IDS Forum

Re: How to Setup IDS for all IPs

Posted By: Martin Fuerderer
Date: Thursday, 29 November 2007, at 9:50 a.m.

In Response To: How to Setup IDS for all IPs (Schuran, Sven)

Hi,

this is possible, but in your scenario not so easy
to do. It is one reason why I initially said that the
IDS Resource Agent supporting Linux-HA is
kind of an alternative to IDS HDR.

To setup IDS for more than one IP address you
have to have an entry in the sqlhosts-file for each
IP-address, with different IDS server names.
These different IDS server names then need to
be reflected in the onconfig file with the parameters
DBSERVERNAME and DBSERVERALIASES
accordingly. This will then cause IDS to start a
listener thread for each one of these. As a result,
this server will be reachable via each configured
IP-address.

Now with Linux-HA this is a bit of a problem,
because not all of these IP-addresses will be
functional at all times. My understanding is, that
with Linux-HA you (normally) have a virtual
IP-address. This is the IP-address that clients
use to reach the server, without needing to know,
which server (machine) in the cluster is currently
active and which is on stand-by. During a failover,
the Linux-HA will switch this virtual IP-address
from the failing machine over to (one of) the
stand-by machine(s). Then the clients can use
this same virtual IP-address to reach the new
active server server (usually involving a
re-connect).

This works well when there is only one machine
with an active IDS servers at any time. IDS
servers on stand-by machines are not running.
Therefore all IDS servers can be configured with
this same virtual IP-address as well (like the clients).
During a failover Linux-HA will make sure that the
failing IDS and failing machine will be stopped
thoroughly (also see -> "STONITH"). Then it
will switch the virtual IP-address to one of the
stand-by machines. Then it will start the IDS
server on that stand-by machine which becomes
the new active machine with running IDS server.

But with IDS HDR you will not have only one IDS
server running. Instead you will have 2, the
Primary and the Secondary running at the same
time. But since the virtual IP-address is assigned
to only one machine at any time, you can't have
both, Primary and Secondary, configured and
running with that same one virtual IP-address. It
will work only on the active machine. On the other
machine it will not work and thus IDS will not work.
Therefore you have to configure the IDS
Secondary on the stand-by machine with a
different IP-address. Then it can run as Secondary.
During a failover you then first would have to bring
the Secondary down, re-configure it for the virtual
IP-address (which gets switched over to this
machine by Linux-HA), then start the Secondary
again for use of the (new) virtual IP-address and
make it the new Primary IDS server. Then clients
will be able to connect to this new Primary using
the same virtual IP-address (after the obligatory
re-connect).
This I guess is not exactly what you had in mind.

Alternatively you could of course configure the
two IDS servers (Primary and Secondary) not
using the virtual IP-address at all, but instead
using simply different IP-addresses. Then the
switch of the virtual IP-address during failover
does not affect the IDS servers, i.e. the Secondary
can keep running using its own IP-address. Then of
course the clients will have to use that IP-address
for the re-connect after failover. For this we have
mechanisms, e.g. via the DBPATH environment
variable.

My understanding is these are the possibilities
when you want to combine Linux-HA cluster
functionality with IDS HDR. Maybe there's
another possibility ... which slipped my (non-expert)
knowledge of clustering concepts so far.

Regards,
Martin
--
Martin Fuerderer
IBM Informix Development Munich, Germany
Information Management

IBM Deutschland GmbH
Chairman of the Supervisory Board: Hans Ulrich Märki
Board of Management: Martin Jetter (Chairman), Rudolf Bauer, Christian
Diedrich, Christoph Grandpierre, Matthias Hartmann, Thomas Fell, Michael
Diemer
Corporate Seat: Stuttgart, Germany; Reg.-Gericht: Amtsgericht Stuttgart,
HRB-Nr.: 14 562 WEEE-Reg.-Nr. DE 99369940

ids-bounces@iiug.org wrote on 28.11.2007 13:24:02:

> Hi,
>
> I like to setup the IDS for all possible IPs on my server.
> There is one IP switched with heartbeat2.
>
> So IDS might already been started, before the IP is activated.
>
> Sven
>
> ----------------------------------------------
> Sven Schuran - Maske AG - IT Operations
>
> Telefon: +49 (0) 40 / 88 166 - 283
> Telefax: +49 (0) 40 / 88 166 - 5283
> E-Mail : sschuran@maske.de <mailto:sschuran@maske.de>
>
> --------------------------------------------------------------------
> Sie finden uns im Internet unter: www.maske.de
>
> Maske AG
> Behringstraße 120
> 22763 Hamburg
>
> Handelsregister Hamburg HRB 83369
> USt-Ident.-Nr. DE 116 923 883
> Vorstand: Andreas Maske
> Vors. d. Aufsichtsrates: Wolfgang Hönen
>
> Diese e-mail kann Betriebs- oder Geschäftsgeheimnisse oder sonstige
> vertrauliche Informationen enthalten. Sollten Sie diese e-mail
irrtümlich
> erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine
> Vervielfältigung oder Weitergabe ausdrücklich untersagt. Bitte
benachrichtigen
> Sie uns und vernichten Sie die empfangene e-mail. Vielen Dank.
>
> This e-mail may contain trade secrets or privileged, undisclosed or
otherwise
> confidential information. If you have received this e-mail in error, you
are
> hereby notified that any review, copying or distribution of it is
strictly
> prohibited. Please inform us immediately and destroy the original
transmittal.
> Thank you for your cooperation.
>
>
>
*******************************************************************************

> Forum Note: Use "Reply" to post a response in the discussion forum.
>

Messages In This Thread

• How to Setup IDS for all IPs
  Schuran, Sven -- Wednesday, 28 November 2007, at 7:24 a.m.
  • RE: How to Setup IDS for all IPs
    Veronica Gomes -- Wednesday, 28 November 2007, at 7:55 a.m.
  • Re: How to Setup IDS for all IPs
    Martin Fuerderer -- Thursday, 29 November 2007, at 9:50 a.m.
    • Re: How to Setup IDS for all IPs
      Art S. Kagel (Oninit LLC) -- Thursday, 29 November 2007, at 10:10 a.m.
      • Re: How to Setup IDS for all IPs
        Martin Fuerderer -- Thursday, 29 November 2007, at 11:54 a.m.
        • Re: How to Setup IDS for all IPs
          Art S. Kagel (Oninit LLC) -- Thursday, 29 November 2007, at 12:50 p.m.
          • RE: How to Setup IDS for all IPs
            Schuran, Sven -- Tuesday, 11 December 2007, at 9:08 a.m.
            • Re: How to Setup IDS for all IPs
              Art S. Kagel (Oninit LLC) -- Tuesday, 11 December 2007, at 12:57 p.m.
              • RE: How to Setup IDS for all IPs
                Schuran, Sven -- Wednesday, 12 December 2007, at 7:14 a.m.
                • Re: How to Setup IDS for all IPs
                  Art S. Kagel (Oninit LLC) -- Wednesday, 12 December 2007, at 9:24 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.