eviden-logo

Evidian > Products > SafeKit: Simple, Cost-Effective High Availability Software > Heartbeat, failover and quorum in a Windows or Linux cluster

Heartbeat, failover and quorum in a Windows or Linux cluster

Evidian SafeKit

What are the different scenarios in case of network isolation in a cluster?

A single network

When there is a network isolation, the default behavior is:

  • as heartbeats are lost for each node, each node goes to ALONE and runs the application with its virtual IP address (double execution of the application modifying its local data),
  • when the isolation is repaired, one ALONE node is forced to stop and to resynchronize its data from the other node,
  • at the end the cluster is PRIM-SECOND (or SECOND-PRIM according the duplicate virtual IP address detection made by Windows).

Two networks with a dedicated replication network

When there is a network isolation, the behavior with a dedicated replication network is:

  • a dedicated replication network is implemented on a private network,
  • heartbeats on the production network are lost (isolated network),
  • heartbeats on the replication network are working (not isolated network),
  • the cluster stays in PRIM/SECOND state.

A single network and a splitbrain checker

When there is a network isolation, the behavior with a split-brain checker is:

  • a split-brain checker has been configured with the IP address of a witness (typically a router),
  • the split-brain checker operates when a server goes from PRIM to ALONE or from SECOND to ALONE,
  • in case of network isolation, before going to ALONE, both nodes test the IP address,
  • the node which can access the IP address goes to ALONE, the other one goes to WAIT,
  • when the isolation is repaired, the WAIT node resynchronizes its data and becomes SECOND.

Note: If the witness is down or disconnected, both nodes go to WAIT and the application is no more running. That's why you must choose a robust witness like a router.

How heartbeats and failover work in a Windows or Linux cluster?

What is a heartbeat?

The basic mechanism for synchronizing two servers and detecting server failures is the heartbeat, which is a monitoring data flow on a network shared by a pair of servers.

The SafeKit software supports as many heartbeats as there are networks shared by two servers. 

The heartbeat mechanism is used to implement Windows and Linux clusters. It is integrated within the SafeKit mirror cluster with real-time file replication and failover.

SafeKit heartbeats

In normal operation, the two servers exchange their states (PRIM, SECOND, the resource states) through the heartbeat channels and synchronize their application start and stop procedures.

In particular, in case of a scheduled failover, the stop script which stops the application is first executed on the primary server, before executing the start script on the secondary server. Thus, replicated data on the secondary server are in a safe state corresponding to a clean stop of the application.

Loss of all heartbeats

When all heartbeats are lost on one server, this server considers the other server to be down and transitions to the ALONE state.

If it is the SECOND server which goes to the ALONE state, then there is an application failover with restart of the application on the secondary server.

Although not mandatory, it is better to have two heartbeat channels on two different networks for synchronizing the two servers in order to separate the network failure case from the server failure one.

Split brain problem and quorum when servers are in two remote computer rooms

Heartbeat, failover and quorum in a Windows or Linux cluster

Remote computer rooms

A high availability cluster securing a critical application can be implemented with two servers in two geographically remote computer rooms.

Thus, the solution supports the disaster of a full room.

Split brain

In situation of a network isolation between both computer rooms, all heartbeats are lost and the split brain problem arises.

Both servers start the critical application.

Complexity of solutions

Mostoften, to solve split brain, quorum is implemented with a third quorum server or a special quorum disk to avoid the double masters.

Unfortunately these new quorum devices add cost and complexity to the overall clustering architecture.

Simple cluster quorum with the SafeKit split brain checker

SafeKit split brain checker

With the SafeKit high availability software, the quorum within a Windows or Linux cluster requires no third quorum server and no quorum disk. A simple split brain checker is sufficient to avoid the double execution of an application.

On the the loss of all heartbeats between servers, the split brain checker selects only one server to become the primary. The other server goes into the WAIT state, until it receives the other server's heartbeats again. It then goes back to secondary after having synchronized replicated data from the primary server.

How the split brain checker works?

The primary server election is based on the ping of an IP address, called the witness. The witness is typically a router that is always available. In case of network isolation, only the server with access to the witness will be primary ALONE, the other will go to WAIT.

The witness is not tested permanently but only when all heartbeats are lost. If at that time, the witness is down, the cluster goes into the WAIT-WAIT state and an administrator can choose to restart one of the servers as primary through the SafeKit web console.

What happens without a split brain checker?

In case of network isolation, both servers will go to the ALONE state running the critical application. The replicated directories are isolated and each application is working on its own data in its own directory.

When the network is reconnected, SafeKit by default chooses the server which was PRIM before the isolation as the new primay and forces the other one as SECOND with a resynchronization of all its data from the PRIM.

Note: Windows can detect a duplicate IP address on one server and remove the virtual IP address on this server. SafeKit has a checker to force a restart in that case.

How the SafeKit mirror cluster works?

Step 1. Real-time replication

Server 1 (PRIM) runs the application. Clients are connected to a virtual IP address. SafeKit replicates in real time modifications made inside files through the network.

File replication at byte level in a mirror cluster

The replication is synchronous with no data loss on failure contrary to asynchronous replication.
You just have to configure the names of directories to replicate in SafeKit. There are no pre-requisites on disk organization. Directories may be located in the system disk.

Step 2. Automatic failover

When Server 1 fails, Server 2 takes over. SafeKit switches the virtual IP address and restarts the application automatically on Server 2.
The application finds the files replicated by SafeKit uptodate on Server 2. The application continues to run on Server 2 by locally modifying its files that are no longer replicated to Server 1.

Failover in a mirror cluster

The failover time is equal to the fault-detection time (30 seconds by default) plus the application start-up time.

Step 3. Automatic failback

Failback involves restarting Server 1 after fixing the problem that caused it to fail.
SafeKit automatically resynchronizes the files, updating only the files modified on Server 2 while Server 1 was halted.

Failback in a mirror cluster

Failback takes place without disturbing the application, which can continue running on Server 2.

Step 4. Back to normal

After reintegration, the files are once again in mirror mode, as in step 1. The system is back in high-availability mode, with the application running on Server 2 and SafeKit replicating file updates to Server 1.

Return to normal operation in a mirror cluster

If the administrator wishes the application to run on Server 1, he/she can execute a "swap" command either manually at an appropriate time, or automatically through configuration.

Typical usage with SafeKit

Why a replication of a few Tera-bytes?

Resynchronization time after a failure (step 3)

  • 1 Gb/s network ≈ 3 Hours for 1 Tera-bytes.
  • 10 Gb/s network ≈ 1 Hour for 1 Tera-bytes or less depending on disk write performances.

Alternative

Why a replication < 1,000,000 files?

  • Resynchronization time performance after a failure (step 3).
  • Time to check each file between both nodes.

Alternative

  • Put the many files to replicate in a virtual hard disk / virtual machine.
  • Only the files representing the virtual hard disk / virtual machine will be replicated and resynchronized in this case.

Why a failover ≤ 32 replicated VMs?

  • Each VM runs in an independent mirror module.
  • Maximum of 32 mirror modules running on the same cluster.

Alternative

  • Use an external shared storage and another VM clustering solution.
  • More expensive, more complex.

Why a LAN/VLAN network between remote sites?

Alternative

  • Use a load balancer for the virtual IP address if the 2 nodes are in 2 subnets (supported by SafeKit, especially in the cloud).
  • Use backup solutions with asynchronous replication for high latency network.

Comparison of SafeKit with Traditional High Availability (HA) Clusters

How does SafeKit compare to traditional High Availability (HA) cluster solutions?

This comparison highlights the fundamental differences between SafeKit and traditional High Availability (HA) cluster solutions like Failover Clusters, Virtualization HA, and SQL Always-On. SafeKit is designed as a low-complexity, software-only solution for generic application redundancy, contrasting with the high complexity and specific storage requirements (shared storage, SAN) typical of traditional HA mechanisms.
Comparison of SafeKit with traditional High Availability (HA) clusters
Solutions Complexity Comments
Failover Cluster (Microsoft) High Specific Storage (shared storage, SAN)
Virtualization (VMware HA) High Specific Storage (shared storage, SAN, vSAN)
SQL Always-On (Microsoft) High Only SQL is redundant, requires SQL Enterprise Edition
Evidian SafeKit Low Simplest, generic and software-only. Unsuitable for large data replication.

SafeKit's Advantage in Application Redundancy

SafeKit achieves its low-complexity High Availability through a simple, software-based mirroring mechanism that eliminates the need for expensive, dedicated hardware like a SAN (Storage Area Network). This makes it a highly accessible solution for quickly implementing application redundancy without complex infrastructure changes.

SafeKit High Availability (HA) Solutions: Quick Installation Guides for Windows and Linux Clusters

This table presents the SafeKit High Availability (HA) solutions, categorized by application and operating environment (Databases, Web Servers, VMs, Cloud). Identify the specific pre‑configured .safe module (e.g., mirror.safe, farm.safe, and others) required for real‑time replication, load balancing, and automatic failover of critical business applications on Windows or Linux. Simplify your HA cluster setup with direct links to quick installation guides, each including a download link for the corresponding .safe module.

A SafeKit .safe module is essentially a pre‑configured High Availability (HA) template that defines how a specific application will be clustered and protected by the SafeKit software. In practice, it contains a configuration file (userconfig.xml) and restart scripts.

