Łukasz Zwierko wrote:
External monitoring would be better, system might hang up, interface could remain up.
Wherein lay an additional problem. Should the system be under severe load, the "system" may appear to hang, indeed become unreachable temporarily. Do you remove the host or check for a flapping state? I think it best to say that architecturally there are lots of considerations!
In my opinion the state would have to be updated at all time. It can not be assumed that the host will have time/means to transfer anything to new-active host when the crash begins.
Indeed, but I would prefer to know that the software developers had designed their modules / core with syncronisation in mind rather than as an afterthought.
I've seen a solution similiar to the one we talking about. Two hosts were connected directly, and the active, updated the secondary all the time, with sessions of active users (it was not voip solutions, it was for GPRS traffic inspection). It was a proprietary solution - Bytemobile MSSP. It a switchover occured (for any reasons), unstable sessions got lost, active sessions remained active. The IP sharing worked a bit differently than I described, as the machines exchanged heartbeat, were not controlled by external monitoring.
There comes a time where the degree of reliability needs to be weighed against commercial requirements. Unstable sessions being transferred in my opinion is in the "not worth it" category unless you have commercial reasons to spend development time on testing it. Banks have cash (well, they did...) open source tends to rely on goodwill :-)
It's hard but doable. More problem would be with restoring call states in standby FS (including voice transcoded connections) . And what about calls being served by external scripts? That's a real challenge!
Walk before you can run! I do wonder if there is scope for thought given FS can act as a proxy itself... James