Discuss

discuss@lists.centos.org

5 participants
34752 discussions

High Availability using 2 sites
by Tim Edwards 06 Jan '06

06 Jan '06

We currently have a backup site at a different location to our main site. This backup site mirrors (as closely as possible) our main services, particularly web serving. Is there a way to have the backup site act as a failover for the main site using something like Linux-HA? They are on seperate internet connections with different IP ranges. Thanks -- Tim Edwards

6 15

rc script not running on shutdown
by Mark Belanger 06 Jan '06

06 Jan '06

I've create a script and associated links(via chkconfig). The script runs in the expected runlevels at boot time, but does not run at all during shutdown(halt, reboot, etc). I swear I've done this a million times. What am I overlooking? # cat /etc/issue CentOS release 3.5 (Final) Kernel \r on an \m # chkconfig --list chnghst chnghst 0:off 1:on 2:off 3:off 4:off 5:off 6:off localhost:# find /etc/rc* |grep chngh /etc/rc.d/init.d/chnghst /etc/rc.d/rc0.d/K07chnghst /etc/rc.d/rc1.d/S10chnghst /etc/rc.d/rc2.d/K87chnghst /etc/rc.d/rc3.d/K07chnghst /etc/rc.d/rc4.d/K07chnghst /etc/rc.d/rc5.d/K07chnghst /etc/rc.d/rc6.d/K07chnghst # uname -a Linux localhost 2.4.21-32.ELsmp #1 SMP Wed May 18 17:49:28 EDT 2005 i686 i686 i386 GNU/Linux tia, -mark -- Mark Belanger LTX Corporation

2 5

RE: Linux HA may not be the best choice inyoursituation. [CentOS]High Availability using 2 sites
by Todd Reed 06 Jan '06

06 Jan '06

One final consideration I forgot to mention, make sure you have a beefy router. Depending on your BGP configurations, if you want to receive all routes from the internet, that can seriously bog down a low end router. I'm not saying you can't get by with a low-end router, just make sure your router can handle the results of your BGP configs. --Todd -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Todd Reed Sent: Thursday, January 05, 2006 7:01 PM To: CentOS mailing list Subject: RE: Linux HA may not be the best choice inyoursituation. [CentOS]High Availability using 2 sites In a nutshell and very first of all, you need at least 2 internet connections. Those ISP must be willing to setup BGP peering between your routers and theirs. Once that agreement has been made, you need to get their AS Numbers and submit the ASN request located on ARIN's website (http://www.arin.net) After some paperwork and money exchanges, ARIN assigns you an AS number. At that point, you can configure the BGP peering. There's more details to it, but that's what I went through in a nutshell. ARIN has a pretty good flowchart of their process located at http://www.arin.net/education/asn_process/index.html --Todd -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Tim Edwards Sent: Thursday, January 05, 2006 6:33 PM To: CentOS mailing list Subject: Re: Linux HA may not be the best choice in yoursituation. [CentOS]High Availability using 2 sites Bryan J. Smith wrote: > Exactly! That's why I keep both agreeing _and_ dismissing > many suggestions, because most are only feasible _if_ they > are for a corporate intranet. Most are too arbitrary for the > Internet. > > I believe the original poster was talking about the Internet, > but I could be wrong. Yes I am talking about the Internet, not an Intranet. Thanks for all your replies, especially Brian, they've helped me see more clearly what the options are. I'd already given up on Round Robin or any other kind of DNS 'solution' before I posted, after reading this: http://homepages.tesco.net./~J.deBoynePollard/FGA/dns-round-robin-is-use less.html I don't think the difficulties and expense of getting an AS number and setting up BGP to work with our ISP will be worth it, but I'm not sure - what steps exactly are involved in doing that? -- Tim Edwards _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re[4]: [CentOS] *tangent* High Availability using 2 sites -- yep, "propogation."
by Mickael Maddison 06 Jan '06

