HP Serviceguard Extended Distance Cluster for Linux A.01.01 Deployment Guide, Third Edition, May 2008

Configuring your Environment for Software RAID
Configuring the Legacy Package Control Script and RAID Configuration File
Chapter 3 79
Figure 3-1 RPO Target Definitions
To ensure that no data is lost when a package fails over to DC2 and
starts with only DC2's local storage, t2 must occur between t0 and t1.
Now consider an XDC configuration such as that shown in Figure 1-3
(DWDM links between data centers). If DC1 fails such that links A
and B both fail simultaneously, and DC1's connection to the Quorum
Server fails at the same time, Serviceguard ensures that DC2
survives and the package fails over and runs with DC2 local storage.
But if DC1's links A and B fail, and later DC1's link to the Quorum
Server fails, then both sets of nodes (DC1 and DC2) will try to obtain
the cluster lock from the Quorum Server. If the Quorum server
chooses DC1 (which is about to experience complete site failure),
then the entire cluster will go down.
But if the Quorum Server chooses DC2 instead, then the application
running on DC1 will not be able to write to the remote storage but
will continue to write to its local (DC1) storage until site failure
occurs (at t3). If the network is set up in such a way that the
application cannot communicate with its clients under these
circumstances, the clients will not receive any acknowledgement of
these writes. HP recommends you configure the network such that
when links between the sites fail, the communication links to the
application clients also go down.