JPH0659865A - Computer system operating method - Google Patents

Abstract

(57) [Summary] [Purpose] It is possible to perform tests in parallel within the same system without affecting the execution work, making it possible to eliminate the need for dedicated test time zones and test exclusive systems. To provide a method of operating a computer system. In a method of operating a computer system having a central processing unit comprising an instruction execution processor and a main memory which is an internal storage unit, and an external storage unit for storing data, a user of the computer system using It is possible to define a plurality of system operation definitions that define usage patterns, execution patterns, execution environments, computer resources used, etc. of jobs executed in the computer system according to purposes such as current operation and test operation. A method of operating a computer system, characterized in that it identifies which of the above-mentioned system operation definitions an execution task belongs to and controls execution according to the system operation definition based on the result of the identification.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of operating a computer system, and more particularly, a system operation definition of the computer system.
Of the (hereinafter, also simply referred to as "operation definition"), the present invention relates to an operation method of a computer system in which a test and a dynamic switching method when the operation definition of the entire system is changed are improved.

[0002]

2. Description of the Related Art Computer systems (hereinafter referred to simply as "systems")
The operation management includes security management that manages a user who uses the system and access of the user, job execution management that manages a job execution order and method, and the like. The system operation definition defines a specific management method of these system operation management. In general, the definition of system operation management is defined collectively because the operation of the entire system is managed uniformly. Therefore, when the operation definition is changed, it affects the entire system. For example, in security management, which is a conventional general system operation management, only one member can be used as an operation definition, and the member can define only one configuration.
Also, there is no control mechanism to change the operation definition by operator command without affecting the running business job, so only a part can be changed except in the test mode where usage is limited. It was So, for example, when using new security features, or
When changing the existing operation method, it was necessary to stop the entire system, restart the system by specifying new operation definition parameters, perform a confirmation test, and restart the operation. . In addition, because the test of new operation may affect the work being executed and requires a lot of time, a dedicated test system should be prepared separately, or a test such as a holiday should be performed. I had to test during the hours. Regarding this, for example, "Hitachi Program Product VO
The description in the "S3 Total User Management Function TRUST E2 Operation Guide" manual (1991) is helpful.

[0003]

[Problems to be Solved by the Invention] Security management, etc.
When changing the operation definition of the entire system to a new operation definition, perform a test in advance so that there are no operation setting mistakes. With the above conventional technology, since there is only one operation definition, immediately change the operation definition. Affect the work being performed,
Also, because there is a limit to changing the operation definition, it was necessary to stop the system once and secure a time zone dedicated to testing at night or on holidays. However, as the operating time of the system has become longer and the number of cases in which continuous operation is performed for a long time is increasing, it is difficult not only to secure a dedicated test time but also to stop the system itself. For this reason, there were cases where a separate system was prepared exclusively for testing. The present invention has been made in view of the above circumstances, and an object thereof is to solve the above-mentioned problems in the conventional art,
To provide a method of operating a computer system that enables tests to be performed in parallel within the same system without affecting execution work, making it possible to eliminate the need for dedicated test time zones and the need for dedicated test systems. It is in. Another object of the present invention is to improve the easiness of operation change and enable a long-term continuous operation of the system even when the operation definition information registered in the external recording medium is made resident in the main memory. It is to provide the operation method of.

[0004]

The above object of the present invention is to provide a computer system having a central processing unit comprising an instruction execution processor and a main memory which is an internal storage device, and an external storage device for storing data. In the operation method, the system operation definition that defines the usage pattern of the user who uses the computer system, the execution pattern / execution environment of the business executed by the computer system, the computer resources used, etc. Separately, it is possible to define a plurality, and to identify which of the above-mentioned system operation definitions the user or execution job belongs to, and control execution according to the system operation definition based on the result of the identification. In addition to the operating method of the computer system and the above-mentioned procedure, it is necessary to make the main memory resident in the specified system operation definition. The present invention is achieved by a method of operating a computer system, characterized by making a certain object resident in the main memory and dynamically changing the current system operation definition including information resident in the main memory. .

