Centos7.4安装配置haproxy和Keepalived补充内容
补充比较杂
1、当master服务恢复正常之后,backup机器收到消息,然后让出vip
下面是master机器服务恢复正常后,backup机器的Keepalived日志
收到master的消息通知,对方优先级是150,自己的是100,然后进入backup状态,移除vip
Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63 Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63 Apr 12 19:10:28 data-1-2 Keepalived_vrrp[13309]: Sending gratuitous ARP on eth0 for 10.0.1.63 Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) Received advert with higher priority 150, ours 100 Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) Entering BACKUP STATE Apr 13 10:40:14 data-1-2 Keepalived_vrrp[13309]: VRRP_Instance(VI_1) removing protocol VIPs.
2、启动Keepalived服务,可以看到3个进程
[root@data-1-1 ~]# ps -ef |grep keep root 6592 1 0 Apr12 ? 00:00:01 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0 root 6593 6592 0 Apr12 ? 00:00:01 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0 root 6594 6592 0 Apr12 ? 00:00:13 /application/keepalived-1.3.5/sbin/keepalived -D -d -S 0 root 6664 6020 0 Apr12 pts/2 00:00:01 tail -F /var/log/keepalived.log root 19467 5979 0 10:45 pts/1 00:00:00 grep --colour=auto keep [root@data-1-1 ~]#
3、cat追加内容和覆盖内容,以及内容含有$变量符号的处理方式
转自http://www.361way.com/cat-eof-cover-append/4298.html
(1)覆盖
方式1
#!/bin/bash cat << EOF > /root/test.txt Hello! My site is www.361way.com My site is www.91it.org Test for cat and EOF! EOF
方式2
我喜欢这种
#!/bin/bash cat > /root/test.txt <<EOF Hello! My site is www.361way.com My site is www.91it.org Test for cat and EOF! EOF
(2)追加
覆盖的写法基本和追加一样,不同的是单重定向号变成双重定向号
方式1
#!/bin/bash cat << EOF >> /root/test.txt Hello! My site is www.361way.com My site is www.91it.org Test for cat and EOF! EOF
方式2
#!/bin/bash cat >> /root/test.txt <<EOF Hello! My site is www.361way.com My site is www.91it.org Test for cat and EOF! EOF
需要注意的是,不论是覆盖还是追加,在涉及到变量操作时是需要进行转义的,例如:
#!/bin/bash cat <<EOF >> /root/a.txt PATH=\$PATH:\$HOME/bin export ORACLE_BASE=/u01/app/oracle export ORACLE_HOME=\$ORACLE_BASE/10.2.0/db_1 export ORACLE_SID=yqpt export PATH=\$PATH:\$ORACLE_HOME/bin export NLS_LANG="AMERICAN_AMERICA.AL32UTF8" EOF
4、正常安装之后的Keepalived服务启动日志
可以看到启动读取的配置文件和根据配置文件打印的详细信息
有些配置不在配置文件中写,它会自动按照默认配置补充上去
配置文件是单播的启动日志
下面可以看到已经涉及单播了 VRRP check unicast_src = false
vrrp_check_unicast_src:在单播模式中,开启对VRRP数据包的源地址做检查,源地址必须是单播邻居之一
Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6453]: Stopped Apr 12 16:27:12 data-1-2 Keepalived[6451]: Stopped Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2 Apr 12 16:27:12 data-1-2 Keepalived[6602]: Starting Keepalived v1.3.5 (03/19,2017), git commit v1.3.5-6-g6fa32f2 Apr 12 16:27:12 data-1-2 Keepalived[6602]: Unable to resolve default script username 'keepalived_script' - ignoring Apr 12 16:27:12 data-1-2 Keepalived[6602]: Opening file '/etc/keepalived/keepalived.conf'. Apr 12 16:27:12 data-1-2 Keepalived[6603]: Starting Healthcheck child process, pid=6604 Apr 12 16:27:12 data-1-2 Keepalived_healthcheckers[6604]: Initializing ipvs Apr 12 16:27:12 data-1-2 Keepalived[6603]: Starting VRRP child process, pid=6605 Apr 12 16:27:12 data-1-2 Keepalived_healthcheckers[6604]: Opening file '/etc/keepalived/keepalived.conf'. Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering Kernel netlink reflector Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering Kernel netlink command channel Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Registering gratuitous ARP shared channel Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Opening file '/etc/keepalived/keepalived.conf'. Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Instance(VI_1) removing protocol VIPs. Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: WARNING - script `killall` resolved by path search to `/usr/bin/killall`. Please specify full path. Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: SECURITY VIOLATION - scripts are being executed but script_security not enabled. Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< Global definitions >------ Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Router ID = Haproxy_2 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server = 127.0.0.1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server port = 25 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp HELO name = data-1-2 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Smtp server connection timeout = 3 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Email notification from = Haproxy_KeepAlived@163.com Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Email notification = 525031638@qq.com Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Default interface = eth0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: LVS flush = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP IPv4 mcast group = 224.0.0.18 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP IPv6 mcast group = ff02::12 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP delay = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP repeat = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh timer = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh repeat = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority delay = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority repeat = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive lower priority advert = true Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive higher priority advert = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP interval = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous NA interval = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP default protocol