Arbitration of disk ownership in a storage pool

The present invention extends to methods, systems, and computer program products for implementing persistent reservation techniques for establishing ownership of one or more physical disks. These persistent reservation techniques can be employed to determine ownership of physical disks in a storage pool as well as in any other storage configuration. Using the persistent reservation techniques of the present invention, when a network partition occurs, a defender of a physical disk does not remove a challenger's registration key until the defender receives notification that the challenger is no longer in the defender's partition. In this way, pending I/O from applications executing on the challenger will not fail due to the challenger's key being removed until the proper ownership of the physical disk can be resolved.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not Applicable.

BACKGROUND

1. Background and Relevant Art

Computer systems and related technology affect many aspects of society. Indeed, the computer system's ability to process information has transformed the way we live and work. Computer systems now commonly perform a host of tasks (e.g., word processing, scheduling, accounting, etc.) that prior to the advent of the computer system were performed manually. More recently, computer systems have been coupled to one another and to other electronic devices to form both wired and wireless computer networks over which the computer systems and other electronic devices can transfer electronic data. Accordingly, the performance of many computing tasks is distributed across a number of different computer systems and/or a number of different computing environments.

Clustering refers to the grouping of multiple computer systems, referred to herein as nodes. Oftentimes, a cluster employs shared storage to enable applications executing on any of the nodes to access the same data. Shared storage enables fail over of applications from node to node in the cluster. For example, if a node fails, the applications executing on the failed node can be switched over to another node where they continue executing. Because the data used by the failed over applications is stored on a shared storage accessible from any node, the applications can continue to execute (e.g. access the same data) after being switched to another node. In this way, the failover is essentially transparent from a user's perspective.

To implement a cluster, it is necessary to maintain consistency across nodes. For example, cluster configuration data should remain consistent across nodes even though each node has access to the configuration data. As long as each node can communicate with the other nodes in the cluster, consistency can be maintained. In some clusters, each node stores a copy of the cluster configuration data, and a cluster service synchronizes the data across nodes.

One problem arises when a network partition occurs thus preventing nodes from communicating.FIG. 1(Prior Art) illustrates an example where a network partition107has occurred in a cluster100preventing a first partition of nodes (nodes101-102) from communicating with a second partition of nodes (nodes103-104). Shared storage106remains accessible to each node of the cluster; however, nodes in the first partition cannot communicate with nodes in the second partition. When such a split in the cluster occurs, it is necessary that only one partition continues functioning as a cluster to ensure that consistency is maintained.

To ensure that only one partition in a cluster continues executing (i.e. retains access to shared storage106), the cluster service requires a partition to have quorum. In general, having quorum means that the partition comprises a majority of the elements in the cluster. Depending on the configuration of the cluster, elements can include the nodes of the cluster and possibly a disk (sometimes referred to as a disk witness) or a file share. Disk witnesses are used when an even number of nodes exist to prevent the situation where a tie would occur (e.g. if only the nodes were considered when determining majority).

InFIG. 1, both the first and the second partition have the same number of nodes. Accordingly, whichever partition has ownership of shared storage106will have quorum (i.e. 2 nodes+1 disk). When a node owns a disk, it has write access to the disk. Other nodes can also write to the disk, but the owner can control which nodes can have access. In this way, a single node is given control over who can access the disk. InFIG. 1, prior to the occurrence of network partition107, node101has ownership of shared storage106.

In general, an owner node allows access to nodes that it knows are members of the cluster and are within the owner node's partition (e.g. when a partition occurs). Therefore, when a partition occurs, the node that owns the disk is responsible for preventing nodes outside the majority from accessing shared storage. For example, inFIG. 1, node101, as owner, would prevent nodes103-104from accessing shared storage106after network partition107occurs.

Disk ownership is commonly determined and managed using a SCSI protocol known as Persistent Reservation (PR). PR is a defense/challenge mechanism. In PR, each node has a unique key known as a registration key. To obtain ownership of a disk, a node must have registered its key, and then must obtain a reservation with the key.

FIG. 2A(Prior Art) illustrates two tables that are used in PR.FIG. 2Arepresents the state of the two tables when node101is the current owner of the disk (shared storage106). Although two tables are shown in this example, PR can be implemented using a single table or other data structure to store similar information.