SafeKit High Availability (HA) Solutions: Quick Installation Guides (with downloadable .safe modules)
Application Category HA Scenario (High Availability) Technology / Product .safe Module Installation Guide
New Applications Real-Time Replication and Failover Windows mirror.safe View Guide: Windows Replication
New Applications Real-Time Replication and Failover Linux mirror.safe View Guide: Linux Replication
New Applications Network Load Balancing and Failover Windows farm.safe View Guide: Windows Load Balancing
New Applications Network Load Balancing and Failover Linux farm.safe View Guide: Linux Load Balancing
Databases Replication and Failover Microsoft SQL Server sqlserver.safe View Guide: SQL Server Cluster
Databases Replication and Failover PostgreSQL postgresql.safe View Guide: PostgreSQL Replication
Databases Replication and Failover MySQL mysql.safe View Guide: MySQL Cluster
Databases Replication and Failover Oracle oracle.safe View Guide: Oracle Failover Cluster
Databases Replication and Failover Firebird firebird.safe View Guide: Firebird HA
Web Servers Load Balancing and Failover Apache apache_farm.safe View Guide: Apache Load Balancing
Web Servers Load Balancing and Failover IIS iis_farm.safe View Guide: IIS Load Balancing
Web Servers Load Balancing and Failover NGINX farm.safe View Guide: NGINX Load Balancing
VMs and Containers Replication and Failover Hyper-V hyperv.safe View Guide: Hyper-V VM Replication
VMs and Containers Replication and Failover KVM kvm.safe View Guide: KVM VM Replication
VMs and Containers Replication and Failover Docker mirror.safe View Guide: Docker Container Failover
VMs and Containers Replication and Failover Podman mirror.safe View Guide: Podman Container Failover
VMs and Containers Replication and Failover Kubernetes K3S k3s.safe View Guide: Kubernetes K3S Replication
AWS Cloud Real-Time Replication and Failover AWS mirror.safe View Guide: AWS Replication Cluster
AWS Cloud Network Load Balancing and Failover AWS farm.safe View Guide: AWS Load Balancing Cluster
GCP Cloud Real-Time Replication and Failover GCP mirror.safe View Guide: GCP Replication Cluster
GCP Cloud Network Load Balancing and Failover GCP farm.safe View Guide: GCP Load Balancing Cluster
Azure Cloud Real-Time Replication and Failover Azure mirror.safe View Guide: Azure Replication Cluster
Azure Cloud Network Load Balancing and Failover Azure farm.safe View Guide: Azure Load Balancing Cluster
Physical Security / VMS Real-Time Replication and Failover Milestone XProtect milestone.safe View Guide: Milestone XProtect Failover
Physical Security / VMS Real-Time Replication and Failover Nedap AEOS nedap.safe View Guide: Nedap AEOS Failover
Physical Security / VMS Real-Time Replication and Failover Genetec (SQL Server) sqlserver.safe View Guide: Genetec SQL Failover
Physical Security / VMS Real-Time Replication and Failover Bosch AMS (Hyper-V) hyperv.safe View Guide: Bosch AMS Hyper-V Failover
Physical Security / VMS Real-Time Replication and Failover Bosch BIS (Hyper-V) hyperv.safe View Guide: Bosch BIS Hyper-V Failover
Physical Security / VMS Real-Time Replication and Failover Bosch BVMS (Hyper-V) hyperv.safe View Guide: Bosch BVMS Hyper-V Failover
Physical Security / VMS Real-Time Replication and Failover Hanwha Vision (Hyper-V) hyperv.safe View Guide: Hanwha Vision Hyper-V Failover
Physical Security / VMS Real-Time Replication and Failover Hanwha Wisenet (Hyper-V) hyperv.safe View Guide: Hanwha Wisenet Hyper-V Failover
Siemens Products Real-Time Replication and Failover Siemens Siveillance suite (Hyper-V) hyperv.safe View Guide: Siemens Siveillance HA
Siemens Products Real-Time Replication and Failover Siemens Desigo CC (Hyper-V) hyperv.safe View Guide: Siemens Desigo CC HA
Siemens Products Real-Time Replication and Failover Siemens Siveillance VMS SiveillanceVMS.safe View Guide: Siemens Siveillance VMS HA
Siemens Products Real-Time Replication and Failover Siemens SiPass (Hyper-V) hyperv.safe View Guide: Siemens SiPass HA
Siemens Products Real-Time Replication and Failover Siemens SIPORT (Hyper-V) hyperv.safe View Guide: Siemens SIPORT HA
Siemens Products Real-Time Replication and Failover Siemens SIMATIC PCS 7 (Hyper-V) hyperv.safe View Guide: SIMATIC PCS 7 HA
Siemens Products Real-Time Replication and Failover Siemens SIMATIC WinCC (Hyper-V) hyperv.safe View Guide: SIMATIC WinCC HA