About High Availability Synchronization and Data Replication
The ActivID Appliance synchronization process consists of the following workflow:
To illustrate the workflow for each node, the following conventions are used in the diagram:
- The status of the synchronization process is represented by the boxes.
- The transitions between the synchronization statuses are represented by the links. These transitions can be triggered automatically or manually by the commands you executed. For more information, see Dual Mode synchronization options.
- The Single Mode node workflow is represented in the grey boxes, while the colored boxes represent the Dual Mode workflow.
| Status | Description |
|---|---|
|
Single Mode |
Synchronization status is not applicable. For the Front-End appliance (that is, when the ActivID Authentication Services are not installed), the HA options are not displayed. |
|
Under Construction |
The remote appliance is under construction, and the initialization and the configuration of the replication processes are under construction. This status appears when the node has just been moved from Single Mode to Dual Mode, while the second node is still not configured properly. Once the second node is configured as Dual Mode, the status automatically changes to Synchronized. |
|
Synchronized |
The replication processes are up and running. Both nodes are synchronized, no issue has been raised, and there is no delay on the synchronization This status is “normal” when the system is in Dual Mode and running normally. |
|
Out of Synchronization
|
Out of Synchronization (recoverable) – both nodes are not synchronized, but the level of resynchronization is recoverable. There are different causes of this status, for example, a network issue, or the remote appliance having an issue or is unresponsive. The breakdown time is limited. For this (limited) period of time, the replication process is registering all data updates and is staying ready to synchronize as soon as the breakdown is fixed. This status is set automatically by the supervisor. This status can appear on both nodes at the same time if the issue is a High Availability issue, for instance. The return to the Synchronized state is done automatically. Out of Synchronization (reason) – both nodes are not synchronized, and the synchronization is not recoverable. The replication processes are stopped. The cause of this breakdown can be a long network issue, or the node does not have the space to record the updates. You can initialize the synchronization, or set the node in Single Mode, or replace the appliance. The following list summarizes the possible reasons for this status:
|
Availability of Synchronization Status Commands
This table summarizes the available commands depending on the synchronization status of the nodes.
|
|
Synchronization Status | Available Commands | |||||||
|---|---|---|---|---|---|---|---|---|---|
|
Local Mode |
Node local |
Node remote |
Set Dual |
Set Single |
Init Sync |
Cancel Sync |
Download File |
Backup |
Restore |
|
Single Mode |
Single Mode |
N/A |
X |
|
|
|
|
X |
X |
|
Dual Mode |
Under Construction |
Under Construction |
|
X |
|
|
X |
X |
|
|
Dual Mode |
Synchronized |
Synchronized |
|
X |
|
X |
|
X |
|
|
Dual Mode |
Out of Synchronization Recoverable |
Unreachable |
|
X |
|
X |
|
X |
|
|
Dual Mode |
Out of Synchronization Unrecoverable |
Out of Synchronization Unrecoverable |
|
X |
X |
|
|
X |
|
Data Replication in Dual Mode
Deployment Components
When appliances are synchronized, the replication of components is described in below table.
When appliances are not synchronized (for example, the network is disconnected), the following warning appears:
"The update cannot be replicated to the other node immediately; the replication is delayed until both appliances are synchronized. Once the appliances synchronized, please double check your updates have been replicated properly or update your configuration once again"
If this happens, check the replication of the updates manually.
| Deployment Components | Synchronization process (when set as dual, install as dual, synchronized) |
Dual Mode (when both nodes are synchronized and running) |
|---|---|---|
|
Application configuration files |
Replicated on second node (as initial default values) |
Not replicated between nodes |
|
Date and Time settings |
Not replicated between nodes It is recommended to use automatic settings as time should be the same on both nodes. |
Not replicated between nodes It is recommended to use automatic settings as time should be the same on both nodes. |
|
Customization Package |
Replicated on second node (as initial default values) |
Not replicated between nodes |
|
Appliance Key Stores |
Replicated on second node (as initial default values) except the appliance server SSL certificate which is defined per node at node installation |
Not replicated between nodes except the ActivID AS server AES keys and IdP certificates (in software cryptography deployments) |
|
Scheduled Backup Configuration |
Not replicated between nodes and can be different on each node |
Not replicated between nodes and can be different on each node |
|
Monitoring/SNMP Configuration |
Not replicated between nodes and can be different on each node |
Not replicated between nodes and can be different on each node |
|
Scheduled Archive audit Configuration |
Not replicated between nodes and can be different on each node |
Not replicated between nodes and can be different on each node |
|
Troubleshooting |
Replicated on second node (as initial default values) |
Not replicated between nodes and can be different on each node |
| License Files |
Replicated on second node The Site Code ID is replicated on second node |
Update is possible from each node Replicated between nodes |
|
OOB template files |
Replicated on second node |
Update is possible from each node. Replicated between nodes |
|
Domains |
Replicated on second node |
Replicated between nodes |
Database Content
When appliances are synchronized, all database objects are replicated.
When appliances are not synchronized (for example, the network is disconnected), the database content diverges on both nodes. The following warning appears:
"Conflicting changes between the two nodes. The system is reconciling the data. Check your recent updates in Management Console and check the archived conflict auditing for detailed information"
When conflict resolution fails, you receive a notification which includes a list of objects (10 maximum), where:
- <Domain> is the domain name
- <GUI Label> is the label of the object as documented and displayed on the ActivID Management Console (for example, Channel, Role)
- <name> is the object name (for example, IIS, Device Administrator)
- <Code> is the code value (for example, CH_123, RL_458)
The following is an example of the warning:
There might be conflicting changes between the nodes that will not be reconcilable. Before you continue, please check to be sure both nodes have the same values for the object(s) and related data listed below. To correct any possible issues, delete any incorrect object, and recreate it.
<Domain> <GUI Label> « <name> » (code <code>)
<Domain> <GUI Label> « <name> » (code <code>)
<Domain> <GUI Label> « <name> » (code <code>)
<Domain> <GUI Label> « <name> » (code <code>)
<Domain> <GUI Label> « <name> » (code <code>)
..Check the objects listed in order to correct potential issues. See the full list of objects (parent/children) which can have incorrect values following conflicting changes.
For guidance on how to eliminate conflicts in your High Availability deployment, save this information and contact HID Global Technical Support.
