MARKLOGIC SERVER

and Local-Disk Failover. Failover will only happen if the host taking over is part of a
quorum of greater than 50% of the hosts in the cluster. 15 (For administrative details see
the Scalability, Availability, and Failover Guide.)
SHARED-DISK FAILOVER
Shared-Disk Failover requires that multiple hosts in a cluster have access to the same
forest data. This can be done with a clustered filesystem: Veritas VxFS, Red Hat GFS,
or Red Hat GFS2. Every D-node stores its forest data on a Storage Area Network
(SAN) that's potentially accessible by other servers in the cluster at the same path.
Should one D-node server fail, it will be removed from the cluster and other servers in
the cluster with access to the SAN will "remotely mount" each of its forests. This can
also be done with a Network File System (NFS), where servers connect to the forests via
the network. Note that each forest in a MarkLogic cluster is only ever mounted by one
host at a time.
With Shared-Disk Failover, the failover D-nodes can read the same bytes on disk as
the failed server—including the journal up to the point of failure—with filesystem
consistency between the servers guaranteed by the clustered filesystem. As part of
configuring each forest, you configure its primary host as well as its failover hosts. All
failover hosts need sufficient spare operating capacity to handle their own forests as well
as any possible remotely mounted forests.
When the failed D-node comes back online, it doesn't automatically remount the forests
that were remotely mounted by other hosts. This avoids having the forests "ping pong"
between hosts in the event that the primary host has a recurring problem that takes
some time to solve. The administrator should "restart" each forest when it's appropriate
for the forest to be mounted again by the primary.
SHARED-DISK FAILOVER
1
NORMAL OPERATION
2
FAILURE
Figure 20: With Shared-Disk Failover, forest data is stored centrally on a SAN or NFS (1). In the case
of failure of one D-node, other D-nodes can take over by remotely mounting the forest (2).
15 Notice that the need for a failover host to be part of a majority requires a minimum of three hosts in a
cluster to support failover. If a majority wasn't required, a cluster could suffer split-brain syndrome in which a
network severing between halves could result in each half cluster thinking it was the surviving half.
105