Disabling Auto-Trespass to Prevent Ping-Pong Failovers in Storage Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In storage systems with active/passive multipathing, auto-trespass functionality can lead to 'ping-pong' failovers between paths, causing performance degradation due to uncoordinated host actions on passive paths after an automatic failover.
Innovation Solution
Temporarily disabling auto-trespass functionality after an automatic failover between paths prevents further failovers by ensuring hosts detect errors on the passive path, forcing them to reroute I/O operations on the active path established by the failover.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If auto-trespass functionality is enabled to allow automatic failover from active path to passive path, then system reliability is improved, but performance degradation occurs due to uncoordinated host actions triggering continuous role transfers
Solution Approach 1:
The system applies preliminary anti-action by having the storage device proactively send a disable auto-trespass command to the host before the host can initiate an I/O operation that would trigger another failover. This preemptive action prevents the harmful sequence of events (host I/O on passive path → failover → another host I/O → another failover) from occurring in the first place, thus maintaining system reliability while preventing performance degradation from continuous role transfers
2Productivity
If auto-trespass functionality is disabled to prevent continuous failovers, then performance is improved, but system reliability deteriorates as hosts cannot automatically failover when errors occur
Solution Approach 1:
The system applies dynamics by making the auto-trespass functionality dynamic rather than static. Auto-trespass is enabled during normal operation to provide automatic failover capability, but is temporarily disabled after a failover occurs to prevent continuous role transfers. The system automatically re-enables auto-trespass after a predetermined time period or when specific conditions are met, thus adapting the reliability mechanism to the current system state to balance both reliability and performance requirements
Data Source
AI summary
Auto-trespass can be at least temporarily disabled subsequent to an automatic failover. The automatic failover exchanges roles between an active path and a passive path, such that the passive path becomes the active path and vice versa. By disabling auto-trespass, hosts that are unaware that the automatic failover has occurred will not trigger another failover when those hosts attempt to perform I/O operations via the formerly-active path. This can reduce performance decreases that would otherwise occur due to the active role being traded in a “ping-pong” manner between the paths.