There also are several differences in maintenance windows for highavailability
sites.
• A prerequisite is that the site must have redundancy if it is to have high
availability.
• It is not necessary to disable access. Services should remain available.
• It is not necessary to have a full shutdown/boot list, because a full
shutdown/reboot does not happen. However, there should be a dependency
list if there are any dependencies between machines.4
• Because ISPs and e-commerce sites do not have on-site customers, being
physically visible the morning after is irrelevant. However, being available
and responsive is still important. Find ways to increase your visibility
and ensure excellent responsiveness. Advertise what the change was,
how to report problems, and so on. Maintain a blog, or put banner advertisements
on your internal web sites advertising the newest features.
• A post-maintenance communication is usually not required, unless customers
must be informed about remaining problems. Customers don’t
want to be bombarded with email from their service providers.
• The most important difference is that the redundant architecture of the
site must be taken into account during the maintenance window planning.
The flight director needs to make sure that none of the scheduled
work can take the service down. The SAs need to make sure that they
know how long failover takes to happen. For example, how long does
the routing system take to reach convergence when one of the routers
goes down or comes back up? If redundancy is implemented within a
single machine, the SA needs to know how to work on one part of the
machine while keeping the system operating normally.
• Availability of the service as a whole must be closely monitored during
the maintenance window. There should be a plan for how to deal
with any failure that causes an outage as a result of temporary lack of
redundancy.