Network & Infrastructure / High Availability & Recovery Design
Quorum design: available nodes do not always mean an available service
Several cluster nodes remain powered on after a partition, but the service stops intentionally. Counting running nodes without examining membership and quorum can misclassify a safety decision as random downtime.
Environment and inputs: Routed and clustered services; define failure ownership, fencing and application recovery requirements before testing. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record configured membership, votes, partition boundaries, witness placement and resource ownership. Compare the surviving communication group with the cluster's documented decision rules.
Explain the result
Quorum determines which group may make authoritative decisions under the selected model. It protects consistency but does not guarantee that every physically surviving subset can continue service.
Plan the fix
Place votes and witnesses according to the intended failure domains and supported cluster design. Avoid changing quorum rules during an incident without understanding the resulting ownership and data risks.
Check the result and rollback
Exercise each planned partition in an isolated environment and verify one authoritative owner. Revert the design if both sides can activate conflicting resources or ordinary single failures unnecessarily stop service.