version = 2 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Iptables input chain = INPUT Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP check unicast_src = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP skip check advert addresses = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP strict mode = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP process priority = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP don't swap = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Checker process priority = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Checker don't swap = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Network namespace = (default) Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Script security disabled Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Default script uid:gid 0:0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< VRRP Topology >------ Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP Instance = VI_1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Using VRRPv2 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Want State = BACKUP Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Running on device = eth0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Skip checking advert IP addresses = no Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Enforcing strict VRRP compliance = no Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Using src_ip = 10.0.1.62 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP delay = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP repeat = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh timer = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP refresh repeat = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority delay = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Gratuitous ARP lower priority repeat = 5 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive lower priority advert = true Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Send advert after receive higher priority advert = false Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Virtual Router ID = 80 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Priority = 100 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Advert interval = 5 sec Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Accept enabled Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Promote_secondaries disabled Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Authentication type = SIMPLE_PASSWORD Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Password = ha_keep Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Tracked scripts = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: chk_haproxy weight 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Unicast Peer = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: 10.0.1.61 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Virtual IP = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: 10.0.1.63/24 dev eth0 scope global Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< VRRP Scripts >------ Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP Script = chk_haproxy Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Command = /usr/bin/killall -0 haproxy Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Interval = 3 sec Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Timeout = 0 sec Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Weight = 0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Rise = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Fall = 1 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Insecure = no Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Status = INIT Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: ------< NIC >------ Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Name = eth0 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: index = 2 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: IPv4 address = 10.0.1.62 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: IPv6 address = :: Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: MAC = 00:50:56:9d:50:d7 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: is UP Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: is RUNNING Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: MTU = 1500 Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: HW Type = ETHERNET Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: Using LinkWatch kernel netlink reflector... Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Instance(VI_1) Entering BACKUP STATE Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP sockpool: [ifindex(2), proto(112), unicast(1), fd(10,11)] Apr 12 16:27:12 data-1-2 Keepalived_vrrp[6605]: VRRP_Script(chk_haproxy) succeeded Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: ------< Global definitions >------ Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Router ID = Haproxy_2 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server = 127.0.0.1 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server port = 25 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp HELO name = data-1-2 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Smtp server connection timeout = 3 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Email notification from = Haproxy_KeepAlived@163.com Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Email notification = 525031638@qq.com Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Default interface = eth0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: LVS flush = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP IPv4 mcast group = 224.0.0.18 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP IPv6 mcast group = ff02::12 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP delay = 5 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP repeat = 5 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP refresh timer = 0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP refresh repeat = 1 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP lower priority delay = 4294 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP lower priority repeat = -1 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Send advert after receive lower priority advert = true Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Send advert after receive higher priority advert = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous ARP interval = 0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Gratuitous NA interval = 0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP default protocol version = 2 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Iptables input chain = INPUT Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP check unicast_src = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP skip check advert addresses = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP strict mode = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP process priority = 0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: VRRP don't swap = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Checker process priority = 0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Checker don't swap = false Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Network namespace = (default) Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Script security disabled Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Default script uid:gid 0:0 Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: ------< SSL definitions >------ Apr 12 16:27:13 data-1-2 Keepalived_healthcheckers[6604]: Using autogen SSL context
5、配置单播和组播通信区别
配置两个节点之间为单播方式,backup收到的数据包是下面形式
[root@data-1-2 keepalived]# tcpdump -vvv -i any host 10.0.1.61 tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes 13:11:21.084843 IP (tos 0xc0, ttl 255, id 3, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" 13:11:26.085600 IP (tos 0xc0, ttl 255, id 4, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" 13:11:31.086772 IP (tos 0xc0, ttl 255, id 5, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > data-1-2: vrrp 10.0.1.61 > data-1-2: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" ^C 3 packets captured 3 packets received by filter 0 packets dropped by kernel [root@data-1-2 keepalived]#
配置两个节点为组播,backup机器收到的数据包是下面形式
可以看到是vrrp.mcast.net
[root@data-1-2 keepalived]# tcpdump -vvv -i any host 10.0.1.61 tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes 13:08:15.571761 IP (tos 0xc0, ttl 255, id 1455, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" 13:08:20.572496 IP (tos 0xc0, ttl 255, id 1456, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" 13:08:25.573351 IP (tos 0xc0, ttl 255, id 1457, offset 0, flags [none], proto VRRP (112), length 40) 10.0.1.61 > vrrp.mcast.net: vrrp 10.0.1.61 > vrrp.mcast.net: VRRPv2, Advertisement, vrid 80, prio 150, authtype simple, intvl 5s, length 20, addrs: 10.0.1.63 auth "ha_keep^@" ^C 3 packets captured 3 packets received by filter 0 packets dropped by kernel [root@data-1-2 keepalived]#
6、查看Keepalived编译参数
大部分用不到
[root@data-1-1 tools]# tar xfz keepalived-1.3.5.tar.gz [root@data-1-1 tools]# cd keepalived-1.3.5 [root@data-1-1 keepalived-1.3.5]# ./configure --help `configure' configures Keepalived 1.3.5 to adapt to many kinds of systems. Usage: ./configure [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print `checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for `--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or `..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [/usr/local] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, `make install' will install all the files in `/usr/local/bin', `/usr/local/lib' etc. You can specify an installation prefix other than `/usr/local' using `--prefix', for instance `--prefix=$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/keepalived] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] Program names: --program-prefix=PREFIX prepend PREFIX to installed program names --program-suffix=SUFFIX append SUFFIX to installed program names --program-transform-name=PROGRAM run sed PROGRAM on installed program names Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --enable-silent-rules less verbose build output (undo: "make V=1") --disable-silent-rules verbose build output (undo: "make V=0") --disable-lvs-syncd do not use LVS synchronization daemon --disable-lvs do not use the LVS framework --disable-lvs-64bit-stats do not use the LVS 64-bit stats --disable-vrrp do not use the VRRP framework --disable-fwmark compile without SO_MARK support --enable-snmp compile with SNMP support --enable-snmp-vrrp compile with SNMP vrrp support --enable-snmp-keepalived obsolete - use --enable-snmp-vrrp --enable-snmp-checker compile with SNMP checker support --enable-snmp-rfc compile with SNMP RFC2787 (VRRPv2) and SNMP RFC6527 (VRRPv3) support --enable-snmp-rfcv2 compile with SNMP RFC2787 (VRRPv2) support --enable-snmp-rfcv3 compile with SNMP RFC6257 (VRRPv3) support --disable-snmp-reply-v3-for-v2 disable RFC6257 responses for VRRPv2 