent Document 1 can continue operating a computer system by cutting off the failed physical server from the computer system. The act of reconstructing a computer system using the remaining physical servers excluding the failed physical server is known as degradation and the configuration resulting from the degradation is called a graceful degradation.

On the other hand, recent mission-critical systems of data centers and companies have been adopting a form in which multiple virtual servers are constructed on a physical server using virtual machine technology.

For example, Non-Patent Document 1 (B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, I. Pratt, A. Warfield, P. Barham and R. Neugebauer, Xen and the Art of Virtualization, 19th ACM Symposium on Operating Systems Principles (SOSP19), 2003.) discloses a technique for using computer resources (a CPU, memory device, and the like) of a physical server as multiple virtual servers implemented by required processing programs.

Non-Patent Document 1 proposes to dynamically change the quantity of computer resources allocated to the virtual servers according to services to be provided. The use of virtual machine technology makes it possible to provide a redundant server for each service-providing subsystem (application program: hereinafter simply referred to as an application) by simply adding virtual servers without introducing new physical servers, and thereby make the computer system redundant at a lower cost.

Generally the total quantity of computer resources available on a physical server is limited. Therefore, with a redundancy technique which uses virtual machine technology, if the quantity of computer resources allocated to virtual servers standing by as redundant virtual servers is increased, there may be some virtual servers which do not meet the quantity of computer resources needed to provide a service because of reduced computer resources.

In particular, with a computer system equipped with multiple subsystems (applications), since a minimum number of virtual servers required for each subsystem (application) is determined based on availability requirements of the subsystem (application), it is necessary to ensure that migration to a graceful degradation will not result in a subsystem (application) which would violate the availability requirements.

However, the redundancy technique described in Non-Patent Document 1 does not take into consideration the effects of changes in the quantity of computer resources allocated to an arbitrary virtual server on other virtual servers, and thus cannot be applied directly to the redundancy technique which uses the virtual machine technology. That is, a technique for migration to a graceful degradation is needed in order to meet the availability requirements of each subsystem (application) running on the computer system.

A related redundancy technique is not provided with a technique for migrating to a graceful degradation by changing the amount of computer resources allocated to virtual servers, and thus cannot determine a graceful degradation according to a failed physical server.

SUMMARY

Thus, an object of the present invention is to provide a graceful degradation designing system and method capable of migrating to a graceful degradation which meets an availability requirement of each subsystem (application) in a computer system made redundant using virtual machine technology.

To achieve the above object, a graceful degradation designing system according to an aspect of the present invention, comprises: input means that is used to enter information about a failed physical server; and graceful degradation determining means that calculates, for each subsystem executing processing programs on a computer system, the number of processing programs which are insufficient to meet an availability requirement specified in advance, that changes a quantity of computer resources allocated to processing programs, and thereby that determines a graceful degradation which meets said availability requirement.

A graceful degradation designing method according to an aspect of the present invention, comprising: calculating, for each subsystem executing on a computer system, the number of processing programs which are insufficient to meet an availability requirement specified in advance when information about a failed physical server is inputted; and determining a graceful degradation which meets said availability requirement by changing the quantity of computer resources allocated to processing programs.

EXEMPLARY EMBODIMENT

Next, the present invention will be described with reference to the drawings.

FIG. 1is a block diagram showing a configuration of a graceful degradation designing system according to an exemplary embodiment.

FIG. 2is a block diagram showing another configuration example of the graceful degradation designing system andFIG. 3is a block diagram showing a configuration example of graceful degradation determining means shown inFIGS. 1 and 2.

As shown inFIG. 1, the graceful degradation designing system according to the exemplary embodiment includes input means11and graceful degradation determining means13.

As shown inFIG. 2, the graceful degradation designing system shown inFIG. 1is used to manage redundant configuration of a computer system which includes multiple physical servers2and virtual servers3constructed on physical servers2.

