Am Mittwoch, 4. Februar 2009 12:27:44 schrieb Igor Neves: > Hi, > > I have done some work woth conntrackd and heartbeat a couple of time ago. > > Attached it's one conntrackd OCF script I made but when I finish I > realized that it was not working and would never work. > As you say in your HOWTO, conntrackd work with 2 caches.
I do start conntracd outside of heartbeat from init. So setup of sync is already working before the cluster starts. Inside heartbeat I only dump the connection table from the cache into the kernel (firewall starts) or clear the cache (firewall stops) If you want to write a OCF resource for that task to be done inside heartbeat you need a stateful agent. You agent below is not stateful, i.e. it does not unterstand promote and demote. Re-thinking: Perhaps you also could state a conntrackd clone... > In my setup, I had two nodes, this two nodes starts conntrackd on the > startup of the machine, in passive state. Once heartbeat starts > conntrackd ocf script it promotes one of them to active, and start > acting as main firewall and the other node continues to work on passive > state, receiving the connection states and committing them to the > external cache. Yes. But your script does not support the promote call. > When I try to migrate the resource to the other node, the migration > happen without problem and the other node that was passive, becomes > active and acts as main firewall and all the connection state are ok and > committed to the kernel cache. > AFTER passive becomes active, I had to > promote the other node to passive, and that was what I don't know how to > do it with heartbeat. Because I had to run on all the other nodes the > stop script, but only after running the start on the new passive, and > heartbeat does the opposite, it does the stop, and only after that does > the start on the newly promoted node. > How do you do that in you configuration? Do you use that advanced mode > in conntrackd you spoke about, in your howto? No. I do not do the advanced config. This is only needed if you have split routing. > Sorry I don't understand too much about conntrackd, maybe my problem > it's stupid and can be solved in conntrackd side. > > Cheers, It is really simple. Setup conntrackd OUTSIDE of heartbeat and have the firewall script only manage the transfer of the cache. If you want to have heartbeat also control conntrackd you would have to: - Make conntrackd running on bith nodes, perhaps as a clone resource. Check the conntrackd init script if it behaves really compatible to the LBS - Write a stateful OCF resource agent: Left for the homework to the reader. Cheers, -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: [email protected] web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42 _______________________________________________ Linux-HA mailing list [email protected] http://lists.linux-ha.org/mailman/listinfo/linux-ha See also: http://linux-ha.org/ReportingProblems
