This is a draft document that was built and uploaded automatically. It may document beta software and be incomplete or even incorrect. Use this document at your own risk.

Jump to content
Performing Maintenance Tasks on Cluster Nodes
SUSE Linux Enterprise High Availability 16.0

Performing Maintenance Tasks on Cluster Nodes

Publication Date: 20 Aug 2026

High Availability clusters require extra preparation steps before you can perform maintenance tasks, or you risk side effects such as resource failure, unsynchronized CIBs, or data loss. Use this workflow when making changes to the cluster nodes, such as hardware, software or firmware updates. This involves putting a node into standby mode and stopping the cluster services on just that node, then rebooting if required. To make changes to multiple nodes, repeat these steps on one node at a time.

Tip

If this isn't the workflow you need, see Section 7, “Other maintenance workflows” to choose the right one.

Important
Important: Maintenance window

Preparing a node for maintenance only takes a few minutes. In this scenario, most resources don't require downtime because the cluster moves them to other nodes, but some resources might stop if constraints prevent them from moving. The resources will still be highly available because only one node at a time is offline.

1 What are HA administrative modes?

While under High Availability cluster management, resources must not be started or stopped from outside the cluster (for example, with systemctl). This means that if you need to manually touch a resource, you must release it from cluster management first. Resources are also vulnerable if something goes wrong when you make changes to the cluster nodes or infrastructure. You must protect the cluster and its resources before performing maintenance tasks or you risk unwanted side effects such as resource failure, unsynchronized CIBs, or even data loss.

1.1 Basic steps

These are the basic steps for performing any maintenance tasks in a High Availability cluster:

  1. Determine the workflow you need, depending on your maintenance tasks.

  2. Apply one or more administrative modes, depending on the workflow.

  3. Perform your maintenance tasks on the cluster, node or individual resource.

  4. Put the cluster, node or resource back into normal operation.

1.2 Administrative modes

SUSE Linux Enterprise High Availability has the following modes for protecting the cluster during maintenance tasks. Depending on your task, you might need to use one of these modes or a combination of multiple modes.

Stopping the cluster services

Stopping the cluster services means stopping Pacemaker and Corosync. In this mode, the cluster is no longer running, either entirely or just on one node. Use this mode when you need to manage infrastructure, such as storage or networking, or when you need to change the configuration of the cluster services.

  • For the whole cluster: Stopping the cluster services on all nodes at once allows you to shut down a cluster while avoiding the mass migration of resources that would happen if you shut down each node one by one. When this mode is used on its own, all the resources stop. However, this doesn't guarantee a graceful shutdown. If stopping a resource fails or times out, the resource's node is fenced. Alternatively, you can avoid resource downtime by using this mode in combination with maintenance mode.

  • For one node: Stopping the cluster services on just one node allows the rest of the cluster to continue running while you perform maintenance tasks on the offline node. The node's resources either move to another node, or stop if constraints prevent them from moving. However, if stopping a resource fails or times out, the node is fenced. To avoid attempting to stop resources and the cluster services at the same time, we recommend using this mode in combination with standby mode.

Maintenance mode

In maintenance mode, the cluster stops managing the resources and won't start, stop or monitor them. This allows you to manually manage applications or services without interference from the cluster. However, resources aren't highly available while in this mode, so they won't fail over to another node if the current node shuts down or reboots.

  • For the whole cluster: Cluster maintenance mode puts all the resources into maintenance mode at once. If you stop or restart the cluster services while in this mode, most resources can continue to run even while the cluster is offline. This allows you to make cluster configuration changes with minimal resource downtime. However, any resources that depend on Corosync, such as DLM, must be stopped.

  • For one node: Node maintenance mode puts all the resources that are running on a specific node into maintenance mode at once. Don't stop or restart the cluster services while in this mode. Without proper caution, this can lead to undesirable effects, such as concurrency violations, where resources mistakenly run on multiple nodes instead of only one node.

  • For one resource: Resource maintenance mode puts a single resource into maintenance mode. You can also put groups and clones into resource maintenance mode.