Input means11and graceful degradation determining means13shown inFIG. 1are implemented, for example, by graceful degradation management server1shown inFIG. 2. Graceful degradation management server1is connected with multiple physical servers2managed by the graceful degradation designing system, for example, via network22.

Each physical server2includes virtual server control means21and uses virtual server control means21to control zero or more virtual servers3constructed on the local physical server2.

Graceful degradation management server1shown inFIG. 2includes input means11, redundant configuration design means12, graceful degradation determining means13, virtual server management means14, system configuration information storage16, and server shortfall information storage18. Incidentally, although virtual server control means21is shown as being included in each physical server2inFIG. 2, virtual server control means21may be included in graceful degradation management server1.

Input means11is used, for example, by an administrator who manages the computer system to enter availability requirements specified for the computer system. Also, input means11is used to enter information (failure information) about failed physical server2by a monitoring system (not shown) which monitors physical servers2for failure or by the administrator of the computer system.

The availability requirements include information such as a maximum allowable simultaneous fault count or a minimum operating level, where the maximum allowable simultaneous fault count represents the number of virtual servers3, or rather, the number of physical servers2which are allowed to fail simultaneously before the computer system can no longer continue to operate and the minimum operating level represents a minimum number of virtual servers3needed for a service provided by each subsystem (application).

By referring to the availability requirements entered by the administrator and to system configuration information stored in system configuration information storage16, redundant configuration design means12makes the computer system redundant, determines placement of virtual servers with respect to physical servers so as to meet the availability requirements, and outputs information about obtained results (virtual server placement information).

The system configuration information, which represents current configuration of the computer system under management, includes information about the number of physical servers2in the computer system, the number of subsystems (applications), the number of virtual servers placed on physical servers2, and the like.

Based on the virtual server placement information outputted from redundant configuration design means12, virtual server management means14manages virtual servers3constructed on each physical server2.

Virtual server control means21accepts various control requests from virtual server management means14and controls virtual servers3in the local physical server2based on the control requests. Possible control requests to virtual server3include, for example, generation of virtual server3, shutdown of virtual server3, and switching between an active virtual server and redundant virtual server.

If physical server2fails after construction of a redundant configuration, information about failed physical server2is inputted in graceful degradation determining means13via input means11by the administrator of the computer system or from the monitoring system (not shown) which monitors physical servers2for failure.

As shown inFIG. 3, graceful degradation determining means13includes server shortfall calculating means131, resource allocation change determining means132, and server shortfall correction means133.

By referring, for example, to the failure information and availability requirements entered by the administrator and the system configuration information stored in system configuration information storage16, server shortfall calculating means131calculates, for each subsystem (application), the number of virtual servers which are insufficient (hereinafter referred to as lacking servers) in meeting the availability requirements.

Resource allocation change determining means132changes the quantity of computer resources allocated to each virtual server3so that the lacking servers calculated by server shortfall calculating means131will be “0” and outputs information (graceful degradation information) about obtained results.

Server shortfall correction means133monitors changes in the number of lacking servers on each subsystem (application) resulting from changes in the quantity of allocated computer resources and updates information stored in server shortfall information storage18.

Based on graceful degradation information outputted from graceful degradation determining means13, virtual server management means14changes the placement of virtual servers3constructed on physical servers2, using virtual server control means21.

The graceful degradation designing system shown inFIG. 1and graceful degradation management server1shown inFIG. 2can be implemented, for example, by a computer shown inFIG. 4.

The computer shown inFIG. 4includes processing device4which performs predetermined processing according to programs, input device5used to input commands, information, and the like in processing device4, and output device6used to monitor processing results produced by processing device4.

Processing device4includes CPU41; main memory42which temporarily holds information needed for processing performed by CPU41; recording medium43which contains programs used to make CPU41perform processes of redundant configuration design means12, graceful degradation determining means13, and virtual server management means14; data storage device44used as system configuration information storage16and server shortfall information storage18; memory control interface45which controls data transfer to/from main memory42, recording medium43, and data storage device44; I/O interface46which is a device interfacing between input device5and output device6; and communication control device47which is an interface for controlling communications with multiple physical servers2under management; all of which are interconnected via bus48.

