[jboss-user] [JBoss Messaging] - Re: strange failover behaviour in clustered config

[timfox]

If one node crashes and server side failover is enabled then the other node will take over the failed nodes messages.

If both nodes crash at exactly the same time e.g. power goes out to both nodes simultaneously.

When you turn the power back on you start up both nodes and you find one does not start - you want the other node to take over the messages from the node that does not start?

The problem with this is how can the node that does start know that the other node really can't start or it's just that the sysadmin hasn't started it yet.

E.g. if you had 10 nodes, each with their own messages, and they were all currently down.

The sysadmin then starts them one by one.

According to what you want, the first node would start, and then say "look... the other nodes aren't alive so I'm going to take over all their messages".

Then the sysadmin starts the other nodes, and you'd end up with all the messages on the one node (the first node started) - which is not good.

In most cases if the power went off, then it's more than likely the nodes will be startable after the power comes back on, and the sysadmin will just start them all - in this case we *don't* want nodes to take over other nodes message.

I think we should cater for the most common case (i.e. the nodes *are* startable after failure), and leave the less common case to require manual intervention (your case where the node isn't startable after failover).

If you can think of a way of automatically dealing with both cases then I am open to suggestion, although I can't think of one right now.

Adding a flag in the database for each node won't help since it doesn't tell you if the node is not startable.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4063453#4063453

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4063453