Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
How to distinguish between a crash and a graceful reboot in RHEL 7 or RHEL 8
Source : https://access.redhat.com/articles/2642741
How can you distinguish between a system crash and a graceful reboot or shutdown in RHEL 7 or RHEL 8? This article outlines 4 approaches :
Inspect wtmp with last -x
Inspect auditd logs with ausearch
Requires configuration: Create a custom service unit
Requires configuration: Inspect previous boots in persistent systemd journal with journalctl
(1) Inspect wtmp with last -x
With a simple last -Fxn2 shutdown reboot command, the system wtmp file reports the two most recent shutdowns or reboots. reboot denotes the system booting up; whereas, shutdown denotes the system going down.
A graceful shutdown would show up as a reboot line followed by shutdown line, as in the following example:
# last -Fxn2 shutdown reboot reboot system boot 4.18.0-80.el8.x8 Mon Aug 31 06:33:11 2020 still running shutdown system down 4.18.0-80.el8.x8 Mon Aug 31 06:33:01 2020 - Mon Aug 31 06:33:11 2020 (00:00)
Note: events from last are printed in descending chronological order, with most recent at the top.
An ungraceful shutdown can be inferred by the omission of shutdown; instead there will either be a single reboot line (if the wtmp file had been truncated/rotated prior to the crash) or 2 reboot lines in a row, as in this example:
# last -Fxn2 shutdown reboot reboot system boot 4.18.0-147.5.1.e Tue Sep 1 07:16:25 2020 still running reboot system boot 4.18.0-147.5.1.e Mon Aug 3 07:10:56 2020 still running
(2) Inspect auditd logs with ausearch
auditd is great and all the different events that it logs can be seen by checking ausearch -m. Apropos to the problem at hand, it logs system shutdown and system boot as above. The command ausearch -i -m system_boot,system_shutdown | tail -4 will report the 2 most recent shutdowns or boots. If this reports a SYSTEM_SHUTDOWN followed by a SYSTEM_BOOT, all is well; however, if it reports 2 SYSTEM_BOOT lines in a row or only a single SYSTEM_BOOT line, then the system did not shutdown gracefully.
Graceful shutdown:
# ausearch -i -m system_boot,system_shutdown | tail -4 ---- type=SYSTEM_SHUTDOWN msg=audit(08/31/2020 06:33:01.571:595) : pid=27156 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg=' comm=systemd-update-utmp exe=/usr/lib/systemd/systemd-update-utmp hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_BOOT msg=audit(08/31/2020 06:33:12.838:9) : pid=828 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg=' comm=systemd-update-utmp exe=/usr/lib/systemd/systemd-update-utmp hostname=? addr=? terminal=? res=success'
Note: as the timestamps should make clear, events from ausearch are printed in ascending chronological order, with oldest at the top.
Ungraceful shutdown:
# ausearch -i -m system_boot,system_shutdown | tail -4 ---- type=SYSTEM_BOOT msg=audit(09/20/2016 01:10:32.392:7) : pid=657 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg=' comm=systemd-update-utmp exe=/usr/lib/systemd/systemd-update-utmp hostname=? addr=? terminal=? res=success' ---- type=SYSTEM_BOOT msg=audit(09/20/2016 01:11:41.134:7) : pid=656 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg=' comm=systemd-update-utmp exe=/usr/lib/systemd/systemd-update-utmp hostname=? addr=? terminal=? res=success'
Another ungraceful shutdown:
Presence of only one SYSTEM_BOOT record could be explained by the system being up for so long prior to the crash that audit logs of the previous reboot had been rotated out … so that the only result is from when the system was just booted.
# ausearch -i -m system_boot,system_shutdown | tail -4 ---- type=SYSTEM_BOOT msg=audit(09/01/2020 07:16:27.069:10) : pid=1057 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg=' comm=systemd-update-utmp exe=/usr/lib/systemd/systemd-update-utmp hostname=? addr=? terminal=? res=success'
(3) Create a custom service unit
Note: If you're trying to diagnose a potential crash right now, this will not help. You need to set it up first.
This approach is great because it allows for complete control. Here's an example of how to do it.
- Create a service that runs only at shutdown \ (Optionally customize the service name and the graceful_shutdown file)
/etc/systemd/system/set_gracefulshutdown.service
[Unit] Description=Set flag for graceful shutdown DefaultDependencies=no RefuseManualStart=true Before=shutdown.target [Service] Type=oneshot ExecStart=/bin/touch /root/graceful_shutdown [Install] WantedBy=shutdown.target
systemctl daemon-reload
systemctl enable set_gracefulshutdown
- Create a service that runs only at startup and only IF the graceful_shutdown file created by the above service exists \ (Optionally customize the service name and ensure the graceful_shutdown file matches the above service)
/etc/systemd/system/check_graceful.service
[Unit] Description=Check if previous system shutdown was graceful ConditionPathExists=/root/graceful_shutdown RefuseManualStart=true RefuseManualStop=true [Service] Type=oneshot RemainAfterExit=true ExecStart=/bin/rm /root/graceful_shutdown [Install] WantedBy=multi-user.target
systemctl daemon-reload
systemctl enable check_graceful
- Any time after a graceful reboot,
systemctl is-active check_gracefulwould be able to confirm the previous reboot was graceful.
Example output:
# systemctl is-active check_graceful && echo GOOD || echo BAD active GOOD # systemctl status check_graceful ● check_graceful.service - Check if system booted after a graceful shutdown Loaded: loaded (/etc/systemd/system/check_graceful.service; enabled; vendor preset: disabled) Active: active (exited) since Tue 2016-09-20 01:10:32 EDT; 20s ago Process: 669 ExecStart=/bin/rm /root/graceful_shutdown (code=exited, status=0/SUCCESS) Main PID: 669 (code=exited, status=0/SUCCESS) CGroup: /system.slice/check_graceful.service Sep 20 01:10:32 a72.example.com systemd[1]: Starting Check if system booted after a graceful shutdown... Sep 20 01:10:32 a72.example.com systemd[1]: Started Check if system booted after a graceful shutdown.
- After a crash or otherwise ungraceful shutdown, the following would be seen:
# systemctl is-active check_graceful && echo GOOD || echo BAD
inactive
BAD
# systemctl status check_graceful
● check_graceful.service - Check if system booted after a graceful shutdown
Loaded: loaded (/etc/systemd/system/check_graceful.service; enabled; vendor preset: disabled)
Active: inactive (dead)
Condition: start condition failed at Tue 2016-09-20 01:11:41 EDT; 16s ago
ConditionPathExists=/root/graceful_shutdown was not met
Sep 20 01:11:41 a72.example.com systemd[1]: Started Check if system booted after a graceful shutdown.
(4) Inspect previous boots in persistent systemd journal with journalctl
Note: If you're trying to diagnose a potential crash right now, this will not help unless you have previously configured systemd to persist the journal to disk.
- Configure systemd-journald to keep a persistent journal on-disk \ Either update
/etc/systemd/journald.confor create the dir yourself as follows
# Create standard log dir and fix ownership/perms ~]# mkdir /var/log/journal; systemd-tmpfiles --create --prefix /var/log/journal 2>/dev/null # Next: tell systemd to flush the current journal to disk ~]# systemctl -s SIGUSR1 kill systemd-journald # OPTIONAL: reboot not required other than to give the following commands more than one boot to inspect ~]# reboot
- Optionally use journalctl --list-boots to get a list of boots in ascending chronological order 0 refers to current runtime logs since the system was booted; -1 covers logs from the previous boot; -2 the boot before that, etc
Example:
~]# journalctl --list-boots -2 e1dbd8f133f643d1a816605d96f3ca07 Fri 2020-03-27 22:31:25 UTC—Thu 2020-05-14 01:02:51 UTC -1 1969253689e842deaea06ca32f4650c7 Thu 2020-05-14 01:10:00 UTC—Thu 2020-06-04 08:29:42 UTC 0 26a4a2ff48594778850d917a7e2ad195 Tue 2020-09-01 07:16:20 UTC—Tue 2020-09-01 19:11:20 UTC
- Use
journalctl -b -1 -nto look at the last 10 lines of the previous boot The following example output shows that the previous system reboot was graceful
~]# journalctl -b -1 -n -- Logs begin at Tue 2016-09-20 01:01:15 EDT, end at Tue 2016-09-20 01:21:33 EDT. -- Sep 20 01:21:19 a72.example.com systemd[1]: Stopped Create Static Device Nodes in /dev. Sep 20 01:21:19 a72.example.com systemd[1]: Stopping Create Static Device Nodes in /dev... Sep 20 01:21:19 a72.example.com systemd[1]: Reached target Shutdown. Sep 20 01:21:19 a72.example.com systemd[1]: Starting Shutdown. Sep 20 01:21:19 a72.example.com systemd[1]: Reached target Final Step. Sep 20 01:21:19 a72.example.com systemd[1]: Starting Final Step. Sep 20 01:21:19 a72.example.com systemd[1]: Starting Reboot... Sep 20 01:21:19 a72.example.com systemd[1]: Shutting down. Sep 20 01:21:19 a72.example.com systemd-shutdown[1]: Sending SIGTERM to remaining processes... Sep 20 01:21:19 a72.example.com systemd-journal[483]: Journal stopped
Note from the author: In my experiences troubleshooting RHEL 7 problems for customers in Red Hat support (in the years leading up to 2016 when I wrote this article), this was somewhat less reliable than the other methods. When bad things happen, it was definitely possible for the indexing in journald to get so bad that the journalctl -b -1 command only gives an error. I'm unsure if this has been improved in later versions of RHEL 7 and RHEL 8.
How to disable system beep for non-privileged user
Source https://unix.stackexchange.com/questions/2381/how-to-disable-system-beep-for-non-privileged-user
echo "set bell-style none" >> ~/.inputrc
ou
export LESS="$LESS"' -q'
Haute dispo cluster failover redhat
Voir aussi :
- OpenSVC
- Paquet resource-agents
Ressources :
- myvip
- fence_node-1
- fence_node-2
- ping
- srvweb
- ClusterMon-External
Liens intros :
Installation
Voir :
Prérequis
Prérequis
- Date syncho
- SELinux désactivé
- service NetworkManager arrêté
- Règles pare-feu
- Conf
/etc/hosts
Date synchro (ntp)
Les nœuds doivent avoir la date et l'heure synchronisée (voir NTP)
Vérif
date
Exemple avec Clush cluster_shell_parallele
echo date |clush -B -w node-[1-2]
SELinux désactivé
setenforce 0 sed -i.bak "s/SELINUX=enforcing/SELINUX=permissive/g" /etc/selinux/config
Vérif
sestatus
Service NetworkManager arrêté et désactivé
systemctl stop NetworkManager systemctl disable NetworkManager
Pare-feu
Si pare-feu activé
firewall-cmd --permanent --add-service=high-availability firewall-cmd --add-service=high-availability
Ou
Désactivation du parefeux
systemctl stop firewalld
systemctl disable firewalld
#rpm -e firewalld
Vérif
iptables -L -n -v
Résolution noms
Chaque nœud doit pouvoir pinguer les autres via son nom. Il est conseiller d'utiliser /etc/hosts plutôt que DNS.
/etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 127.0.1.1 node-1.localdomain 192.168.97.221 node-1.localdomain node-1 192.168.97.222 node-2.localdomain node-2
Install
Install paquets
yum install -y pacemaker pcs psmisc policycoreutils-python
echo "P@ssw0rd" | passwd hacluster --stdin systemctl start pcsd.service systemctl enable pcsd.service #unset http_proxy #export NO_PROXY=localhost,127.0.0.1,node-1,node-2 pcs cluster auth node-1 node-2 #-u hacluster -p passwd #pcs cluster setup --start --name my_cluster node-1 node-2 pcs cluster setup --name my_cluster node-1 node-2 pcs cluster start --all pcs cluster enable --all