Processing device4performs processes of redundant configuration design means12, graceful degradation determining means13, and virtual server management means14according to programs recorded on recording medium43. Incidentally, recording medium43may be a magnetic disk, semiconductor memory, optical disk, or the like. Also, data storage device44does not always need to be installed in graceful degradation management server1, and may be an independent device. Physical servers2shown inFIG. 2can also be implemented by the computer shown inFIG. 4except that physical servers2operate according to a different program, and thus description thereof is omitted herein.

Next, a graceful degradation designing method according to the present exemplary embodiment will be described with reference to the drawings.

FIG. 5is a flowchart showing processing procedures of the redundant configuration design means shown inFIG. 2andFIG. 6is a flowchart showing processing procedures for a redundant configuration design carried out by the virtual server management means and virtual server control means shown inFIG. 2.

As shown inFIG. 5, when the administrator enters availability requirements via input means11(Step1000), redundant configuration design means12acquires current system configuration information from system configuration information storage16, calculates the number of virtual servers3which meets the entered availability requirements, checks whether or not the number of virtual servers3needed to make the computer system redundant is equal to or smaller than the number of currently available virtual servers3, and determines whether or not a redundant configuration can be designed (Step1001).

The availability requirements represent a reliability level required of the computer system under management. An example is shown inFIG. 9.FIG. 9shows an example of the maximum allowable simultaneous fault count and minimum operating level which are availability requirements.

The maximum allowable simultaneous fault count represents the number of failed physical servers2allowed in the entire computer system. That is, the maximum allowable simultaneous fault count is an indicator which indicates that the system can continue to operate using a degradation process if the number of failed physical servers2does not exceed the maximum allowable simultaneous fault count. The minimum operating level defines a minimum requirement which needs to be met in order to continue operating the computer system. The minimum operating level is set, for example, as a minimum number of virtual servers (hereinafter referred to as a minimum server count) needed for each subsystem (application). When a redundant configuration is designed using virtual machine technology, it is necessary to prepare redundant virtual servers3so that the availability requirements are met even in case of a failure.

If it is determined that a redundant configuration can be designed, redundant configuration design means12determines placement of virtual servers3with respect to physical servers2and outputs information about obtained results (virtual server placement information) (Step1002). If it is determined that a redundant configuration cannot be designed, redundant configuration design means12outputs, for example, the number of physical servers2to be added for redundancy and finishes processing.

If there is no problem in the virtual server placement information (redundant configuration) outputted from redundant configuration design means12, virtual server management means14and virtual server control means21start the process of constructing a redundant configuration.

The construction of the redundant configuration may be started either after the virtual server placement information outputted from redundant configuration design means12is confirmed by the administrator or without confirmation by the administrator. In either case, the construction of the redundant configuration is started when the virtual server placement information is inputted in virtual server management means14.

An example of virtual server placement information is shown inFIG. 10.FIG. 10shows an example of defining virtual servers3running on each physical server2. In the example shown inFIG. 10, two types of virtual server3—active and redundant—run on each physical server2and three types of subsystem (application) are allocated to each virtual server3. Also, an active virtual server3and redundant virtual server3which execute the same application are placed on different physical servers2. Specifically, an active virtual server running on application A and a redundant virtual server running on application B are placed on a first physical server (physical server1) while an active virtual server running on application B and a redundant virtual server running on application C are placed on a second physical server (physical server2). Also, an active virtual server running on application C and a redundant virtual server running on application A are placed on a third physical server (physical server3).

As shown inFIG. 6, when virtual server placement information is inputted (Step2000), virtual server management means14transmits a control request to virtual server control means21on each physical server2based on the virtual server placement information (Step2001).

As described above, possible control requests include generation of virtual server3, shutdown of virtual server3, a change from an active virtual server to a redundant virtual server, and a change from a redundant virtual server to an active virtual server.