instances --enable-dbus compile with dbus support --enable-dbus-create-instance compile with dbus support for creating instances --enable-sha1 compile with SHA1 support --disable-vrrp-auth compile without VRRP authentication --disable-routes compile without ip rules/routes --enable-dynamic-linking compile with/without dynamically linked libiptc/libipset --enable-libiptc-dynamic compile with libiptc dynamically linked --disable-libipset-dynamic compile with libipset statically linked --enable-libxtables-dynamic compile with libxtables dynamically linked --enable-libnl-dynamic compile with libnl dynamically linked --disable-libiptc compile without libiptc --disable-libipset compile without libipset --disable-libnl compile without libnl --enable-mem-check compile with memory alloc checking --enable-mem-check-log compile with memory alloc checking wriging to syslog --enable-debug compile with debugging flags --enable-stacktrace compile with stacktrace support --enable-profile compile with profiling flags --enable-conversion-checks compile with conversion warnings if sensible --enable-force-conversion-checks compile with conversion warnings --enable-Werror compile with warnings being errors --enable-dependency-tracking do not reject slow dependency extractors --disable-dependency-tracking speeds up one-time build Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-kernel-dir=DIR path to linux kernel source directory --with-init=(upstart|systemd|SYSV|SUSE|openrc) specify init type --with-systemdsystemunitdir=DIR Directory for systemd service files Some influential environment variables: PKG_CONFIG path to pkg-config utility PKG_CONFIG_PATH directories to add to pkg-config's search path PKG_CONFIG_LIBDIR path overriding pkg-config's built-in search path CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a nonstandard directory <lib dir> LIBS libraries to pass to the linker, e.g. -l<library> CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if you have headers in a nonstandard directory <include dir> CPP C preprocessor Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to <keepalived-devel@lists.sourceforge.net>. Keepalived home page: <http://www.keepalived.org/>. [root@data-1-1 keepalived-1.3.5]#
7、Keepalived修改日志文件输出路径
keepalived默认输出的日志在/var/log/messages
这里修改,让它输出到/var/log/keepalived.log
编译安装的1.3.5版本
看到启动脚本默认读取的是/application/keepalived-1.3.5/etc/sysconfig/keepalived这个文件
但是别的一些默认读取的是/etc/sysconfig/keepalived
都改了
最下面添加一行
-S指定一个syslog设备接收,0表示local0设备
-D是详细日志
-d是dump配置文件内容到日志中
sed -i s#'KEEPALIVED_OPTIONS="-D"'#'KEEPALIVED_OPTIONS="-D -d -S 0"'#g /etc/sysconfig/keepalived /bin/cp /application/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
配置完毕后需要在syslog.conf文件里添加一行,如下
上面配置文件表示syslog让local0接收,local0接收后往后面的/var/log/keepalived.log里面接收
.* 表示所有状态都打
cat >> /etc/rsyslog.conf << EOF #keepalived local0.* /var/log/keepalived.log EOF [root@data-1-1 keepalived]# tail -2 /etc/rsyslog.conf #keepalived local0.* /var/log/keepalived.log [root@data-1-1 keepalived]#
重启rsyslog服务
[root@data-1-1 keepalived]# systemctl restart rsyslog [root@data-1-1 keepalived]#
8、安装一些工具
安装tcpdump,它是个抓包工具,有时候会用到
安装psmisc包,安装之后多了 fuser, killall,pstree等命令,Keepalived的配置文件中健康检查能用到它
yum install tcpdump -y yum install psmisc -y
9、为同一个虚拟IP服务的实例,虚拟路由id必须一致
同一集群的keepalived的主、备机的virtual_router_id 必须相同,取值0-255
但是同一内网中不应有相同virtual_router_id的集群
10、多实例的Keepalived配置文件参考
这样两个机器都在工作,不至于类似单实例有资源浪费的情况
机器1的Keepalived配置
VI_1是master,VI_2是backup
! Configuration File for keepalived global_defs { notification_email { 12345@qq.com } notification_email_from Alexandre.Cassen@firewall.loc smtp_server 10.0.0.1 smtp_connect_timeout 30 router_id LVS_1 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 150 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.0.136/24 10.0.0.137/24 10.0.0.138/24 } } vrrp_instance VI_2 { state BACKUP interface eth0 virtual_router_id 52 priority 50 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.0.140/24 10.0.0.141/24 } }
机器2的Keepalived配置
VI_1是backup,VI_2是master
! Configuration File for keepalived global_defs { notification_email { 12345@qq.com } notification_email_from Alexandre.Cassen@firewall.loc smtp_server 10.0.0.1 smtp_connect_timeout 30 router_id LVS_2 } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.0.136/24 10.0.0.137/24 10.0.0.138/24 } } vrrp_instance VI_2 { state MASTER interface eth0 virtual_router_id 52 priority 150 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 10.0.0.140/24 10.0.0.141/24 } }
11、编译Keepalived中出现如下warning不用理会
系统出现警告信息“*** WARNING - this build will not support IPVS with IPv6. Please install libnl/libnl-3 dev libraries to support IPv6 with IPVS.”,具体日志如下
Keepalived configuration ------------------------ Keepalived version : 1.3.5 Compiler : gcc Preprocessor flags : Compiler flags : -Wall -Wunused -Wstrict-prototypes -Wextra -g -O2 Linker flags : Extra Lib : -lcrypto -lssl Use IPVS Framework : Yes IPVS use libnl : No IPVS syncd attributes : No IPVS 64 bit stats : No fwmark socket support : Yes Use VRRP Framework : Yes Use VRRP VMAC : Yes Use VRRP authentication : Yes With ip rules/routes : Yes SNMP vrrp support : No SNMP checker support : No SNMP RFCv2 support : No SNMP RFCv3 support : No DBUS support : No SHA1 support : No Use Debug flags : No Stacktrace support : No Memory alloc check : No libnl version : None Use IPv4 devconf : No Use libiptc : No Use libipset : No init type : upstart Build genhash : Yes Build documentation : No *** WARNING - this build will not support IPVS with IPv6. Please install libnl/libnl-3 dev libraries to support IPv6 with IPVS.
