MetroCluster Manuals ( CA08871-401 )

How the ONTAP Mediator supports automatic unplanned switchover

The ONTAP Mediator provides mailbox LUNs to store state information about the MetroCluster IP nodes. These LUNs are co-located with the ONTAP Mediator, which runs on a Linux host physically separate from the MetroCluster sites. The MetroCluster IP nodes can use the mailbox information to monitor the state of their disaster recovery (DR) partners and implement a Mediator-assisted unplanned switchover (MAUSO) in the case of a disaster.

When a node detects a site failure requiring a switchover, it takes steps to confirm that the switchover is appropriate and, if so, performs the switchover. By default, a MAUSO is initiated for the following scenarios:

Both SyncMirror mirroring and DR mirroring of each node’s nonvolatile cache is operating and the caches and mirrors are synchronized at the time of the failure.
None of the nodes at the surviving site are in takeover state.
If a site disaster occurs. A site disaster is a failure of all nodes at the same site.

A MAUSO is not initiated in the following shutdown scenarios:

You initiate a shutdown. For example, when you:
- Halt the nodes
- Reboot the nodes

Learn about the MAUSO features available with each ONTAP 9 release.

Beginning with… Description

Beginning with…	Description
ONTAP 9.13.1	A MAUSO is initiated if a default scenario occurs and a fan or hardware failure initiates an environmental shutdown. Examples of hardware failures include a high or low temperature, or a power supply unit, NVRAM battery, or Service Processor heartbeat failure. The default value for the failure domain is set to "auso-on-dr-group" in a MetroCluster IP configuration. For ONTAP 9.12.1 and earlier, the default value is set to "auso-on-cluster-disaster". In an eight-node MetroCluster IP configuration, "auso-on-dr-group" triggers a MAUSO either on failure of the cluster or a HA pair in one DR group. For a HA pair, both nodes must fail at the same time. Optionally, you can change the failure domain setting to the "auso-on-cluster-disaster" domain using the `metrocluster modify -auto-switchover-failure-domain auso-on-cluster-disaster` command to trigger a MAUSO only if there are HA node pair failures in both DR groups. You can change the behavior to force a MAUSO even if NVRAM is not in sync at the time of the failure.
ONTAP 9.12.1	You can enable the MetroCluster automatic forced switchover feature in a MetroCluster IP configuration by using the `metrocluster modify -allow-auto-forced-switchover true` command. Switchover upon detection of a site failure happens automatically when you enable the MetroCluster automatic forced switchover feature. You can use this feature to supplement the MetroCluster IP automatic switchover capability. Risks and limitations of using MetroCluster automatic forced switchover When you allow a MetroCluster IP configuration to operate in automatic forced switchover mode, the following known issue might lead to data loss: The nonvolatile memory in the storage controllers is not mirrored to the remote DR partner on the partner site. Caution: You might encounter scenarios that are not mentioned. We are not responsible for any data corruption, data loss, or other damage that might arise from enabling the MetroCluster automatic forced switchover feature. Do not use the MetroCluster automatic forced switchover feature if the risks and limitations are not acceptable to you.

ONTAP 9.13.1

A MAUSO is initiated if a default scenario occurs and a fan or hardware failure initiates an environmental shutdown. Examples of hardware failures include a high or low temperature, or a power supply unit, NVRAM battery, or Service Processor heartbeat failure.
The default value for the failure domain is set to "auso-on-dr-group" in a MetroCluster IP configuration. For ONTAP 9.12.1 and earlier, the default value is set to "auso-on-cluster-disaster".

In an eight-node MetroCluster IP configuration, "auso-on-dr-group" triggers a MAUSO either on failure of the cluster or a HA pair in one DR group. For a HA pair, both nodes must fail at the same time.

Optionally, you can change the failure domain setting to the "auso-on-cluster-disaster" domain using the metrocluster modify -auto-switchover-failure-domain auso-on-cluster-disaster command to trigger a MAUSO only if there are HA node pair failures in both DR groups.
You can change the behavior to force a MAUSO even if NVRAM is not in sync at the time of the failure.

ONTAP 9.12.1

You can enable the MetroCluster automatic forced switchover feature in a MetroCluster IP configuration by using the metrocluster modify -allow-auto-forced-switchover true command.

Switchover upon detection of a site failure happens automatically when you enable the MetroCluster automatic forced switchover feature. You can use this feature to supplement the MetroCluster IP automatic switchover capability.

Risks and limitations of using MetroCluster automatic forced switchover

When you allow a MetroCluster IP configuration to operate in automatic forced switchover mode, the following known issue might lead to data loss:

The nonvolatile memory in the storage controllers is not mirrored to the remote DR partner on the partner site.

Caution: You might encounter scenarios that are not mentioned. We are not responsible for any data corruption, data loss, or other damage that might arise from enabling the MetroCluster automatic forced switchover feature. Do not use the MetroCluster automatic forced switchover feature if the risks and limitations are not acceptable to you.