[Linux-HA] methods of dealing with network failover

[Andrew Beekhof]

On 1/11/07, Andreas Kurz <andreas.kurz at gmail.com> wrote:
> On 1/11/07, Andrew Beekhof <beekhof at gmail.com> wrote:
> > On 1/10/07, Andreas Kurz <andreas.kurz at gmail.com> wrote:
> > > On 1/10/07, Andrew Beekhof <beekhof at gmail.com> wrote:
> > > > On 1/10/07, Andreas Kurz <andreas.kurz at gmail.com> wrote:
> > > > > On 1/10/07, Andrew Beekhof <beekhof at gmail.com> wrote:
> > > > > > but i still dont think that helps you because 2 node clusters _always_
> > > > > > have quorum (so this particular policy will never take effect)
> > > > >
> > > > > Can you explain this a bit further? Do you mean in the case of a
> > > > > heartbeat start one node is sufficient to have quorum?
> > > >
> > > > correct - this is how v1 worked
> > > > since it only supported 2 nodes it had to work this way otherwise it
> > > > would never be able to do resource takeover
> > >
> > > I see. I have never tested a two node cluster without stonith or a
> > > third quorum node. Wouldn't it be an improvement if a two node cluster
> > > is required to have at least two independent heartbeat channels and if
> > > not to enforce the no_quorum policies also with two nodes? Or at least
> > > enforce the policies for primitives with operations that have
> > > "prereq=quorum" set?
> >
> > possibly. personally i think it would just be better not to have the
> > fudge that pretends we have quorum when we dont.
>
> Why not make either a stonith device or the new quorumd a prerequisite
> for a cluster with an even number of nodes and enforce the
> no_quorum_policys as intended? If someone thinks he knows what he's
> doing it is always possible to set the no_quorum_policy to ignore.

because that a whole lot more complex than removing a hack that
arguably shouldn't be there in the first place