HealthOptions

The thresholds of a node's health, conservative by default: a probe that fails too soon takes nodes out of service, or restarts them, for what a retry would have absorbed.

• sampleInterval: how often NodeHealth samples what a probe must not wait for (each log's head, the subscriptions' lag and parked counts), and probes the stores the node has not called successfully since.

• storeDownAfter: how long a store must keep failing, with no success since, before it is DOWN; failing for less, DEGRADED. A failure is a call or a probe that failed, or a probe that timed out (after this long, at least a second); a probe still under way is not one. With zero, a store is DOWN at its first failure, never because a sample is pending. storeWindow: a store with a failure this recent is DEGRADED.

• handoverGrace: a lease group whose owned partitions differ from the node's share for longer is DEGRADED, and DOWN when the node owns none of a share that is not empty (a hand-over within it is normal).

• topicsRequired: whether a topic the node is still joining makes it not ready.

• executorSaturation: the share of wow.executor.max-in-flight at which the executor is DEGRADED.

• lagDegradedAt, parkedDegradedAt: the entries behind the log's head, and the parked entries (counted up to it), at which a subscription is DEGRADED.

• stallTimeout: the liveness fails when the node's dispatcher, or the dispatcher of its backends' blocking driver calls, has not ticked for this long, when a reconcile has not ended in this long, or when commands are in flight, the stores answer, and none has finished for this long. Three minutes by default: a store call that is slow under load answers within seconds (a store is DOWN after storeDownAfter already), and a reconcile waits only on store calls and on hand-offs bounded by the cluster's drainTimeout. It is longer than the cluster's reconcileTimeout (one minute), after which a stuck node leaves the members, so the others run its partitions before it restarts.