...

• If JOC Cockpit is assigned the Cluster Watch role then fail-over capabilities of JOC Cockpit apply.
• If an Agent is assigned the Cluster Watch role (available for earlier releases of JS7 until branch 2.5) then the above explanations suggest that the Agent should Agent should never be run on the hosts that the Primary and Secondary Controller instances are operated on.

...

• If the Cluster Watch  is terminated at the same time as a failed Active Controller Instance then no fail-over can occur.
• If the Cluster Watch is terminated at the same time as one of the Controller instances then the Controller Cluster cannot start up as this requires operational readiness of the Cluster Watch.
• A Cluster Watch that is started after failure of the Active Controller Instance is disqualified from casting its vote as it has no knowledge of whether the Controller instances' journals are in sync.

High Availability Setup

For high availability setup with two server nodes the following distribution of active and standby JS7 products should be applied:

Cluster Operations

Cluster operations include an automated fail-over and a manual switch-over of the Active Controller Instance.

...

• the Active Controller Instance is stopped normally from the command line:
  • controller_instance.sh | .cmd stop
• the Active Controller Instance is restarted normally from the command line:
  • controller_instance.sh | .cmd restart
• the operating system is shut down normally and systemd / init.d or a Windows Service are in place to stop the Controller normally.
• the Active JOC Cockpit Instance is not running as it holds the Cluster Watch role that is required for fail-over.

Fail-over happens within a short period of time, typically in 2-3s.

...

• the Active Controller Instance is stopped normally from the command line:
  • controller_instance.sh | .cmd stop
• the Active Controller Instance is restarted normally from the command line:
  • controller_instance.sh | .cmd restart
• the operating system is shut down normally and systemd / init.d or a Windows Service are in place to stop the Controller normally.

...

The best advice is not to apply automated clustering mechanisms, but to perform manual failswitch-over. Reasons include but are not limited to the following issues:

...