Le fichier corosync.conf est automatiquement crée
/etc/corosync/corosync.conf
totem { version: 2 secauth: off cluster_name: my_cluster transport: udpu } node-list { node- { ring0_addr: node-1 node-id: 1 } node- { ring0_addr: node-2 node-id: 2 } } quorum { provider: corosync_votequorum two_node-: 1 } logging { to_logfile: yes logfile: /var/log/cluster/corosync.log to_syslog: yes }
Vérifier la conf de corosync 1
corosync-cfgtool -s
Doit retourner no faults \ Ne doit pas comporter d’adresse 127.0.0.1
Vérifier la conf de corosync 2
corosync-cmapctl |grep members pcs status corosync
Configuration
Prevent Resources from Moving after Recovery
pcs resource defaults resource-stickiness=100
Pas de quorum
#pcs property set no-quorum-policy=ignore pcs property set no-quorum-policy=freeze
Configuration du fencing / stonith
Test en vue du fencing via iDRAC
Voir https://www.devops.zone/tricks/connecting-ssh-drac-reboot-server/
Tester du fencing
/usr/sbin/fence_drac5 --ip=192.168.96.221 --username=root --password=calvin --ssh -c 'admin1->'
Test avec OpenManage /opt/dell/srvadmin/sbin/racadm
racadm -r 192.168.96.221 -u root -p calvin get iDRAC.Info
Test via SSH sur iDRAC Pour redemarrer le serveur en se connectant en SSH sur la iDRAC
ssh root@192.168.96.221 racadm serveraction powercycle
Si pas de stonith / fence sinon la VIP refusera de démarrer
# Si pas de stonith / fence pcs property set stonith-enabled=false
Vérif
crm_verify -LVVV
Configuration
# pcs stonith create fence_node-1 fence_drac5 ipaddr=192.168.96.221 login=root passwd=calvin secure=1 cmd_prompt="/admin1->" pcmk_host_list=node-1 stonith-action=poweroff pcs stonith create fence_node-1 fence_drac5 ipaddr=192.168.96.221 login=root passwd=calvin secure=1 cmd_prompt="/admin1->" pcmk_host_list=node-1 op monitor interval="60s" pcs stonith create fence_node-2 fence_drac5 ipaddr=192.168.96.222 login=root passwd=calvin secure=1 cmd_prompt="/admin1->" pcmk_host_list=node-2 op monitor interval="60s" pcs stonith level add 1 node-1 fence_node-1 pcs stonith level add 1 node-2 fence_node-2
Interdire le suicide (le fencing de soi-même)
pcs constraint location fence_node-1 avoids node-1 pcs constraint location fence_node-2 avoids node-2
Tester le fencing
#stonith_admin --reboot node-1 pcs stonith fence node-1
Ajout ressources
Ajout ressource VIP (adresse IP virtuelle)
pcs resource create myvip IPaddr2 ip=192.168.97.230 cidr_netmask=24 nic=bond0 op monitor interval=30s on-fail=fence #pcs constraint location myvip prefers node-1=INFINITY pcs constraint location myvip prefers node-1=100 pcs constraint location myvip prefers node-2=50 #pcs resource meta myvip resource-stickiness=100
Ajouter ressource ping
pcs resource create ping ocf:pacemaker:ping dampen=5s multiplier=1000 host_list=192.168.97.250 --clone pcs constraint location myvip rule score=-INFINITY pingd lt 1 or not_defined pingd
Ajout ressource Apache
Avant il faut configurer http://localhost/server-status et arrêter le service d'apache sur l'ensemble des nœuds
curl http://localhost/server-status systemctl stop httpd.service systemctl disable httpd.service
pcs resource create srvweb apache configfile="/etc/httpd/conf/httpd.conf" statusurl="http://127.0.0.1/server-status" op monitor interval=1min #--clone # Le serveur Web toujours sur la VIP pcs constraint colocation add srvweb with myvip # D'abord la VIP puis le serveur Web pcs constraint order myvip then srvweb
Manip
Déplacer la VIP
pcs resource move myvip node-1 pcs resource move myvip node-2
Retour arrière - Déplacer la VIP
#pcs constraint --full |grep prefer
pcs constraint remove cli-prefer-myvip
