Managing HP Serviceguard for Linux, Eighth Edition, March 2008

Understanding Serviceguard Software Components
How the Cluster Manager Works
Chapter 346
Cluster Quorum to Prevent Split-Brain Syndrome
In general, the algorithm for cluster re-formation requires a cluster
quorum of a strict majority (that is, more than 50%) of the nodes
previously running. If both halves (exactly 50%) of a previously running
cluster were allowed to re-form, there would be a split-brain situation
in which two instances of the same cluster were running. In a split-brain
scenario, different incarnations of an application could end up
simultaneously accessing the same disks. One incarnation might well be
initiating recovery activity while the other is modifying the state of the
disks. Serviceguard’s quorum requirement is designed to prevent a
split-brain situation.
Cluster Lock
Although a cluster quorum of more than 50% is generally required,
exactly 50% of the previously running nodes may re-form as a new
cluster provided that the other 50% of the previously running nodes do
not also re-form. This is guaranteed by the use of a tie-breaker to choose
between the two equal-sized node groups, allowing one group to form the
cluster and forcing the other group to shut down. This tie-breaker is
known as a cluster lock. The cluster lock is implemented either by
means of a lock LUN or a quorum server. A cluster lock is required on
two-node clusters.
Use of a Lock LUN as the Cluster Lock
A lock LUN can be used for clusters up to and including four nodes in
size. The cluster lock LUN is a special area (known as a partition) on a
LUN that is shareable by all nodes in the cluster. When a node obtains
the cluster lock, this area is marked so that other nodes will recognize
the lock as “taken.”
The lock LUN is dedicated for use as the cluster lock; the disk cannot be
employed as part of a normal volume with user data on it. The complete
path name of the lock LUN is identified in the cluster configuration file.