Upon receiving a control request to virtual server3(Step2002), virtual server control means21performs requested control (Step2003) and transmits control results to virtual server management means14(Step2004).

Upon receiving the control results from virtual server control means21of all physical servers2, virtual server management means14finishes the process of constructing the redundant configuration (Step2005).

Next, a degradation process performed when physical server2fails will be described with reference toFIGS. 7 and 8.

FIG. 7is a flowchart showing processing procedures of the graceful degradation determining means shown inFIGS. 1 and 2, andFIG. 8is a flowchart showing processing procedures for graceful degradation design carried out by the virtual server management means and virtual server control means shown inFIG. 2.

As shown inFIG. 7, when a physical server fails, information about failed physical server2is inputted in graceful degradation determining means13via input means11(Step3000). In the degradation process, it is necessary to design a redundant configuration (graceful degradation) so as to meet the minimum operating level, which is an availability requirement, for remaining physical servers2excluding failed physical server2.

First, graceful degradation determining means13determines whether or not degradation is possible by comparing the number of failed physical servers2with the maximum allowable simultaneous fault count, which is an availability requirement (Step3001). If the number of failed physical servers2exceeds the maximum allowable simultaneous fault count, since it is not possible to migrate to a graceful degradation, graceful degradation determining means13outputs a message indicating that degradation is not possible and thereby finishes processing.

On the other hand, if the number of failed physical servers2does not exceed the maximum allowable simultaneous fault count, since degradation is possible, graceful degradation determining means13makes server shortfall calculating means131calculate, for each subsystem (application), the insufficient number of virtual servers3(hereinafter referred to as server shortfall) in meeting the availability requirements and stores results of the calculation (server shortfall information) in server shortfall information storage18(Step3002).

The number of lacking servers is determined by subtracting the number of active virtual servers remaining after occurrence of failure from an inputted availability requirement, i.e., the minimum number of virtual servers3(minimum server count) needed for each subsystem (application).

An example of server shortfall information is shown inFIG. 11. In the example shown inFIG. 11, the minimum server count for application A is “1,” but the number of remaining virtual servers (hereinafter referred to as a remaining server count) is “0,” and thus the server shortfall is “1.” Graceful degradation determining means13designs a graceful degradation so as to compensate for the lacking server.

Next, graceful degradation determining means13starts the process of compensating for lacking virtual servers determined for each subsystem (application), using redundant virtual servers.

Graceful degradation determining means13makes resource allocation change determining means132select a subsystem (application) in which virtual servers3are lacking (Step3003) and search for redundant virtual servers3allocated to the subsystem (application) (Step3004). When any redundant virtual server allocated to the selected subsystem (application) is found, resource allocation change determining means132changes the quantity of computer resources allocated to the redundant virtual server (Step3005).

As described above, when the quantity of computer resources allocated to a redundant virtual server is changed, the virtual server computer resources that are allocated to other subsystems (applications) are reduced, which may result in an insufficient number of servers.

Thus, graceful degradation determining means13makes server shortfall correction means133recalculate, for each subsystem (application), the number of lacking virtual servers3in meeting the availability requirements and updates the server shortfall information stored in server shortfall information storage18(Step3006).

Server shortfall correction means133determines whether or not the server shortfall is “0” (Step3007). If the server shortfall is “1” or larger, server shortfall correction means133returns to the process of Step3003and repeats the processes of Steps3003to3007. Server shortfall correction means133repeats the processes of Steps3003to3007until the server shortfall becomes “0,” and thereby determines a graceful degradation and outputs graceful degradation information which represents the graceful degradation.

An example of graceful degradation information is shown inFIG. 12.FIG. 12shows an example of a degradation process carried out as a result of failure in the first physical server (physical server1) using the graceful degradation shown inFIG. 10: a virtual server allocated to application A placed on the third physical server (physical server3) is changed from redundant to active and a virtual server allocated to application C is changed from active to redundant.

