Abstract:
The system and method described herein automatically detect various corruptions in a file system and notify a system administrator of the corruption. Detailed information on the file system is collected by a probe process. If the file system is corrupt or inaccessible, the system and method marks the file system as bad, notifies the system administrator and then ceases to attempt to collect information on that system again until it has been repaired.

Description:
BACKGROUND 
     In the course of operating a computer on a network, computer application processes need to access the host computer&#39;s file system through a variety of system calls. In systems of the prior art, when the file system is corrupt, the software requesting access to a file system resource will hang, often with no way to be killed, or terminated. Problem elements of the file system are bad disk sectors, bad inode table, full inode table, bad FAT tables, etc. Once the software hangs, it is necessary for the user to reboot the system in order to resume. The system is rebooted so that the operating system (OS) will exclude the corrupt file system from being mounted. Once the software hangs, it usually requires a user to personally either reboot the system or repair the corrupted file system. 
     Problems with a corrupt file system are even more critical with the widespread use of storage area networks (SANs). More and more network devices now attempt to access storage file systems of the SAN. The benefits of SANs, e.g., storage scalability, availability, and flexibility, are becoming clearer as the entire IT industry adopts this storage topology. As SANs grow to accommodate the growth in storage requirements, the task of managing this business-critical resource, without increasing staff, becomes daunting. 
     To help customers manage their SANs, a powerful, integrated suite of SAN-management software products, collectively called OpenView Storage Area Manager (OVSAM), have been developed and are available through the Hewlett-Packard Company. These products provide a single, centralized solution for managing a SAN. The products automatically discover storage devices, interconnect devices, and hosts, to enable a user to proactively manage more storage with less effort. 
     SUMMARY 
     The system and method described herein automatically detect various corruptions in a file system and notify a system administrator of the corruption. Detailed information on the file system is collected by a probe process. If the file system is corrupt or inaccessible, the system and method marks the file system as bad, notifies the system administrator and then ceases to attempt to collect information on that system again until it has been repaired. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
       The detailed description will refer to the following drawings, wherein like numerals refer to like elements, and wherein: 
         FIG. 1  illustrates a flow diagram of an exemplary process to monitor a file system for corruption; and 
         FIG. 2  is block diagram showing an exemplary storage area network with three file systems. 
     
    
    
