Help! Problems with IP address takeover on 2.0.36

[Amit.Joshi@libnet.com]

Hello,

> Alan's remark about MAC addresses really missed the point about why
> partitioning is hard: voting about who gets what services between the
> majority survivors is not difficult.  What is difficult is dealing with
> a partition in which you can only see half of the votes and you have no
> idea whether or not the other half of the cluster is alive.

I am not sure if it helps but my 2 cents worth:

- Vote based on quorom: I know this can have problems in the two node case
but see next point.
- Clearly a tie breaker is needed whenever there is a possibility of
breaking the cluster into equal sized groups  or only groups each without a
quorom. Here as others have pointed out you can use an "external voter"
that goes with only one of the various groups. The trickiness comes when
there is a group with a quorom but another got the "external vote".
Typically you want the large group to be the alive cluster. One approach
may be to perform the master election for each subgroup as described below.
Finally make the "external voter" choose the largest subgroup and a random
one if there are more than one equal sized large groups.
- In an application that we had developed rather than be dependent on MAC
addresses we employed the following mechanism:
   - Each "set" of applications formed a group.
   - Each group had a master.
   - The master was "elected".
     All the members in a group would vote for themselves as a master with
a random number of for the vote count.
     The member with the most votes (the highest random number) would
become the master.
     The master machine would then confirm with all the voting members that
it was the master.
     The quorom mechanism ensured that there were no partitions. In
actuality we allowed partitions to provide "safe (as defined by the
application)"  information.
   - You could have different master machines for different set's of
applications. In fact this was more usual than not.

Clearly the difficulty is the "external voter" It needs to be on
"communication terms" with all the groups. If such a mechanism cannot be
found then the sanest way may be declare a hard failure of each subgroup
with no quorum. The serial lines, the additional ethernets are essentially
the "external voters".