3 ms·
Once you're planning work arounds for the "assume half your servers fail" scenario, I think it's time to admit that eventually, something is going to go down th
by f0urtyfive 10y ago
Once you're planning work arounds for the "assume half your servers fail" scenario, I think it's time to admit that eventually, something is going to go down that is not automatically recoverable.
- ori_b 10y agoThe problem is that half the servers failing is indistinguishable from a switch connecting two racks being flaky, or anything else which can lead to half the servers being temporarily disconnected from the others.
- f0urtyfive 10y agoWhy wouldn't you use redundant switches rather than n(2) servers?
- ori_b 10y agoWhy would I buy two switches when I can solve the problem in general with a consensus algorithm that handles hosts going away for any reason? Especially since a flaky switch isn't the only issue. Power loss could bring down even redundant backbone switches, but leave communication within the rack going. You could accidentally push a bad routing config and blackhole traffic to a bunch of hosts. You could send out a bad push that intermittently breaks connectivity to some hosts. And so on.
- ketzu 10y agoClassical consensus only solves the problem for up to 33% failure (3f+1 nodes, with f failures), having half of your servers fail can not be done with paxos.