Quorum disk as controller-based shadow set ?

[Michael Kloth]

As everyone knows, the quorum disk in a VMS-cluster may not be shadowed with host-based shadowing. But what about controller-based shadowing ? Would it work if I create a shadowset of 2 disks on my HSG80-controller and use this one as quorum-disk ?

[Volker Halle · Accepted solution]

Michael,

you can certainly use a controller-based shadowset (RAID 1) for a quorum disk. Any other controller-based RAID set is also possible. OpenVMS sees those 'disks' as one single entitiy and there cannot be any incertainty about the state of that disk.

Volker.

[Hoff]

You can use a controller-based RAID if there is no chance that the "quorum disk" can or will ever be manifested and accessible through more than one path in parallel. That is, that there is no chance that the "quorum disk" will ever be split into two or more "disks" via two or more paths.

There's a write-up on this and on related topics in the OpenVMS FAQ over at HoffmanLabs site. Topics include "Why no shadowing for a Quorum Disk?", etc.

Stephen Hoffman
HoffmanLabs LLC

[Jan van den Ende]

Michael,

technically there is nothing that prevents it.
But, in the words of Mr disaster_tolerant, Keith Parris: "Unless that changed overnight when I was not looking, it is not and will not be supported. The reason being, that it is a clear recipy for disaster"

_IF_ you ever loose connectivity to one of the QD members, THAT is a likely moment where you NEED the qourum scheme to kick in. But if the reason for losing that member is the loss of connectivity between the two members, on all likelyhood connectivity between parts of the cluster also gets lost. And should there be a mechanism that makes each part "see" "the" QDSK (which in reality is only the half of it that is visible locally), THEN you have managed to trick the quorum mechanism into a partitioned cluster...
(the HPUX term for this is rather more descriptive: "split-brain cluster" )

Bottom line:
VMS has no way to prevent us using controller-based mirroring of the Duorum disk,
but

DONT

hth

Proost.

Have one on me.

jpe

[Uwe Zessin]

> _IF_ you ever loose connectivity to one of the QD members, THAT is a likely moment where you NEED the qourum scheme to kick in.

What is that supposed to mean?

The RAID controller will shield the hosts from the physical disk drives. The hosts have access to one logical disk.

If the controller 'looses connectivity', it marks the physical disk drive as FAILED, puts it into the FAILEDSET and continues with the remaining member unless a suitable spare disk drive exists.

Still, the hosts have access to one logical disk only.

[Dean McGorrill]

The machines I took over management of, are all two node clusters, with sys$sysdevice
being the quorum disk. From vms, you can't
tell whether the disk is a single disk or
mirror or stripeset etc. mine are dual mirrored disks, controller hsz70. works aok.

[Jon Pinkley]

Michael Kloth>>>
As everyone knows, the quorum disk in a VMS-cluster may not be shadowed with host-based shadowing. But what about controller-based shadowing ? Would it work if I create a shadowset of 2 disks on my HSG80-controller and use this one as quorum-disk ?
<<<

Michael,

If you are talking about HSG80 mirrorsets, then YES, you can use a $1$DGAxxx device as a quorum disk (but see below for some restrictions). However, because of your choice of terminology "shadowsets", I will state explicitly, you CANNOT use host based volume shadowing to create a DSA device and use that for a quorum disk, even if all disks in the shadowset exist on the same controller.

Jan van den Ende>>
technically there is nothing that prevents it.
But, in the words of Mr disaster_tolerant, Keith Parris: "Unless that changed overnight when I was not looking, it is not and will not be supported. The reason being, that it is a clear recipy for disaster"
<<<

Jan,

Are you sure Keith Parris was talking about single cabinet controller based mirrors, or about two controller pairs connected in a data replication/disaster tolerant configuration with something like EVA Continuous Access or HSG80 Data Replication Manager?