To have write access to a disk, a node must register its registration key. A node registers its key by adding it to registration table201. For example, registration table201shows that nodes101-104have each registered their key. Accordingly, nodes101-104have write access to shared storage106.

Once registered, a node can then attempt to reserve its key by adding it to reservation table202. For example, reservation table202shows that node101has successfully reserved its key thereby making node101the owner of the disk. Once a node reserves its key, it can use its key to control the disk.

If, however, a reservation already exists when a node (referred to as a challenger) attempts to reserve its key, the reservation will fail. For example, because node101's key is already reserved, any other node's attempt to reserve its key will fail. As part of this failed reservation, a challenger receives the current reservation key (e.g. node101's key).

When a reservation already exists, a node must first preempt the reservation before it can reserve its own key. To enable an owner node (referred to as the defender) to defend its ownership of a disk, PR rules require a challenger to wait a specified time period (generally 6 seconds) after a reservation fails before issuing a preempt command. After this time period, the challenger awakes and issues a preempt command to attempt to remove the defender's key from the reservation table. The preempt command specifies the challenger's key as well as the current reservation key (the defender's key reserved in the reservation table that the challenger received when it failed reservation). For example, the preempt command specifies the key to remove from reservation table202(the defender's key), as well as the key to reserve in reservation table202(the challenger's key).

For the preempt command to succeed, the challenger's key must still be in registration table201. To defend its ownership (i.e. to cause the challenger's preempt command to fail), the defender must remove the challenger's registration key from registration table201before the challenger issues a preempt command. Generally, every 3 seconds, the defender will awake and check reservation table202to determine whether any challenges have been made. Because the defender owns the disk, it can remove any other node's registration key from the registration table201.

When node101sees node104's key in registration table201, node101will remove node104's registration key from registration table201.FIG. 2B(Prior Art) represents the state of the two tables after node101has defended against node104's challenge. As shown, node104's key is no longer listed in registration table201.

Accordingly, when node104awakes and issues a preempt command, the preempt command will fail because the defender has already removed node104's registration key. Because node104's registration key has been removed from registration table201, node104no longer has access to shared storage106.

Because the defender sleeps for a shorter duration than the challenger, as long as the defender remains functional and has no reason to not defend its ownership, it will retain ownership by periodically removing the registration keys of any node challenging for ownership. However, if the defender fails or otherwise loses access to the disk, it will fail to remove the registration key of a challenger thereby allowing the challenger to successfully preempt ownership (i.e. remove the defender's keys from the registration and reservation table).

In addition to removing a challenger's registration key in a defense, a defender will also periodically remove the registration keys of any nodes that it does not recognize as being part of the active cluster. In other words, a node in a cluster is periodically updated regarding which nodes it can communicate with. If an owner node receives a notification that it cannot communicate with another node in the cluster (e.g. due to a network partition), the owner node will remove the other node's registration key to prevent the other node from accessing cluster storage.

Accordingly, in conventional PR, there are two general ways in which a node's registration key will be removed: (1) when the owner node receives notification that it cannot communicate with the node; and (2) when the node unsuccessfully challenges for ownership of the shared storage.

When a network partition occurs (i.e. when a node becomes aware that it cannot communicate with each node in the cluster), a node in a partition that does not have ownership of the disk generally will begin challenging for ownership of the disk. For example, inFIG. 1, after network partition107occurs, one or more of nodes103-104can commence a challenge to preempt node101's ownership of shared storage106(because nodes103and104need ownership of shared storage106to obtain quorum (to thereby be able to continue functioning within the cluster).

InFIG. 1, network partition107does not prevent any of the nodes from accessing shared storage106(i.e. it only prevents nodes101-102from communicating with nodes103-104). Accordingly, node101will continue to defend its ownership of shared storage106from node103's or node104's challenges.

If, however, node101were to fail or otherwise lose connection to shared storage106(or determine that it should not defend because it is not in a partition that could have quorum), challenges from node103or104would succeed (because node101would not be able to remove node103's or node104's registration keys). As a result, when the challenger (node103or node104) awakes, its registration key will still be listed in registration table201thus allowing it to preempt node101's ownership. The challenger will then take ownership of shared storage106. As owner, the node will commence defending its ownership as described above (e.g. if node101or102commenced challenging for ownership).