Standby mode

When a node is in standby mode, it can't run resources. Any resources that were running on it either move to another node, or stop if constraints prevent them from moving. Standby mode gives the resources more time to move or stop successfully because they aren't limited by the shutdown timeout of the cluster services. Therefore, this mode is useful for gracefully evacuating a node before stopping the cluster services or rebooting the node.

Unmanaged mode

When a resource is in unmanaged mode, the cluster won't start or stop it. However, unlike maintenance mode, the cluster still monitors the resource and reports any failures. This can be useful for troubleshooting. In most other cases, maintenance mode is more appropriate.

1.3 For more information

For more information, see https://clusterlabs.org/projects/pacemaker/doc/3.0/Pacemaker_Administration/html/administrative.html.

2 Putting a node into standby mode

Use standby mode to gracefully evacuate a node before stopping the cluster services or rebooting the node. When you put a node into standby mode, its resources either move to another node, or stop if constraints prevent them from moving.

  • CRM Shell
  • Hawk

Perform this procedure on the node you want to put into standby mode.

  1. Log in to the node either as the root user or as a user with sudo privileges.

  2. Put the node into standby mode:

    > sudo crm --wait node standby

    Use --wait to make sure the node's resources have really moved or stopped before the command returns.

    By default, the node will remain in standby mode after rebooting. Alternatively, you can set the node to come back online automatically with crm --wait node standby reboot.

  3. Check the status of the cluster:

    > sudo crm status

    The node should show the status standby.

3 Stopping the cluster services for one node

Stopping the cluster services means stopping Pacemaker and Corosync. When used on one node, the node is no longer an active member of the cluster. The node's resources either move to another node, or stop if constraints prevent them from moving. However, if stopping a resource fails or times out, the node is fenced. To avoid attempting to stop resources and the cluster services at the same time, we recommend using this mode in combination with standby mode.

Warning
Warning: Don't stop the cluster services in single-node maintenance mode

Stopping the cluster services while in single-node maintenance mode can lead to undesirable effects. Resources running on this node might also start on another node. Caution is required to prevent potential concurrency violations.

Perform this procedure on the node you want to stop.

  1. Log in to the node either as the root user or as a user with sudo privileges.

  2. Check the status of the cluster:

    > sudo crm status
    • If the node is in maintenance mode: Don't stop the cluster services, as this can lead to undesirable effects. Take the node out of maintenance mode first.

    • If the node is in standby mode: The resources have either moved to other nodes or stopped, so you can safely stop the cluster services.

    • If the node isn't in either mode: When you stop the cluster services, the resources attempt to move to other nodes. If they can't move, they stop. However, if any resources fail to stop before the cluster's shutdown timeout, the node will be fenced.

  3. Stop the cluster services on the node:

    > sudo crm cluster stop
  4. Check the status of the cluster services:

    > sudo crm cluster status

    Both Pacemaker and Corosync should be inactive.

4 Performing the maintenance tasks

Perform your maintenance tasks on the cluster node. This could be hardware, software or firmware updates, for example. In this workflow, you can safely shut down or reboot the node if required.

Warning
Warning: Only make changes to one node at a time

If you need to make changes to other nodes, wait until this node is an active member of the cluster again before repeating this workflow on the next node.

5 Starting the cluster services for one node

Starting the cluster services means starting Pacemaker and Corosync. The node becomes an active member of the cluster again.

Perform this procedure on the node you want to start.

  1. Log in to the node either as the root user or as a user with sudo privileges.

  2. If you rebooted the node, check whether the cluster services started automatically:

    > sudo crm cluster status

    If the cluster services started automatically, both Pacemaker and Corosync will be active.

  3. If the cluster services didn't start automatically, start them manually:

    > sudo crm cluster start
  4. Check the status of the cluster:

    > sudo crm status

    The node should be Online. It might also have the status standby. If the node is in standby mode, it won't be able to run resources again until you take it out of standby mode.

6 Taking a node out of standby mode

Taking a node out of standby mode allows resources to run on it again. The resources that moved away from the node might return to it automatically, depending on their constraint scores and stickiness.

  • CRM Shell
  • Hawk

Perform this procedure on the node you want to take out of standby mode.

  1. Log in to the node either as the root user or as a user with sudo privileges.

  2. Check the status of the cluster:

    > sudo crm status

    The node might have come back online automatically if you used the reboot option.

