[Pacemaker] stonith and avoiding split brain in two nodes cluster

[Brian J. Murrell]

On 13-03-25 03:50 PM, Jacek Konieczny wrote:
> 
> The first node to notice that the other is unreachable will fence (kill)
> the other, making sure it is the only one operating on the shared data.

Right.  But with typical two-node clusters ignoring no-quorum, because
quorum is being ignored, as soon as there is a communications breakdown,
both nodes will notice the other is unreachable and both nodes will try
to fence the other, entering into a death-match.

It is entirely possible that both nodes end up killing each other and
now you have no nodes running any resources!

> Even though it is only half of the node, the cluster is considered
> quorate as the other node is known not to be running any cluster
> resources.
> 
> When the fenced node reboots its cluster stack starts, but with no
> quorum until it comminicates with the surviving node again. So no
> cluster services are started there until both nodes communicate
> properly and the proper quorum is recovered.

But this requires a two-node cluster to be able to determine quorum and
not be configured to ignore no-quorum which I think is the entire point
of the OP's question.

b.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 263 bytes
Desc: OpenPGP digital signature
URL: <https://lists.clusterlabs.org/pipermail/pacemaker/attachments/20130328/8dee5509/attachment-0004.sig>