[jira] [Commented] (HDFS-3743) QJM: improve formatting behavior for JNs

["Todd Lipcon (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDFS-3743?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13425448#comment-13425448 ] 

Todd Lipcon commented on HDFS-3743:
-----------------------------------

I'll propose the following design:

- the "hdfs namenode -format" command should take confirmation and then format all of the underlying JNs, regardless of whether they currently have data.
- at startup, and at the beginning of each log segment, if a quorum of JNs are formatted, but a minority are not, the NN should auto-format the minority. This allows an admin to replace a dead JN without taking any downtime or running any "format" command. He or she simply re-starts the dead node with a fresh disk, or reassigns a VIP/CNAME to some new node.
- at startup, if the majority of JNs are unformatted, the NN should refuse to start up, because it may result in missing edits. This would require manual intervention, for now, if the admin really wants to start up despite the potential data loss (eg rsyncing one JN's directories to one of the fresh nodes). A future enhancement would be to automate this "unsafe startup" process.
- for the HA use case, the "initializeSharedEdits" function would take care of formatting the JNs.

The above proposed behavior is based on what we currently do with storage directories: if one is formatted and another is not, we will auto-format the empty one. If none are formatted, we require an explicit format step.
                
> QJM: improve formatting behavior for JNs
> ----------------------------------------
>
>                 Key: HDFS-3743
>                 URL: https://issues.apache.org/jira/browse/HDFS-3743
>             Project: Hadoop HDFS
>          Issue Type: Sub-task
>    Affects Versions: QuorumJournalManager (HDFS-3077)
>            Reporter: Todd Lipcon
>            Assignee: Todd Lipcon
>
> Currently, the JournalNodes automatically format themselves when a new writer takes over, if they don't have any data for that namespace. However, this has a few problems:
> 1) if the administrator accidentally points a new NN at the wrong quorum (eg corresponding to another cluster), it will auto-format a directory on those nodes. This doesn't cause any data loss, but would be better to bail out with an error indicating that they need to be formatted.
> 2) if a journal node crashes and needs to be reformatted, it should be able to re-join the cluster and start storing new segments without having to fail over to a new NN.
> 3) if 2/3 JNs get accidentally reformatted (eg the mount point becomes undone), and the user starts the NN, it should fail to start, because it may end up missing edits. If it auto-formats in this case, the user might have silent "rollback" of the most recent edits.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira