Protecting paired virtual machines

Patent metadata

Field	Value
Publication number	US-9268642-B2
Application number	US-201313975133-A
Country	US
Kind code	B2
Filing date	Aug 23, 2013
Priority date	Aug 24, 2012
Publication date	Feb 23, 2016
Grant date	Feb 23, 2016

Abstract

A system for monitoring virtual machines includes a master host and a slave host. The slave host includes a primary virtual machine and a secondary virtual machine. The slave host is configured to identify a failure that impacts an ability of at least one of the primary virtual machine and the secondary virtual machine to provide service. If the failure is a Permanent Device Loss failure, the slave host is configured to terminate each impacted virtual machine. If the failure is an All Paths Down failure, the master host is configured to apply one of the following: a first remedy if the primary virtual machine is impacted and the secondary virtual machine is not impacted; a second remedy if the secondary virtual machine is impacted and the primary virtual machine is not impacted; or a third remedy if both the primary virtual machine and the secondary virtual machine are impacted.

First claim

What is claimed is:

1. A system for monitoring virtual machines, the system comprising:
a master host; and
a slave host comprising a primary virtual machine and a secondary virtual machine, the secondary virtual machine being a backup virtual machine to the primary virtual machine, and wherein the slave host is configured to identify a failure that impacts an ability of at least one of the primary virtual machine and the secondary virtual machine to provide service; and
wherein if the failure is a Permanent Device Loss (PDL) failure, the slave host is configured to terminate each impacted virtual machine; and
wherein if the failure is an All Paths Down (APD) failure, the master host is configured to apply one of the following: a first remedy if the primary virtual machine is impacted and the secondary virtual machine is not impacted; a second remedy if the secondary virtual machine is impacted and the primary virtual machine is not impacted; or a third remedy if both the primary virtual machine and the secondary virtual machine are impacted.

2. The system of claim 1 , wherein the first remedy comprises causing the primary virtual machine to failover to the secondary virtual machine without first determining whether there is sufficient resource capacity to restart the primary virtual machine on another host.

3. The system of claim 1 , wherein the second remedy comprises causing the secondary virtual machine to failover without first determining whether there is sufficient resource capacity to restart the secondary virtual machine on another host.

4. The system of claim 1 , wherein the third remedy comprises:
receiving, from the slave host, a request to reserve resources on another host to enable at least the primary virtual machine to failover;
calculating a resource capacity for the other host;
determining whether the calculated resource capacity is sufficient to reserve the resources; and
if it is determined that the calculated resource capacity is sufficient to reserve the resources, causing the primary virtual machine and the secondary virtual machine to failover; or
if it is determined that the calculated resource capacity is not sufficient to reserve the resources, ignoring the APD failure.

5. The system of claim 1 , wherein the system further comprises a network partition, wherein the master host is on a first side of the network partition and the slave host is on a second side of the network partition, wherein the master host is unable to determine resource availability on the second side of the network partition, and wherein the third remedy comprises:
if an aggressive policy is established, causing the primary virtual machine and the secondary virtual machine to failover; or
if a conservative policy is established, ignoring the APD failure.

6. The system of claim 1 , wherein the system further comprises a network partition, wherein the master host is on a first side of the network partition and the slave host is on a second side of the network partition, wherein the master host is unable to determine resource availability on the second side of the network partition, and wherein the first remedy comprises:
if an aggressive policy is established, causing the primary virtual machine to failover to the secondary virtual machine; or
if a conservative policy is established, not causing the primary virtual machine to failover.

7. The system of claim 1 , wherein if the failure is a PDL failure, the slave host is configured to terminate each impacted virtual machine without a need for each impacted virtual machine to check a health of its peer, and wherein the master host is further configured to attempt to restart each of the terminated virtual machines on a healthy host.

8. A method comprising:
receiving, from a slave host comprising a primary virtual machine and a secondary virtual machine being a backup virtual machine to the primary virtual machine, a notification that a failure has impacted an ability of at least one of the primary virtual machine and the secondary virtual machine to provide service; and
if the failure is a Permanent Device Loss (PDL) failure, terminating the impacted virtual machines; and
if the failure is an All Paths Down (APD) failure, applying one of the following: a first remedy if the primary virtual machine is impacted and the secondary virtual machine is not impacted; a second remedy if the secondary virtual machine is impacted and the primary virtual machine is not impacted; or a third remedy if both the primary virtual machine and the secondary virtual machine are impacted.

9. The method of claim 8 , wherein the first remedy comprises causing the primary virtual machine to failover to the secondary virtual machine without first determining whether there is sufficient resource capacity to restart the primary virtual machine on another host.

10. The method of claim 8 , wherein the second remedy comprises causing the secondary virtual machine to failover without first determining whether there is sufficient resource capacity to restart the secondary virtual machine on another host.

11. The method of claim 8 , wherein the third remedy comprises:
receiving, from the slave host, a request to reserve resources on another host to enable at least the primary virtual machine to failover;
calculating a resource capacity for the other slave host;
determining whether the calculated resource capacity is sufficient to reserve the resources; and
if it is determined that the calculated resource capacity is sufficient to reserve the resources, causing the primary virtual machine and the secondary virtual machine to failover; or
if it is determined that the calculated resource capacity is not sufficient to reserve the resources, ignoring the APD failure.

12. The method of claim 8 , wherein the master host is on a first side of a network partition and the slave host is on a second side of the network partition, wherein the master host is unable to determine resource availability on the second side of the network partition, and wherein the third remedy comprises:
if an aggressive VMCP policy is established, causing the primary virtual machine and the secondary virtual machine to failover; or
if a conservative VMCP policy is established, ignoring the APD failure.

13. The method of claim 8 , wherein the master host is on a first side of a network partition and the slave host is on a second side of the network partition, wherein the master host is unable to determine resource availability on the second side of the network partition, and wherein the first remedy comprises:
if an aggressive VMCP policy is established, causing the primary virtual machine to failover to the secondary virtual machine; or
if a conservative VMCP policy is established, not causing the primary virtual machine to failover.

14. The method of claim 8 , wherein if the failure is a PDL failure, terminating each impacted virtual machine without a need for each impacted virtual machine to check a health of its peer, and restarting each of the terminated virtual machines on a healthy host.

15. At least one non-transitory computer-readable storage medium having computer-executable instructions embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:
receive, from a slave host comprising a primary virtual machine and a secondary virtual machine being a backup virtual machine to the primary virtual machine, a notification that a failure has impacted an ability of at least one of the primary virtual machine and the secondary virtual m

Assignees

• Vmware Inc

Inventors

• Krishnan Manoj
• Ren Joanne
• Farkas Keith
• Tarashansky Igor
• Ziskind Elisha

Classifications

• G06F11/1484

  involving virtual machines · CPC title

• G06F11/20

  using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements · CPC title

• G06F11/1438

  Restarting or rejuvenating · CPC title

• G06F11/1415 Primary

  at system level · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title