Quorum

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Q. What is the quorum used for?

A. Server clusters require a quorum resource to function. The quorum resource, like any other resource, is a resource which can only be owned by one server at a time, and for which servers can negotiate for ownership. Negotiating for the quorum resource allows Server clusters to avoid "split-brain" situations where the servers are active and think the other servers are down. This can happen when, for example, the cluster interconnect is lost and network response time is problematic. The quorum resource is used to store the definitive copy of the cluster configuration so that regardless of any sequence of failures, the cluster configuration will always remain consistent.

Q. What options do I have for my quorum resource?

A. In Windows 2000, there are two quorum-capable resources:

• Physical Disk Resource

  This allows a disk on the shared cluster storage bus to be used as the quorum resource. The cluster code uses SCSI commands to arbitrate for the quorum disk ensuring only one node owns the quorum disk at any point in time. This is the standard quorum resource that Microsoft recommends for all production Windows 2000 clusters.

  Note

  Some storage vendors provide their own quorum capable resources for specific hardware solutions (e.g., IBM Shark Storage) or software solutions (such as Veritas Volume Manager). You should use these if they are required for your environment.

• Local Quorum

  This quorum-capable resource allows a single node cluster to be setup without having a second storage bus. This type of cluster is useful for developing cluster-aware software without having to have a multi-node cluster.
  Local Quorum can be used in a production environment if you want to take advantage of the resource health monitoring and local restart facilities provided by Server cluster on a single node.

In Windows Server 2003 we have introduced another quorum capable resource type

Majority Node Set

A majority node set is a single quorum resource from a Server cluster perspective; however, all of the quorum data is actually stored on multiple disks across the cluster. The majority node set resource takes care to ensure that the cluster configuration data stored on the majority node set is kept consistent across the different disks.

See What is Majority Node Set? for more details.

Q. Can other applications share the quorum disk?

A. Microsoft recommends that you do NOT use the quorum disk for other applications in the cluster and that the quorum disk is restricted to use by the cluster service itself. If you use the quorum disk for other applications you should be aware of the following:

• The quorum disk health determines the health of the entire cluster. If the quorum disk fails, the cluster service will become unavailable on all cluster nodes. The cluster service checks the health of the quorum disk and arbitrates for exclusive access to the physical drive using standard I/O operations. These operations are queued to the device along with any other I/Os to that device. If the cluster service I/O operations are delayed by extremely heavy traffic, the cluster service will declare the quorum disk as failed and force a regroup to bring the quorum back online somewhere else in the cluster. To protect against malicious applications flooding the quorum disk with I/Os, the quorum disk should be protected. Access to the quorum disk should be restricted to the local administrator group and the cluster service account.

• If the quorum disk fills up, the cluster service may be unable to log required data. In this case, the cluster service will fail, potentially on all cluster nodes. To protect against malicious applications filling up the quorum disk, access should be restricted to the local administrator group and the cluster service account.

• The cluster service itself will always try to bring the quorum disk back online. In doing so, it may violate the failover and failback policies assigned to applications in the same group.

Q. Can a NAS device be used as the shared quorum disk?

A. No, out-of-the-box, the cluster service supports physical disks on the shared cluster bus or in Windows Server 2003 Majority Node Set quorum resources.

Q. What is Majority Node Set?

A. A majority node set is a single quorum resource from a Server cluster perspective; however, all of the quorum data is actually stored on multiple disks across the cluster. The majority node set resource takes care to ensure that the cluster configuration data stored on the majority node set is kept consistent across the different disks. This allows cluster topologies as follows:

The disks that make up the majority node set could, in principle be local disks physically attached to the nodes themselves or disks on a shared storage fabric. In the majority node set implementation that is provided as part of Server clusters in Windows Server 2003, every node in the cluster uses a directory on its own local system disk to store the quorum data. If the configuration of the cluster changes, that change is reflected across the different disks. The change is only considered to have been committed (i.e. made persistent), if that change is made to:

(<Number of nodes configured in the cluster>/2) + 1

This ensures that a majority of the nodes have an up-to-date copy of the data. The cluster service itself will only start up, and therefore bring resources on line, if a majority of the nodes configured as part of the cluster are up and running the cluster service. If there are fewer nodes, the cluster is said not to have quorum and therefore the cluster service waits (trying to restart) until more nodes try to join. Only when a majority or quorum of nodes, are available, will the cluster service start up the resources be brought online. This way, since the up-to-date configuration is written to a majority of the nodes, regardless of node failures, the cluster will always guarantee that it starts up with the latest and most up-to-date configuration.