  3. If the node still has the status standby, bring it back online:

    > sudo crm node online
  4. Check the status of the cluster again. The node should no longer have the status standby, and resource clones should be running on the node again. Other resources might return to the node automatically, depending on their constraint scores and stickiness.

7 Other maintenance workflows

If you need a different workflow, or to perform a specific task, check this list of other articles:

General workflows

These articles describe general workflows for different scenarios:

Performing maintenance tasks on cluster infrastructure

Make changes to the configuration of the cluster services, or to infrastructure used by the cluster services, such as storage or networking. This involves putting the whole cluster into maintenance mode and stopping the cluster services on all nodes at once, but not rebooting any nodes.

(This article) Performing maintenance tasks on cluster nodes

Make changes to the cluster nodes, such as hardware, software or firmware updates. This involves putting a node into standby mode and stopping the cluster services on just that node, then rebooting if required.

Performing maintenance tasks on cluster resources

Manually manage applications or services without interference from the cluster. This involves putting one or more resources into maintenance mode so you can temporarily manage them manually.

Specific tasks

These articles describe specific maintenance or administration tasks:

Changing the Configuration of SBD

This article describes different ways to update the configuration of SBD for node fencing. Most of these tasks require stopping the cluster services, and might also require cluster maintenance mode.

HA glossary

active/active, active/passive

How resources run on the nodes. Active/passive means that resources only run on the active node, but can move to the passive node if the active node fails. Active/active means that all nodes are active at once, and resources can run on (and move to) any node in the cluster.

arbitrator

An arbitrator is a machine running outside the cluster to provide an additional instance for cluster calculations. For example, QNetd provides a vote to help QDevice participate in quorum decisions.

CIB (cluster information base)

An XML representation of the whole cluster configuration and status (cluster options, nodes, resources, constraints, etc.). The CIB manager (pacemaker-based) keeps the CIB synchronized across the cluster nodes and handles requests to modify it.

clone

In the context of a cluster resource, a clone is a resource that can be active on multiple nodes. Any resource can be cloned if its resource agent supports it.

cluster

A high-availability cluster is a group of servers (physical or virtual) designed primarily to secure the highest possible availability of data, applications and services. Not to be confused with a high-performance cluster, which shares the application load to achieve faster results.

Cluster LVM (Cluster logical volume manager)

The term Cluster LVM indicates that LVM is being used in a cluster environment. This requires configuration adjustments to protect the LVM metadata on shared storage.

cluster offline upgrade

If a new product version includes major changes that are backward incompatible, the cluster requires a cluster offline upgrade. You must stop the cluster services on all nodes and upgrade the whole cluster before bringing the nodes back online.

For minor version upgrades, see cluster rolling upgrade.

cluster partition

A cluster partition occurs when communication fails between one or more nodes and the rest of the cluster. The nodes are split into partitions but are still active. They can only communicate with nodes in the same partition and are unaware of the separated nodes. This is known as a split brain scenario.

cluster rolling upgrade

In a cluster rolling upgrade, one cluster node at a time is upgraded while the rest of the cluster is still running. Stop the cluster services on a node, upgrade it, then bring it back online to join the cluster. Continue one by one until all cluster nodes are upgraded.

For major version upgrades, see cluster offline upgrade.

cluster services

The services that run the cluster. Typically this refers to Pacemaker and Corosync, but might also include SBD and QDevice if those services are used.

cluster stack

The ensemble of software technologies and components that make up a cluster.

colocation constraint

A type of resource constraint that specifies which resources can or cannot run together on a node.

concurrency violation

A resource that should be running on only one node in the cluster is running on several nodes.

Corosync

Corosync provides reliable messaging, membership and quorum information about the cluster. This is handled by the Corosync Cluster Engine, a group communication system.

CRM (cluster resource manager)

The management entity responsible for coordinating all non-local interactions in a High Availability cluster. SUSE Linux Enterprise High Availability uses Pacemaker as the CRM. It interacts with several components: local executors on its own node and on the other nodes, non-local CRMs, administrative commands, the fencing functionality, and the membership layer.

crmsh (CRM Shell)

The command-line utility crmsh manages the cluster, nodes and resources.