[0005]

In the computer system operation method according to the present invention, the system operation definition used in the current operation and the system operation definition for testing can be independently defined and used arbitrarily. Then, the user classification and business classification for which the current operation definition is valid and the user classification and business classification for which the test operation definition is valid can be separated and identified. In addition, while the user is using the system and executing the business, it is possible to control by the operation definition corresponding to the user and the business, and the execution of the current business and the confirmation test can be performed in the same system. Can be run at the same time. Further, after the test is completed, it is possible to switch to a new operation definition without stopping the work being executed by the system or online. Further, even when the operation definition information is made resident in the main memory, it is possible to switch to the new operation definition without stopping the system and the work being executed.

[0006]

Embodiments of the present invention will now be described in detail with reference to the drawings. The embodiment described below shows an example in which the present invention is applied to a security program that realizes security operation of a system. FIG. 1 shows the hardware configuration of a system according to the present embodiment, a security program for implementing security, a security operation configuration of a system including users of the system and execution work. In the figure, 101 is a central processing unit (CPU), which comprises an instruction execution processor 102 and a main memory 103 accessed by the instruction execution processor 102. Also,
104 is an operating system that controls the system
(OS), and the security program 10 that realizes the characteristic operation of this embodiment in the operating system.
There is 5. Reference numeral 110 is a magnetic disk device of an external recording medium in which definition information regarding security operation, which is one of the constituent elements of this embodiment, is stored.

111 in the magnetic disk device 110
Is a security register that stores access rule information to protect the data sets and volumes that store the data handled by this system, and information to identify users who can use this system. is there. In addition,
The security registration list 111 is prepared for each object to be protected, such as user, data set, volume, etc., and the access rule is registered through the security program 105 described above. Reference numeral 112 is a security operation definition parameter library that defines a security method and an effective range.
Reference numerals 4 and 113 respectively denote a secondary registry and a secondary library when a plurality of operational configurations, which are one of the features of this embodiment, are defined. That is, 114 is the security registration list 11
Reference numeral 1 is a secondary security operation registration parameter list, and reference numeral 113 is a secondary security operation definition parameter library corresponding to the security operation definition parameter library 112.

Reference numeral 120 is a user of this system in which the definitions of the security registration list 111 and the security operation definition parameter library 112 are valid, and 121 is the security registration list 111 and the security operation definition parameter library 11.
This is a business job for which definition 2 is valid. Similarly, 12
2 is a user of this system in which the definitions of the secondary security register 114 and the secondary security operation definition parameter library 113 are valid, and 123 is the secondary security register 114.
And the definition of the secondary security operation definition parameter library 113 is a valid business job. The security program 105 uses the system user 120 according to the information registered in the security registry 111, the security operation definition parameter library 112, the secondary security operation definition parameter library 113, and the secondary security register 114. , 12
2 and control access from the business jobs 121 and 123.

FIG. 2 shows an example of defining the security operation definition parameter library and the security registry described above in a two-layer structure of a primary and a secondary. Here, 112 is a primary operation definition parameter library, and in this example, in the primary operation definition parameter 112, the names and their locations of the primary user registration list 201, the primary data set registration list 202, and the primary volume registration list 203 are included. It defines the place. Information for managing system users is stored in the above-mentioned primary user registry 201, and the primary data set registry 2
The access rule information of the data set is stored in 02, and the access rule information of the volume is stored in the primary volume register 203. Similarly, 113 is a secondary operation definition parameter library, which defines a test environment. In this example, the secondary user registration list 211, the secondary data set registration list 212, and the secondary volume registration list 213 are defined in the secondary operation definition parameters. In addition, the secondary operation definition parameter library 113
It is defined in the primary operation definition parameter 112.

