Dell iDRAC 6 fencing question

[tomatogoatee]

Hello, everyone. I apologize if this is something really simple and I'm just not getting it, but I think this has something to do with my HA problems. I have a four-node cluster that works famously as long as I don't physically pull power on one of the nodes. If I do that, then the VMs running on it do not migrate. They just kinda... Die. So I'm thinking it might have something to do with my fencing, but I can't find a clear answer. I've attached my cluster.conf so you can see what I have for the fencing (since I can't seem to paste it here in the board without it removing all the line breaks). But a quick version is:

<fencedevice agent="fence_drac5" cmd_prompt="admin1->" ipaddr="10.10.25.131" login="pvefence" name="ipmi01" passwd="xxxxx" power_wait="5" secure="1"/>

Now, according to the wiki entry on Fencing, this should be the correct format for an iDRAC 5, 6, and 7. However, if I test it using:

fence_drac5 --ip="10.10.25.131" --username="pvefence" --password="xxxxx" --ssh --verbose --debug-file="/tmp/foo" --command-prompt="admin1->" --action="off"

the machine reboots rather than shuts down as one would expect from the "action=off" line. We set up a test cluster using Dell servers that have older DRAC cards (4, I think) that uses the fence_ipmi agent. Should I be using that instead of the fence_drac5? Or should I be using something different altogether? I've tried finding answers elsewhere, but the only solutions I've found involve either iDRAC 5 or 7 interfaces; nothing that explicitly says 6. (Except the wiki, which only mentions 6 at the bottom under 'testing'.)

 

[spirit]

Hi, for drac5, I think you need to remove cmd_prompt="admin1->" (just logon manually with ssh to the drac to see the ssh promp).

the syntax should work with drac6,7,8.


(I don't think you'll have drac4, poweredge 2950 already have drac5 and they are first one to support kvm / intel vtx extensions)


I'm not sure about action, but reboot is enough to get fencing working.

 

[dietmar]

I assume those fencing devices does not work at all if you pull power (or do they have separate power supply?).

 

[spirit]

I assume those fencing devices does not work at all if you pull power (or do they have separate power supply?).

They share same power supplies than the server.

(But you should have 2 power supplies with 2 different electric path )

 

[dietmar]

They share same power supplies than the server.

If so, they do not work if power is lost (that explains the observed behavior).

 

[tomatogoatee]

If so, they do not work if power is lost (that explains the observed behavior).

So if the fencing device in a HA cluster loses power, the whole HA aspect fails? How can that be HA? The chances of losing two PSUs connected to separate power sources is rather slim, I'll admit, but still possible. Also, how do you insert line breaks in this forum? No matter how many times I press enter or insert [br][/br] I can't get anything to line break.

 

[tom]

So if the fencing device in a HA cluster loses power, the whole HA aspect fails? How can that be HA?

If you need reliable HA, you need reliable and independent fencing device, e.g. power fencing. IMPI or iDRAC fencing only is not the optimal choice.

 

[spirit]

If you need reliable HA, you need reliable and independent fencing device, e.g. power fencing. IMPI or iDRAC fencing only is not the optimal choice.

Hi tom, I still don't get the point of advantage of external power fencing like APC psu.

If you have 1 powersource with 1 apc psu, and all your servers on it, I don't see how it's help, because all nodes will be down is case of power failure.

 

[dietmar]

If you have 1 powersource with 1 apc psu, and all your servers on it, I don't see how it's help, because all nodes will be down is case of power failure.

This is different (if you have no power, you cannot run computers). But with iDRac, a single node with damaged power supply can prevent failover.
But sure, you need redundant fence devices for good Availability.