[DRBD-user] is arbiter significant in classic primary->secondary proto C ?

[WK]

We are upgrading an old 8.x NFS DRBD cluster that has worked great all 
this time.

It is a classic primary->secondary (cross-over cable) with a manual 
floating IP

In the event of failure or maintenance we would investigate the issue. 
Then if needed we MANUALLY invoke a script that kills the primary, 
promoted the secondary, migrated the floating IP and started up the NFS 
on the newly promoted box. The fixed/box would become the secondary when 
returned to service.

We have no interest in Primary Primary, nor automating the failover process.

With 9.x we see there is the option of adding a diskless arbiter.

I understand the arbiter provides more safety against split brain, but 
with Proto C guaranteeing writes, we are wondering how much more safety 
the arbiter is providing.

For example, we like that the cross-over cable removes the switch as a 
point of failure.

OTOH, if the feeling is that the arbiter is definately an improvement in 
this situation we want to follow best practices and would slide in a 
third box (maybe small desktop) into the mix.

Sincerely,

-wk