Split-brain and jeopardy handling
Prev How Storage Foundation Cluster File System High Availability works Next

Split-brain and jeopardy handling

A split-brain occurs when the cluster membership view differs among the cluster nodes, increasing the chance of data corruption. With I/O fencing, the potential for data corruption is eliminated. I/O fencing requires disks that support SCSI-3 PR.

You can also configure I/O fencing using coordination point servers (CP servers). In virtual environments that do not support SCSI-3, you can configure non-SCSI-3 server-based fencing.

See About server-based I/O fencing.

See About I/O fencing for SFCFSHA in virtual machines that do not support SCSI-3 PR.

Jeopardy state

In the absence of I/O fencing, SFCFSHA installation requires two heartbeat links. When a node is down to a single heartbeat connection, SFCFSHA can no longer discriminate between loss of a system and loss of the final network connection. This state is defined as jeopardy.

SFCFSHA detects jeopardy and responds to it in ways that prevent data corruption in some split-brain situations. However, data corruption can still occur in other situations:

  • All links go down simultaneously.

  • A node hangs and is unable to respond to heartbeat messages.

To eliminate the chance of data corruption in these scenarios, I/O fencing is required. With I/O fencing, the jeopardy state does not require special handling by the SFCFSHA stack.

Jeopardy handling

For installations that do not have I/O fencing configured, jeopardy handling prevents some potential split-brain conditions. If any cluster node fails following a jeopardy state notification, all cluster file systems that were mounted on the failed node or nodes are disabled on all remaining nodes. If a leave reconfiguration happens after jeopardy state notification, then the nodes which have received the jeopardy state notification leave the cluster.
Prev Up Next
Configuring a low-priority link Home About I/O fencing