Hold on, people make this out to be like if a disk fails it requires immediate intervention. However if the system already booted it stays up. Who reboots a production system without monitoring it? Also if you boot with a degraded disk are you not asking for massive trouble, because if another disk fails you might end up with data loss which is IMO much worse on a production system than not being able to boot until you add another disk.

The risks are the same whether you keep running with a failed disk vs. rebooting/booting with a failed disk. Also, given a system in which the OS is not running and requires booting, how exactly are you going to resync a replacement drive if you don't boot the system with a degraded raid volume?

> Who reboots a production system without monitoring it?

Anyone.

> Also if you boot with a degraded disk are you not asking for massive trouble

> not being able to boot until you add another disk

Great.

I'm just a [sys]admin who were given a task to do something on $server.

I jump around the red tape, claw out a 15 minute downtime because the task requires reboot, proceed with all that corporate dance with notification emails.

I do my thing, reboot the server and it doesn't return back online.

Suddenly I broke the server, missed maintenance window, amount of mails with CC and RE: in my mailbox grows in geometric progression and the most important - now I need to find out who were responsible for the server, contact him and [kick his ass] ask him to diagnose what is going on.

Bonus points if:

server doesn't have a meaningful BMC/iLO/iDRAC with KVM console

it does have it but it's broken for some reason eg requires Java 6 on Vista

server was configured 10 years ago by a greybeard who is not only retired but already died from the old age

server is 6000km away from any place with a replacement disks and the earliest time when you can send the replacement would be the next spring when the ice would break and taw enough for the ships to move. Of course you can hire a helo to deliver it, which get your ass chewed for an unplanned $50k expenses

Also: https://news.ycombinator.com/item?id=33963000

It sounds like you're hypothesizing a long chain of bad decisions, and then ridiculing btrfs for taking the choice that means your next bad decision only culminates in (predictable, preventable) downtime rather than data loss.

> It sounds like you're hypothesizing

This is all the things what I encountered in my admin days.

Including BL670 with incorrectly connected drives, so despite everything saying (and indicating) what the failed drive was in bay 2 it was actually in bay 1.

> then ridiculing btrfs

I ridicule btrfs for it's RAID mode not being a RAID mode by default.

RAID is about availability of data.

If you so hell bent on the data safety then btfrs should kernel panic as soon as one drive degrades. THAT would make sure someone would come and investigate what happened and no data loss.

Right?

> If you so hell bent on the data safety then btfrs should kernel panic as soon as one drive degrades. THAT would make sure someone would come and investigate what happened and no data loss.

> Right?

Panicking an already-running kernel would only serve to prevent userspace from handling the failure through mechanisms that are inherently beyond the scope and capabilities of the kernel alone (ie. stuff like alerting a sysadmin, activating a hot spare, or initiating a rebalance to restore redundancy among the remaining drives).

Perhaps the kernel should default to freezing a non-root filesystem when it becomes degraded, absent an explicit configuration permitting otherwise. But for the root filesystem, that would be counterproductive and prevent the failure from being handled gracefully.

Obviously, the tradeoffs are different for a system that is still trying to boot as opposed to one that is fully up and running.

As someone who too had all of these happen at one point or another over the years: These are all process issues, not technical issues. No matter your RAID config or FS features,you're gonna have a bad time.

Why? Are you in a position where you can’t modify grub or fstab?

Because RAID is a High Availability technology.

It's not a backup. It doesn't protect against mistakes, bugs, or the server failing in some other way. What it's good for is for ensuring that work keeps happening if a disk fails. And disk failures happen to be fairly frequent, since spinning rust is a rather delicate technology.

If somebody has to connect to the machine and fiddle with it by hand it means that the system has been down, possibly for hours, when that was the exact thing you were trying to prevent by setting up RAID on it.

You don't have to modify it after a failure. You can set it right now to explicitly say "when I end up in a degraded state, I want to boot anyway".

> What it's good for is for ensuring that work keeps happening if a disk fails.

Different services have different priorities. I want my work servers to keep running, but my home server under the desk to stop until I replace the failed drive. Btrfs gives you a choice.

No, because I want to be elsewhere on a Sunday evening than in front of a computer modifying fstab to bring a production server back online.

Unless you want to reboot the server this shouldn't affect you in any way.

Unless you get a power outage or some other event that causes a reboot (e.g. STONITH)

Unless you give it permission.

It's an option to enable. If you needing to configure something is a dealbreaker then having RAID is probably not for you anyway.

IMO, the inconvenience this causes is outweighed by the prevention of data loss for people who otherwise would never have noticed the degraded array.

Right but if it's remote server you're fucked and you can't login on it to even assess what happened

This is why I want servers to always boot to an OS whenever possible. It's fine if production data is not available until someone fixes an array, but without the OS, it's a pain to even figure out what's happened, let alone fix it.

Don't servers tend to include some kind of out-of-band management like HP iLO, Dell iDRAC, or OpenBMC?

That’s what the likes of dropbear-initramfs is for

I think this is the difference in target audience - for home use, maybe I won't have monitoring, so it should fail to boot.

For enterprise, if you dont have monitoring setup it's on you