[DRBD-user] State change failed: Device is held open by someone

[Iñigo Salvat]

Hi list,

I' am creating a HA iptables firewall using conntrack-tools, keepalived
and drbd.

It seems to be working nice but when i make a stress test (reboot de
primary node so the secondary should became primary and when the other
node starts up change again to secondary) sometimes 15% to 20% the drbd
device does not change its state. The error that appears in the logs is:
State change failed: Device is held open by someone.

I cant understand that because the script that is in use is the
following:

case "$1" in
primary)
        /usr/local/sbin/conntrackd -c
        /usr/local/sbin/conntrackd -R
        /etc/fwbuilder/firewall_script.sh
        iptables -I FORWARD -i eth0 -m state --state ESTABLISHED,RELATED
-j ACCEPT
        iptables -I FORWARD -i eth1 -p tcp --syn -m state --state NEW -j
ACCEPT
	iptables -I FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j
ACCEPT
	iptables -I INPUT -d 225.0.0.50 -j ACCEPT
	iptables -I INPUT -d 224.0.0.18 -j ACCEPT
	iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT
	iptables -I OUTPUT -d 224.0.0.18 -j ACCEPT
	iptables -I INPUT -p tcp -m tcp --dport 7788 -j ACCEPT
	iptables -I OUTPUT -p tcp -m tcp --dport 7788 -j ACCEPT
	drbdadm primary r0
	mount /dev/drbd0 /etc/fwbuilder
;;
fault)
	for a in $(ip a l eth1 | grep inet | grep secondary | awk '{print
$2}'); do ip addr del $a dev eth1; done
	umount /etc/fwbuilder
	drbdadm secondary r0
;;
backup)
	for a in $(ip a l eth1 | grep inet | grep secondary | awk '{print
$2}'); do ip addr del $a dev eth1; done
	/usr/local/sbin/conntrackd -B
	umount /etc/fwbuilder
	drbdadm secondary r0
;;
esac

exit 0 


As you can see the script ensures that when a node becomes secondary it
umount the disk and converts de drbd device in secondary so the other
node can become primary and mount the device.

I've tried it with the drbd device in reiserfs, ext3 and ext2 with the
same problem. 

Does any of you know what should happen?. Any way to solve it? any
ideas.

Thanks for your help.

Aiko
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linbit.com/pipermail/drbd-user/attachments/20080915/13086f4d/attachment.htm>