18.04.2017 10:47, Ulrich Windl пишет: ... >> >> Now let me come back to quorum vs. stonith; >> >> Said simply; Quorum is a tool for when everything is working. Fencing is >> a tool for when things go wrong. > > I'd say: Quorum is the tool to decide who'll be alive and who's going to die, > and STONITH is the tool to make nodes die.
If I had PROD, QA and DEV in a cluster and PROD were separated from QA+DEV I'd be very sad if PROD were shut down. The notion of simple node majority as kill policy is not appropriate as well as simple node based delays. I wish pacemaker supported scoring system for resources so that we could base stonith delays on them (the most important sub-cluster starts fencing first). > If everything is working you need > neither quorum nor STONITH. > I wonder how SBD fits into this discussion. It is marketed as stonith agent, but it is based on committing suicide so relies on well-behaving nodes. Which we by definition cannot trust to behave well, otherwise we'd not need stonith in the first place. _______________________________________________ Users mailing list: Users@clusterlabs.org http://lists.clusterlabs.org/mailman/listinfo/users Project Home: http://www.clusterlabs.org Getting started: http://www.clusterlabs.org/doc/Cluster_from_Scratch.pdf Bugs: http://bugs.clusterlabs.org