The graceful degradation information outputted from graceful degradation determining means13is inputted in virtual server management means14and the degradation process is started. In so doing, the degradation process may be started either with or without approval by the administrator.

As shown inFIG. 8, when the graceful degradation information is inputted (Step4000), virtual server management means14transmits a control request to virtual server control means21based on the graceful degradation information (Step4001).

Upon receiving the control request (Step4002), virtual server control means21performs the requested control (Step4003) and transmits control results to virtual server management means14(Step4004). Upon receiving the control results from virtual server control means21of all physical servers2, virtual server management means14finishes the degradation process (Step4005).

In case of failure, the graceful degradation designing system according to the present exemplary embodiment calculates the server shortfall for each subsystem (application) based on the availability requirements, changes the quantity of computer resources allocated to the remaining virtual servers, and thereby determines a graceful degradation, making it possible to migrate to the graceful degradation which meets the availability requirements, without depending on the failed physical server.

Also, since the graceful degradation designing system according to the present exemplary embodiment calculates the number of lacking servers resulting from the changes in the quantity of allocated computer resources and repeats changing the quantity of allocated computer resources until the new server shortfall becomes “0,” it is possible to determine a graceful degradation which meets the availability requirements of each subsystem (application).

Furthermore, since the graceful degradation designing system according to the present exemplary embodiment switches between an active virtual server and redundant virtual server by simply changing the quantity of computer resources allocated to virtual servers3, it is possible to design a graceful degradation quickly without stopping the computer system.

EXAMPLES

Next, the examples will be described with reference to the drawings.

FIG. 13is a block diagram showing a configuration of an example of the graceful degradation designing system.

The graceful degradation designing system shown inFIG. 13is equipped with six physical servers2to be managed and configured such that two virtual servers operate on each physical server2.

FIG. 14is a table showing an example of system configuration information used by the graceful degradation designing system shown inFIG. 13.

As shown inFIG. 14, the system configuration information according to the present example includes information about allocation of active virtual servers3to six physical servers2, where each active virtual server3is running on one of three subsystems (applications).

In the example shown inFIG. 14, active virtual servers of application A are allocated to the first physical server (physical server1), to second physical server (physical server2) and to third physical server (physical server3), active virtual servers of application B are allocated to the fourth physical server (physical server4) and to fifth physical server (physical server5), and an active virtual server of application C is allocated to the sixth physical server (physical server6).

In the present example, it is assumed that availability requirements shown inFIG. 15are inputted in the graceful degradation designing system shown inFIG. 13. As shown inFIG. 15, availability requirements according to the present example are such that the maximum allowable simultaneous fault count is “3” and that the minimum server count per application, specified as the minimum operating level, is “1.”

It is assumed that redundant configuration design means12determines placement of virtual servers3with respect to physical servers2so as to meet the availability requirements shown inFIG. 15and outputs virtual server placement information such as shown inFIG. 16. In the example shown inFIG. 16, redundant virtual servers of application B are allocated to the first physical server (physical server1) and to second physical server (physical server2), redundant virtual servers of application C are allocated to the third physical server (physical server3), to fourth physical server (physical server4) and to fifth physical server (physical server5), and a redundant virtual server of application A is allocated to the sixth physical server (physical server6).

Even if any of the three physical servers fail, the virtual server placement information shown inFIG. 16allows the graceful degradation designing system shown inFIG. 13to migrate to a graceful degradation which meets the availability requirements, by simply changing the quantity of computer resources allocated to virtual servers.

A degradation process carried out when a physical server fails will be described with reference to the flowchart shown inFIG. 7.

As shown inFIG. 7, when, for example, the administrator enters information about a failed physical server via input means11(Step3000), graceful degradation determining means13determines whether or not it is possible to migrate to a graceful degradation which meets the availability requirements (Step3001).