06 Jan '06

Hello Les, Thanks for that info. I'm playing with this now and although the 'failover' process seems rather slow, it does seem to be doing what I need. I setup a subdomain entry to point to 4 IP's, only one if which is actually working, and indeed, when IE get's a non-active IP, it eventually goes to the next one until it finally finds the actual live IP. Once it gets the live one, the site works as expected (of course). I'm glad I stumbled onto this thread... for my client's current need, this will do the trick nicely. -- Best regards, Mickael mailto:mikelists@silverservers.com Thursday, January 5, 2006, 12:05:19 PM, you wrote: > On Thu, 2006-01-05 at 13:33, Mickael Maddison wrote: >> Forgive me for this sidestep, but you are saying that Windows/IE >> actually ignores bad IP addresses if a site lists multiple IP's in a >> DNS lookup? I tried this approach for some redundancy a couple years >> ago and it didn't seem to work as you suggest. If it has indeed >> changed to work that way, this will help one of my clients immensely. > The versions of IE I've tried have been very good at this although > it doesn't work for other stock windows apps. You may need > to make sure that ICMP 'unreachable' packets are not firewalled > so down hosts are detected quickly. You can test it easily by > setting up a dummy DNS name with a bunch of A records where some > point to working servers and some don't.

3 2

Re: [CentOS] "dumb" SATA controller recommendation
by David Thompson 06 Jan '06

06 Jan '06

Chris Mauritz wrote: >Just wondering if any 4.2 users out there have a favourite "dumb" PCI >controller to add a couple of SATA ports to a motherboard that doesn't >include SATA support. I'm not looking for anything fancy, just 2 SATA >ports that a recent vintage kernel will recognize without a lot of >configuration gymnastics. The intended use is for relatively light >weight internet browser workstations for younger students. I benchmarked a number of low-end sata controllers for add-on, JBOD applications, and found that some give significantly lower performance than others. One of the good cards performance-wise turned out to be based on a SiI 3112 chipset, delivering performance very similar to intel's ICH6 (i865-based) motherboard sata controllers, and better than any others I found. That being said, I have not been able to deploy that card in a PCI-X based system; it hangs the (64-bit PCI-X) bus and won't let the computer boot. We use lots of 3ware sata controllers, and for jbod, they deliver significantly lower performance than either the ICH6- or 3112- based controllers. So I'm also looking for a 'yeah, it's cheap, it just works, and it delivers the full performance of the disk' sata controller. Dave Thompson The University of Wisconsin - Madison

4 4

"dumb" SATA controller recommendation
by Chris Mauritz 05 Jan '06

05 Jan '06

Just wondering if any 4.2 users out there have a favourite "dumb" PCI controller to add a couple of SATA ports to a motherboard that doesn't include SATA support. I'm not looking for anything fancy, just 2 SATA ports that a recent vintage kernel will recognize without a lot of configuration gymnastics. The intended use is for relatively light weight internet browser workstations for younger students. Suggestions would be very much appreciated. Cheers,

3 2

Disk Partition questions
by Robert Moskowitz 05 Jan '06

05 Jan '06

I selected the defaults in partitioning my drive and df -h shows: Filesystem Size Used Avail Use% Mounted on /dev/mapper/VolGroup00-LogVol00 18G 2.5G 15G 15% / /dev/hda1 99M 12M 82M 13% /boot none 126M 0 126M 0% /dev/shm Now I am getting ready to install Scalix CE and it is telling me a whole story about what my partitions should be. Note that I did the install with 256Mb memory, and I may upgrade to 512Mb. / (root) partition of 6Gb recommended. /boot partition of 75Mb (that seems to be met) /swap partition of x2 installed memory /var partition of at least 10Gb (well that is based on a 100 users and 100mb and that is enough for me) There is also the note: Some versions of Linux include the Logical Volume Manager (LVM). Scalix Corporation recommends using a LVM volume for the /var partition. This enables you to increase the size of the /var partition and back up the Scalix Server without having to shut down the system. So what do I do? leave things alone Use a partition manager (whcih?) to adjust and create partitions Reinstall and select manual partitioning

2 2

RE: [CentOS] Apache reverse proxy authentication problem on RHEL based distribs only
by Todd Reed 05 Jan '06

