Failure situation in a 2 node load balancer

Question

I am planning to setup a 2-node active-active app server cluster for a HA scenario. Now, when one of the server goes down, the entire site load will come on one server till the other server comes up again.

what is the best option in such a failure scenario

1. Run site in degraded mode assuming the failed server will come up quickly
2. Run each app server at 50% load always. So, if one server fails it will still be able to support the entire site load assuming the servers can operate at 100% load.

Please advise.

Answer 1

I know that it's not necessarily the answer you are looking for, but:

It's going to a business decision that cannot be decided for you by someone else.

You can however be guided by some principles:

• How quickly can you replace a failed server..

  Do you have hands available 24x7?
  Do you have maintenance contracts on all components?
  What is the guaranteed lead time on replacements?

• Are you able to run under utilised machines..

  Can you afford sufficiently specced machines?
  Do management understand the requirement?
  Ideally you want to run at less than 50% individually. A total of 100% infeasible.

• What are your service requirements..

  Will your reputation or finances be damaged if it all goes wrong?
  What do your users expect or indeed pay for?

Totting these up should put you in a better position to make your decision.

Answer 2

Dan Carley's answer is good -- I'm expanding on a misunderstanding I often see people make.

2-node active-active app server cluster for a HA scenario. ... when one of the server goes down, the entire site load will come on one server

Yes, which is why 2-node active/active often is a poor solution. At a high level, if you have 2 nodes you can do one of the following:

1. 2 node active-active, where each single node cannot handle full daily load. By employing 2 nodes, you get a certain extra headroom for load spikes (slashdotting) and you can take a single node offline during the night for maintenance without service disruption. You do not get high availability, since the failure of a single node during peak hours will take your system down. In fact, you have at least 2 single points of failure for your service (each node).
2. 2 node active-passive, where each single node can handle full load. You get high availability, and relatively simple setup.
3. 2 node active-active, where each node can handle full load. You get all of the benefits of 1) plus high availability, but typically at the cost of a more complex setup and more expensive hardware requirements.

For a 2 node HA system active-passive is generally my preferred setup. There is IMHO little benefit in running active-active in a 2-node setup, and active-passive is often easier to understand and simpler to get working. Active-active becomes a good solution when you have 3 or more nodes, so that fail over of one nodes traffic to the others is not a problem.

I'm not 100% clear on what OP means, but I think his option 2 corresponds to my option 2 or 3, in the sense that each single node runs at less than 50% capacity.