FIG. 17shows an example of failure information used to identify failed physical servers. As shown inFIG. 17, it is assumed that the first physical server (physical server1), second physical server (physical server2), and third physical server (physical server3) have failed out of the six physical servers in the graceful degradation designing system shown inFIG. 13.

Since the number of failed physical servers is three, which does not exceed the maximum allowable simultaneous fault count prescribed by the availability requirement shown inFIG. 15, graceful degradation determining means13determines that degradation is possible.

Next, graceful degradation determining means13makes server shortfall calculating means131calculate, for each subsystem (application), the number of lacking virtual servers3(server shortfall) in meeting the availability requirements and stores information about the results of the calculation (server shortfall information) in server shortfall information storage18(Step3002).

FIG. 18shows an example of server shortfall information calculated by server shortfall calculating means131.

As shown inFIG. 18, according to the present example, since there is one lacking server in application A, graceful degradation determining means13makes resource allocation change determining means132select application A (Step3003) and search for redundant virtual server3that is allocated to the subsystem (application A) (Step3004).

When a redundant virtual server that is allocated to application A is found, resource allocation change determining means132changes the quantity of computer resources allocated to the redundant virtual server (Step3005).

When resource allocation change determining means132changes the quantity of allocated computer resources, lacking servers may newly occur in other subsystems (applications). Thus, graceful degradation determining means13makes server shortfall correction means133recalculate the server shortfall for each subsystem (application) and stores the results of the calculation in server shortfall information storage18and thereby updates the server shortfall information (Step3006).

Next, graceful degradation determining means13determines whether or not the server shortfall is “0.” If the server shortfall is not “0,” graceful degradation determining means13returns to the process of Step3003and repeats the processes of Steps3003to3007. Graceful degradation determining means13repeats the processes of Steps3003to3007until the server shortfall becomes “0,” and thereby determines a graceful degradation to migrate to.

Graceful degradation design procedures will be described in more detail with reference toFIG. 19.

As shown inFIG. 19, first, graceful degradation determining means13initializes value of variable i (i=1) (Step5000). Each application is defined as a_i, with application A being a—1, application B being a—2, and application C being a—3. Also, the server shortfall in each application a_i is designated as γ(a_i).

Next, graceful degradation determining means13selects application a_i (Step5001) and determines whether or not server shortfall γ(a_i) in the selected application is “0” (Step5002).

According to the present example, since γ(a—1)=1 as shown in the example inFIG. 18, graceful degradation determining means13searches for any physical server Sn to which a redundant virtual server of application a—1 is allocated and in which an operating virtual server is not executing an application process (Step5006).

Graceful degradation determining means13determines whether or not any physical server Sn exists (Step5007). If no physical server Sn exists, graceful degradation determining means13goes to the process of Step5003.

In this case, since the sixth physical server (physical server6) is detected, graceful degradation determining means13determines to change the quantity of computer resources allocated to the sixth physical server (Step5008).

Since the sixth physical server is executing a process of application C (a—3) using an operating virtual server, graceful degradation determining means13changes the quantity of allocated computer resources to decrease the remaining server count of application a—3 by “1” and to increase the remaining server count of application a—1 by “1” (Step5009).

When the quantity of allocated computer resources is changed, graceful degradation determining means13recalculates the server shortfalls (Step5010). In this case, server shortfall information after the recalculation is as shown inFIG. 20. In the example shown inFIG. 20, after the quantity of allocated computer resources is changed, a lacking server newly occurs in application C (a—3). The server shortfall information after the recalculation is stored in server shortfall information storage18.

Next, graceful degradation determining means13determines whether or not server shortfall γ(a—1) of the selected application (a—1 in this case) is “0” (Step5011). In this case, since γ(a—1)=0, graceful degradation determining means13determines application a—1 as having been processed (Step5012) and then goes to the process of Step5003to set i=2 and to determine whether or not the value of i has exceeded number n of applications (Step5004).

According to the present example, since n=3, graceful degradation determining means13returns to the process of Step5001and repeats the above processes for application a—2.

First, graceful degradation determining means13selects application a—2 (Step5001) and determines whether or not server shortfall γ(a—2) in the selected application is “0” (Step5002).

According to the present example, since γ(a—2)=0 as shown in the example inFIG. 18, graceful degradation determining means13goes to the process of Step5003to set i=3 and to determine whether or not the value of i has exceeded number n of applications (Step5004).

According to the present example, since n=3, graceful degradation determining means13returns to the process of Step5001and repeats the above processes for application a—3.

First, graceful degradation determining means13selects application a—3 (Step5001) and determines whether or not server shortfall γ(a—2) in the selected application is “0” (Step5002).

According to the present example, as shown inFIG. 20, since server shortfall γ(a—3) in application a—3 is “1” when the server shortfall is recalculated, graceful degradation determining means13searches for any physical server Sn to which a redundant virtual server of application a—3 is allocated and in which an operating virtual server is not executing an application process (Step5006).

Graceful degradation determining means13determines whether or not any physical server Sn exists (Step5007). If no physical server Sn exists, graceful degradation determining means13goes to the process of Step5003.

In this case, since the fourth physical server (physical server4) is detected, graceful degradation determining means13determines to change the quantity of computer resources allocated to the fourth physical server (Step5008).

Since the fourth physical server is executing a process of application B (a—2) using an operating virtual server, graceful degradation determining means13changes the quantity of allocated computer resources to decrease the remaining server count of application a—2 by “1” and to increase the remaining server count of application a—3 by “1” (Step5009).

When the quantity of allocated computer resources is changed, graceful degradation determining means13recalculates the server shortfalls (Step5010). In this case, server shortfall information after the recalculation is as shown inFIG. 21.

In the example shown inFIG. 21, after the quantity of allocated computer resources is changed, the server shortfalls of all the applications are “0.” The server shortfall information after the recalculation is stored in server shortfall information storage18.

Next, graceful degradation determining means13determines whether or not server shortfall γ(a—3) of the selected application (a—3 in this case) is “0” (Step5011). In this case, since γ(a—3)=0, graceful degradation determining means13determines application a—3 as having been processed (Step5012) and then goes to the process of Step5003to set i=4 and to determine whether or not the value of i has exceeded number n of applications (Step5004).

According to the present example, since n=3, graceful degradation determining means13goes to the process of Step5005and calculates the sum total of the server shortfalls in all the applications. Then, graceful degradation determining means13determines whether or not the sum total of the server shortfalls is “0.” If the sum total of the server shortfalls is “0,” graceful degradation determining means13finishes processing. If the sum total of the server shortfalls is not “0,” graceful degradation determining means13returns to the process of Step5001and repeats the processes of Steps5001to5012.

As a result of the above-described processes, the quantity of computer resources allocated to the fourth physical server and sixth physical server is changed, producing graceful degradation information such as shown inFIG. 22. In the example shown inFIG. 22, an active virtual server of application C and a redundant virtual server of application B are allocated to the fourth physical server (physical server4) and an active virtual server of application A and a redundant virtual server of application C are allocated to the sixth physical server (physical server6).

Once the graceful degradation information is obtained, the redundant configuration of the computer system is changed according to the procedures shown inFIG. 8. According to the present example, active and redundant virtual servers are interchanged by changing the quantity of allocated computer resources of the virtual servers placed on the fourth physical server and sixth physical server. Since changes in the quantity of allocated computer resources are finished soon, the degradation process can be performed quickly.

With the graceful degradation designing system according to the present example, even if lacking servers occur in other applications when the quantity of computer resources that are allocated to a virtual server is changed, since virtual servers whose quantity of computer resource allocation needs to be changed are searched for repeatedly by updating the server shortfall information, it is possible to determine a graceful degradation which meets availability requirements.

The present invention has been described with reference to an exemplary embodiment, but the present invention is not limited to the exemplary embodiment described above and various modifications to the configuration and details of the present invention will become apparent to those skilled in the art without departing from the scope of the present invention.