A failover scope comprises a node collection in a computer cluster. A
resource group (e.g., application program) is associated with one or more
failover scopes. If a node fails, its hosted resource groups only
failover to nodes identified in each resource group's associated failover
scope(s), beginning with a first associated failover scope, in order,
thereby defining an island of nodes within which a resource group can
failover. If unable to failover to a node of a resource group's first
failover scope, failover is attempted to a node represented in any next
associated failover scope, which may require manual intervention.
Failover scopes may represent geographic sites, whereby each resource
group attempts to failover to nodes within its site before failing over
to another site. Failover scopes may be managed by the cluster runtime
automatically, e.g., an added node is detectable as belonging to a site
represented by a failover scope.