1. 26 Sep, 2013 1 commit
  2. 24 Jul, 2013 1 commit
    • antirez's avatar
      sdsrange() does not need to return a value. · 6ea8e094
      antirez authored
      Actaully the string is modified in-place and a reallocation is never
      needed, so there is no need to return the new sds string pointer as
      return value of the function, that is now just "void".
      6ea8e094
  3. 11 Jul, 2013 2 commits
  4. 10 Jul, 2013 1 commit
  5. 09 Jul, 2013 1 commit
  6. 08 Jul, 2013 2 commits
  7. 20 Jun, 2013 1 commit
    • antirez's avatar
      Sentinel: parse new INFO replication output correctly. · 4c0f8c4e
      antirez authored
      Sentinel was not able to detect slaves when connected to a very recent
      version of Redis master since a previos non-backward compatible change
      to INFO broken the parsing of the slaves ip:port INFO output.
      
      This fixes issue #1164
      4c0f8c4e
  8. 30 Apr, 2013 2 commits
    • antirez's avatar
      Sentinel: changes to tilt mode. · e5ef85c4
      antirez authored
      Tilt mode was too aggressive (not processing INFO output), this
      resulted in a few problems:
      
      1) Redirections were not followed when in tilt mode. This opened a
         window to misinform clients about the current master when a Sentinel
         was in tilt mode and a fail over happened during the time it was not
         able to update the state.
      
      2) It was possible for a Sentinel exiting tilt mode to detect a false
         fail over start, if a slave rebooted with a wrong configuration
         about at the same time. This used to happen since in tilt mode we
         lose the information that the runid changed (reboot).
      
         Now instead the Sentinel in tilt mode will still remove the instance
         from the list of slaves if it changes state AND runid at the same
         time.
      
      Both are edge conditions but the changes should overall improve the
      reliability of Sentinel.
      e5ef85c4
    • antirez's avatar
      ef05a78e
  9. 26 Apr, 2013 1 commit
    • antirez's avatar
      Sentinel: only demote old master into slave under certain conditions. · 48ede0d8
      antirez authored
      We used to always turn a master into a slave if the DEMOTE flag was set,
      as this was a resurrecting master instance.
      
      However the following race condition is possible for a Sentinel that
      got partitioned or internal issues (tilt mode), and was not able to
      refresh the state in the meantime:
      
      1) Sentinel X is running, master is instance "A".
      3) "A" fails, sentinels will promote slave "B" as master.
      2) Sentinel X goes down because of a network partition.
      4) "A" returns available, Sentinels will demote it as a slave.
      5) "B" fails, other Sentinels will promote slave "A" as master.
      6) At this point Sentinel X comes back.
      
      When "X" comes back he thinks that:
      
      "B" is the master.
      "A" is the slave to demote.
      
      We want to avoid that Sentinel "X" will demote "A" into a slave.
      We also want that Sentinel "X" will detect that the conditions changed
      and will reconfigure itself to monitor the right master.
      
      There are two main ways for the Sentinel to reconfigure itself after
      this event:
      
      1) If "B" is reachable and already configured as a slave by other
      sentinels, "X" will perform a redirection to "A".
      2) If there are not the conditions to demote "A", the fact that "A"
      reports to be a master will trigger a failover detection in "X", that
      will end into a reconfiguraiton to monitor "A".
      
      However if the Sentinel was not reachable, its state may not be updated,
      so in case it titled, or was partiitoned from the master instance of the
      slave to demote, the new implementation waits some time (enough to
      guarantee we can detect the new INFO, and new DOWN conditions).
      
      If after some time still there are not the right condiitons to demote
      the instance, the DEMOTE flag is cleared.
      48ede0d8
  10. 24 Apr, 2013 1 commit
    • antirez's avatar
      Sentinel: always redirect on master->slave transition. · 1965e22a
      antirez authored
      Sentinel redirected to the master if the instance changed runid or it
      was the first time we got INFO, and a role change was detected from
      master to slave.
      
      While this is a good idea in case of slave->master, since otherwise we
      could detect a failover without good reasons just after a reboot with a
      slave with a wrong configuration, in the case of master->slave
      transition is much better to always perform the redirection for the
      following reasons:
      
      1) A Sentinel may go down for some time. When it is back online there is
      no other way to understand there was a failover.
      2) Pointing clients to a slave seems to be always the wrong thing to do.
      3) There is no good rationale about handling things differently once an
      instance is rebooted (runid change) in that case.
      1965e22a
  11. 19 Apr, 2013 1 commit
  12. 31 Jan, 2013 1 commit
  13. 19 Jan, 2013 1 commit
  14. 08 Nov, 2012 1 commit
  15. 26 Sep, 2012 1 commit
  16. 04 Sep, 2012 2 commits
    • antirez's avatar
      Sentinel: reply -IDONTKNOW to get-master-addr-by-name on lack of info. · 9bd0e097
      antirez authored
      If we don't have any clue about a master since it never replied to INFO
      so far, reply with an -IDONTKNOW error to SENTINEL
      get-master-addr-by-name requests.
      9bd0e097
    • antirez's avatar
      Sentinel: more easy master redirection if master is a slave. · 8bdde086
      antirez authored
      Before this commit Sentienl used to redirect master ip/addr if the
      current instance reported to be a slave only if this was the first INFO
      output received, and the role was found to be slave.
      
      Now instead also if we find that the runid is different, and the
      reported role is slave, we also redirect to the reported master ip/addr.
      
      This unifies the behavior of Sentinel in the case of a reboot (where it
      will see the first INFO output with the wrong role and will perform the
      redirection), with the behavior of Sentinel in the case of a change in
      what it sees in the INFO output of the master.
      8bdde086
  17. 30 Aug, 2012 1 commit
  18. 29 Aug, 2012 1 commit
  19. 28 Aug, 2012 2 commits
    • antirez's avatar
      Sentinel: Sentinel-side support for slave priority. · 3ec701e0
      antirez authored
      The slave priority that is now published by Redis in INFO output is
      now used by Sentinel in order to select the slave with minimum priority
      for promotion, and in order to consider slaves with priority set to 0 as
      not able to play the role of master (they will never be promoted by
      Sentinel).
      
      The "slave-priority" field is now one of the fileds that Sentinel
      publishes when describing an instance via the SENTINEL commands such as
      "SENTINEL slaves mastername".
      3ec701e0
    • antirez's avatar
      Sentinel: suppress harmless warning by initializing 'table' to NULL. · c14e0eca
      antirez authored
      Note that the assertion guarantees that one of the if branches setting
      table is always entered.
      c14e0eca
  20. 24 Aug, 2012 2 commits
    • antirez's avatar
      Sentinel: send SCRIPT KILL on -BUSY reply and SDOWN instance. · 850789ce
      antirez authored
      From the point of view of Redis an instance replying -BUSY is down,
      since it is effectively not able to reply to user requests. However
      a looping script is a recoverable condition in Redis if the script still
      did not performed any write to the dataset. In that case performing a
      fail over is not optimal, so Sentinel now tries to restore the normal server
      condition killing the script with a SCRIPT KILL command.
      
      If the script already performed some write before entering an infinite
      (or long enough to timeout) loop, SCRIPT KILL will not work and the
      fail over will be triggered anyway.
      850789ce
    • antirez's avatar
      Sentinel: fixed a crash on script execution. · 01477753
      antirez authored
      The call to sentinelScheduleScriptExecution() lacked the final NULL
      argument to signal the end of arguments. This resulted into a crash.
      01477753
  21. 03 Aug, 2012 1 commit
    • antirez's avatar
      Sentinel: SENTINEL FAILOVER command implemented. · cada7f96
      antirez authored
      This command can be used in order to force a Sentinel instance to start
      a failover for the specified master, as leader, forcing the failover
      even if the master is up.
      
      The commit also adds some minor refactoring and other improvements to
      functions already implemented that make them able to work when the
      master is not in SDOWN condition. For instance slave selection
      assumed that we ask INFO every second to every slave, this is true
      only when the master is in SDOWN condition, so slave selection did not
      worked when the master was not in SDOWN condition.
      cada7f96
  22. 02 Aug, 2012 1 commit
    • antirez's avatar
      Sentinel: client reconfiguration script execution. · 6275004c
      antirez authored
      This commit adds support to optionally execute a script when one of the
      following events happen:
      
      * The failover starts (with a slave already promoted).
      * The failover ends.
      * The failover is aborted.
      
