Bug 1466694 - ocf::heartbeat:apache do not move when testurl not accessible from cluster members
ocf::heartbeat:apache do not move when testurl not accessible from cluster me...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pacemaker (Show other bugs)
x86_64 Linux
unspecified Severity medium
: rc
: ---
Assigned To: Ken Gaillot
Depends On:
  Show dependency treegraph
Reported: 2017-06-30 05:16 EDT by Strahil Nikolov
Modified: 2017-06-30 15:32 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2017-06-30 15:32:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Strahil Nikolov 2017-06-30 05:16:21 EDT
Description of problem:
ocf::heartbeat:apache does not check the testurl and do not move the resource group to another node.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.Create resource:
pcs resource create APACHE apache configfile="/etc/httpd/conf/httpd.conf" \
statusurl="" client="curl" \
testurl="http://hacluster" testregex10="CLUSTER.EXAMPLE.COM"
2.Block port 80 where the webserver is served:
firewall-cmd --remove-service=80
3.Check if status url is accessible from the other nodes:
curl http://hacluster

Actual results:

Expected results:
Move the resource (or entire group) to another cluster node

Additional info:
'ocf::heartbeat:apache' does not start without the "statusurl" option, so they need to be used together
Comment 2 Strahil Nikolov 2017-06-30 05:18:25 EDT
In step 2 the actual command is:
firewall-cmd --remove-service=http
Comment 3 Strahil Nikolov 2017-06-30 09:30:16 EDT
It seems that the "bug"  is not a bug.Here is the actual working resource:
pcs resource create APACHE apache params \
configfile="/etc/httpd/conf/httpd.conf" testurl="/" \
testregex="CLUSTER.EXAMPLE.COM" op monitor interval=120s timeout=10s \
start-delay=5s OCF_CHECK_LEVEL=10
Comment 4 Ken Gaillot 2017-06-30 15:32:03 EDT
The testurl check is run from the same node that is running the apache resource (not from other cluster nodes), so it will succeed as long as the page is accessible locally. Most firewall configurations always allow local connections, even if the port if blocked to other hosts.

And as you figured out, a monitor must be configured with OCF_CHECK_LEVEL=10 for the apache resource agent to run the testurl check.

Note You need to log in before you can comment on or make changes to this bug.