HP Serviceguard Extended Distance Cluster for Linux A.11.20.10 Deployment Guide, December 2012

Figure 5 Package failover sequence
In this figure, nodes N1 and N2 are in Datacenter 1 at Site 1, while N3 and N4 are in Datacenter
2 in Site 2. In the package configuration file, you need to specify the failover sequence such that
N1 of Site 1 is followed by a node in Site 2. In this figure, you need to specify that N1 is followed
by N3. Similarly, specify that N2 of Site 1 is followed by N4.
Table 3 (page 33) describes the failover sequence that you need to specify to ensure that there is
not data loss when there is a site failure.
Table 3 Failover Sequence
SiteNode
Site 1N1
Site 2N3
Site 1N2
Site 2N4
or
Site 1N1
Site 2N4
Site 1N2
Site 2N3
In this table, every node is followed by a node from another site. If this order is not used, then site
failures can result in data loss. In the event of a site failure at site S1, if N1 goes down first followed
by N2, it results in a package failure. This failure occurs because after N1 fails, the package may
failover to N2 if the recommended order of configuration is not specified. When the package fails
over to N2 at the same site, it starts with a partial mirror disk. Starting with a single mirror disk
prevents the package from starting at site S2 if N2 also fails. The package will not start on a node
in site S2 because serviceguard-xdc prevents starting a package that has already started once
before with a partial mirror disk.
For this reason, it is also required that if one node of the four nodes is brought down at a site for
maintenance, then one node at the other site must also be brought down. So if a node in one site
fails, the package will fail over to another node in the other site.
5.1 Creating a serviceguard-xdc Modular Package 33