Database Reference
In-Depth Information
NOTE
The term “gossip protocol” was originally coined in 1987 by Alan Demers, a researcher at Xerox's Palo
Alto Research Center, who was studying ways to route information through unreliable networks.
The gossip protocol in Cassandra is primarily implemented by the
org.apache.cas-
sandra.gms.Gossiper
class, which is responsible for managing gossip for the local node.
When a server node is started, it registers itself with the gossiper to receive endpoint state in-
formation.
Because Cassandra gossip is used for failure detection, the
Gossiper
class maintains a list of
nodes that are alive and dead.
Here is how the gossiper works:
1. Periodically (according to the settings in its
TimerTask
), the G=gossiper will choose a
random node in the ring and initialize a gossip session with it. Each round of gossip re-
quires three messages.
2. The gossip initiator sends its chosen friend a
GossipDigestSynMessage
.
3. When the friend receives this message, it returns a
GossipDigestAckMessage
.
4. When the initiator receives the
ack
message from the friend, it sends the friend a
Gos-
sipDigestAck2Message
to complete the round of gossip.
When the gossiper determines that another endpoint is dead, it “convicts” that endpoint by mark-
ing it as dead in its local list and logging that fact.
Cassandra has robust support for failure detection, as specified by a popular algorithm for distrib-
uted computing called Phi Accrual Failure Detection. This manner of failure detection originated
at the Advanced Institute of Science and Technology in Japan in 2004.
Accrual failure detection is based on two primary ideas. The first general idea is that failure de-
tection should be flexible, which is achieved by decoupling it from the application being mon-
itored. The second and more novel idea challenges the notion of traditional failure detectors,
which are implemented by simple “heartbeats” and decide whether a node is dead or not dead
based on whether a heartbeat is received or not. But accrual failure detection decides that this
approach is naive, and finds a place in between the extremes of dead and alive—a suspicionlevel.
Therefore, the failure monitoring system outputs a continuous level of “suspicion” regarding how
confident it is that a node has failed. This is desirable because it can take into account fluctuations
in the network environment. For example, just because one connection gets caught up doesn't
necessarily mean that the whole node is dead. So suspicion offers a more fluid and proactive in-