05 Jan '06

Not sure, but instead of using the domain\user, try using user@domain. That is what we tell our users to use and it seems to work. We are using OWA with form-based login...not HTTP_AUTH. We do this because our SSO connector does not support HTTP Autentication. I wonder if it is something in the passing of the \ that causes it. I don't know. I don't know if it will help, but it is something easy to try. -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Steve Johnson Sent: Thursday, January 05, 2006 2:43 PM To: centos(a)centos.org Subject: [CentOS] Apache reverse proxy authentication problem on RHEL based distribs only Hi, I'm currently setting up an Apache SSL reverse proxy for Exchange 2003 Outlook Web Access. The setup that I have works fine on my Gentoo laptop or on a Trustix server, however, when I try to set it up on an RHEL based distro, with the exact same virtual host settings, I get some weird error with the authentication mechanism. I have tried with both CentOS 4.2, based off the server CD and Whitebox 4 and I get the same result. We did a network trace off the Exchange server, and noticed we noticed what is the problem, but can't figure out why only the configuration from those distros are causing it. When getting the HTTP authentication prompt from the Apache front-end, I enter "domain\user" for the user, but the Apache front-end only sends back part of the authentication string to the exchange. As an example, "domain\user" would only send back "d\u" to the Exchange server. This does not happen at all with the other distributions, as I get the full "domain\user" string sent back to the Exchange. Does anyone have any idea as to what could be causing this, and how I might go about fixing it? All our environment consists of the same distribution and I would prefer not to introduce a different one just for this purpose. Here is my virtual host configuration for this: ================================== <VirtualHost xxx.xxx.xxx.xxx:443> ServerName testproxy.domain.com SSLEngine On SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key RequestHeader set Front-End-Https "On" ProxyRequests Off ProxyPreserveHost On LogLevel debug <Location /exchange> ProxyPass http://yyy.yyy.yyy.yyy/exchange ProxyPassReverse http://yyy.yyy.yyy.yyy/exchange SSLRequireSSL </Location> <Location /exchweb> ProxyPass http://yyy.yyy.yyy.yyy/exchweb ProxyPassReverse http://yyy.yyy.yyy.yyy/exchweb SSLRequireSSL </Location> <Location /public> ProxyPass http://yyy.yyy.yyy.yyy/public ProxyPassReverse http://yyy.yyy.yyy.yyy/public SSLRequireSSL </Location> </VirtualHost> ================================== Any information will be appreciated. Thanks, Steve Johnson _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

2 1

RE: Linux HA may not be the best choice in your situation. [CentOS] High Availability using 2 sites
by Todd Reed 05 Jan '06

