OSE Gateway Cold Failover
TT does not recommend configuring the same exchange credentials on redundant OSE Gateways.
If you are configuring a redundant, secondary OSE Gateway to use in the event of a complete hardware failure or Order Server failure on your primary gateway, one alternative is to configure the secondary OSE Gateway with unique exchange credentials (i.e., NIC IP addresses, Member IDs, sessions IDs, etc.). If you configure the secondary OSE Gateway with the same exchange credentials and exchange-flavor (e.g., both primary and secondary are OSE-A), you need to be aware of the impact on OSE Gateway functionality when switching over to the secondary gateway.
The OSE Gateway can be set up in a cold standby configuration using the same exchange credentials. This means that you can set up two OSE Gateways with the same Exchange-Flavor name and IP Address, but only one of the gateways is connected to the network at a time. If the active OSE Gateway shuts down, you need to take it off the network and add the back up OSE Gateway to the network. Both of these OSE Gateways must have identical configurations and trader login IDs.
Cold Failover Configurations
OSE Gateways that make use of redundant configurations typically cannot be deployed in a hot failover cluster. If you decide to configure redundant gateways, you can choose from two configuration options. Both options require the customer to have at least two server machines. The two options are:
- Cold Standby
- Backup Flavor
These are not automatic failover solutions. You need to manually start the backup OSE Gateway after a failure on the primary gateway. If you setup the Backup Flavor configuration, traders need to log in to the backup OSE Gateway in order to continue trading.
Cold Standby Failover
In a cold standby configuration, two OSE Gateways of the same exchange-flavor are installed on two separate server-class machines. Only one of the two OSE Gateways is running at any time; the active OSE Gateway is the primary gateway, and the backup OSE Gateway is the secondary gateway.
If there is a loss of service on the primary OSE Gateway, you must manually start the secondary OSE Gateway. All X_TRADER® clients connected to the primary gateway automatically connect to the secondary gateway when it becomes active.
Configuring Cold Standby Failover
To Configure Cold Standby Redundancy
- Configure the TTChron service
or file (ttchron.ini)
on the secondary gateway in one of the following ways:
- Set the TTChron service to start manually.
- If you want TTChron to start automatically, then comment out all services in ttchron.ini other than the Guard Server and, optionally, the Price Server.
- If you do not want to edit the ttchron.ini file at start up, you can configure two TTChron files on the secondary gateway: One is the default ttchron.ini included in the install, and a second one you need to create that just contains the Guard Server and, optionally, the Price Server. If the primary gateway fails, you can swap out the default ttchron.ini for the Guardian Server-only ttchron.ini.
- Start and run the Guard Server on the secondary OSE Gateway at all times to ensure that the secondary gateway always has the most up to date risk limits and license information.
- Optionally, configure the Price Server on the secondary OSE Gateway to run on its normal schedule. The secondary Price Server will be in Standby mode (half yellow, half green in Guardian) until the primary OSE Gateway fails, at which point it will become Active and all X_TRADER® clients will automatically switch over to it. If you choose to configure Price Server failover, the Price Server must be configured with a different Market Data ID than the primary Price Server.
- Configure identical Hostinfo.cfg files on the primary and secondary OSE Gateways (i.e., order sessions and NIC IP Addresses).
- Set up user IDs to log in to both servers using Windows User Authentication, TT Login Server, or TT User Setup. Risk limits need to be set up for a single exchange-flavor only, but are used on both gateways.
OSE Gateway Behavior during Cold Standby Failover
In the event of a shutdown or loss of service on the primary OSE Gateway, the following occurs when connecting to the cold standby (secondary) gateway:
- Manually start the server machine with the secondary OSE Gateway.
- You must manually start the servers on the secondary gateway
in one of the following ways depending on how the gateway is configured:
- Start the TTChron service, which in turn starts the Order, Price, and Fill Servers.
- If you commented-out all services in ttchron.ini, uncomment the order, price and fill server sections in this file and restart the TTChron service.
- If you configured two ttchron.ini files on the secondary OSE Gateway, swap out the default OSE Gateway ttchron.ini for the Guardian Server-only ttchron.ini and restart the TTChron service.
- When the servers are active, all X_TRADER® clients that had been connected to the primary OSE Gateway automatically connect to the secondary OSE Gateway.
- All working orders will be downloaded as incomplete or unknown orders. All fills that have been received will be double-counted and considered incomplete or unknown.
- Traders’ risk limits are still in effect and remain unchanged on the secondary gateway.
Backup Flavor Failover
In a Backup Flavor configuration, two OSE Gateways of different exchange-flavors (e.g., OSE-A and OSE-B) are installed on two separate server machines. Both OSE Gateways are in the Active state. If there is a service failure on OSE-A, for example, traders can log in to OSE-B and continue trading.
Optionally, both OSE-A and OSE-B can be primary OSE Gateways for some or all traders. When both OSE Gateways are used simultaneously, you can load balance trading activity between the two gateways.
Configuring Backup Flavor Failover
To Configure Backup Flavor Redundancy
- Configure trader IDs in one of
the following ways:
- Configure trader IDs through TT User Setup so that traders are always logged in to both gateways at all times.
- A second option is to give traders login permissions to both OSE-A and OSE-B at all times.
- A third option is to give traders login permissions to OSE-A only. If OSE-A fails, you have to manually give the trader permission to log in to OSE-B. The trader can then manually log in to OSE-B and continue trading. With this option, you have full control over which gateways the trader can log in to, and can control load balancing between gateways.
- Ensure both gateways run using the default TTChron configuration.
- Ensure that you have configured different session IDs in Hostinfo.cfg on OSE-A and OSE-B. In other words, ensure that traders will use different sessions on both gateways.
OSE Gateway Behavior during Backup Flavor Failover
In the event of a loss of service or hardware failure on one of the exchange-flavor OSE Gateways (e.g., OSE-A), the following occurs depending on how you configured the redundant gateway.
- Traders connected to OSE-A need to do the
following based on how you configured their user IDs:
- If you set up traders to be logged in to both gateways at all times, these traders just have to open the necessary X_TRADER® windows for their products on OSE-B and continue trading.
- If you set up traders to have login permissions for both gateways, then these traders manually login to OSE-B through Guardian when OSE-A fails, then open the necessary X_TRADER® windows for their products on OSE-B and continue trading.
- If you have only given traders login permissions to OSE-A, you now have to manually give these traders permission to login to OSE-B. Then, these traders manually login to OSE-B and continue trading.
- Orders entered through OSE-A may still be working at the exchange after the exchange failure. If these orders are filled after the traders connect to OSE-B using X_TRADER®, traders will not receive the fills. Inform your traders to contact the exchange to check if they have any orders still working at the exchange.