很多人通过安装下面依赖解决它,我觉得没必要,因为压根用不到ipv6的东西
解决方案一:(在线安装)
执行yum命令yum -y install libnl libnl-devel解决上述警告问题
执行yum命令yum install -y libnfnetlink-devel解决上述错误问题
12、阿里云下载镜像得路径注意下,是isos
https://mirrors.aliyun.com/centos/7.4.1708/isos/x86_64/
13、Keepalived中配置文件也可以自定义监控脚本
#自定义监控脚本 vrrp_script chk_haproxy { script "/etc/keepalived/check_haproxy.sh" interval 5 weight 2 }
14、Keepalived和haproxy配置文件详解
来自下面链接
https://blog.csdn.net/HzSunshine/article/details/61673572
简单参考下
! Configuration File for keepalived global_defs { #设置报警通知邮件地址,可以设置多个 notification_email { msun1996@163.com } #设置邮件的发送地址 notification_email_from keepalived@msun.com #设置smtp server的地址,该地址必须是存在的 smtp_server 127.0.0.1 #设置连接smtp server的超时时间 smtp_connect_timeout 30 #运行Keepalived服务器的标识,发邮件时显示在邮件标题中的信息 router_id HAProxy_msun } # 检测haproxy脚本 vrrp_script chk_haproxy { script "/etc/keepalived/check_haproxy.sh" interval 2 #下面方法相对更优 #script "killall -0 haproxy" #killall (安装 yum install psmisc -y) #interval 2 #weghit 2 #权值脚本成功时(0)等于priority+weghit #否则为priority } #定义VRRP实例,实例名自定义 vrrp_instance haproxy_msun { #指定Keepalived的角色,MASTER为主服务器,BACKUP为备用服务器 state MASTER #从设置为BACKUP #指定HA监测的接口 interface eno16777736 #虚拟路由标识,这个标识是一个数字(1-255),在一个VRRP实例中主备服务器ID必须一样 virtual_router_id 68 #优先级,数字越大优先级越高,在一个实例中主服务>器优先级要高于备服务器 priority 100 #从设置为99 #设置主备之间同步检查的时间间隔单位秒 advert_int 1 #设置验证类型和密码 authentication { #验证类型有两种{PASS|HA} auth_type PASS #设置验证密码,在一个实例中主备密码保持一样 auth_pass 1689 } track_script { chk_haproxy # 执行监控的服务 } #定义虚拟IP地址,可以有多个,每行一个 virtual_ipaddress { 192.168.1.160 } }
haproxy配置文件详解1
简单参考下
global #全区日志配置 使用rsyslog的local3设备 log 127.0.0.1 local3 info #工作目录(安全) chroot /var/lib/haproxy #pid文件存储目录 pidfile /var/run/haproxy.pid #后台进程数量 nbproc 1 #每个进程最大并发数 maxconn 40000 user haproxy group haproxy #后台程序模式工作 daemon defaults mode http #后端连接重试次数,超出标识不可用 retries 3 #连接服务器最长等待时间 timeout connect 10s #客户端发送请求最长等待时间 timeout client 30s #服务器会复客户端最长等待时间 timeout server 30s #对后端服务器的检测超时时间 timeout check 10s #定义HAProxy监控页面 listen admin_stats bind 0.0.0.0:9188 mode http log 127.0.0.1 local3 err #HAProxy监控页面统计自动刷新时间。 stats refresh 30s #设置监控页面URL路径。 http://IP:9188/haproxy-status可查看 stats uri /haproxy-status #统计页面密码框提示信息 stats realm welcome login\ Haproxy #登录统计页面用户和密码 stats auth admin:123456 #隐藏HAProxy版本信息 stats hide-version #设置TURE后可在监控页面手工启动关闭后端真实服务器 stats admin if TRUE #定义前端虚拟节点 frontend www #监听端口 bind *:80 mode http #启用日志记录HTTP请求。 option httplog #启用后后端服务器可以获得客户端IP option forwardfor #客户端和服务器完成一次连接请求后,HAProxy主动关闭TCP链接(优化选项) option httpclose #使用全局日志配置 log global #指定后端服务池(backend定义htmpool) default_backend htmpool #定义后端真实服务器 backend htmpool mode http #用于cookie保持环境。(如后端服务器故障,客户端cookie不会刷新,用此来把用户请求强制定向到正常服务器) option redispatch #负载均衡很高时,自动结束当前队列处理时间长的连接 option abortonclose #负载均衡算法 balance roundrobin #允许向cookie插入SERVERID.下面server可以使用cookie定义 cookie SERVERID #启用HTTP服务状态检测功能 (后端服务器一定要存在此文件,不然haproxy认为其故障) option httpchk GET /index.html #后端服务设置 server web1 192.168.1.186:80 cookie server1 weight 6 check inter 2000 rise 2 fall 3 server web2 192.168.1.188:80 cookie server2 weight 6 check inter 2000 rise 2 fall 3
