Hello,
let me see if I've understood correctly. Assume the following cluster:
Internet Internet
| |
| |
node1 -------------- node2
(drbd primary) (drbd secondary)
Now the network is partitioned. node2 can't communicate with node1. So
it thinks node1 is down. So it makes itself a drbd primary, and clients
are now writing data to node2. But node1 is not really down, it's just
disconnected from node2. Some clients are still accessing node1 and
writing to it. Result: chaos. So we use stonith to guard against this
issue, but stonith requires a second, independent communication channel
to node1. I have no experience on this but I guess "independent" is a
big word.
Instead:
Internet Internet
| |
| |
node1 -------------- node2
(drbd primary) (drbd secondary)
| |
| |
+-------- node3 ------+
The network is partitioned; say node1 is disconnected from both node2
and node3. Node1, seeing that it no longer has quorum (it is alone),
switches itself to drbd secondary. node2, seeing that node1 is no longer
there and that together with node3 it has a quorum, makes itself a drbd
primary.
This looks to me simpler and easier to achieve (but again, I have no
experience). Isn't it a valid alternative solution, that makes stonith
unnecessary? I'm asking because in some places in the Pacemaker or drbd
documentation it says "don't do this without stonith!"; it doesn't say
"don't do this without either stonith or quorum!", and I was therefore
wondering whether I've understood something wrong.
_______________________________________________
discuss mailing list
discuss@xxxxxxxxxxxx
http://lists.corosync.org/mailman/listinfo/discuss