A quorum disk is not supported on an HSG80 DRM or EVA CA config, therefore the need for a "quorum node", preferably at a third site. However, I have never heard that a mirror on a single controller pair can't be used. I can't think of any failure scenario where it would even be a problem with a multipath device. The controller pairs within a single HSx or EVA system are very tightly coupled, which is not true for two systems in separate locations. And unless something has recently changed, a single controller (of the redundant pair) services all members of a "unit" in the HSx. Again, I know of no failure case where one member of a mirror would be presented by one controller and the other member by the other, if it were even possible to have both controllers in a single HSG80 operate in a "partitioned" mode.

I am sure Uwe knows a lot more about this than me, maybe he will chime in with a possible failure mode that I am not aware of.

Jon

[Uwe Zessin]

Hello Jon,

> if it were even possible to have both controllers in a
> single HSG80 operate in a "partitioned" mode.

I have seen that controllers did not agree about the configuration.[1] It wasn't in an OpenVMS cluster, but it did affect the regular data disks. On the other hand, I have never seen one controller present one physical member of a mirror-set and the other controller presenting the second - no matter if it was a quorum or a regular data disk.

An administrator can create an alternate disk with the same identity (same unit identifier and LUN WWN), but he also can do so for regular data disks, too.


Don't know where I read it, but I like it:
"it is impossible to make a system 'fool-proof', because fools are so inventive"


> A quorum disk is not supported on an HSG80 DRM or EVA CA config

Is this documented somewhere? Normally, the target units are not presented to the hosts anyway.



[1] We even had a customer running a dual-controller HSZ70 in a partitioned mode 'by design', but that as a 'pilot error'.

[Jan van den Ende]

@ Jon

>>>
Are you sure Keith Parris was talking about single cabinet controller based mirrors, or about two controller pairs connected in a data replication/disaster tolerant configuration with something like EVA Continuous Access or HSG80 Data Replication Manager?
<<<

I am afraid that my focus may be too narrow (or should that be "wide" here?).
I indeed referred to exactly THAT config (and, knowing his field of specialism, I assume Keith did as well).
If this is about a single controller with two tightly coupled drives, then that is an area where I have no right of speech.

fwiw

Proost.

Have one on me.

jpe

[Jon Pinkley]

Jon Pinkley>>> A quorum disk is not supported on an HSG80 DRM or EVA CA config
<<<

Uwe Zessin>>>
Is this documented somewhere? Normally, the target units are not presented to the hosts anyway.
<<<

I've looked through Keith's notes http://www2.openvms.org/kparris/f2004_vms_dt_clusters.pdf and I can't find anywhere that is says you can or can't have a quorum disk on a controller participating in a DataReplication set.. I must be misremembering based on HBVS, which isn't supported.

I have no experience with either EVA CA or HSG80 DRM, so I should not have claimed it wasn't supported, only that I can think of more ways for failures to occur in a data replication case than in a redundant pair.

So at this point, I will bow out, and let the experts give their opinions.

Jon

[Robert V Dixon]

> As everyone knows,
> the quorum disk in a VMS-cluster may not be shadowed
> with host-based shadowing.
Correct. i.e. You indicate clearly that you have no intention of using host based shadowing to create a VMS DS unit to present as a candidate for the quorum disk role.

> But what about controller-based shadowing ?
yes - its often referred to as "mirroring" to distinguish it from host-based "shadowing". You could certainly use that ( as Volker confirmed immediately ).


> Would it work if I create a shadowset
[ or controller-based 'mirrorset']
> of 2 disks on my HSG80-controller and use this one
[ virtual unit]
> as quorum-disk

yes - your HSG80 will present one virtual unit to VMS to be used as a quorum disk. That unit will have increased resilience by virtue of being a controller-based mirrorset.

You have a good design for improved resilience ( and you lose a little diskspace).


Regards
Rob

[Volker Halle]

Michael,

you might also want to have a look at the following old thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=920269

It describes steps to re-create a quorum disk, which could be useful in your situation.

Volker.