FIG. 3 shows an example of the definition for identifying the operation definition parameter and the business type and user type for which it becomes effective. 301 is one definition parameter in the above-mentioned operation definition parameter library 112. Three
Reference numeral 02 shows an example of designation of a business type and a user type in which the information defined in the operation parameter library is valid in the definition parameter 301. ACTION is a keyword indicating that valid information is defined. The job type includes a job name, a job class, a terminal name, a program name, and a part indicating the name rule of these. In addition, the user type includes a user name, a group name to which the user belongs, and a part indicating the rule of these names. FIG. 4 shows that when a plurality of security definition information defined in the magnetic disk device 110 described above is used in this system, it is read from the magnetic disk device 110 onto the main memory 103 and managed on the main memory 103. An example of the format is shown.

In the figure, 401 is an area on the main memory 103 in which identification information for which the information of the current security operation parameter library 112 is valid is stored, and 402 is defined by the corresponding current security operation parameter. This is an area where information is stored. In general, since the security protection information has a large amount of information, the information in the protection registration list is not made resident in the main memory 103 except for the frequently accessed information. Similarly, 41
Reference numeral 0 is an area in which identification information for validating the information in the test security operation parameter library 113 is stored, and reference numeral 411 is an area in which information defined by the corresponding test security operation parameter is stored. FIG. 5 is a flowchart showing a processing procedure when the security program 105 controls security according to the designation of the current security operation parameter and the test security operation parameter. The security program 105 is called from the operating system when the work is executed and the access to the data set is started.

In the security protection program 105, first, the job requesting access is the area 40 on the main memory.
It is searched whether or not it matches the one defined in the definition condition of the identification information of No. 1 (step 501). If it is determined in step 502 that they match, access control is performed according to the corresponding security operation parameter information and the access rule in the security register (step
503). If they do not match in the determination in step 502, they are positioned in the next identification information storage area (step 50
4) Then, repeat the same procedure from step 501. Figure 6
Shows a format example of a command for instructing the security program 105. 601 is the name of the command,
Here, parameter changes are shown. 602 is an example of the name of the security program 105. Reference numeral 603 denotes one operand of the command, which indicates that the primary operation definition parameter is switched. Reference numeral 604 is a member name of a security parameter to be newly used. Reference numeral 605 indicates that if there is a designation in the security protection parameter 604 to make the main memory 103 resident, it is read from the magnetic disk device 110 in advance and made resident before switching.

FIG. 7 shows the security definition parameters described above.
The control flag and the control counter on the main memory 103 for dynamically switching without affecting the work being executed are shown. Reference numeral 701 is a control flag indicating that a command for switching the operation definition parameter of the security protection program 105 shown in FIG. 6 has been input. Reference numeral 702 is a control counter indicating the number of commands being processed when the security program 105 is currently performing access control processing. FIG. 8 is a flowchart showing a procedure of access control of the security protection program 105. First, prior to the start of processing, the control flag 701 is referenced to determine whether or not a switching command is currently input and processing is in progress.
(Step 801). If the command processing is in progress, wait until the command processing is completed (step 802), and after completion, execute the processing of step 803 and thereafter. If it is not being processed, the counter indicating that the access control is being processed is incremented by 1 (step 803). After the access control process is completed, the counter being processed is decremented by 1 (step
804).

FIG. 9 is a flowchart showing a processing procedure in the security program 105 when dynamically switching the security definition parameters by a command. First, analyze the instructions specified by the command (step 90
1). Next, the information of the specified definition parameter 604 is read into the main memory 103, analyzed, and put into the security definition information storage area (step 902). And with the command,
If RESET is specified (step 903), the information that needs to be made resident in the main memory 103 among the analyzed parameters is read from the magnetic disk device 110 and stored in the area on the main memory 103 (step 904). Now that the switching preparation is completed, the control flag 701 indicating that the command is being processed
On (step 905). Next, it is determined whether the above-mentioned control counter 702 is "0", and it is confirmed that the access control process is not in operation (step 906). If it is running, wait for the access control process to finish
(Step 907).

