2.3.8 Hybrid fencing

The hybrid fencing function is a combination of host reset and SCSI reservation for shared disk.

If hot-standby switchover is performed based on only host reset and host reset fails, the host will be placed in the hot-standby wait state. By contrast, if hot-standby switchover is performed based on hybrid fencing and host reset fails, the system can continue switchover by performing SCSI reservation for shared disk. Therefore, the hot-standby switchover method using hybrid fencing has the following advantage over other methods:

Because the reliability of automatic hot-standby switchover in the event of a host failure is high, system availability can be improved.

Note that if host reset is successful, SCSI reservation for shared disk is not performed.

You must decide whether to use this function. For details about how to decide, see 1.4 Hot-standby switchover methods and 3.1 List of functions supported by HA Monitor.

The following figure shows the processing flow in the case where this function is used.

Figure 2‒19: Processing flow in the case where hot-standby switchover is performed based on hybrid fencing

Organization of this subsection

(1) Required environment settings
(2) Time to perform SCSI reservation for shared disk
(3) Behavior when hot-standby switchover is performed based on SCSI reservation for shared disk
(4) Checking the status of SCSI reservation for shared disk (for a host on which the active server is operating)
(5) Checking the path to a shared disk (for a host on which the standby server is operating)
(6) Behavior if both host reset and SCSI reservation for shared disk fail
(7) Results (success/failure) of hot-standby switchover of grouped servers
(8) Notes

(1) Required environment settings

Specify the following settings in the HA Monitor environment settings:

Specify use for the fence_reset and fence_scsi operands in the HA Monitor environment settings.
Specify a device for the scsi_device or dmmp_device operand in the server environment definition.

In cases in which the settings in (4) When there is a server that does not use a shared disk under 2.3.6 SCSI reservation for shared disk are not specified, if host reset fails, the servers that do not use a shared disk are placed in the hot-standby wait state.

To Page Top

(2) Time to perform SCSI reservation for shared disk

HA Monitor issues a reset request to the hosts with different times so that the hosts are not reset at the same time. Furthermore, HA Monitor performs SCSI reservation for shared disk after the reset end times of all hosts have passed to prevent hosts from attempting SCSI reservation at the same time. The type of failure in host reset differs depending on the environment as follows.

Basic environment: Failure in a physical reset
Virtualization environment (where the physical partition reset function is not used): Failure in a logical reset
Virtualization environment (where the physical partition reset function is used): Failure in logical reset and physical reset

To Page Top

(3) Behavior when hot-standby switchover is performed based on SCSI reservation for shared disk

If hot-standby switchover is performed based on SCSI reservation for shared disk, system operation continues with a shared disk reserved. HA Monitor releases reservation for shared disks in the following cases:

After the switching-source server (prior active server) is restored as the standby server, the hot-standby switchover destination server (current active server) stops.
After the switching-source server (prior active server) is restored as the standby server, the hot-standby switchover destination (current active server) fails, and host reset is successful.
After HA Monitor is notified that hardware was turned off, the hot-standby switchover destination server stops.
A server in the hot-standby wait state is started as the active server by executing the wait-state server startup command (monact command).

If any of the following events occur before HA Monitor releases reservation of a shared disk, reservation is not released:

The active server stops (in this case, the KAMN728-W message is output).
The OS is shut down when the active server is running.
A host failure occurs in the active system.

If reservation is not released, the next time an attempt is made to start the active server, the attempt fails. Make sure that there is no active server on the other host, release the reservation, and then start the active server. For details about the procedures for checking the reservation status and releasing reservation, see 7.5.6 Handling device failures on a shared disk (while the active server is starting) (using SCSI reservation for shared disk) and 7.5.8 Handling device failures on a shared disk (while the active server is terminating) (using SCSI reservation for shared disk).

To Page Top

(4) Checking the status of SCSI reservation for shared disk (for a host on which the active server is operating)

In the active system in which the active server is operating, HA Monitor periodically checks whether reservation is obtained by the other host. If hot-standby switchover occurs and the standby system reserves the shared disk, the active system detects it, and stops the server.

For details about the check, see (a) Checking the reservation status from the active system in (3) Checking the reservation status under 2.3.6 SCSI reservation for shared disk.

To Page Top

(5) Checking the path to a shared disk (for a host on which the standby server is operating)

HA Monitor obtains the status of the shared disk from the standby system to check the status of the disk path. If host reset fails, the host might be placed in the hot-standby wait state because the shared disk cannot be reserved. To prevent this, HA Monitor checks whether the shared disk can be reserved. If the shared disk cannot be reserved, HA Monitor notifies the user accordingly so that the user can take measures beforehand.

For details about the check, see (b) Checking the shared disk path status from the standby system in (3) Checking the reservation status under 2.3.6 SCSI reservation for shared disk.

To Page Top

(6) Behavior if both host reset and SCSI reservation for shared disk fail

If both host reset and SCSI reservation for shared disk fail, the server is placed in the hot-standby wait state. The following figure shows the system behavior.

Figure 2‒20: Behavior if both host reset and SCSI reservation for shared disk fail

To Page Top

(7) Results (success/failure) of hot-standby switchover of grouped servers

For grouped servers, whether hot-standby switchover is successful depends on the server configuration in the group (whether the servers are under order control and whether they use a shared disk), and the result of SCSI reservation for shared disk. The following describes the results of hot-standby switchover in the preceding conditions.

(a) If the servers are not under order control

In the case where servers use a shared disk

As shown in the following figure, hot-standby switchover occurs according to whether reservation of each server succeeds or fails.

Figure 2‒21: Results of hot-standby switchover for grouped servers that are not under order control (in the case where servers use a shared disk)

In the case where servers do not use a shared disk

As shown in the following figure, these servers are placed in the hot-standby wait state.

Figure 2‒22: Results of hot-standby switchover for grouped servers that are not under order control (in the case where servers do not use a shared disk)

(b) If the servers are under order control

In the case where the child server uses a shared disk and the parent server succeeded in reservation

As shown in the following figure, hot-standby switchover occurs according to whether reservation of each server succeeds or fails.

Figure 2‒23: Results of hot-standby switchover for grouped servers that are under order control (in the case where the child server uses a shared disk and the parent server succeeded in reservation)

In the case where the child server uses a shared disk and the parent server failed in reservation

As shown in the following figure, the result of reservation by the parent server affects the child server, and both the parent server and child server are placed in the hot-standby wait state.

Figure 2‒24: Results of hot-standby switchover for grouped servers that are under order control (in the case where the child server uses a shared disk and the parent server failed in reservation)

In the case where the child server uses no shared disk and the parent server succeeded in reservation

As shown in the following figure, the result of reservation by the parent server affects the child server, and hot-standby switchover occurs on both the parent server and child server.

Figure 2‒25: Results of hot-standby switchover for grouped servers that are under order control (in the case where the child server uses no shared disk and the parent server succeeded in reservation)

In the case where the child server uses no shared disk and the parent server failed in reservation

As shown in the following figure, the result of reservation by the parent server affects the child server, and both the parent server and child server are placed in the hot-standby wait state.

Figure 2‒26: Results of hot-standby switchover for grouped servers that are under order control (in the case where the child server uses no shared disk and the parent server failed in reservation)

To Page Top

(8) Notes

The sg_persist command might be used when SCSI reservation for shared disk is released. If the sg_persist command has not been installed, install the sg3_utils and sg3_utils-libs packages that are bundled with Linux.

To Page Top