The above example describes a cluster that provides the nodes and the storage with votes to determine ownership. Other voting schemes also exist which use the PR techniques described above. These schemes include node only voting (where only the nodes have a vote), and node+file share voting (where the nodes and a file share vote). Node only voting is commonly used when the cluster includes an odd number of nodes. Node+file share voting is similar to the node+storage voting described above, but is used when a file share is used for shared storage.

PR as described above functions correctly within many typical storage configurations. However, PR, as described above, is not always satisfactory when used in other types of storage configurations (e.g. when a cluster employs virtual disks as shared storage). In the Windows operating system, virtual disks are referred to as “Storage Spaces.” In a Storage Space, multiple physical disks are aggregated into a storage pool. The storage pool can then be divided into one or more logical “Spaces” (or virtual disks). Each Space appears to applications as a physical storage device even though the Space is virtualized and may actually span many different physical storage devices.

For example,FIG. 3(Prior Art) illustrates a cluster300that is similar to cluster100ofFIG. 1except that shared storage106has been replaced by storage pool306. Storage pool306comprises three physical storage devices310-312. From this pool, the user can create one or more Spaces.FIG. 3shows that the user has created a single Space307. Space307can be treated, from the perspective of applications on each node in the cluster, as a normal physical disk.

When Spaces are used, the nodes of the cluster need to have access to each physical disk in the underlying pool because the Spaces can be spread among the physical disks. For example, in cluster300, data written to Space307could be physically stored on any of three physical storage devices in storage pool306. When using Spaces, a single node owns the storage pool (meaning that the node owns each physical disk in the pool).

One particular problem caused by applying standard PR techniques with Spaces is that anytime a challenger attempts to preempt ownership of the pool from which the Spaces are created, the owner of the pool will remove the challenger's key thus causing any I/O to any Space from applications on the challenger to fail (because the challenger's key must be registered with a physical disk to enable the applications on the challenger to write to the physical disk).

Causing I/O from a challenger to fail may be an incorrect result of a challenge. For example, a challenger may be notified of a network partition prior to the defender. In response to the network partition, the challenger commences a challenge for the pool. If the challenger is in a partition that has quorum, the correct result would be for the challenger to win the challenge to take ownership of the pool (to thereby allow the challenger's partition to continue executing).

If, however, the defender has not been notified of the network partition (and accordingly, not notified that it is in a partition that does not have quorum), the defender will successfully defend its ownership of the pool. Using conventional PR techniques as described above, this defense includes removing the challenger's registration key so that any writes from the challenger will fail. The defender will continue to successfully defend its ownership until it receives notification of the network partition. Accordingly, until the defender receives notification of the network partition, the cluster will not commence operating properly on the partition with quorum (i.e. the challenger's partition). In other scenarios, the application of conventional PR techniques also leads to undesirable results.

BRIEF SUMMARY

The present invention extends to methods, systems, and computer program products for implementing persistent reservation techniques for establishing ownership of one or more physical disks. These persistent reservation techniques can be employed to determine ownership of physical disks in a storage pool as well as in any other storage configuration. Using the persistent reservation techniques of the present invention, when a network partition occurs, a defender of a physical disk does not remove a challenger's registration key until the defender receives notification that the challenger is no longer in the defender's partition. In this way, pending I/O from applications executing on the challenger will not fail due to the challenger's key being removed until the proper ownership of the physical disk can be resolved.

In one embodiment, a first node defends against another node's attempt to preempt the first node's persistent reservation on a storage device. After a network partition that prevents the first node from communicating with another node in the cluster, and prior to the first node being notified of the network partition, the first node detects that another node in the cluster has attempted to reserve the storage device shared by nodes of the cluster. The detection comprises identifying that the other node has changed the other node's registration key in a registration data structure.

The first node changes the first node's registration key, registers the changed registration key in the registration data structure, and reserves the changed registration key in a reservation data structure.

In another embodiment, a second node attempts to remove a first node's persistent reservation on a storage device so as to obtain a persistent reservation for the second node. The second node receives a notification that a network partition has occurred that prevents the second node from communicating with the first node.

The second node attempts to reserve the second node's registration key so as to obtain a persistent reservation on the storage device. The attempt to reserve includes the second node reading the registration key of the first node that is stored in a reservation data structure and storing the first node's key. The attempt to reserve also includes the second node changing the second node's registration key and registering the changed registration key. The attempt to reserve also includes the second node sleeping for a specified duration of time prior to issuing a preempt command to remove the first node's persistent reservation.

