Disaster Recovery Documentation
Redundant TT Gateways: Price Server Hot Failover
You can configure your trading system to provide hot failover functionality for your Price Server components. In a hot failover setup, you run two or more Price Servers on different TT Gateway machines that share the same exchange-flavor. In a group of TT Gateways that share the same exchange-flavor, only one TT Gateway runs an entire set of TT Gateway server components (referred to as a ‘full’ TT Gateway); additional TT Gateways in the failover group run only the Price Server and Guard Server components (referred to as ‘Price Server-only TT Gateways’).
This section describes setting up only the Price Server component for failover. Different TT Gateways offer different, more enhanced failover features. To see if your TT Gateway supports such enhanced failover options and for setup instructions, refer to that TT Gateway’s SAM.
When Price Servers with identical exchange-flavors start up, they negotiate with one another to determine which one multicasts the price feed to traders (designated the ‘primary’ Price Server) and which one refrains from multicasting this data (referred to as the ‘standby’ Price Server).
When clients log into the failover group, all traders use the active Price Server. The client application tracks all products to which the trader subscribes.
While the primary Price Server is interacting with client applications and actively broadcasting prices, the standby Price Server:
- Maintains a live connection to the exchange.
- Receives and monitors the same subscriptions and price requests as the active Price Server.
- Remains idle. The standby Price Server does not broadcast prices.
- Appears half-green and half-yellow in Guardian.
- Does not calculate VAP (TTQAP)
When the active Price Server fails, it takes 30 seconds for the standby Price Server to detect the failure (via missed heartbeats) and begin broadcasting prices. Price Server failover does not affect a trader’s orders, but prices go stale until the standby Price Server begins broadcasting prices. When the client application detects the failover (i.e., that the standby Price Server is now primary), the client application sends its current product subscriptions to the newly active Price Server.
If you run more than two Price Servers in a failover group, Price Server failover can take up to a minute.
To setup the Price Server for hot failover:
- According to standard TT instructions,
install the TT Gateway onto as many machines as you want to include
in the failover group. However during installation, assign the same
exchange-flavor to each TT Gateway.
Remember if you do not use a domain controller, you must enter Trader IDs into the Windows User Authentication System (WUAS) on each TT Gateway in the failover group.
- Designate one TT Gateway as a primary TT Gateway and configure it to run as you would if it were a stand alone TT Gateway (i.e., run all server components as you normally do).
- On the secondary (Price Server-only) TT Gateways, disable all server components except for Price Server and Guard Server in ttchron.ini.
- Run your TT Gateways and test the Price Server failover.
- Instruct all users to set the primary TT Gateway as the preferred server in their client application Login screens.
Testing Price Server Failover
To test Price Server failover:
- Start all TT Gateways in the failover group.
- Stop TTChron on the TT Gateways that run the Price Servers.
- Using X_TRADER®, log into the full TT Gateway.
The full TT Gateways hosts all TT Gateway components (Order Server, Fill Server, Price Server, etc.).
- Verify that you receive prices.
- On the TT Gateway that hosts the active Price
Server, stop the Price Server.
The active Price Server appears fully green in Guardian.
- Verify that after approximately 30 seconds, X_TRADER® begins receiving prices from the other Price Server.
- Start TTChron on the TT Gateways that run the Price Servers.