Dual Cluster Lock Disk question

[Douglas D. Denney]

What is the purpose of a Dual cluster lock disks?

On page 68 of the "Managing ServiceGuard Version A.11.16, Eleventh Edition" manual, it describes how a dual cluster lock disk would be useful where a two-node cluster is running in two separate datacenters. You would have two lock disks, one for each datacenter. If a node AND lock disk die (i.e, lost a datacenter), then the other node and lock disk will keep the cluster going.

I thought I understood this, until I read the "NOTE:" near the middle of the page. It seems to contradict itself by stating that "A dual lock disk does not provide a redundant cluster lock. In fact, the dual lock is a compound lock. This means that the two disks must be available at cluster formation time rather than the one that is needed for a single lock disk. Thus, the only recommended usage of the dual cluster lock is when the single cluster lock cannot be isolated at the time of a failure from exactly one half of the cluster nodes."

So...is the following true:
1. All nodes must see both lock disks at cluster formation time (i.e, when the nodes boot and the cluster forms for the first time).

2. After that, the loss of a single cluster lock disk will allow the cluster to function, provided that the nodes can get to the remaining lock disks.

I am hoping to use the dual cluster lock disks as a redundant cluster lock. If one disk fails the other disk will keep the cluster running.

Thanks for all your help.
Douglas Denney

[Olivier Masse · Accepted solution]

Cluster locking is a science per se. :) HP has a good whitepaper on this here:
http://docs.hp.com/en/B3936-90070/B3936-90070.pdf

I seem to forget all this over time but I just checked in the whitepaper, and it says that the dual cluster lock prevents the SPOF of having only one lock in an extended-distance cluster with two data centers.

I've never tried crashing my primary disk tower in my DR tests, but from my understanding, your point #1 is probably true: Chances are you can't bring the cluster up if the primary cluster lock is unavailable. But it will failover and reform correctly if you lose your primary site, as long as you don't try to stop and restart it once you've failed over.

You must therefore prepare your DR plan to hange the cluster configuration files if you ever need to restart the whole cluster at your failover site.

Olivier

[melvyn burnard]

To answer your questions:

1. No, they do not need to see the cluster lock discs. In fact the cluster will start if it cannot see the lock disk. The lock disk(s) are ONLY used when a cluster REformation occurs, qnd EXACTLY 50% of nodes are available.

2. Even if you lost BOTH cluster lock discs, the cluster would continue to operate UNTIL you had a failure and hit the 50% nodes available for reformation scenario.

One thing to bear in mind, if you lose ALL links between the datacenters, you are running the risk of having split-brain scenario, hence the general supportability recommendation is to have dual cluster lock discs only when there is a split of the nodes between datacentres.

[Douglas D. Denney]

Thanks for you help. I have a better understanding of the function of cluster lock disks. I believe for my configuration, I'll stick with the single cluster lock PV/VG.