| Program: rhcs_fence | |
| Author: Madison Kelly (digimer@alteeve.com) | |
| Alteeve's Niche! - https://alteeve.com/w/ | |
| Date: 2013-03-13 | |
| Version: 0.2.6 | |
| License: GPL v2.0+ | |
| -=] Description: | |
| This script is designed to be used as DRBD's 'fence-peer' handler. It ties | |
| DRBD's fence call, using 'disk { fencing resource-and-stonith }' into Red Hat | |
| Cluster Service's fenced daemon. This allows you to configure fencing once in | |
| your cluster and use it for both the cluster and DRBD. | |
| This program was based heavily on Lon Hohberger <lhh[a]redhat.com> | |
| "obliterate-peer.sh" script. This was created as a replacement fence handler | |
| designed to add some features and intelligence to his script, but became a new | |
| program in order to switch to perl. | |
| -=] Supported Environments | |
| This script supports two-node DRBD setups only, but the nodes themselves may be | |
| part of a larger cluster. This script should be used when | |
| 'fencing resource-and-stonith' is set only. The 'on <host> { }' name *must* | |
| match the '<clusternode name="..."> as well. | |
| -=] Limitations | |
| As this handler insists on seeing the local disk as 'UpToDate' before it will | |
| proceed with a fence. Thus, if you have a simultaneous and complete cluster | |
| crash followed by the recovery of only one node, the recovered node will be in | |
| a 'Consistent' state, which will abort the fence call. As such, this scenario | |
| will recover human intervention to recover from. | |
| -=] Notes: | |
| This program takes certain steps to avoid dual-fencing; | |
| - First, Timing: | |
| This program will use the cluster's 'Node ID' as a base value for a delay prior | |
| to fencing. If a node has 'Node ID: 1' (as seen with 'cman_tool status'), there | |
| will be no delay and the fence will occur immediately. All other nodes will | |
| sleep for ((node_id x 2) + 5) seconds, up to a maximum of 30 seconds. | |
| It is possible to override this behaviour by setting 'local_delay' in the head | |
| configuration section of the script. If this is a non-0 value, the script will | |
| pause for the defined number of seconds, ignoring the behaviour described | |
| above. | |
| - Second, 'UpToDate' check; | |
| When a fence call is made, this program checks the referenced resource minor | |
| number's disk state to ensure it is 'UpToDate' as resported by '/proc/drbd'. | |
| The fence call will abort if the disk state is 'Consistent' (or anything else). | |
| This helps prevent accidentally fencing the original survivng node when the | |
| cluster communication is up, but the storage network is not, avoiding a | |
| fence-loop. | |
| -=] Failure Modes: | |
| This program follows the "Fail Early, Fail Often" ethos. It will *only* fence | |
| the peer if several conditions are met. Please test the functionality of this | |
| script before going into production! | |
| Exit codes; | |
| 1 - Fence failed, see syslog | |
| 7 - Fence succeeded | |
| 255 - End of script hit, likely a program error | |
| If you run into any trouble, please enable 'debug' mode by setting the internal | |
| 'debug' value to '1'. If you need help, please send the output of the syslog | |
| of both nodes with debug enabled to the Linux Cluster mailing list or DRBD | |
| Users mailing list. | |
| -=] Getting Help: | |
| By email: digimer@alteeve.com / https://alteeve.com | |
| IRC: #linux-cluster and #drbd on freenode.net | |
| Mailing list: https://www.redhat.com/mailman/listinfo/linux-cluster | |
| http://lists.linbit.com/mailman/listinfo/drbd-user |