At this point, the following failures are possible:
The application’s link to the commit server, or the commit server itself, may go down.
In this case, the following call to commit_xact will fail, and the application must roll back the transactions using abort_xact.
The application’s link to a participating server may go down.
In this case, the following call to commit_xact will succeed, but the application’s commit transaction command to the participating server will not. However, the server will be aware that its connection with the application has died. It will communicate with the commit server, using probe, to determine whether to commit the transaction locally.
A participating server may go down.
In this case, the following call to commit_xact will succeed, but the application’s commit transaction to the participating server will not. When the participating server comes back up, it will use probe to determine whether to commit the transaction locally.
Both the application’s link to the commit server and the application’s link to the participating server may go down.
In this case, the following call to commit_xact will fail. The application must roll back the transactions with abort_xact, but will not be able to communicate with the participating server. The participating server will use probe to communicate with the commit server. It will learn that the transaction has not been committed in the commit service, and will roll back the transaction locally.
Both the application’s link to the participating server and the participating server’s link to the commit server may go down.
In this case, the following call to commit_xact will succeed, but the application will not be able to communicate this to the participating server. When its connection to the application dies, the participating server will attempt to communicate with the commit server using probe to determine whether or not to commit the transaction locally. Because its link to the commit server is down, however, it will not be able to.
Because it cannot resolve the transaction, the participating server marks the user task process as infected.
If the System Administrator kills the infected process while the commit server is still down, two-phase commit protocol is violated and the integrity of the transaction is not guaranteed.
If the System Administrator waits until commit server is back up to kill the infected process, probe executes automatically when the System Administrator attempts to kill the process. probe communicates with the commit server and determines whether the participating server should commit the transaction locally. The integrity of the transaction is guaranteed.
