1. 15 Mar, 2014 1 commit
  2. 14 Mar, 2014 4 commits
    • Matt Stancliff's avatar
      Fix segfault from accessing array out of bounds · 584052ee
      Matt Stancliff authored
      argc == 2; argv[2] == crash
      584052ee
    • antirez's avatar
      Sentinel: be safe under crash-recovery assumptions. · ed813863
      antirez authored
      Sentinel's main safety argument is that there are no two configurations
      for the same master with the same version (configuration epoch).
      
      For this to be true Sentinels require to be authorized by a majority.
      Additionally Sentinels require to do two important things:
      
      * Never vote again for the same epoch.
      * Never exchange an old vote for a fresh one.
      
      The first prerequisite, in a crash-recovery system model, requires to
      persist the master->leader_epoch on durable storage before to reply to
      messages. This was not the case.
      
      We also make sure to persist the current epoch in order to never reply
      to stale votes requests from other Sentinels, after a recovery.
      
      The configuration is persisted by making use of fsync(), this is
      considered in the context of this code a good enough guarantee that
      after a restart our durable state is restored, however this may not
      always be the case depending on the kind of hardware and operating
      system used.
      ed813863
    • antirez's avatar
      Sentinel: fake PUBLISH command to receive HELLO messages. · 36509402
      antirez authored
      Now the way HELLO messages are received is unified.
      Now it is no longer needed for Sentinels to converge to the higher
      configuration for a master to be able to chat via some Redis instance,
      the are able to directly exchanges configurations.
      
      Note that this commit does not include the (trivial) change needed to
      send HELLO messages to Sentinel instances as well, since for an error I
      committed the change in the previous commit that refactored hello
      messages processing into a separated function.
      36509402
    • antirez's avatar
  3. 04 Mar, 2014 2 commits
    • Jan-Erik Rediger's avatar
      Small typo fixed · 5f5118bd
      Jan-Erik Rediger authored
      5f5118bd
    • antirez's avatar
      Sentinel: more aggressive failover start desynchronization. · 47750998
      antirez authored
      Sentinel needs to avoid split brain conditions due to multiple sentinels
      trying to get voted at the exact same time.
      
      So far some desynchronization was provided by fluctuating server.hz,
      that is the frequency of the timer function call. However the
      desynchonization provided in this way was not enough when using many
      Sentinel instances, especially when a large quorum value is used in
      order to force a greater degree of agreement (more than N/2+1).
      
      It was verified that it was likely to trigger a split brain
      condition, forcing the system to try again after a timeout.
      Usually the system will succeed after a few retries, but this is not
      optimal.
      
      This commit desynchronizes instances in a more effective way to make it
      likely that the first attempt will be successful.
      47750998
  4. 24 Feb, 2014 4 commits
  5. 22 Feb, 2014 1 commit
    • antirez's avatar
      Sentinel: IDONTKNOW error removed. · b1c13863
      antirez authored
      This error was conceived for the older version of Sentinel that worked
      via master redirection and that was not able to get configuration
      updates from other Sentinels via the Pub/Sub channel of masters or
      slaves.
      
      This reply does not make sense today, every Sentinel should reply with
      the best information it has currently. The error will make even more
      sense in the future since the plan is to allow Sentinels to update the
      configuration of other Sentinels via gossip with a direct chat without
      the prerequisite that they have at least a monitored instance in common.
      b1c13863
  6. 20 Feb, 2014 1 commit
  7. 18 Feb, 2014 2 commits
    • antirez's avatar
      Sentinel: SENTINEL_SLAVE_RECONF_RETRY_PERIOD -> RECONF_TIMEOUT · 7cec9e48
      antirez authored
      Rename define to match the new meaning.
      7cec9e48
    • antirez's avatar
      Sentinel: fix slave promotion timeout. · 18b8bad5
      antirez authored
      If we can't reconfigure a slave in time during failover, go forward as
      anyway the slave will be fixed by Sentinels in the future, once they
      detect it is misconfigured.
      
      Otherwise a failover in progress may never terminate if for some reason
      the slave is uncapable to sync with the master while at the same time
      it is not disconnected.
      18b8bad5
  8. 17 Feb, 2014 1 commit
  9. 07 Feb, 2014 1 commit
  10. 31 Jan, 2014 1 commit
  11. 14 Jan, 2014 1 commit
  12. 13 Jan, 2014 3 commits
  13. 10 Jan, 2014 7 commits
  14. 13 Dec, 2013 1 commit
  15. 10 Dec, 2013 1 commit
    • antirez's avatar
      dict.c: added optional callback to dictEmpty(). · 2eb781b3
      antirez authored
      Redis hash table implementation has many non-blocking features like
      incremental rehashing, however while deleting a large hash table there
      was no way to have a callback called to do some incremental work.
      
      This commit adds this support, as an optiona callback argument to
      dictEmpty() that is currently called at a fixed interval (one time every
      65k deletions).
      2eb781b3
  16. 06 Dec, 2013 2 commits
    • antirez's avatar
      Sentinel: fix reported role info sampling. · c590549e
      antirez authored
      The way the role change was recoded was not sane and too much
      convoluted, causing the role information to be not always updated.
      
      This commit fixes issue #1445.
      c590549e
    • antirez's avatar
      Sentinel: fix reported role fields when master is reset. · 2b414a4b
      antirez authored
      When there is a master address switch, the reported role must be set to
      master so that we have a chance to re-sample the INFO output to check if
      the new address is reporting the right role.
      
      Otherwise if the role was wrong, it will be sensed as wrong even after
      the address switch, and for enough time according to the role change
      time, for Sentinel consider the master SDOWN.
      
      This fixes isue #1446, that describes the effects of this bug in
      practice.
      2b414a4b
  17. 05 Dec, 2013 1 commit
  18. 02 Dec, 2013 2 commits
    • antirez's avatar
      Sentinel: don't write HZ when flushing config. · f80cf736
      antirez authored
      See issue #1419.
      f80cf736
    • antirez's avatar
      Sentinel: better time desynchronization. · dffebbc9
      antirez authored
      Sentinels are now desynchronized in a better way changing the time
      handler frequency between 10 and 20 HZ. This way on average a
      desynchronization of 25 milliesconds is produced that should be larger
      enough compared to network latency, avoiding most split-brain condition
      during the vote.
      
      Now that the clocks are desynchronized, to have larger random delays when
      performing operations can be easily achieved in the following way.
      Take as example the function that starts the failover, that is
      called with a frequency between 10 and 20 HZ and will start the
      failover every time there are the conditions. By just adding as an
      additional condition something like rand()%4 == 0, we can amplify the
      desynchronization between Sentinel instances easily.
      
      See issue #1419.
      dffebbc9
  19. 28 Nov, 2013 1 commit
  20. 26 Nov, 2013 1 commit
  21. 25 Nov, 2013 2 commits