haproxy配置文件参考2
来自http://blog.chinaunix.net/uid-25266990-id-3989321.html
这里主要看下acl规则
#vim /etc/haproxy/haproxy.cfg # this config needs haproxy-1.1.28 or haproxy-1.2.1 global log 127.0.0.1 local0 #日志输出配置,所有日志都记录在本机,通过local0输出 log 127.0.0.1 local1 notice #log loghost local0 info maxconn 4096 #最大连接数 chroot /usr/share/haproxy #改变当前工作目录。 uid 99 #所属用户的uid gid 99 #所属运行的gid daemon #以后台形式运行haproxy #debug #quiet defaults log global mode http #默认的模式mode { tcp|http|health },tcp是4层,http是7层,health只会返回OK option httplog option dontlognull option redispatch #当serverId对应的服务器挂掉后,强制定向到其他健康的服务器 option abortonclose #当服务器负载很高的时候,自动结束掉当前队列处理比较久的链接 retries 3 #两次连接失败就认为是服务器不可用 maxconn 2000 #默认的最大连接数 #timeout http-keep-alive 10s # timeout queue 1m contimeout 5000 #连接超时 clitimeout 50000 #客户端超时 srvtimeout 50000 #服务器超时 timeout check 5s #心跳检测超时 stats refresh 30s #统计页面自动刷新时间 stats uri /stats #统计页面url stats realm baison-test-Haproxy #统计页面密码框上提示文本 stats auth admin:admin123 #统计页面用户名和密码设置 stats hide-version #隐藏统计页面上HAProxy的版本信息 frontend www bind *:80 #这里建议使用bind *:80的方式,要不然做集群高可用的时候有问题,vip切换到其他机器就不能访问了。 acl web hdr(host) -i www.zhirs.com #acl后面是规则名称,-i是要访问的域名,如果访问www.zhirs.com这个域名就分发到下面的webserver 的作用域。 acl img hdr(host) -i img.zhirs.com #如果访问img.baison.com.cn就分发到imgserver这个作用域。 use_backend webserver if web use_backend imgserver if img backend webserver #webserver作用域 mode http balance roundrobin #banlance roundrobin 轮询,balance source 保存session值,支持static-rr,leastconn,first,uri等参数 option httpchk /index.html #检测文件,如果分发到后台index.html访问不到就不再分发给它 server web01 192.168.137.201:80 check inter 2000 fall 3 weight 30 server web01 192.168.137.202:80 check inter 2000 fall 3 weight 20 server web01 192.168.137.203:80 check inter 2000 fall 3 weight 10 backend imgserver mode http option httpchk /index.php balance roundrobin server img01 192.168.137.101:80 check inter 2000 fall 3 server img02 192.168.137.102:80 check inter 2000 fall 3
haproxy参考配置3
来自
https://blog.csdn.net/sj349781478/article/details/78862315
global log 127.0.0.1 local0 #[日志输出配置,所有日志都记录在本机,通过local0输出] log 127.0.0.1 local1 notice #定义haproxy 日志级别[error warringinfo debug] daemon #以后台形式运行harpoxy nbproc 1 #设置进程数量 maxconn 4096 #默认最大连接数,需考虑ulimit-n限制 #user haproxy #运行haproxy的用户 #group haproxy #运行haproxy的用户所在的组 #pidfile /var/run/haproxy.pid #haproxy 进程PID文件 #ulimit-n 819200 #ulimit 的数量限制 #chroot /usr/share/haproxy #chroot运行路径 #debug #haproxy 调试级别,建议只在开启单进程的时候调试 #quiet ########默认配置############ defaults log global mode http #默认的模式mode { tcp|http|health },tcp是4层,http是7层,health只会返回OK option httplog #日志类别,采用httplog option dontlognull #不记录健康检查日志信息 retries 2 #两次连接失败就认为是服务器不可用,也可以通过后面设置 #option forwardfor #如果后端服务器需要获得客户端真实ip需要配置的参数,可以从Http Header中获得客户端ip option httpclose #每次请求完毕后主动关闭http通道,haproxy不支持keep-alive,只能模拟这种模式的实现 #option redispatch #当serverId对应的服务器挂掉后,强制定向到其他健康的服务器,以后将不支持 option abortonclose #当服务器负载很高的时候,自动结束掉当前队列处理比较久的链接 maxconn 4096 #默认的最大连接数 timeout connect 5000ms #连接超时 timeout client 30000ms #客户端超时 timeout server 30000ms #服务器超时 #timeout check 2000 #心跳检测超时 #timeout http-keep-alive10s #默认持久连接超时时间 #timeout http-request 10s #默认http请求超时时间 #timeout queue 1m #默认队列超时时间 balance roundrobin #设置默认负载均衡方式,轮询方式 #balance source #设置默认负载均衡方式,类似于nginx的ip_hash #balnace leastconn #设置默认负载均衡方式,最小连接数 ########统计页面配置######## listen stats bind 0.0.0.0:1080 #设置Frontend和Backend的组合体,监控组的名称,按需要自定义名称 mode http #http的7层模式 option httplog #采用http日志格式 #log 127.0.0.1 local0 err #错误日志记录 maxconn 10 #默认的最大连接数 stats refresh 30s #统计页面自动刷新时间 stats uri /stats #统计页面url stats realm XingCloud\ Haproxy #统计页面密码框上提示文本 stats auth admin:admin #设置监控页面的用户和密码:admin,可以设置多个用户名 stats auth Frank:Frank #设置监控页面的用户和密码:Frank stats hide-version #隐藏统计页面上HAProxy的版本信息 stats admin if TRUE #设置手工启动/禁用,后端服务器(haproxy-1.4.9以后版本) ########设置haproxy 错误页面##### #errorfile 403 /home/haproxy/haproxy/errorfiles/403.http #errorfile 500 /home/haproxy/haproxy/errorfiles/500.http #errorfile 502 /home/haproxy/haproxy/errorfiles/502.http #errorfile 503 /home/haproxy/haproxy/errorfiles/503.http #errorfile 504 /home/haproxy/haproxy/errorfiles/504.http ########frontend前端配置############## frontend main bind *:80 #这里建议使用bind *:80的方式,要不然做集群高可用的时候有问题,vip切换到其他机器就不能访问了。 acl web hdr(host) -i www.abc.com #acl后面是规则名称,-i为忽略大小写,后面跟的是要访问的域名,如果访问www.abc.com这个域名,就触发web规则,。 acl img hdr(host) -i img.abc.com #如果访问img.abc.com这个域名,就触发img规则。 use_backend webserver if web #如果上面定义的web规则被触发,即访问www.abc.com,就将请求分发到webserver这个作用域。 use_backend imgserver if img #如果上面定义的img规则被触发,即访问img.abc.com,就将请求分发到imgserver这个作用域。 default_backend dynamic #不满足则响应backend的默认页面 ########backend后端配置############## backend webserver #webserver作用域 mode http balance roundrobin #balance roundrobin 负载轮询,balance source 保存session值,支持static-rr,leastconn,first,uri等参数 option httpchk /index.html HTTP/1.0 #健康检查, 检测文件,如果分发到后台index.html访问不到就不再分发给它 server web1 10.16.0.9:8085 cookie 1 weight 5 check inter 2000 rise 2 fall 3 server web2 10.16.0.10:8085 cookie 2 weight 3 check inter 2000 rise 2 fall 3 #cookie 1表示serverid为1,check inter 1500 是检测心跳频率 #rise 2是2次正确认为服务器可用,fall 3是3次失败认为服务器不可用,weight代表权重 backend imgserver mode http option httpchk /index.php balance roundrobin server img01 192.168.137.101:80 check inter 2000 fall 3 server img02 192.168.137.102:80 check inter 2000 fall 3 backend dynamic balance roundrobin server test1 192.168.1.23:80 check maxconn 2000 server test2 192.168.1.24:80 check maxconn 2000 listen tcptest bind 0.0.0.0:5222 mode tcp option tcplog #采用tcp日志格式 balance source #log 127.0.0.1 local0 debug server s1 192.168.100.204:7222 weight 1 server s2 192.168.100.208:7222 weight 1