DETAILED DESCRIPTION

The present invention extends to methods, systems, and computer program products for implementing persistent reservation techniques for establishing ownership of one or more physical disks. These persistent reservation techniques can be employed to determine ownership of physical disks in a storage pool as well as in any other storage configuration. Using the persistent reservation techniques of the present invention, when a network partition occurs, a defender of a physical disk does not remove a challenger's registration key until the defender receives notification that the challenger is no longer in the defender's partition. In this way, pending I/O from applications executing on the challenger will not fail due to the challenger's key being removed until the proper ownership of the physical disk can be resolved.

In one embodiment, a first node defends against another node's attempt to preempt the first node's persistent reservation on a storage device. After a network partition that prevents the first node from communicating with another node in the cluster, and prior to the first node being notified of the network partition, the first node detects that another node in the cluster has attempted to reserve the storage device shared by nodes of the cluster. The detection comprises identifying that the other node has changed the other node's registration key in a registration data structure.

The first node changes the first node's registration key, registers the changed registration key in the registration data structure, and reserves the changed registration key in a reservation data structure.

In another embodiment, a second node attempts to remove a first node's persistent reservation on a storage device so as to obtain a persistent reservation for the second node. The second node receives a notification that a network partition has occurred that prevents the second node from communicating with the first node.

The second node attempts to reserve the second node's registration key so as to obtain a persistent reservation on the storage device. The attempt to reserve includes the second node reading the registration key of the first node that is stored in a reservation data structure and storing the first node's key. The attempt to reserve also includes the second node changing the second node's registration key and registering the changed registration key. The attempt to reserve also includes the second node sleeping for a specified duration of time prior to issuing a preempt command to remove the first node's persistent reservation.

Although the present invention is described as being implemented in cluster400shown inFIG. 4, it is to be understood that the PR techniques can also be implemented in other computer architectures that include multiple nodes. Cluster400includes four interconnected nodes (nodes401-404). Each node is connected to each of storage devices410-412. Storage devices410-412comprise storage pool420from which multiple virtual disks (or Spaces)430a-430nhave been created. Accordingly, applications on each node can access each of virtual disks430a-430n. It is assumed that quorum in cluster400is determined using a nodes+storage voting scheme. Accordingly, each of nodes401-404and pool420has a vote. A single node owns each storage device in pool420at a given time.

Additionally,FIGS. 5A-5Fillustrate various states of a registration table501and a reservation table502that can be maintained to implement the PR techniques of the present invention. A separate set of registration and reservation tables is maintained for each of storage devices410-412. In the following description, it will be assumed that registration table501and reservation table502pertain to storage device410, but it should be understood that a similar process would be followed for determining ownership of each storage device. Also, even though two tables are shown, the present invention can be implemented using a single table or any number of other data structures. Accordingly, the data structure used to store the keys is not essential to the invention.

FIGS. 5A-5Falso include nodes401and404to illustrate how the nodes store currently reserved keys during the PR process of the present invention. Of course, although not shown, each node also stores its registration key.

FIG. 5Arepresents the state of the two tables prior to the occurrence of network partition405. InFIG. 5A, registration table501includes four registration keys, one for each of nodes401-404indicating that each node in the cluster can write to storage device410. Reservation table502also includes node401's registration key indicating that node401has a reservation on storage device410(i.e. node401is the current owner of the physical disk).

When network partition405occurs, each node in the cluster will be notified of the partition. However, each node will not necessarily be notified at the same time. In this example, node404has been notified of network partition405and accordingly has commenced a challenge for ownership of each storage device in pool420(because node404's partition needs ownership of pool420to have quorum).

Node401, however, at the time of node404's challenge has yet to be notified of network partition405. As such, node401will think that it is still in the same partition as node404. In conventional PR, when node404challenges for ownership of storage device410, the fact that node401still thinks that node404is in the same partition would not matter, and node401would remove node404's registration key from registration table501thus causing I/O from node404to fail.

In contrast, in the present invention, different PR techniques are applied to ensure that node401does not remove node404's registration key until node401knows that node404is no longer in the same partition.FIGS. 5B-5Eillustrates how the PR techniques of the present invention are implemented.

FIG. 5Brepresents the state of the two tables after node404has commenced a challenge for ownership of storage device410. Accordingly,FIG. 5Bcan represent the time period while node404is asleep and node401has not yet awakened to defend its ownership.