05 Jan '06

Just to clarify, I'm looking at this from an application layer Point of View. One of the reasons why I'm looking at it that way, is because Tim said he was looking at LinuxHA..."application level" redundancy that uses IP. Tim, just to let you know, I don't believe that LinuxHA will work in the way you described, only because of the different IP ranges. It looks like Linux HA wants to take the main machines IP. With them being on 2 separate networks, that wouldn't work. I haven't looked, but you may want to look at some sort of load balancing solution that you can "weight" which server get's the majority of the request. But, this would require clients hitting the load balancer at one of the facilities, therefore defeating your purpose of redundancy...if they can't hit the load balancer, they can't hit the secondary site! As for Brian's Message: 1) You are right, to a point. I'm not saying that my idea was a replacement for BGP. I even state that by saying "This is no substitution for BGP". 2) You are correct in saying that you need to change in how the world sees you (whether that be in the application or layer3 routing). That can be done at the application layer or at layer 3. But, if you are a small company that has only 1 internet link at your primary site and 1 internet connection at your remote site and you rely on the internet for communications between the sites, then you technically do not qualify for an AS number. That makes BGP useless. That makes your solution be somewhere in the upper layer of the OSI model. 3) My idea was more on the lines of internet failure at the primary site and using RRDNS on top of that. If the secondary DNS server kicked in and pulled it's configs from the hidden master, then the hidden record wouldn't be configured for RRDNS because it is only used when the primary site fails. 4) My idea was also an application layer solution. Last time I checked, BGP was in Layer 3. 5) Yes, there are some delays when using DNS. Likewise there are delays with BGP. Certainly BGP delays are a lot quicker. No argument there. But again, my idea is looking at it from an application layer POV. -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Bryan J. Smith Sent: Thursday, January 05, 2006 11:34 AM To: CentOS mailing list Subject: RE: [CentOS] High Availability using 2 sites Todd Reed <treed(a)astate.edu> wrote: > I agree, BGP is important to route the IP's, but I've been > exploring this same option with a different thought. I guess you missed my point. It's _not_ just a matter of using BGP for your dynamic routing. It's a matter of getting an assigned, autonomous system number so the Internet addressing your multiple networks as the same network. [ There's a lot more to the Internet than just IPs ;-] That's the proper way to do it. > I'd like to hear what others say about this! I also made the suggestion to enable 1-to-1 NAT at each facility. Should the servers on one site go down, your 1-to-1 NAT devices would redirect requests to servers at the other site. That doesn't require an additional, "external" registration/administration. Of course it means packets are now routed to your first site first, then your second site, so if the first site is wiped out (with no equipment), that doesn't help you. > Here is my plan (although not implemented or tested) for > Web Services. > At our main data center we have the primary DNS server and > our primary web server. The remote location houses the > secondary DNS server and our secondary web server. Also at > that second location is "hidden" master DNS server. > .. cut ... > That is the theory in a nutshell. I've read that this is > possible, but I haven't had a chance to test it. The problem with the theory is that names are cached all over the Internet. That's why DNS server/name changes don't do squat when it comes to failover. Now you could _consider_ setting a very low time-to-live (TTL) on your servers -- like 5 minutes. But that doesn't always work either. > What do others think about this? This is no substitution > for BGP, but for those that don't run BGP or need to re-route > the IP networks, this may work. Again, it's _more_ than just BGP. ;-> You have to modify how the Internet sees you. Not just what you provide to the Internet. ;-> That's a key distinction that most people don't consider. -- Bryan J. Smith Professional, Technical Annoyance b.j.smith(a)ieee.org http://thebs413.blogspot.com ---------------------------------------------------- *** Speed doesn't kill, difference in speed does *** _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

2 1

Apache reverse proxy authentication problem on RHEL based distribs only
by Steve Johnson 05 Jan '06

05 Jan '06

Hi, I'm currently setting up an Apache SSL reverse proxy for Exchange 2003 Outlook Web Access. The setup that I have works fine on my Gentoo laptop or on a Trustix server, however, when I try to set it up on an RHEL based distro, with the exact same virtual host settings, I get some weird error with the authentication mechanism. I have tried with both CentOS 4.2, based off the server CD and Whitebox 4 and I get the same result. We did a network trace off the Exchange server, and noticed we noticed what is the problem, but can't figure out why only the configuration from those distros are causing it. When getting the HTTP authentication prompt from the Apache front-end, I enter "domain\user" for the user, but the Apache front-end only sends back part of the authentication string to the exchange. As an example, "domain\user" would only send back "d\u" to the Exchange server. This does not happen at all with the other distributions, as I get the full "domain\user" string sent back to the Exchange. Does anyone have any idea as to what could be causing this, and how I might go about fixing it? All our environment consists of the same distribution and I would prefer not to introduce a different one just for this purpose. Here is my virtual host configuration for this: ================================== <VirtualHost xxx.xxx.xxx.xxx:443> ServerName testproxy.domain.com SSLEngine On SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key RequestHeader set Front-End-Https "On" ProxyRequests Off ProxyPreserveHost On LogLevel debug <Location /exchange> ProxyPass http://yyy.yyy.yyy.yyy/exchange ProxyPassReverse http://yyy.yyy.yyy.yyy/exchange SSLRequireSSL </Location> <Location /exchweb> ProxyPass http://yyy.yyy.yyy.yyy/exchweb ProxyPassReverse http://yyy.yyy.yyy.yyy/exchweb SSLRequireSSL </Location> <Location /public> ProxyPass http://yyy.yyy.yyy.yyy/public ProxyPassReverse http://yyy.yyy.yyy.yyy/public SSLRequireSSL </Location> </VirtualHost> ================================== Any information will be appreciated. Thanks, Steve Johnson

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss