recover-wait period question

[David W. Hankins]

On Tue, Dec 12, 2006 at 11:14:51AM -0500, Darren wrote:
> however, respond to inform.  The primary will not hand out addresses 
> that should be handed out by the secondary while the secondary is in 
> recover-wait mode.  This means it is possible to run out of addresses 

If the secondary is in recover-wait, hopefully your primary is in
partner-down state (in the events you describe, anything else is
either a bug or you're missing some events).

In which case it will respond to all clients, and hand out free or
backup leases alike (so long as STOS+MCLT has expired).

So it's possible to run out of addresses, but only if all addresses
are actively assigned, or if you run out of free addresses before
STOS+MCLT expires (which may be before the secondary entered recover
state, or may be approximately the same time).

STOS is "Start Time Of Service" by the way.

> What is the purpose of this recover-wait period?

There's a danger of duplicate allocation of any leases the secondary,
in your example, handed out just prior to going down.  It's possible
that neither the primary nor secondary would retain any information
about these allocations.

Since the surviving server (your primary) is the only one that has
all the relevant state to avoid these duplicate allocations
(STOS+MCLT), the secondary stays out of it.  Hence, recover-wait.

-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		you'll just have to do it again."
Internet Systems Consortium, Inc.	-- Jack T. Hankins