keepalived provides a strong and robust health checking for LVS clusters. It nginx implements a framework of health checking on multiple layers for server failover, and VRRPv2 stack to handle director failover. How do I install and configure Keepalived for reverse proxy server such as nginx or lighttpd?

If your are using a LVS director to loadbalance a server pool in a production environment, you may want to have a robust solution for healthcheck & failover. This will also work with reverse proxy server such as nginx.

lb0 – Linux box directly connected to the Internet via eth1. This is master load balancer.
lb1 – Linux box directly connected to the Internet via eth1. This is backup load balancer. This will become active if master networking failed.

202.54.1.1 – This ip moves between lb0 and lb1 server. It is called virtual IP address and it is managed by keepalived.
eth0 is connected to LAN and all other backend software such as Apache, MySQL and so on.

You need to install the following softwares on both lb0 and lb1:

keepalived for IP failover.
iptables to filter traffic
nginx or lighttpd revers proxy server.

DNS settings should be as follows:

hackadmin.in – Our sample domain name.
lb0.hackadmin.in – 202.54.1.11 (real ip assigned to eth1)
lb1.hackadmin.in – 202.54.1.12 (real ip assigned to eth1)
www.hackadmin.com – 202.54.1.1 (VIP for web server) do not assign this IP to any interface.

Install Keepalived

Visit keepalived.org to grab latest source code. You can use the wget command to download the same (you need to install keepalived on both lb0 and lb1):

# cd /opt

# wget http://www.keepalived.org/software/keepalived-1.1.19.tar.gz

#  tar -zxvf keepalived-1.1.19.tar.gz

# cd keepalived-1.1.19

Install Kernel Headers

You need to install the following packages:

Kernel-headers – includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package.
kernel-devel – this package provides kernel headers and makefiles sufficient to build modules against the kernel package.

Make sure kernel-headers and kernel-devel packages are installed. If not type the following install the same:

Compile keepalived

Type the following command:
# ./configure –with-kernel-dir=/lib/

At any rate, this sweet little 6000 series switch works fine connected to a PC, but through the Digi we get no love. What does Dell say? Dell says it should be exactly like all of our 5000 series switches and there should be no change in Digi pinouts, they also said, if it doesn’t work now, it never will. Whatever that means.. Well this of course creates a dilemma, we need to modify this thing and it is definitely going to drop the network.

So the short term solution is using a linux box that is connected to one of our entry points. Basically we just plugged the Dell console cable into the serial port of this server. After that you can just use screen from a terminal window to make it all go.

Once you have the Dell console cable connected, open a terminal window to the server that is hooked to the Dell(or whatever device). If you haven’t used sceen before, it’s really quite simple, basically, in your terminal window type the following command:

screen /dev/ttyS0 9600

This opens a console connection to the dell through your serial port at 9600 baud. Once you are in here, it’s life as normal, it’s getting out where you’ll need to know a little about screen.

The easiest way to bail out of this connection is the following sequence:
CTRL + A
K (SHIFT + K)

This will open a dialog at the bottom of the window asking if you are sure that you want to kill this window. Answer ‘y’ and you are back to your original terminal window.

Dat’s it.

For example, if you are adding routes where the route’s gateway will be on the network in use on eth0, you will create the following file: route-eth0

In the file add the following parameters:

GATEWAY0=192.168.195.2
NETMASK0=255.255.255.0
ADDRESS0=10.0.0.0

For each subsequent route statement increment the number that is appended to each parameter.

At any rate, here’s what I finally found:

For Windoze Whores:

http://support.microsoft.com/kb/284285

From the command line:

openssl s_client -host localhost -port 443 -ssl2

Of course you can rotate through your protocols and examine the output.

*Sigh*…

yum -y install net-snmp

Then copy over my default snmpd.conf file and fire it up.

In these instances however, snmpd either refused to start or gave the following error in /var/log/messages:

Apr 16 18:14:35 msx-db01 kernel: audit(1208384075.250:6): avc: denied { read } for pid=27712 comm="snmpd" name="snmpd.conf" dev=sda3 ino=7241736 scontext=root:system_r:snmpd_t tcontext=root:object_r:tmp_t tclass=file
Apr 16 18:14:35 msx-db01 kernel: audit(1208384075.265:7): avc: denied { read } for pid=27712 comm="snmpd" name="snmpd.conf" dev=sda3 ino=7241736 scontext=root:system_r:snmpd_t tcontext=root:object_r:tmp_t tclass=file
Apr 16 18:14:35 msx-db01 snmpd[27712]: Warning: no access control information configured. It's unlikely this agent can serve any useful purpose in this state. Run "snmpconf -g basic_setup" to help you configure the snmpd.conf file for this agent.
Apr 16 18:14:35 msx-db01 snmpd[27712]: NET-SNMP version 5.1.2


I tried to use snmpconf as suggested even though I knew my snmpd.conf file was fine. snmpconf was not on the system so I didn’t waste any time trying to find out how to get it.

So the fix is to install the net-snmp-libs package, not sure what it updates but it works.

yum -y install net-snmp-libs

The catch after that is (at least in all 3 of my situations) the following error on the yum install:

Transaction Check Error: file /usr/share/man/man8/ext2online.8.gz from install of e2fsprogs-1.35-12.11.el4_6.1 conflicts with file from package e2fsprogs-1.35-12.4.EL4

So, back to the hack admin package manager of choice *yum* :

yum update e2fsprogs

Once it’s updated, the net-snmp-libs goes in as expected.

So what’s the deal with all this? I dunno, what the hell do utilities for ext2 have to do with my ability to run snmp monitoring? Who gives a shit and if you know, you’re probably on the wrong site. At any rate, my monitoring works and I’ll leave the rest to the server fairies.

Moral of the story: If your shit works, do you really need to understand it?