pcs resource relocate run
Remise à zero compteur erreurs
#pcs resource failcount reset res1 #crm_resource -P pcs resource cleanup
Déplacer toutes les ressources sur le nœud primaire (ignoring resource stickiness)
#pcs resource relocate show
pcs resource relocate run
Maintenance sur une ressource
#pcs resource update fence_node-1 meta target-role=stopped #pcs resource update fence_node-1 meta is-managed=false #pcs resource update fence_node-1 op monitor enabled=false #pcs resource disable fence_node-1 pcs resource unmanage fence_node-1
Maintenance générale du cluster
pcs property set maintenance-mode=true
Fin de maintenance
pcs property set maintenance-mode=false
Arrêt du cluster
pcs cluster stop --all pcs cluster disable --all
Diagnostic / Supervision
Diag Passif
# Check syntax conf corosync -t # Check cluster communication corosync-cfgtool -s # check the node's network corosync-cmapctl |grep members
Vérif
pcs cluster pcsd-status pcs cluster verify pcs status corosync crm_mon -1 --fail crm_mon -1Af journalctl --since yesterday -p err journalctl -u pacemaker.service --since "2017-02-24 16:00" -p warning
Script supervision (ces commandes doivent retourner aucune ligne)
LANG=C pcs status |egrep "Stopped|standby|OFFLINE|UNCLEAN|Failed|error" crm_verify -LVVV LANG=C pcs resource relocate show |sed -ne '/Transition Summary:/,$p' |grep -v '^Transition Summary:' crm_mon -1f | grep -q fail-count
Voir plus haut si (script /usr/local/bin/crm_logger.sh)
tailf /var/log/messages |grep "ClusterMon-External:"
Script supervision Quel nœud est actif
LANG=C crm_resource --resource myvip --locate |cut -d':' -f2 |tr -d ' '
Le serveur web répond t-il bien en utilisant l'IP de la VIP. (Le code de retour doit-être 0)
#curl -4 -m 1 --connect-timeout 1 http://192.168.97.230/ > /dev/null 2>&1 curl -4 -m 1 --connect-timeout 1 http://192.168.97.230/cl.html > /dev/null 2>&1 #echo $?
ACL
Compte en lecture seule avec les droits de consulter crm_mon \
Attention : ce compte trouver le mdp iDRAC/Ilo
pcs stonith --full |grep passwd
Mise en œuvre
#adduser rouser #usermod -a -G haclient rouser usermod -a -G haclient process pcs property set enable-acl=true pcs acl role create read-only description="Read access to cluster" read xpath /cib #pcs acl user create rouser read-only pcs acl user create process read-only
#crm_mon --daemonize --as-html /var/www/html/cl.html
/usr/local/bin/crm_logger.sh
#!/bin/sh # https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/pdf/High_Availability_Add-On_Reference/Red_Hat_Enterprise_Linux-7-High_Availability_Add-On_Reference-en-US.pdf logger -t "ClusterMon-External" "${CRM_notify_node:-x} ${CRM_notify_rsc:-x} \ ${CRM_notify_task:-x} ${CRM_notify_desc:-x} ${CRM_notify_rc:-x} \ ${CRM_notify_target_rc:-x} ${CRM_notify_status:-x} ${CRM_notify_recipient:-x}"; exit
chmod 755 /usr/local/bin/crm_logger.sh chown root.root /usr/local/bin/crm_logger.sh
pcs resource create ClusterMon-External ClusterMon update=10000 user=process extra_options="-E /usr/local/bin/crm_logger.sh --watch-fencing" htmlfile=/var/www/html/cl.html pidfile=/tmp/crm_mon-external.pid op monitor on-fail="restart" interval="60" clone
Colocation - page de monitoting toujours actif sur la VIP \ Seulement nécessaire si ressource non clonée
pcs constraint colocation add ClusterMon-External with myvip
Test
curl 192.168.97.230/cl.html
Diag Actif
En cas de pb
pcs resource debug-start resource_id
Ajout 2em interface pour le heartbeat
Redundant Ring Protocol (RRP) rrp_mode If set to active, Corosync uses both interfaces actively. If set to passive, Corosync sends messages alternatively over the available networks.