Node404attempts to reserve by performing the following tasks. Node404increments (or otherwise changes) its own registration key and registers it in registration table501(in place of its old registration key). However, because node401is the current owner, node404's attempt to reserve will initially fail thus requiring node404to sleep before attempting to preempt node401's reservation. Because the reservation failed, node404also reads the current reservation key (node401's key in reservation table502) and stores it.

Accordingly,FIG. 5B, shows that registration table501has been changed by replacing node404's old registration key with node404's incremented registration key. InFIG. 5B, node404is shown as storing the current reservation key, node401's registration key.

FIG. 5Crepresents the state of the two tables after node401has awakened to defend its ownership, but prior to node401being notified of network partition405. In a defense, a node removes the registration keys of any nodes that are not recognized as being part of the owner node's partition. Accordingly, when node401sees node404's incremented registration key in registration table501, node401will not remove node404's registration key because node401still believes node404is in the same partition.

Rather than remove node404's registration key from registration table501(thus preventing node404from writing to storage device410), node401instead increments its own registration key, registers the incremented key, and reserves the incremented key. This is the owner node's form of defense when a node that is not known to be in a different partition challenges for ownership.

Accordingly,FIG. 5Cshows that registration table501and reservation table502now each include node401's incremented registration key in place of node401's previous key. In short, because node401does not yet know that node401and node404are no longer in the same partition, node401's response to node404's challenge involves incrementing and reserving its registration key rather than removing node404's registration key from registration table501.

FIG. 5Drepresents the state of the two tables after node404has awakened and issued preempt command530. Preempt command530includes node404's current registration key and the reservation key that node404read prior to sleeping. Because node401has incremented its registration key and reserved the incremented key, the reservation key held by node404will not match the current reservation key stored in reservation table502(Node—401_key—0001 !=Node—401_key—0002). Thus, node404's preemption attempt will fail, and node401will remain owner of storage device410.FIG. 5Daccordingly shows that both tables remain the same as inFIG. 5Cbecause node401has remained owner but has not removed node404's registration.

At some later time, node404(or similarly, node403) can commence another challenge in the manner described with respect toFIGS. 5A-5B.FIG. 5Erepresents the state of the two tables after node404has commenced another challenge. As shown, registration table501now includes node404's incremented key (Node—404_key—0003). Node404has also stored the current reservation key (Node—401_key—0002).

Prior to node401awakening to defend its ownership, node401has been notified of network partition405. Accordingly, node401responds differently to node404's challenge. In particular, node401now knows that node404is not in the same partition, and as such, node401removes node404's registration key from registration table501causing node404's challenge to fail as well as preventing node404from writing to storage device410.

FIG. 5F, therefore, represents the state of the two tables after node401has been notified of network partition405and after node401has defended against node404's challenge. As shown, registration table501does not include node404's registration key. Although node404is shown as still storing the current reservation key, a preemption attempt by node404would fail because node404's registration key is not in registration table501.

Although the above description uses the example of incrementing a key, the present invention can also be implemented by changing a key in any other way to notify another node of a challenge. For example, rather than increment its key, node404could change a bit. In essence, the changing of the registration key acts as a way for the nodes to continue communicating even though the network partition has prevented the nodes from directly communicating. Accordingly, any means of modifying the registration key to communicate a node's challenge can be used in the present invention.

It is noted that node404's registration key may also be removed even without node404commencing a challenge. Any time node401awakes to defend ownership, it first checks for any registration keys of nodes it does not recognize as being part of the same partition. For example, if node401awakes after network partition405and prior to node404commencing a challenge, node401will remove node404's key (as well as node403's key) from registration table501because node404and403are no longer in the same partition.

Accordingly, an owner node does not remove another node's registration key until the owner node knows that the other node is not in the same partition as the owner node. In this way, an owner node will not remove another node's key when a network partition occurs until the owner node knows about the network partition and can respond accordingly (e.g. by defending or not defending its ownership).

Of course, during any given defense, the owner node can both remove registration keys of any node it does not recognize as being part of the same partition, as well as increment, register, and reserve its registration key in response to a challenge from a node that it does not yet know is in another partition. Using the same example ofFIGS. 5A-5F, if node403and404challenged at the same time, but node401had only been notified that node404was no longer in the same partition, node401would remove node404's key, while leaving node403's key and incrementing its own key.

Similarly, if at any time, node401became aware that it was in a partition that did not have quorum (e.g. if network partition405separated node401from nodes402-404), node401would not defend its ownership thus allowing one of the nodes in the other partition to successfully preempt node401's ownership.

As mentioned above, the process described with respect toFIGS. 5A-5Fis performed for every storage device in a storage pool. For example, node404would challenge for ownership of storage devices411and412in the same manner. A single node, however, should generally have ownership of every storage device in the pool. To ensure that a single node obtains and retains ownership of each storage device, the process described above is carried out on each storage device is a predefined order.

In other words, each node knows of an order in which each storage device should be challenged for. This order can be determined, for example, based on an identifier associated with the storage device (e.g. a pool guide). For example, when node404awakes to issue preempt commands, it can issue the preempt commands in a specified order (such as by preempting on storage device410, then storage device411, then storage device412).

If any preempt command fails, the challenging node will cease challenging for ownership. For example, if node404's preempt command failed on storage device410, node404would not attempt to preempt ownership of storage devices411and412. By issuing preempt commands in a specified order, the situation can be avoided where one node wins ownership of some storage devices in the pool, while one or more other nodes win ownership of other storage devices in the pool.

In addition to ensuring that an owner node or challenger node is part of a partition that has quorum (or could have quorum by obtaining ownership of the pool), a node can also verify that a quorum of disks in the pool are accessible prior to commencing a defense of or challenge for the storage devices of the pool. For example, when node401awakes to defend its ownership, it can first enumerate all storage devices in pool420. If the number of enumerated storage devices is less than a majority of the storage devices in the pool (e.g. less than 2 of storage devices410-412), node401can cease its defense. Similarly, when node404attempts a challenge, it can also enumerate the storage devices and cease the challenge if a quorum of the storage devices is not accessible. A storage device may be inaccessible if the storage device fails or otherwise stops operating correctly.

FIG. 6illustrates an exemplary format for a registration key600. Registration key600includes four sections: an identifier section601, a revision section602, a node identifier section603, and a signature section604. Identifier section601includes an identifier of the storage device for which the registration key is used. Revision section602is the portion of the key that is incremented as described above. Node identifier section603includes an identifier of the node to which the key pertains. Signature portion604includes a unique signature generated by the corresponding node.

FIG. 7illustrates a flow chart of an example method700for a first node to defend against another node's attempt to preempt the first node's persistent reservation on a storage device. Method700will be described with respect to FIGS.4and5A-5F.

Method700includes an act701of, after a network partition that prevents the first node from communicating with another node in the cluster, and prior to the first node being notified of the network partition, the first node detecting that another node in the cluster has attempted to reserve the storage device shared by nodes of the cluster. The detection comprises identifying that the other node has changed the other node's registration key in a registration data structure. For example, node401can detect that node404has changed its registration key in registration table501pertaining to storage device410while node401has a persistent reservation on storage device410.

Method700includes an act702of, the first node changing the first node's registration key, registering the changed registration key in the registration data structure, and reserving the changed registration key in the reservation data structure. For example, node401can change (e.g. increment) its registration key, register the changed registration key in registration table501, and reserve the changed registration key in reservation table502.

FIG. 8illustrates a flow chart of an example method800for a second node to attempt to remove a first node's persistent reservation on a storage device so as to obtain a persistent reservation for the second node. Method800will be described with respect to FIGS.4and5A-5F.

Method800includes an act801of the second node receiving a notification that a network partition has occurred that prevents the second node from communicating with the first node. For example, node404can receive notification that network partition405has occurred.

Method800includes an act802of the second node attempting to reserve the second node's registration key so as to obtain a persistent reservation on the storage device. Act802includes sub-acts802a-802c.

Sub-act802aincludes the second node reading the registration key of the first node that is stored in a reservation data structure and storing the first node's key. For example, node404can read node401's registration key in reservation table502.

Sub-act802bincludes the second node changing the second node's registration key and registering the changed registration key. For example, node404can change its registration key and register the changed registration key in registration table501.

Sub-act802cincludes the second node sleeping for a specified duration of time prior to issuing a preempt command to remove the first node's persistent reservation. For example, node404can sleep for at least twice the duration as the defender node sleeps (e.g. six seconds if the node401sleeps for three seconds) prior to awaking and issuing a preempt command to remove node401's reservation on storage device410.