[Pacemaker] DRBD and fencing

[Matthew Palmer]

On Thu, Mar 11, 2010 at 08:30:29AM +0800, Martin Aspeli wrote:
> Martin Aspeli wrote:
>> Hi folks,
>>
>> Let's say have a two-node cluster with DRBD and OCFS2, with a database
>> server that's supposed to be active on one node at a time, using the
>> OCFS2 partition for its data store.
>>
>> If we detect a failure on the active node and fail the database over to
>> the other node, we need to fence off the shared storage in case the
>> active node is still writing to it.
>>
>> Can this be done in such a way that the local DRBD/OCFS2 refuses to
>> accept writes from the now-presumed-dead node? I guess this would be
>> similar to putting an access rule on a SAN to block off the previously
>> active node from attempting to read or write any data.
>>
>> Is this feasible?
>
> We went off on a side-track, I think, but I'd still like to know the  
> answer: Can one "fence" at the DRBD level?
>
> From the thread, it sounds like we'll not use OCFS2 for the Postgres  
> data store, but would still use DRBD, e.g. with ext4 or whatever. The  
> fencing problem would then be equally, if not more, acute.
>
> It's basically between doing something at the DRBD level, if that's  
> feasible, or using the DRAC IPMI device on our server to shoot it.

Enable STONITH in Pacemaker and configure appropriate STONITH devices.  I
don't have a config in front of me to give you exact magic beans, but it's
pretty well documented.

- Matt