Csync2

A synchronization tool for replicating configuration files across all nodes in the cluster.

DC (designated coordinator)

The pacemaker-controld daemon is the cluster controller, which coordinates all actions. This daemon has an instance on each cluster node, but only one instance is elected to act as the DC. The DC is elected when the cluster services start, or if the current DC fails or leaves the cluster. The DC decides whether a cluster-wide change must be performed, such as fencing a node or moving resources.

disaster

An unexpected interruption of critical infrastructure caused by nature, humans, hardware failure, or software bugs.

disaster recovery

The process by which a function is restored to the normal, steady state after a disaster.

Disaster Recovery Plan

A strategy to recover from a disaster with the minimum impact on IT infrastructure.

DLM (Distributed Lock Manager)

DLM coordinates accesses to shared resources in a cluster, for example, managing file locking in clustered file systems to increase performance and availability.

DRBD

DRBD® is a block device designed for building High Availability clusters. It replicates data on a primary device to secondary devices in a way that ensures all copies of the data remain identical.

existing cluster

The term existing cluster is used to refer to any cluster that consists of at least one node. An existing cluster has a basic Corosync configuration that defines the communication channels, but does not necessarily have resource configuration yet.

failover

Occurs when a resource or node fails on one machine and the affected resources move to another node.

failover domain

A named subset of cluster nodes that are eligible to run a resource if a node fails.

fencing

Prevents access to a shared resource by isolated or failing cluster members. There are two classes of fencing: resource-level fencing and node-level fencing. Resource-level fencing ensures exclusive access to a resource. Node-level fencing prevents a failed node from accessing shared resources and prevents resources from running on a node with an uncertain status. This is usually done by resetting or powering off the node.

GFS2

Global File System 2 (GFS2) is a shared disk file system for Linux computer clusters. GFS2 allows all nodes to have direct concurrent access to the same shared block storage. GFS2 has no disconnected operating mode, and no client or server roles. All nodes in a GFS2 cluster function as peers. GFS2 supports up to 32 cluster nodes. Using GFS2 in a cluster requires hardware to allow access to the shared storage, and a lock manager to control access to the storage.

group

Resource groups contain multiple resources that need to be located together, started sequentially and stopped in the reverse order.

Hawk (HA Web Konsole)

A user-friendly Web-based interface for monitoring and administering a High Availability cluster from Linux or non-Linux machines. Hawk can be accessed from any machine that can connect to the cluster nodes, using a graphical Web browser.

heuristics

QDevice supports using a set of commands (heuristics) that run locally on start-up of cluster services, cluster membership change, successful connection to the QNetd server, or optionally at regular times. The result is used in calculations to determine which partition should have quorum.

knet (kronosnet)

A network abstraction layer supporting redundancy, security, fault tolerance, and fast fail-over of network links. In SUSE Linux Enterprise High Availability 16, knet is the default transport protocol for the Corosync communication channels.

local cluster

A single cluster in one location (for example, all nodes are located in one data center). Network latency is minimal. Storage is typically accessed synchronously by all nodes.

local executor

The local executor is located between Pacemaker and the resources on each node. Through the pacemaker-execd daemon, Pacemaker can start, stop and monitor resources.

location

In the context of a whole cluster, location can refer to the physical location of nodes (for example, all nodes might be located in the same data center). In the context of a location constraint, location refers to the nodes on which a resource can or cannot run.

location constraint

A type of resource constraint that defines the nodes on which a resource can or cannot run.

meta attribute

Parameters that tell the CRM (cluster resource manager) how to treat a specific resource. For example, you might define a resource's priority or target role.

metro cluster

A single cluster that can stretch over multiple buildings or data centers, with all sites connected by Fibre Channel. Network latency is usually low. Storage is frequently replicated using mirroring or synchronous replication.

network device bonding

Network device bonding combines two or more network interfaces into a single bonded device to increase bandwidth and/or provide redundancy. When using Corosync, the bonded device is not managed by the cluster software. Therefore, the bonded device must be configured on every cluster node that might need to access it.

node

Any server (physical or virtual) that is a member of a cluster.

order constraint

A type of resource constraint that defines the sequence of actions.

