Re: Filesystems

[Anne & Lynn Wheeler <lynn@garlic.com>]

Christopher Browne <cbbrowne@acm.org> writes:
> Ah, but the merit of journalling filesystems is that they "play well"
> even if you have a power outage or other 'forcible crash.'
>
> Journalling provides little value if the system /doesn't/ crash.

when my wife and i started ha/cmp ... we were dependent on JFS for
fast take-over .... regardless of the failure-mode or outage.

one of the failure-modes was design for 1-800 number system. out the
back of the ss7 to the 1-800 number lookup was two T1s. They had been
going to a fault tolerant system running the database. The 1-800
number system had design point of something like five-nines ... about
5 minutes of outage per year. while the hardware was fault tolerant,
the system had to come down for software maint. .... which was on the
order of 30 mins or more (single maint. operation per year blew a
minimum of six years outage budget).

Now, it turns out that the ss7 was already fault tolerant and was
prepared to redrive the request down the alternate T1 in case it
didn't get an answer back on the initial query. We claimed that the
SS7 fault tolerant management could "mask" all sorts of outages and a
non-fault-tolerant ha/cmp backend was actually superior to the
fault-tolernat implementation ... since either backend could be out
for whatever reason and everything would still work ... aka an ha/cmp
configuration easily met the outage budget relying on the
fault-tolerant redrive logic in the SS7 to mask outages.

Of course it would have been possible to also replicate the
fault-tolerant boxes ... at significantly increased cost ... and then
both the ha/cmp implementation and the fault-tolerant implementation
would have met the outage budget.


random ha/cmp ref:
http://www.garlic.com/~lynn/95.html#13

lots more ha/cmp refs:
http://www.garlic.com/~lynn/subtopic.html#hacmp

-- 
Anne & Lynn Wheeler | http://www.garlic.com/~lynn/ 
Internet trivia 20th anv http://www.garlic.com/~lynn/rfcietff.htm