Apparatus and method for deterministically performing active-active failover of redundant servers in a network storage appliance
First Claim
1. A network storage appliance for deterministically performing active-active failover of redundant servers enclosed therein, comprising:
- two redundant servers, each having at least one unique ID for communicating on a network;
at least one storage controller, coupled to said redundant servers, for transferring data between storage devices and said servers, wherein said at least one storage controller comprises redundant storage controllers;
a backplane, wherein said storage controller and servers comprise a plurality of blades for plugging into said backplane, wherein two of said plurality of blades each comprise;
one of said two redundant servers; and
a portion of one of said redundant storage controllers; and
first and second status paths, comprised in said backplane, each for providing a heartbeat from one of the servers to the other server;
wherein each of said servers is configured to deterministically disable the other server from communicating on said network in response to detecting that said heartbeat of the other server has stopped, and to assume said at least one unique ID of the other server for communicating on said network thereafter.
2 Assignments
0 Petitions
Accused Products
Abstract
An apparatus for deterministically performing active-active failover of redundant server blades hot-pluggable into a backplane of a network storage appliance chassis is disclosed. Each server monitors the other'"'"'s heartbeat on a respective path in the backplane. Other paths between the two servers on the backplane enable one server to reliably kill the other server and take over its identity on the network in response to detecting a stopped heartbeat of the other server. The apparatus is superior to a conventional heartbeat link between servers in separate chassis, such as an Ethernet cable, because it is not prone to user removal or damage since the backplane cannot be removed by a user while the appliance is operational and enables each server to know a true heartbeat failure has occurred, as opposed to failure of a conventional external heartbeat link causing each server to each think the other has failed.
-
Citations
51 Claims
-
1. A network storage appliance for deterministically performing active-active failover of redundant servers enclosed therein, comprising:
-
two redundant servers, each having at least one unique ID for communicating on a network; at least one storage controller, coupled to said redundant servers, for transferring data between storage devices and said servers, wherein said at least one storage controller comprises redundant storage controllers; a backplane, wherein said storage controller and servers comprise a plurality of blades for plugging into said backplane, wherein two of said plurality of blades each comprise; one of said two redundant servers; and a portion of one of said redundant storage controllers; and first and second status paths, comprised in said backplane, each for providing a heartbeat from one of the servers to the other server; wherein each of said servers is configured to deterministically disable the other server from communicating on said network in response to detecting that said heartbeat of the other server has stopped, and to assume said at least one unique ID of the other server for communicating on said network thereafter. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37)
-
-
38. A network storage appliance for deterministically performing active-active failover of redundant servers enclosed therein, comprising:
-
a chassis; two redundant servers, enclosed in said chassis, each having at least one unique ID for communicating on a network; at least one storage controller, enclosed in said chassis, coupled to said redundant servers, for transferring data between storage devices and said servers; and first and second status paths, enclosed in said chassis, each for providing a heartbeat from one of the servers to the other server; wherein each of said servers is configured to deterministically disable the other server from communicating on said network in response to detecting that said heartbeat of the other server has stopped, and to assume said at least one unique ID of the other server for communicating on said network thereafter, wherein at least one of said two redundant servers includes a shield circuit for preventing the other server from disabling the at least one of said two redundant servers from communicating on the network, wherein said at least one of said two redundant servers is configured to enable said shield circuit prior to deterministically disabling the other server from communicating on said network. - View Dependent Claims (39, 40, 41, 42)
-
-
43. An apparatus for deterministically performing active-active failover of two redundant servers integrated with at least one storage controller into a network storage appliance chassis, each of the servers being configured to communicate with computers on a network, the apparatus comprising:
-
a backplane, enclosed in the chassis, configured to receive a plurality of hot-pluggable blades comprising the servers and storage controller; two heartbeat paths, comprised in said backplane, each for conveying a respective heartbeat signal from one of the servers to the other server; two kill paths, on said backplane, each for conveying a signal from an inactivating one of the two redundant servers to the other server for inactivating the other server from communicating on the network in response to the inactivating server detecting said heartbeat of the other server has stopped; and a shield circuit, comprised in the inactivating server, for preventing the other server from inactivating the inactivating server from communicating on the network, wherein the inactivating server is configured to enable said shield circuit prior to inactivating the other server from communicating on the network; wherein the inactivating server is configured to take over the identity of the inactivated server on the network after inactivating the other server. - View Dependent Claims (44, 45, 46)
-
-
47. A method for deterministically performing failover of first and second redundant servers integrated into a network storage appliance chassis, the method comprising:
-
receiving, by the first server, a first heartbeat signal from the second server via a first signal path in a backplane of the chassis; receiving, by the second server, a second heartbeat signal from the first server via a second signal path in a backplane of the chassis; detecting, by the first server, that the first heartbeat signal has stopped; generating, by the first server, a kill signal to control logic of the second server to disable the second server from communicating on a network, in response to said detecting the first heartbeat signal has stopped; taking over the identity of the second server on the network, by the first server, after said generating the kill signal; and enabling, by the first server, a shield circuit, prior to said generating the kill signal, to prevent the second server from disabling the first server from communicating on the network. - View Dependent Claims (48, 49, 50, 51)
-
Specification