[Linux-HA] observations after some fencing tests in a two node

[Andrew Beekhof]

On Nov 9, 2007, at 7:05 PM, Ivan wrote:

> Andrew Beekhof wrote:
>> Which is why 2 node clusters are not a very good idea :-)
>> In a 3-node cluster the disconnected node wont have quorum and isn't
>> allowed to try and kill anyone.
>
> Excuse me for the interruption...
>
> I think the majority of the users have 2 node clusters at least that's
> what everybody starts with according to the messages. As I  
> understand in
> a 2 node cluster the only way to prevent the issue mentioned is to  
> avoid
> losing the connection between the nodes right.

or use quorumd, but i dont personally know how that works

> So if there's a possibility of losing 2 switches shouldn't we set up
> serial communication as well?

yes, that (or a second NIC) is very highly recommended.
a second NIC is generally more scalable (more nodes and bigger  
configurations) but is still IP-based and isn't going to help you if  
someone misconfigures a firewall...

> What is the best way of protecting a 2 node cluster apart form not
> having one? I tested mine very well but it would be very bad if both
> decided to be DC (due to losing all switches for instance) and started
> all domUs on them...

if you enable stonith this can't happen.
but the cluster can get into the described stonith fight and cause far  
more outage than necessary.