Mailing-List: contact dev-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@zookeeper.apache.org
Date: Thu, 12 Jan 2017 02:18:16 +0000 (UTC)
From: "ASF GitHub Bot (JIRA)" <jira@apache.org>
To: dev@zookeeper.apache.org
Message-ID: <JIRA.12411016.1229641052000.3576.1484187496571@Atlassian.JIRA>
In-Reply-To: <JIRA.12411016.1229641052000@Atlassian.JIRA>
References: <JIRA.12411016.1229641052000@Atlassian.JIRA> <JIRA.12411016.1229641052184@arcas>
Subject: [jira] [Commented] (ZOOKEEPER-261) Reinitialized servers should not
 participate in leader election
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 12 Jan 2017 02:18:18 -0000


    [ https://issues.apache.org/jira/browse/ZOOKEEPER-261?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15819918#comment-15819918 ] 

ASF GitHub Bot commented on ZOOKEEPER-261:
------------------------------------------

Github user enixon commented on a diff in the pull request:

    https://github.com/apache/zookeeper/pull/120#discussion_r95714487
  
    --- Diff: src/java/main/org/apache/zookeeper/server/persistence/FileTxnSnapLog.java ---
    @@ -167,6 +175,16 @@ public long restore(DataTree dt, Map<Long, Integer> sessions,
                 PlayBackListener listener) throws IOException {
             long deserializeResult = snapLog.deserialize(dt, sessions);
             FileTxnLog txnLog = new FileTxnLog(dataDir);
    +        boolean suspectEmptyDB;
    +        File initFile = new File(dataDir.getParent(), "initialize");
    +        if (initFile.exists()) {
    +            if (!initFile.delete()) {
    +                throw new IOException("Unable to delete initialization file " + initFile.toString());
    +            }
    +            suspectEmptyDB = false;
    +        } else {
    +            suspectEmptyDB = !autoCreateDB;
    --- End diff --
    
    I tempted to do put the log line on the other side of the conditional since this side is the expected case. We should only delete an initialize file once in the lifecycle of a given server while the check against `autoCreateDB` will happen every other time the server is restarted.


> Reinitialized servers should not participate in leader election
> ---------------------------------------------------------------
>
>                 Key: ZOOKEEPER-261
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-261
>             Project: ZooKeeper
>          Issue Type: Improvement
>          Components: leaderElection, quorum
>            Reporter: Benjamin Reed
>
> A server that has lost its data should not participate in leader election until it has resynced with a leader. Our leader election algorithm and NEW_LEADER commit assumes that the followers voting on a leader have not lost any of their data. We should have a flag in the data directory saying whether or not the data is preserved so that the the flag will be cleared if the data is ever cleared.
> Here is the problematic scenario: you have have ensemble of machines A, B, and C. C is down. the last transaction seen by C is z. a transaction, z+1, is committed on A and B. Now there is a power outage. B's data gets reinitialized. when power comes back up, B and C comes up, but A does not. C will be elected leader and transaction z+1 is lost. (note, this can happen even if all three machines are up and C just responds quickly. in that case C would tell A to truncate z+1 from its log.) in theory we haven't violated our 2f+1 guarantee, since A is failed and B still hasn't recovered from failure, but it would be nice if when we don't have quorum that system stops working rather than works incorrectly if we lose quorum.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)