Pacemaker

Pacemaker is the CRM (cluster resource manager) in SUSE Linux Enterprise High Availability, or the brain that reacts to events occurring in the cluster. Events might be nodes that join or leave the cluster, failure of resources, or scheduled activities such as maintenance, for example. The pacemakerd daemon launches and monitors all other related daemons.

parameters (instance attributes)

Parameters determine which instance of a service the resource controls.

primitive

A primitive resource is the most basic type of cluster resource.

promotable clone

Promotable clones are a special type of clone resource that can be promoted. Active instances of these resources are divided into two states: promoted and unpromoted (also known as active and passive or primary and secondary).

QDevice

QDevice and QNetd participate in quorum decisions. The corosync-qdevice daemon runs on each cluster node and communicates with QNetd to provide a configurable number of votes, allowing a cluster to sustain more node failures than the standard quorum rules allow.

QNetd

QNetd is an arbitrator that runs outside the cluster. The corosync-qnetd daemon provides a vote to the corosync-qdevice daemon on each node to help it participate in quorum decisions.

quorum

A cluster partition is defined to have quorum (be quorate) if it has the majority of nodes (or votes). Quorum distinguishes exactly one partition. This is part of the algorithm to prevent several disconnected partitions or nodes (split brain) from proceeding and causing data and service corruption. Quorum is a prerequisite for fencing, which then ensures that quorum is unique.

RA (resource agent)

A script acting as a proxy to manage a resource (for example, to start, stop or monitor a resource). SUSE Linux Enterprise High Availability supports different kinds of resource agents.

ReaR (Relax and Recover)

An administrator tool set for creating disaster recovery images.

resource

Any type of service or application that is known to Pacemaker, for example, an IP address, a file system, or a database. The term resource is also used for DRBD, where it names a set of block devices that use a common connection for replication.

resource constraint

Resource constraints specify which cluster nodes a resource can run on, what order the resources should start in, and which other resources a specific resource is dependent on.

See also colocation constraint, location constraint and order constraint.

resource set

As an alternative format for defining location, colocation or order constraints, you can use resource sets, where primitives are grouped together in one set. When creating a constraint, you can specify multiple resources for the constraint to apply to.

resource template

To help create many resources with similar configurations, you can define a resource template. After being defined, it can be referenced in primitives or in certain types of constraints. If a template is referenced in a primitive, the primitive inherits all operations, instance attributes (parameters), meta attributes and utilization attributes defined in the template.

SBD (STONITH Block Device)

SBD provides a node fencing mechanism through the exchange of messages via shared block storage. Alternatively, it can be used in diskless mode. In either case, it needs a hardware or software watchdog on each node to ensure that misbehaving nodes are really stopped.

scheduler

The scheduler is implemented as pacemaker-schedulerd. When a cluster transition is needed, pacemaker-schedulerd calculates the expected next state of the cluster and determines what actions need to be scheduled to achieve the next state.

split brain

A scenario in which the cluster nodes are divided into two or more groups that do not know about each other (either through a software or hardware failure). STONITH prevents a split-brain scenario from badly affecting the entire cluster. Also known as a partitioned cluster scenario.

The term split brain is also used in DRBD but means that the nodes contain different data.

SPOF (single point of failure)

Any component of a cluster that, if it fails, triggers the failure of the entire cluster.

stickiness

Resource stickiness is a meta attribute that determines how much a resource prefers to stay on its current node.

STONITH

Another term for the fencing mechanism that shuts down a misbehaving node to prevent it from causing trouble in a cluster. In a Pacemaker cluster, node fencing is managed by the fencing subsystem pacemaker-fenced.

switchover

The planned moving of resources to other nodes in a cluster. See also failover.

utilization

Tells the CRM what capacity a certain resource requires from a node.

watchdog

SBD (STONITH Block Device) needs a watchdog on each node to ensure that misbehaving nodes are really stopped. SBD feeds the watchdog by regularly writing a service pulse to it. If SBD stops feeding the watchdog, the hardware enforces a system restart. This protects against failures of the SBD process itself, such as becoming stuck on an I/O error.