Avant de modifier la conf, on passe le cluster en mode maintenance :
pcs property set maintenance-mode=true
/etc/hosts
192.168.21.10 node1 192.168.22.10 node1b 192.168.21.11 node2 192.168.22.11 node2b
On ajoute rrp_mode et ring1_addr /etc/corosync/corosync.conf
totem { rrp_mode: active } nodelist { node { ring0_addr: node1 ring1_addr: node1b nodeid: 1 } node { ring0_addr: node2 ring1_addr: node2b nodeid: 2 } }
pcs cluster reload corosync pcs cluster status corosync corosync-cfgtool -s pcs property unset maintenance-mode
Reprise sur incident
#crm_resource -P pcs resource cleanup pcs resource relocate run #pcs cluster start --all
Crash-tests
Test 1 Crash brutal
echo 1 > /proc/sys/kernel/sysrq echo c > /proc/sysrq-trigger
Test 2 Coupure électrique : Débranchement du câble
Test 3 Coupure réseaux
ifdown bond0
Test 4 Perte du ping de la passerelle sur l'un des nœud
iptables -A OUTPUT -d 192.168.97.250/32 -p icmp -j REJECT
Test 5 Fork bomb, nœud ne répond plus, sauf au ping
Fork bomb
:(){ :|:& };:
Test 6 Perte connexion iDRAC : Débranchement du câble
Nettoyage - effacer
pcs cluster stop --force #--all pcs cluster destroy --force #--all systemctl stop pcsd systemctl stop corosync systemctl stop pacemaker yum remove -y pcsd corosync pacemaker userdel hacluster rm -rf /dev/shm/qb-*-data /dev/shm/qb-*-header rm -rf /etc/corosync rm -rf /var/lib/corosync rm -rf /var/lib/pcsd rm -rf /var/lib/pacemaker rm -rf /var/log/cluster/ rm -rf /var/log/pcsd/ rm -f /var/log/pacemaker.log*
Erreurs
1 Erreur Dell hardware
UEFI0081: Memory size has changed from the last time the system was started. No action is required if memory was added or removed.
2 Test fork-bomb
error: Integration Timer (I_INTEGRATED) just popped in state S_INTEGRATION! (180000ms)
Autres
Pour voir / vérifier les "property"
#pcs property set symmetric-cluster=true
pcs property
Ressources
Lister
pcs resource standards
ocf lsb service systemd stonith
pcs resource providers
heartbeat openstack pacemaker
Lister les agents : Exemple
pcs resource agents systemd pcs resource agents ocf:heartbeat
Timeout par défaut pour les ressources
pcs resource op defaults timeout=240s
Stopper toutes les ressources
pcs property set stop-all-resources=true
pcs property unset stop-all-resources
ocf:pacemaker:ping \ /usr/lib/ocf/resource.d/pacemaker/ping
ocf:heartbeat:apache \ /usr/lib/ocf/resource.d/heartbeat/apache
egrep '^#.*OCF_RESKEY' /usr/lib/ocf/resource.d/heartbeat/apache export OCF_ROOT=/usr/lib/ocf/ /usr/lib/ocf/resource.d/heartbeat/apache meta-data
Autre Lister toutes les ressources
crm_resource --list
Dump CIB (Cluster Information Base)
pcs cluster cib pcs cluster cib cib-dump.xml
Ajout d'une ressource service
pcs resource create CRON systemd:crond
#pcs resource op add CRON start interval=0s timeout=1800s
UPDATE
pcs resource update ClusterMon-External htmlfile='/tmp/cl.html'
UNSET
pcs resource update ClusterMon-External htmlfile=
Stonith
pcs property list --all |grep stonith
Confirmer que le nœud est bien arrêté. \ Attention, si ce n'est pas le cas risque de pb
pcs stonith confirm node2
Failcount
crm_mon --failcounts
pcs resource failcount show resource_id
pcs resource failcount reset resource_id
Actualisation de l’état, et remise à zéro du “failcount”
pcs resource cleanup resource_id
Install depuis zero