      The script is called with enough parameters (documented in the example
      sentinel.conf file) to provide information about the old and new ip:port
      pair of the master, the role of the sentinel (leader or observer) and
      the name of the master.
      
      The goal of the script is to inform clients of the configuration change
      in a way specific to the environment Sentinel is running, that can't be
      implemented in a genereal way inside Sentinel itself.
      6275004c
  23. 31 Jul, 2012 3 commits
    • antirez's avatar
      Sentinel: when leader in wait-start, sense another leader as race. · fd92b366
      antirez authored
      When we are in wait start, if another leader (or any other external
      entity) turns a slave into a master, abort the failover, and detect it
      as an observer.
      
      Note that the wait-start state is mainly there for this reason but the
      abort was yet not implemented.
      
      This adds a new sentinel event -failover-abort-race.
      fd92b366
    • antirez's avatar
    • antirez's avatar
      Sentinel: abort failover when in wait-start if master is back. · 75084e05
      antirez authored
      When we are a Leader Sentinel in wait-start state, starting with this
      commit the failover is aborted if the master returns online.
      
      This improves the way we handle a notable case of net split, that is the
      split between Sentinels and Redis servers, that will be a very common
      case of split becase Sentinels will often be installed in the client's
      network and servers can be in a differnt arm of the network.
      
      When Sentinels and Redis servers are isolated the master is in ODOWN
      condition since the Sentinels can agree about this state, however the
      failover does not start since there are no good slaves to promote (in
      this specific case all the slaves are unreachable).
      
      However when the split is resolved, Sentinels may sense the slave back
      a moment before they sense the master is back, so the failover may start
      without a good reason (since the master is actually working too).
      
      Now this condition is reversible, so the failover will be aborted
      immediately after if the master is detected to be working again, that
      is, not in SDOWN nor in ODOWN condition.
      75084e05
  24. 28 Jul, 2012 2 commits
    • antirez's avatar
      Sentinel: scripts execution engine improved. · 3f194a9d
      antirez authored
      We no longer use a vanilla fork+execve but take a queue of jobs of
      scripts to execute, with retry on error, timeouts, and so forth.
      
      Currently this is used only for notifications but soon the ability to
      also call clients reconfiguration scripts will be added.
      3f194a9d
    • Jan-Erik Rediger's avatar
      Include sys/wait.h to avoid compiler warning · c6c19c83
      Jan-Erik Rediger authored
      gcc warned about an implicit declaration of function 'wait3'. 
      Including this header fixes this.
      c6c19c83
  25. 26 Jul, 2012 1 commit
  26. 25 Jul, 2012 2 commits
    • antirez's avatar
      baace5fc
    • antirez's avatar
      Sentinel: abort failover if no good slave is available. · 672102c2
      antirez authored
      The previous behavior of the state machine was to wait some time and
      retry the slave selection, but this is not robust enough against drastic
      changes in the conditions of the monitored instances.
      
      What we do now when the slave selection fails is to abort the failover
      and return back monitoring the master. If the ODOWN condition is still
      present a new failover will be triggered and so forth.
      
      This commit also refactors the code we use to abort a failover.
      672102c2
  27. 24 Jul, 2012 4 commits
    • antirez's avatar
      9e5bef38
    • antirez's avatar
      Prevent a spurious +sdown event on switch. · a23a5b6c
      antirez authored
      When we reset the master we should start with clean timestamps for ping
      replies otherwise we'll detect a spurious +sdown event, because on
      +master-switch event the previous master instance was probably in +sdown
      condition. Since we updated the address we should count time from
      scratch again.
      
      Also this commit makes sure to explicitly reset the count of pending
      commands, now we can do this because of the new way the hiredis link
      is closed.
      a23a5b6c
    • antirez's avatar
      Sentinel: debugging message removed. · d918e6f1
      antirez authored
      d918e6f1
    • antirez's avatar
      Sentinel: changes to connection handling and redirection. · 75fb6e5b
      antirez authored
      We disconnect the Redis instances hiredis link in a more robust way now.
      Also we change the way we perform the redirection for the +switch-master
      event, that is not just an instance reset with an address change.
      
      Using the same system we now implement the +redirect-to-master event
      that is triggered by an instance that is configured to be master but
      found to be a slave at the first INFO reply. In that case we monitor the
      master instead, logging the incident as an event.
      75fb6e5b