15、如果两台Keepalived机器必须开启防火墙的话
假设这里不使用firewalld,使用的是iptables
需要添加源地址信任。不然无法收到心跳报文
master机器添加backup机器的信任
[root@data-1-1 ~]# iptables -I INPUT -s 10.0.1.62 -j ACCEPT [root@data-1-1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.0.1.62 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@data-1-1 ~]#
backup机器添加下来自master机器的信任
[root@data-1-2 ~]# iptables -I INPUT -s 10.0.1.61 -j ACCEPT [root@data-1-2 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.0.1.61 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@data-1-2 ~]#
16、模拟裂脑
假如backup机器防火墙设置不当,没允许master的报文。它收不到master的心跳报文,就认为master机器服务down机或者Keepalived服务死掉了
它会自动添加vip,可以看到最后10.0.1.63这个vip自动配置上了。这样就出现裂脑了
[root@data-1-2 ~]# iptables -L -n -t filter --line-numbers Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:18181 2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8181 3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 4 ACCEPT all -- 10.0.1.61 0.0.0.0/0 5 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination [root@data-1-2 ~]# iptables -D INPUT 4 [root@data-1-2 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:18181 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8181 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@data-1-2 ~]# ip ad 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0 valid_lft forever preferred_lft forever [root@data-1-2 ~]# ip ad 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.0.1.63/24 scope global secondary eth0 valid_lft forever preferred_lft forever [root@data-1-2 ~]#
而此时master机器也没释放资源
[root@data-1-1 ~]# ip ad 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:9d:0b:ee brd ff:ff:ff:ff:ff:ff inet 10.0.1.61/24 brd 10.0.1.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.0.1.63/24 scope global secondary eth0 valid_lft forever preferred_lft forever [root@data-1-1 ~]#
修复规则,放行来自master机器的数据包,裂脑情况消失
[root@data-1-2 ~]# ip ad 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.0.1.63/24 scope global secondary eth0 valid_lft forever preferred_lft forever [root@data-1-2 ~]# iptables -I INPUT -s 10.0.1.61 -j ACCEPT [root@data-1-2 ~]# ip ad 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:50:56:9d:50:d7 brd ff:ff:ff:ff:ff:ff inet 10.0.1.62/24 brd 10.0.1.255 scope global eth0 valid_lft forever preferred_lft forever [root@data-1-2 ~]#
下面是一些常用的添加防火墙规则的命令
iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -I INPUT -p tcp --dport 8181 -j ACCEPT iptables -I INPUT -p tcp --dport 18181 -j ACCEPT iptables -A INPUT -j DROP