     DETAILED DESCRIPTION 
     A feature of the apparatus and method described herein is to probe the health status of a system. Probing of the file system is done by appending data to an opened data file. The file is opened by a probe process. If appending data to an opened data file is successful within an adjustable time interval (e.g., PROBE_INTERVAL, where the default is 1 second), the file system is considered to be functioning well and responsive to the users. If a file system doesn&#39;t respond to the outside users within the time interval, the probe will then continue for a specified number of tries (e.g., MAX_PROBE, where the default is 300 times). If the file system is still not able to append data to the opened data file after the selected time period of PROBE_INTERVAL*MAX_PROBE, the file system is considered as corrupted. 
     Referring now to  FIG. 1 , there is shown a flow diagram of an exemplary method, generally designated by the reference numeral  100 , for probing a file system to detect corruption therein. The described method operates on various operating systems, but each operating system has its own indicators of file system corruption. For instance, Unix and Linux use an inode table. If the operating system of the target computer is Unix or Linux, as determined in step  101 , then a determination is made as to whether the inode table is full or bad, in step  103 . It will be apparent to one of ordinary skill in the art that step  103  can be customized for any operating system that has unique indicators of file system corruption. For instance, for a Windows™ operating system, the FAT table is checked. Inode or FAT table checking is different from appending data to the opened file. Operating System APIs are relied upon to find out such information. Further, there are other reasons why a file system is corrupted that are tested, for instance, if someone pulls out the hard disk prematurely. If the test for a bad table fails, then the probe process attempts to append data to an opened file on the file system, in step  105 . The probe process basically tries to collect some basic file information by attempting the write/append: the probe process basically tries to probe the health status of the file system by appending data to an opened file. If the process doesn&#39;t come back right away (within PROBE_INTERVAL*MAX_PROBE time), then the process streams bytes back to the main process. If the same number of bytes is not received back within a certain amount of time, then the file system can be marked as corrupted. If the write is successful within the specified time interval, PROBE_INTERVAL, then the file system is declared okay, in step  109 . If the write is not successful in the specified time, then it is determined whether the number of tries exceeds the maximum specified, MAX_PROBE, in step  107 . If the maximum number of tries has been exceeded without a successful write/append, or the inode table was full or bad, then a file system corrupted message is posted to the system administrator, in step  111 . If the maximum number of tries has not been exceeded, then the probe process continues at step  105  to attempt another write/append. 
     The exemplary method uses two time out thresholds to make this detection mechanism both responsive and generic. If a file system works well, the detection returns fairly quickly, i.e., within the PROBE_INTERVAL. If a file system fails to write data, e.g., within the afore-mentioned the MAX_PROBE=300 seconds, it is fairly safe to assume that file system is in bad shape for some reason. In an exemplary embodiment, the two time out thresholds (PROBE_INTERVAL and MAX_PROBE) are configurable to handle the extreme case that a file system works but does not write data to the data file within a default time, for instance, if the system load is extremely heavy. Thus, the threshold, MAX_PROBE, can be set to a bigger number. To make the probing more responsive, PROBE_INTERVAL can be set to a small number, for instance, 100 milliseconds. 
     In one embodiment, this implementation of the file system corruption mechanism is incorporated into the Storage Builder of Open View Storage Area Management (OVSAM) 3.0. As before, default thresholds (PROBE_INTERVAL=1 second and MAX_PROBE=300) are used in the tests. The probe process is always on during a file collection, to make sure the process will not hang. In this embodiment, when there is no need to collect data for an OVSAM Storage Builder, the probe process is turned off. When the corrupted file system is fixed, the probe process can be notified via the a graphic user interface or command line interface (GUI/CLUI) to enable file collection on that corrupted file system again. 
     The present system and method is system-independent. One embodiment is written in JAVA™ and has different native codes for Windows™ and UNIX. In an exemplary embodiment, the probe process is implemented as native code on UNIX and Windows™ using C to append data to an opened data file. The file system corruption detection framework in this embodiment is written as Java™ code. 
     Referring now to  FIG. 2 , there is shown an exemplary storage area network  200  having several file systems. In the exemplary network  200 , a host CPU  201  is connected to a network of file systems  205 , 207 , and  209 . Suppose that file system FS 1   205  has become corrupt. If the host CPU  201  tries to access file system FS 1   205 , it will be unable to do so, and the application requiring access to FS 1   205  will typically hang and never return. It is advantageous for the applications to know when a file system is corrupt to bypass it or more quickly return from an operation. The probe process  203  runs on a host CPU  201 , which has three file systems mounted  205 ,  207 , and  209 , respectively. The probe process  203  creates a data file on each file system and appends data to each to probe the status of the file system. As described above, the file system is considered to be corrupted if the appending is unsuccessful within the interval of PROBE_INTERVAL*MAX_PROBE. 
     The probe process software goes out to all of the attached file systems and retrieves information to find out how much capacity is left on the respective file systems. This process sends out an event and a desired action associated with the event. The action is user selectable, and can be e-mailing, paging or just appearing as a warning on the application process. The probe process is always on when a file collection is performed as a safeguard to make sure the application software does not hang. Once a corrupt file system is fixed, the user can check this file system, and then the disks of file systems will be collected on again. 
     It will be apparent to one skilled in the art that the described system and method is scalable to multiple file systems on a network of computers. The probe process will typically reside on the host computer that controls a given file system. However, any computer on the network that can run the operating system APIs on the file systems can host the probe process. 
     As noted, an advantage of this corrupted file system detection is that it is system-independent. The same concept carries over to all the file systems. Another advantage is using a multi-level time-out mechanism. Such mechanisms have the great advantage that not much performance penalty is brought to a good file system, and a corrupted file system can be detected quite fast. A further advantage is that the time-out thresholds are user-selectable. Thus, the time-outs are adaptable for different work loads. 
     The terms and descriptions used herein are set forth by way of illustration only and are not meant as limitations. Those skilled in the art will recognize that many variations are possible within the spirit and scope of the invention as defined in the following claims, and their equivalents, in which all terms are to be understood in their broadest possible sense unless otherwise indicated.