Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socke

[pivertd]

Hi !

I recently found keepalived that seems to be a great solution... and is exactly what we need for having an active-active failover on our two internet gateways.

But I experience some problems :

1. When starting keepalived from command line of by using the /etc/init.d/keepalived init script, I have this error :
Apr 7 14:28:57 gateway2 Keepalived: Starting Keepalived v1.1.5 (25/01, 2004)
Apr 7 14:28:57 gateway2 Keepalived: Starting Healthcheck child process, pid=23551
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Using MII-BMSR NIC polling thread...
Apr 7 14:28:57 gateway2 Keepalived: Starting VRRP child process, pid=23553
Apr 7 14:28:57 gateway2 Keepalived_vrrp: Using MII-BMSR NIC polling thread...
Apr 7 14:28:57 gateway2 Keepalived_vrrp: Registering Kernel netlink reflector
Apr 7 14:28:57 gateway2 Keepalived_vrrp: Registering Kernel netlink comand channel
Apr 7 14:28:57 gateway2 Keepalived_vrrp: Registering gratutious ARP shared channel
Apr 7 14:28:57 gateway2 Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socket
Apr 7 14:28:57 gateway2 Keepalived: Watchdog: Error connecting /tmp/.healthcheckers wdog socket
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Registering Kernel netlink reflector
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Registering Kernel netlink comand channel
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Configuration is using : 173058 Bytes
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Watchdog: Starting listener on /tmp/.healthcheckers wdog socket
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Activating healtchecker for service [192.168.100.200:80]
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Activating healtchecker for service [192.168.100.200:443]
Apr 7 14:28:57 gateway2 Keepalived_healthcheckers: Activating healtchecker for service [192.168.0.91:25]
Apr 7 14:29:00 gateway2 CRON[23555]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Apr 7 14:29:02 gateway2 Keepalived: Watchdog: success connecting /tmp/.healthcheckers wdog socket
Apr 7 14:29:02 gateway2 Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socket
Apr 7 14:29:07 gateway2 Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socket
Apr 7 14:29:12 gateway2 Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socket


But if I launch the keepalived with the options --vrrp and --check separately... It works perfectly. It seems that the keepalived process running the vrrp crash... because when I run keepalived --vrrp I have in my logs :
Apr 7 14:34:59 gateway2 Keepalived: Starting Keepalived v1.1.5 (25/01, 2004)
Apr 7 14:34:59 gateway2 Keepalived: Starting VRRP child process, pid=23656
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Using MII-BMSR NIC polling thread...
Apr 7 14:34:59 gateway2 Keepalived: Watchdog: Error connecting /tmp/.vrrp wdog socket
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Registering Kernel netlink reflector
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Registering Kernel netlink comand channel
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Registering gratutious ARP shared channel
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Configuration is using : 197625 Bytes
Apr 7 14:34:59 gateway2 Keepalived_vrrp: Watchdog: Starting listener on /tmp/.vrrp wdog socket
Apr 7 14:34:59 gateway2 Keepalived_vrrp: VRRP_Instance(VI_1) Transition to MASTER STATE
Apr 7 14:35:00 gateway2 Keepalived_vrrp: VRRP_Instance(VI_1) Entering MASTER STATE
Apr 7 14:35:00 gateway2 Keepalived_vrrp: Remote SMTP server [192.168.0.92:25] connected.
Apr 7 14:35:00 gateway2 Keepalived_vrrp: SMTP alert successfully sent.
Apr 7 14:35:04 gateway2 Keepalived: Watchdog: success connecting /tmp/.vrrp wdog socket

That is really better... And I can see the virtual ip with the "ip addr" cmd.



2. My second problem is not really a problem of keepalived... but a problem of firewall.
I have 2 gateways. The first, that is actually in production... running shorewall. The second is my keepalived gateway. When I connect to a server through the lvs... The packet correctly reach the server (NAT method), but the answer from the server leaves our newtork through the first gateway runing shorewall... That blocks the packet. (the internet is masqueraded for all our servers).


PS: My second gateway does not yet have shorewall running... but that 'll be for an other day..


Does anybody have an idea ??

Thanks !!