On 2013-06-12T11:57:05, Digimer <li...@alteeve.ca> wrote:
> I build exclusively two-node clusters, and the biggest draw-back is the
> possibility of a "fence loop". That is, without quorum and with a network
> error, a node can come up on it's own, fail to contact it's peer and fence
> it. When the fenced node boots, it comes up, fails to contact it's peer, and
> fences it. Wash, rinse, repeat.
>
> To prevent this, I recommend *not* letting your cluster stack start on boot.
FWIW, I've added code to sbd recently that makes this a bit more
fine-grained: don't start automatically if we were fenced by another
node previously.
Not quite perfect yet (we should auto-start if we can contact the other
node; pacemaker should boot into a standby/fenced mode only, unless it
can contact), but a step in the right direction.
(SBD doesn't need to be used with redundant fence methods, I'd actively
recommend not to do that.)
Regards,
Lars
--
Architect Storage/HA
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB
21284 (AG Nürnberg)
"Experience is the name everyone gives to their mistakes." -- Oscar Wilde
_______________________________________________
Pacemaker mailing list: Pacemaker@oss.clusterlabs.org
http://oss.clusterlabs.org/mailman/listinfo/pacemaker
Project Home: http://www.clusterlabs.org
Getting started: http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf
Bugs: http://bugs.clusterlabs.org