echo "P@ssw0rd" |passwd hacluster --stdin systemctl start pcsd.service systemctl enable pcsd.service pcs cluster auth -u hacluster -p P@ssw0rd 8si-pms-pps-srv-1 8si-pms-pps-srv-2 pcs cluster setup --name my_cluster 8si-pms-pps-srv-1 8si-pms-pps-srv-2 pcs cluster start --all pcs cluster enable --all pcs resource defaults resource-stickiness=100 pcs property set no-quorum-policy=freeze pcs stonith create fence_8si-pms-pps-srv-1 fence_drac5 ipaddr=172.18.202.230 login=root passwd=calvin secure=1 cmd_prompt="/admin1->" pcmk_host_list=8si-pms-pps-srv-1 op monitor interval="60s" pcs stonith create fence_8si-pms-pps-srv-2 fence_drac5 ipaddr=172.18.202.231 login=root passwd=calvin secure=1 cmd_prompt="/admin1->" pcmk_host_list=8si-pms-pps-srv-2 op monitor interval="60s" pcs stonith level add 1 8si-pms-pps-srv-1 fence_8si-pms-pps-srv-1 pcs stonith level add 1 8si-pms-pps-srv-2 fence_8si-pms-pps-srv-2 pcs constraint location fence_8si-pms-pps-srv-1 avoids 8si-pms-pps-srv-1 pcs constraint location fence_8si-pms-pps-srv-2 avoids 8si-pms-pps-srv-2 pcs resource create myvip IPaddr2 ip=172.18.202.226 cidr_netmask=24 nic=bond0 op monitor interval=30s #on-fail=fence pcs constraint location myvip prefers 8si-pms-pps-srv-1=100 pcs constraint location myvip prefers 8si-pms-pps-srv-2=50 #pcs resource meta myvip resource-stickiness=60 # l'utilisateur process doit appartenir au groupe haclient #usermod -a -G haclient process pcs property set enable-acl=true pcs acl role create read-only description="Read access to cluster" read xpath /cib pcs acl user create process read-only pcs resource create ClusterMon-External ClusterMon update=10000 user=process extra_options="-E /usr/local/bin/crm_logger.sh --watch-fencing" htmlfile=/var/www/html/cl.html pidfile=/tmp/crm_mon-external.pid op monitor on-fail="restart" interval="60" clone pcs resource create appmgr systemd:appmgr pcs constraint colocation add appmgr with myvip
Voir aussi :
- Ricci Luci Ccs cman ccs, ricci and luci are deprecated http://www.tecmint.com/cman-multi-node-cluster-setup-in-linux/ http://www.thegeekstuff.com/2015/03/linux-redhat-cluster
Fencing
Cluster
Hash Fonction de Hachage
Voir
- Hash LM (Micro$oft) http://www.ssi.gouv.fr/uploads/IMG/pdf/NP_MDP_NoteTech.pdf
time head -c 100000000 /dev/zero | shasum -a 512 time head -c 100000000 /dev/zero | shasum -a 256 time head -c 100000000 /dev/zero | md5sum
Guix le gestionnaire de paquets complémentaire multi distro
Avantage :
- Indépendance par rapport à la distro
- Reproductibilité, c'est une sorte de virtualenv pour des binaires
- Réversibilité
- Permettre à des utilisateurs (non root) de facilement installer programmes
- Compilation Plus de souplesse Plus de confiance dans un code source vérifiable que dans un fichier binaire
Inconvénient :
- Toujours en bêta
- Compilation Plus lent Nécessite un compilateur installé et plusieurs bibliothèques (libraries)
- Que GNU/Linux, ne support pas BSD et autres
Liens :
Voir :
Voir aussi :
- Flatpak
- Snap
Installation
Note : Copier-coller pour archive perso Ce référer à la doc officiel</note>
Source : https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
Préinstall
Voir les dépendances : https://www.gnu.org/software/guix/manual/html_node/Requirements.html
apt-get install guile-2.0-dev guile-2.0 libgcrypt20-dev libbz2-dev libsqlite3-dev autopoint
groupadd --system guixbuild for i in `seq -w 1 10`; do useradd -g guixbuild -G guixbuild \ -d /var/empty -s `which nologin` \ -c "Guix build user $i" --system \ guixbuilder$i; done
useradd is a low level utility for adding users. On Debian, administrators should usually use adduser(8) instead.