If there is no active access control processing, or if the active access control processing ends, the contents of the address indicating the security definition information storage area currently in use are stored in step 902. Change to the address of the area (step 908). Finally, since the command processing is completed, the control flag 701 is turned off (step 909). According to the above embodiment, when the system operation definition parameter is changed, the definition parameter of the current operation and its configuration are defined by the primary operation definition parameter, the test operation configuration is defined by the secondary operation definition parameter, and the test operation configuration is defined. By defining the following new operation definition parameter in the operation definition parameter, it is possible to perform a confirmation test of the new operation definition parameter in parallel with the current job. Further, according to the above-described embodiment, it is possible to dynamically switch to the new operation definition parameter without stopping the system or the work being executed without waiting for the completion of the confirmation test.

Further, according to the above-mentioned embodiment, when the operation parameters are dynamically switched, even if there is information resident in the main memory, by making it resident in advance before the switching, the operation being executed is affected. Can be switched at high speed without giving. It is needless to say that the above embodiment shows one example of the present invention, and the present invention should not be limited to this.

[0017]

As described above in detail, according to the present invention, it is possible to perform tests in parallel in the same system without affecting the execution work, thereby eliminating the need for a dedicated test time zone. This has the remarkable effect of realizing a computer system operation method that makes it possible to eliminate the need for a test-dedicated system.

[0018]

[Brief description of drawings]

FIG. 1 is a diagram showing a security operation configuration of a system according to an embodiment of the present invention.

FIG. 2 is a diagram showing two configuration examples of a current security operation definition and a test security operation definition and their relationships in the embodiment.

FIG. 3 is a diagram showing an example of a method of defining identification information for identifying a business type and a user type for which the operation definition information is valid in the embodiment.

FIG. 4 is a diagram showing a relationship between identification information managed on a main memory and corresponding security definition information in the embodiment.

FIG. 5 is a flowchart showing a processing procedure for identifying a processing target based on identification information in the embodiment.

FIG. 6 is a diagram showing a format example of a command for instructing the security program 105 in the embodiment.

FIG. 7 is a diagram showing a control area for dynamically switching operation definition parameters in the embodiment.

FIG. 8 is a flowchart showing a processing procedure of access control of the security program 105 in the embodiment.

FIG. 9 is a flow chart showing a processing procedure at the time of dynamically switching a security definition parameter by a command in the embodiment.

[Explanation of symbols]

101: central processing unit, 102: instruction processor, 10
3: main storage device, 104: operating system,
105: security program, 110: magnetic disk device, 111: primary security registry, 112: primary security operation definition parameter library, 113: secondary security operation definition parameter library, 114: secondary security registry, 120,122: system users, 121,12
3: Business job, 201: Primary user registry, 202:
Primary data set register, 203: primary volume register, 211: secondary user register, 212: secondary data set register, 213: secondary volume register.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Sachiyoshi Takada 6-81 Onoue-cho, Naka-ku, Yokohama-shi, Kanagawa Hitachi Software Engineering Co., Ltd. (72) Inventor Koji Morikawa 6-81, Onoe-cho, Naka-ku, Yokohama-shi, Kanagawa Address Hitachi Software Engineering Co., Ltd. In-house (72) Inventor Masayuki Ito 6-81, Onoe-cho, Naka-ku, Yokohama-shi, Kanagawa Hitachi Software Engineering Co., Ltd. (72) Inventor Sakaihiro 5030 Totsuka-cho, Totsuka-ku, Yokohama-shi, Kanagawa Hitachi, Ltd. Software Development Division

Claims (2)

[Claims] 1. A method for operating a computer system having a central processing unit comprising an instruction execution processor and a main memory which is an internal storage device, and an external storage device for storing data, the use of the computer system. It is possible to define a plurality of system operation definitions that define the user's usage pattern, the execution pattern / execution environment of the business to be executed in the computer system, the computer resources used, etc. for each purpose such as current operation and test operation. A method of operating a computer system, characterized in that an operator or an execution task is identified to which of the above-mentioned system operation definitions, and execution is controlled according to the system operation definition based on the result of the identification. 2. In addition to the procedure described above, further, of the designated system operation definitions, those that need to be made resident in the main memory are made resident in the main memory, and then the current system operation definition is A method of operating a computer system characterized by dynamically changing information including information resident in main memory.