Summary

Three Server Requirement for a Redundant Server Configuration

Synopsis

In a three-redundant server configuration, why does FLEX support only three redundant license servers and not two license servers?

Discussion

For consistency and security of the software publisher's licenses, FLEX must ensure that only one license server instance, anywhere in the world, can serve a given set of counted licenses at any one time. The consistency and security of the software publisher's licenses must exist in a hostile environment where dishonest users prevent the license servers from communicating to each other, but allows the license server to communicate with the machine running the licensed applications.

A single license server (that is, a non-redundant license server) does this by binding a given set of counted licenses to the hostid of the license server's machine. The license server then ensures that only one instance of its process can be run at any one time on its machine. In order to provide for license server fail-over, multiple redundant license servers, each running on their own machine, must be able to serve the same set of counted licenses.

However, to ensure consistency and security of the software publisher's licenses, these redundant license servers must ensure that only one of them can serve licenses at any one time. The manner in which FLEX does this is described in the remaining part of this section.

A given set of counted licenses is bound to the hostids of a specific number of redundant license server machines. Each redundant license server is configured so that it knows how to communicate with the other redundant license servers that are bound to the same set of counted licenses. Upon start-up, each license server determines whether or not it can communicate with the other redundant license servers.

A group of redundant license servers is formed when all members of the group can each communicate with all others in that same group. Once a group is formed, the group guarantees that only one of its license servers can serve licenses at any one time. However, FLEX must ensure that only one such group will be formed from the total number of redundant license servers. To ensure that there is only one group that is formed, only the group that contains greater than one half of the redundant license servers will allow itself to serve licenses. This group of license servers is called either the majority or the quorum.

(INTERNAL NOTE: I don't like the term quorum, because a quorum is a term that could mean majority, two-thirds vote, three-quarters vote, etc; majority clearly means 50% + 1). It may be the case that there is no majority. License servers that are not part of the majority will refuse to serve licenses (including single license servers that cannot communicate with any other of its redundant license servers). License servers that are not part of the majority (including single license servers that cannot communicate with any other of its redundant license servers) will continue to run, but only so that they can continue their attempt to join the majority (or form a majority if no majority yet exists). If a license server ever detects that it is no longer in communication with the majority, it refuses to serve licenses until it can. If the members of the majority determine that they have lost communication with enough other license servers that they have lost the majority, they refuse to serve licenses. One might think that the most simplistic and effective deployment would be two license servers. If FLEX allowed a set of counted licenses to be bound to only two redundant license servers, (by the rules above) only a group that contains greater than one half of the total number of redundant license servers would allow itself to serve licenses. For a group of only two, this would mean both license servers would have to remain in constant communication and neither could fail (that is, the only number greater than one half of two is two)! This is not a fail-over solution! Because of the requirement for a majority, the obvious number of redundant license servers to use is an odd number. Using an even number of license servers would require an extra license server to be part of the majority without adding value. For simplicity, FLEX only supports three redundant license servers because three is the smallest odd number greater than one. author: David Z.