Is it reboot a good fencing action ?

[Hernan]

Hi eveybody,

( i think ) i got a working HA configuration : 2 node + quorum disk + DRBD. I did it by reading the proxmox ve wiki related documents.

I would like to know why i should choose the reboot action and not the 'off'.

If you disconect the ethernet cables of the first node (that supouse is runnig one VM); but not the one corresponding to fencing nor the one corresponing to DRBD.
If fencing works, as i think, it will reboot the first node but never will be able to recover it because has no conection; so the 'reboot' action had been "successfull" but not the recovery ...
So the cluster will get stopped for ever ? (UNtil manual intervention) Or it will think it can not recover the node and will kik out of the cluster ?

This is my last 'working' config, but not sure if let it as is:

<?xml version="1.0"?>
<cluster config_version="12" name="PVECLUSTER">
<cman expected_votes="3" keyfile="/var/lib/pve-cluster/corosync.authkey"/>
<quorumd allow_kill="0" interval="1" label="pve_quorumdisk" tko="10" votes="1"/>
<totem token="54000"/>
<clusternodes>
<clusternode name="node01" nodeid="1" votes="1">
<fence>
<method name="ilo">
<device action="reboot" name="ILO01"/>
</method>
</fence>
</clusternode>
<clusternode name="node02" nodeid="2" votes="1">
<fence>
<method name="ilo">
<device action="reboot" name="ILO01"/>
</method>
</fence>
</clusternode>
</clusternodes>
<fencedevices>
<fencedevice agent="fence_ipmilan" ipaddr="x.y.z.171" lanplus="1" login="Admin" name="ILO01" passwd="ABCDEGFS" power_wait="5"/>
<fencedevice agent="fence_ipmilan" ipaddr="x.y.z.181" lanplus="1" login="Admin" name="ILO02" passwd="WERTVFGF" power_wait="5"/>
</fencedevices>
<rm>
<pvevm autostart="1" vmid="100"/>
</rm>
</cluster>



Thanks in advance

 

[spirit]

Hi, Fencing is used for host crash/hang.

You need to have redundant/stable network (dual switchs, dual nics cards, using bonding) before trying to do an HA cluster.

 

[Hernan]

Hi spirit,

thak you for your kind answer.

i have dual switch, dual nics (using bonding) for the bridged interafaces and for the DRBD. But the question was if in the scenario proposed the reboot action would be right option.
By the way; as the reboot would be performed , will the fencing action be considered as 'ok' or as failed (as the rebooted node still will be inacesible for quorum)

thank you

 

[spirit]

Yes, it will be ok.
The purpose of fencing, is to be sure that the server has be shutdown or rebooted, and that no vm are running anymore. (to avoid to have the vm running twice on different hosts, thing that can break your storage).
If the node reboot with fencing, and no network is available, the vm will not be restarted on this node.

 

[Hernan]

Hi spirit,

and the part of the cluster that gets quorum will start de VMs that where originally running in the 'problematic node', right?

Thank you.