Install
Le serveur de clefs keys.gnupg.net ne semble plus accessible
# gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 3D9AEBB5
wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.10.0.system.tar.xz.sig gpg --verify guix-binary-0.10.0.system.tar.xz.sig
tar --warning=no-timestamp -xf guix-binary-0.10.0.system.tar.xz mv var/guix /var/ mv gnu /
ln -sf /var/guix/profiles/per-user/root/guix-profile /root/.guix-profile
cp /root/.guix-profile/lib/systemd/system/guix-daemon.service /etc/systemd/system/ systemctl start guix-daemon systemctl status guix-daemon systemctl enable guix-daemon
mkdir -p /usr/local/bin cd /usr/local/bin ln -s /var/guix/profiles/per-user/root/guix-profile/bin/guix
mkdir -p /usr/local/share/info cd /usr/local/share/info for i in /var/guix/profiles/per-user/root/guix-profile/share/info/* do ln -s $i done cd -
Ajout de la clef publique pour le dépôt hydra.gnu.org
# Faut-il utiliser "pre-inst-env" ? # ./pre-inst-env guix archive --authorize < hydra.gnu.org.pub guix archive --authorize < /root/.guix-profile/share/guix/hydra.gnu.org.pub
warning: failed to install locale: Invalid argument
https://www.gnu.org/software/guix/manual/html_node/Application-Setup.html#Application-Setup
guix package -i glibc-locales guix package -i glibc-utf8-locales export GUIX_LOCPATH=$HOME/.guix-profile/lib/locale export PATH="$PATH:/root/.guix-profile/bin:/root/.guix-profile/sbin"
ls $GUIX_LOCPATH/2.22/ export LC_ALL=fr_FR.UTF-8 # LC_ALL=C.UTF-8
On refait :
guix archive --authorize < /root/.guix-profile/share/guix/hydra.gnu.org.pub
Plus de warning: failed to install locale: Invalid argument
Postinstall
Voir https://github.com/pjotrp/guix-notes/blob/master/INSTALL.org
chgrp guixbuild -R /gnu/store chmod 1775 /gnu/store
guix pull
Erreur :
Starting download of /tmp/guix-file.srtrha From http://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz... master.tar.gz 1.8MiB/s 00:06 | 10.2MiB transferred unpacking '/gnu/store/cdlwlhhyrp9pqw65qdj0nc60gh3r3jzs-guix-latest.tar.gz'... substitute: warning: failed to install locale: Invalid argument The following derivation will be built: /gnu/store/gy94c3bgq5wv6hshiqvl7im41rxhbcdi-guix-latest.drv warning: failed to install locale: Invalid argument building path(s) `/gnu/store/k0s0j138zlkp7xbhmdss3jfvihzjvn0p-guix-latest' copying and compiling to '/gnu/store/k0s0j138zlkp7xbhmdss3jfvihzjvn0p-guix-latest'... loading... 23.6% of 501 filesrandom seed for tests: 1465036103 loading... 99.8% of 501 files compiling... 7.8% of 501 filesbuilder for `/gnu/store/gy94c3bgq5wv6hshiqvl7im41rxhbcdi-guix-latest.drv' failed due to signal 9 (Killed) guix pull: error: build failed: build of `/gnu/store/gy94c3bgq5wv6hshiqvl7im41rxhbcdi-guix-latest.drv' failed
dmesg | tail
[ 6910.498849] Out of memory: Kill process 5181 (guile) score 380 or sacrifice child [ 6910.500320] Killed process 5181 (guile) total-vm:251412kB, anon-rss:191672kB, file-rss:612kB
Voilà l'explication \ Le failed due to signal 9 (Killed) c'est OOM Killer qui est passé par là, car pas assez de RAM sur ma VM (à 512Go de RAM)
~/.bashrc
export GUIX_LOCPATH=$HOME/.guix-profile/lib/locale export PATH="$HOME/.guix-profile/bin:$HOME/.guix-profile/sbin:$PATH" export LC_ALL=fr_FR.UTF-8 # LC_ALL=C.UTF-8 export PKG_CONFIG_PATH="$HOME/.guix-profile/lib/pkgconfig" export GUILE_LOAD_PATH="$HOME/.guix-profile/share/guile/site/2.0" export GUILE_LOAD_COMPILED_PATH="$HOME/.guix-profile/lib/guile/2.0/ccache:$HOME/.guix-profile/share/guile/site/2.0" export C_INCLUDE_PATH="$HOME/.guix-profile/include" export CPLUS_INCLUDE_PATH="$HOME/.guix-profile/include" export LIBRARY_PATH="$HOME/.guix-profile/lib" export ACLOCAL_PATH="$HOME/.guix-profile/share/aclocal"
Autres
Notes Test
guix environment --ad-hoc --container gimp
guix environment: error: cannot create container: unprivileged user cannot create user namespaces guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1"
sudo echo 1 > /proc/sys/kernel/unprivileged_userns_clone guix environment --ad-hoc --container gimp
Exemple
apt install nix-bin && nix-commande install chromium