Split rings

Split rings can occur when more than one operator tries to restart the ring at the same time, causing the ring to split into multiple independent rings, each able to grant access to global resources at the same time. Split rings create a severe data integrity exposure. Actions you can take to avoid split rings include:

Ensure that an operator issues VARY GRS(ALL),RESTART only from an inactive system.
Ensure that only one operator issues VARY GRS(ALL), RESTART
Provide alternate links.
Specify RESTART(YES) whenever possible, which allows automatic restart and reduces operator intervention in recovery from a ring disruption.

An operator trying to restart the ring should always issue VARY GRS(ALL),RESTART to restart all of the systems rather than VARY GRS(sysname),RESTART or VARY GRS(*),RESTART to restart a specific system. When the operator issues VARY GRS(ALL),RESTART, global resource serialization issues the following messages:

ISG026I SYSTEM SYS2 MAY CREATE A SPLIT RING IF ANY OTHER GRS SYSTEM
          IS ACTIVE. VERIFY THAT NO GRS SYSTEM IS ACTIVE BEFORE
          CONFIRMING RESTART
  ISG027D CONFIRM RESTART RING FOR SYSTEM SYS2 - REPLY NO OR YES

Before replying to message ISG027D, the operator must issue D GRS and/or check with the other operators to verify that there are no active systems. If all other systems are inactive, the operator can safely reply YES to continue the restart. If any system is active, the operator must reply NO to avoid split rings.

For example, consider the two-system complex shown in Figure 1. SYS1 is active, SYS2 is quiesced, and the communication link has failed. If the operator issues a restart command on SYS2, message ISG026I appears to warn the operator that split rings might occur, followed by a prompting message. If the operator replies YES to the prompt, SYS2 will create a ring of one system. Because SYS1 is also active and there is no communication, there are two one-system rings. Both rings can grant access to the same global resources, and neither system can rejoin the ring created by the other without an IPL. Note that global resource serialization does not force the reIPL; it is, however, required to resolve the data integrity exposure.

Figure 1. Two-System Ring with Link Failure

There are several ways to avoid split rings in this situation:

If the configuration includes an alternate link, and the alternate link has not failed, the problem does not occur; global resource serialization could use the alternate link and resume processing almost immediately.
If the operator issues the restart command on the active system, split rings do not occur. Instead, the following message appears:
```
ISG014I VARY GRS RESTART REQUEST FOR SYSTEM SYS1 REJECTED -
          SYSTEM NOT RESPONDING
```
If the operator replies NO to the prompt following message ISG027D, split rings do not occur.

In the last two cases, message ISG026I or message ISG014I alert the operator to the actual problem; SYS1 and SYS2 cannot communicate. The operator could then respond correctly — fix the link problem, then reissue the VARY GRS(SYS2),RESTART command for the quiesced system.