> 2. Node 1 panics > To node 2, this still looks like a split brain as it > can not contact > node1. If the algo is modified to give priority to > node1, you will have > a full cluster outage.
Correct. However if node 2 panics it also loses connection to quorum server. I'm pretty sure that we can reliably say that if node is not accessible via both private and public interfaces it is 99.9% dead. Given choice between 5-15 second delay before failover/crash of node and 15+ minute-long start of tens of Oracle databases I'd choose 5-15 second delay. -- This message posted from opensolaris.org
