* Stefan Hajnoczi (stefa...@redhat.com) wrote: > On Fri, Apr 24, 2015 at 11:36:35AM +0200, Paolo Bonzini wrote: > > > > > > On 24/04/2015 11:38, Wen Congyang wrote: > > >> > > > >> > That can be done with drive-mirror. But I think it's too early for > > >> > that. > > > Do you mean use drive-mirror instead of quorum? > > > > Only before starting up a new secondary. Basically you do a migration > > with non-shared storage, and then start the secondary in colo mode. > > > > But it's only for the failover case. Quorum (or a new block/colo.c > > driver or filter) is fine for normal colo operation. > > Perhaps this patch series should mirror the Secondary's disk to a Backup > Secondary so that the system can be protected very quickly after > failover. > > I think anyone serious about fault tolerance would deploy a Backup > Secondary, otherwise the system cannot survive two failures unless a > human administrator is lucky/fast enough to set up a new Secondary.
I'd assumed that a higher level management layer would do the allocation of a new secondary after the first failover, so no human need be involved. Dave > Stefan -- Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK