يبتهج البعض دفاعا عن نوابهم أو أحزابهم، ولعلي أقف موقف محايد من الجميع لعدم انتمائي لأي حزب سياسي و ليس لي أية نشاط سياسي لا قبل ولا بعد الثورة، ما يهمني فقط مصلحة بلدي تونس ومستقبلها ومستقبل أجيال من بعدنا. أتحدث من موقعي أولا كمواطن تونسي، ثم كمهندس تونسي، مستشار في تكنولوجيا المعلومات والاتصالات، وخبير في الحوكمة الالكترونية.

موضوع الشفافية والحوكمة المفتوحة موضوع يهم كل التونسيين والتونسيات بكل اطيافهم وتياراتهم وأفكارهم وانتماءاتهم الحزبية والسياسية، لأن الموضوع يحد من تفشي الفساد الاداري من ناحية، ويعطي الشعب فرصة حقيقية للمساهمة في اتخاذ القرار وتقرير مستقبل البلاد. بالاضافة الى ان للموضوع ابعاد ايجابية عدة من الناحية الاقتصادية، السياسية، والاجتماعية. سنعود لهذه المفاهيم بالمزيد من التفاصيل، ونحن نعمل داخل مجموعة OpenGovTN على اصدار كتيب يوضح اكثر هذه المفاهيم، ولكن لاختصار الطريق ان المطالبة بالشفافية ليست مطالبة سياسية وانما هي مطالبة طبيعية وشرعية !

أولا، لدي بعض التساؤلات

1- هل تعتبرون البث المباشر للجلسة العامة تحقيق للشفافية نعم أم لا ؟

اذا كانت الاجابة بنعم، فاعطني لمحة عن القانون الذي هو بصدد المناقشة في المجلس التأسيسي حاليا ومحتواه (عدد الفصول على الاقل). ويستثنى السادة النواب من الاجابة ومن لم يجب على السؤال الأول أعلاه.

اذا كانت الاجابة بلا، فاعلم انه من موقعك كمتفرج ترى نوابا تناقش موضوع ليس لديك عنه اية خلفية ولايصلك سوى بعض ملاحظات نواب الكتلة او المعارضة فقط. تقريبا كما تشاهد احد المسلسلات التركية او المكسيكية. ومع ذلك نعتبره ضربا من الشفافية نظرا لبداية التجربة الديمقراطية في تونس، واول الغيث قطرة.

2- هل تعتبرون النواب تم انتخابهم واعطائهم الثقة العمياء ليفعلوا مايريدون داخل المجلس نعم ام لا ؟ بغض النظر عن البرامج التي قدمت سابقا ولن تنفذ أغلبها.

اذا كانت الاجابة بنعم، فضلا التوقف عند هذا السطر. وإعادة قرائة السؤال مع التركيز على عبارة “الثقة العمياء”.

اذا كانت الاجابة بلا، فاعلم أنه اي شخص مهما كان مستواه، ثقافته، وعلمه، ولم يجد النصيحة منك فأنك تشارك في افساده وتغليطه كما قال الرئيس السابق “غلطوني”. وكفى ما أفسدنا من بلادنا.

3- هل تونس تبني دستور مؤقت، أو لـ 50 سنة، أو للأجيال القادمة ؟

وأترك لكم الاجابة…

فالموضوع المطروح في الحوكمة المفتوحة هو كيف يمكنك تقديم النصح للنواب أو الحكومة وليس لديك اية معلومة عما يدور بداخل المجلس، ولمن صوت النائب، وكأن كل المواضيع المطروحة تخص امن الدولة، بما في ذلك الجلسات العلانية. دون الحديث عن غياب النواب، وأذكر (فقط للذكر ولا للحصر) بغياب 14 نائب في جلسة انتخاب رئيس الجمهورية، غياب 39 نائب في اول تصويت للمجلس التاسيسي للمصادقة على الدستور الصغير.

من خلال نقاش النواب للفصلين 62 و68 توقفت على ملاحظات النواب الرافضين قطعيا لعلانية أشغال اللجان. النقطة الاولى استند عليها النائب حبيب خضر وهي “المبدأ في عمل اللجان هو السرية، وعلى هذا الاساس يكون النص : جلسات اللجان سرية ولرئيس اللجنة أن يقرر علانيتها” ويبرر ذالك بأن عمل اللجان عمل تمهيدي… لم تتعود أذني على ما قيل فعلى حد علمي ان الاصل في الاشياء عموما هو المباح الا ما يمنعه القانون، او أحد يصلح لي اذا ذُكِر في قانون ما أن الاصل في الاشياء المنع ماعدا المباح. والقياس على الدين ممكن، بأن الاصل في الاشيء الحلال الا ما حرم الله. وهي قواعد عامة والمنع هو الاستثناء. للملاحظة، فإن الاستاذ يتحدث فقط على البث المباشر لأعمال اللجان، وهو ليس الهدف في حد ذاته. الهدف من النقاش في الفصلين تحديدا هو الشفافية في اعمال اللجان وان اختلفت الوسائل والسبل للوصول اليها.

النقطة الثانية هي نجاعة اللجان، حيث ان علانيتها يمكن ان يعطل ويؤخر اتخاذ القرار في اعمالها. والواقع انه يمكن ان نكتفي بنشر محاضر اللجان بعد اتمام أعمالها، وهذا لا يعطل ولا يؤخر مجرى العمل. صورة المحضر كما توزع على السادة النواب فهي تنشر على الموقع. لكن الوقوف على السرية التامة لكل اعمال اللجان أمر غير مقبول.

بقية المداخلات الاخرى توافق اغلبها النائب حبيب خضر، ولاتناقش مبدأ الشفافية في العمل.

ملاحظة النائب محمد السعيدي أن أغلب البرلمانات تعمل لجانها في سرية غير صحيح، وهذه بعض الامثلة :

1. البرلمان الاروبي : “Les commissions parlementaires se réunissent une ou deux fois par mois à Bruxelles et leurs débats sont publics.” المصدر : http://www.europarl.europa.eu/parliament/public/staticDisplay.do?id=45&pageRank=5&language=FR

2. فرنسا (الفصل 46) : قرار علنية الجلسة لدى مكتب اللجنة ولا ينفرد به رئيس اللجنة فقط : “À l’issue de chaque réunion, un compte rendu est publié, faisant état des travaux et des votes de la commission, ainsi que des interventions prononcées devant elle.” et que le bureau peut décider en plus de diffuser un rapport audiovisuel. Alors que dans le projet actuel du RI aucun rapport n’est public. http://www.assemblee-nationale.fr/connaissance/reglement.asp#P718_60974

3. كندا : نوعين من اللجان مغلقة وعلانية. لكل مواطن الحق في الحضور في الجلسات العلانية للمجلس واللجان ! محاضر واعمال اللجان المقدمة للمجلس تكون متوفرة للعموم. المصدر : http://www.assnat.qc.ca/fr/document/14803.html http://www.assnat.qc.ca/fr/visiteurs/assister-travaux.html

ملاحظة النائب في ما يخص لجنة الحصانة ولجنة التحقيق، أذكر بأنه يستثنى من العلانية المواضيع الامنية، وخصوصية الافراد، وهي لا تحقق الهدف من الشفافية وهو خدمة مصلحة البلاد، لا أن تصبح هتكا في أعراض العباد.

للمزيد من المعلومات، المقترحات الخمس من مجموعة OpenGovTN حول الشفافية في القانون الداخلي للمجلس التأسيسي متوفرة بالعربية والفرنسية على هذا الرابط : http://opengovtn.info/2011/12/5-propositions-pour-le-reglement-interieur-de-lassemblee-constituante/

والدعوة مفتوحة للجميع لتبادل الآراء والمشاركة في المجموعة، علما وان المجموعة تضم حاليا اكثر من 250 عضو من تيارات مختلفة، منهم عشرة نواب من 6 احزاب مختلفة من الكتلة والمعارضة.

Related Posts

No related posts.

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://archive.ubuntu.com natty-updates Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/natty-updates/Release
W: Some index files failed to download. They have been ignored, or old ones used instead.

here is a quick fix :

$ sudo apt-get clean
$ cd /var/lib/apt
$ sudo mv lists lists.old
$ sudo mkdir -p lists/partial
$ sudo apt-get clean

Should be enough, but still getting error like :

W: GPG error: http://archive.ubuntu.com natty-updates Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key

Try another clean

$ sudo apt-get clean
$ sudo aptitude -o Acquire::http::No-Cache=True -o Acquire::BrokenProxy=true update

Test now

$ sudo apt-get update
$ sudo apt-get upgrade

Fixed !

Related Posts

1. BackupExec support for ubuntu 10 and 11 (maverick and natty) »
2. Two nodes Load balance and Failover with keepalived and Ubuntu Server 10.04 x64 »
3. Shared OCFS2 partition on Ubuntu Server 10.04 x64 »

As you might know CDIA is quiet old certification and will be retired in 2011, is there an alternative for document imaging professionals ? how do you see the future ? would love to hear CDIA’s opinion.

Well, I was not expecting too much feedback for a certification that is retiring. I’m more interested to the CDIA knowledge, much more than the certification itself. The CompTIA Certified Document Imaging Architect (CDIA+) certification ensures critical knowledge for a career in the document imaging and document management industry.

It’s an international, vendor-neutral certification covering all major areas in the technologies and best practices used to plan, design, and specify a document imaging management system. The exam was last updated in 2009, and I think that the CDIA+ knowledge need lots of refreshments with new technologies, techniques, and best practices.

I have a small experience with document imaging solutions, and I have done a research – maybe in 2006 – as part of my job about different imaging solutions available, their benefits, features… etc. I have also implemented with my colleagues a very small but terrible imaging system based on open source tools, which is actually running in high-demand environment and serving million of documents, and hundreds of new documents archived daily… and this was a substitution to a commercial closed software which was expensive, limited, and poorly supported. So somehow CDIA+ knowledge was part of my daily job even if I was not certified at that time, but I was reading a lot about it.

I would like to thank Chuck Romano – SME Technical Advisory Committee member at CompTIA, who was probably the most enthusiast to keep this certification active and updated in the linkedin groups. Many CDIAs joined and welcomed the idea later ! And guess what ? Even CompTIA posted an updated about this certification and is actually recruiting subject matter experts (SME) to help keep this exam current and relevant for the industry, it’s not retiring anymore !

“This is where we’ll need all of you. To successfully complete the update of a certification exam it requires a minimum of 15 subject matter experts to participate in three separate workshops (job task analysis (JTA), item writing and cut-score workshop).”

If you are CDIA+ and have at least four years technical experience, you can become an SME and contribute to keep this certification active and updated. An exam development workshop is scheduled for October 3-7, 2011 in CompTIA Headquarters, Downers Grove, IL.

Notice that if they will not have 15 SME’s approved and confirmed to travel to this workshop by September 1st, 2011 the workshop will be cancelled and the CDIA+ retirement will be re-instated and moved to March 31st, 2012. Silly me, I would have helped to delay CDIA+ retirement for three months only No seriously, I’m not in US to actively contribute, however I passed today CDIA+ with a score of 856/900. (Thank you)

Subject matter experts (SMEs) will receive a $300 a day stipend for the 5-day workshop, as well as meals provided during the 9 a.m. to 5 p.m. working days. Recognition for SMEs includes listing on the CompTIA website pending full participation in the program. I would love to be with you guys !

You can also join CDIA+ Advocacy Group to help document imaging industry advance, grow, and strengthen.

Your contribution is really needed, thank you !

Related Posts

No related posts.

I have noticed today that in Ubuntu – and in debian generally, the port 10000 is reserved for webmin even if it’s not installed, which is a conflict with ndmp service for backupexec agent which run on the same port. A workaround will be to change ndmp port to 12000 for example and everything will be working like charm.

The only issue here, is that in a datacenter there are more complex architectures, going behind firewalls, with public servers, … you will need to restrict dynamic ports that Backupexec is using. From a range of 10000 ports to only 4 ports for example. So to make sure that there is no firewall issue, I used to add this rule to iptables (Not required) :

$ sudo iptables -A INPUT -p tcp --dport 10000:10003 -j ACCEPT
$ sudo iptables-save
$ sudo iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpts:ndmp:10003
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination

if ndmp is not defined in services, make sure you add it :

$ sudo vi /etc/services

# comment webmin line below
# webmin 10000/tcp

# add this for backupexec
ndmp 10000/tcp # backupexec

Then restart RALUS service

$ sudo /opt/VRTSralus/bin/VRTSralus.init restart

As I have previously mentioned, if 10000 is not working, try with 12000. And you are done.

Last note, it’s “recommended” to have two different selections for windows and linux servers, and have the backup method for windows servers using the reset archive bit, while the Linux using modified time. Reset archive bit might work fine for linux though even if it’s a recommendation from Symantec.

Enjoy !

Related Posts

1. Install ASP.NET 3.5 Environment for Ubuntu Maverick 10.10 »
2. Two nodes Load balance and Failover with keepalived and Ubuntu Server 10.04 x64 »
3. Ubuntu Howto Fix Repository Signature Verification Issues »

After the Tunisian revolution I was glad to see active Facebook pages for some ministries, but I was annoyed when I saw some Facebook applications implemented as services by these ministries. I’m not against these applications or against using Facebook platform, however I believe that our country need a serious e-Government plan with five key objectives :

• Transparency
• Flexibility
• Services
• Efficiency
• Follow-up

Today I’m pleased to announce the first public release of this paper. Anyone on Internet can find, view and edit, so you are welcome to voice your opinions and contribute. Released under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.

Of course you are welcome to edit anonymously, however I suggest you to use your Google Account to give you credits for contribution.

Tunisia 2.0 and e-Government, Strategies and Tactics, public draft paper is available here (Google Document, No sign-in required)

Related Posts

1. e-Government as Platform »
2. YEFI e-Government Interoperability Framework »

Video for those who missed this event :

For updates follow @DevDayEvents or join DevDay on Facebook

Related Posts

No related posts.

Cross platform is definitely one of its best features. Mono runs on Linux, Microsoft Windows, Mac OS X, BSD, and Sun Solaris, Nintendo Wii, Sony PlayStation 3, Apple iPhone. It also runs on x86, x86-64, IA64, PowerPC, SPARC (32), ARM, Alpha, s390, s390x (32 and 64 bits) and more. Developing your application with Mono allows you to run on nearly any computer in existence.

I won’t be able to try all computer in existence, but here is a quick guide to get ASP.NET 3.5 running under apache2 and ubuntu 10.10. In addition I’ll install MonoDevelop IDE, to be able to explore better Mono features : Database, debugger, Unit test, Code completion, GUI … etc.

First we need to install the necessary packages :

$ sudo apt-get install monodevelop mono-devel monodevelop-database mono-debugger mono-xsp2 libapache2-mod-mono mono-apache-server2 apache2

The Apache mod_mono module is enabled after this by default, I just disable this and enable mod_mono_auto instead for Auto Configuration :

$ sudo a2dismod mod_mono
$ sudo a2enmod mod_mono_auto

Finally we’ll have to edit the mod_mono_auto.conf and add default locations :

$ sudo -b gedit /etc/apache2/mods-available/mod_mono_auto.conf

Then add in the end :

MonoPath default "/usr/lib/mono/3.5"
MonoServerPath default /usr/bin/mod-mono-server2
AddMonoApplications default "/:/var/www"

We restart Apache again

$ sudo /etc/init.d/apache2 restart

Now let’s create a simple hello world and give it a try :

$ sudo -b gedit /var/www/index.aspx

And enter the code below, or any other sample

<%@ Page Language="C#" %>
<html>
<head>
<title>Sample Calendar</title>
</head>
<asp:calendar showtitle="true" runat="server">
</asp:calendar>

Then fire your fox at http://localhost/index.aspx and you should see the default calendar, Easy ?

More info and getting started with Mono at : http://mono-project.com/Start

Related Posts

1. BackupExec support for ubuntu 10 and 11 (maverick and natty) »
2. Two nodes Load balance and Failover with keepalived and Ubuntu Server 10.04 x64 »
3. Shared OCFS2 partition on Ubuntu Server 10.04 x64 »

I was very excited when Professor Ahmed Ballagi accepted to coach me on this project, as he was our teacher for reactor’s course in that time.

That year I have discovered and for the first time the number of elements that could be found in water, thousands and thousands of elements ! I always thought that it’s no more that the ten elements written in the mineral water bottle !

The project was finished in time, and I even found very acceptable scientific results that my couch confirmed. This study should be available in my school (ENIM), and I’m still keeping a copy of this work at my parent’s home in Tunisia.

In the last ten years I have been actively working in the IT industry and didn’t follow-up my energy engineering studies. Today I wanted to share and remember this work, as I know that Ozone is a very dangerous element, but we can get very very good water quality especially for highly polluted water.

A post treatment should be considered if this water is for human usage, otherwise it might be sufficient for any other usage.

Today, after all these years, nothing really changed ! Do you think there is not enough technology to give clean water for everybody ? No, I think there is everything available today, however politics and economy are controlling most of the water, industry is polluting the rest of it , and for a reason or another lots of money dedicated for water treatment or protection have disappeared ….  poor people are the only ones suffering around the world, and we are all poor people.

God told us in Quran, Surat Al-Anbiya (Verse 30): “Have not those who disbelieve known that the heavens and the earth were joined together as one united piece, then We parted them ? And We made from water every living thing. Will they not then believe ?”

Related Posts

No related posts.

In the beginning I opted for NFS as shared file system, then decided to go for OCFS2 which is open source, maintained by Oracle, and available under GPLv2.

Some Pros/Cons of NFS, GFS2 and OCFS2 (from Dublin OSS barcamp) :

NFS

• Pro: standard, cross-platform, easy to implement
• Con: Poor performance, single point of failure (single locking manager, even in HA)

GFS2

• Pro: Very responsive on large data files, works on physical and virtual, quota and SE-Linux support, faster than EXT3 when I/O operations are on the same node
• Con: Only supported with Red Hat, Performance issues on accessing small files on several subdirectory on different nodes

OCFS2

• Pro: Very fast with large and small data files on different node with two types of performance models (mail, data file). Works on a physical and virtual.
• Con: Supported only through contract with Oracle or SLES, no quota support, no on-line resize

First we need to install OCFS2 tools :

sudo apt-get install ocfs2-tools

There is another package ocfs2console that you want to install to configure the cluster via GUI, but since I’m using ubuntu server I’m skipping this to configure my cluster manually.

Create on every node attached to storage /etc/ocfs2/cluster.conf

sudo vi /etc/ocfs2/cluster.conf

With the content below, only replace node1 and node2 with their respective names and IP for each node :

node:
name = node1
cluster = ocfs2
number = 0
ip_address = 10.10.0.0
ip_port = 7777
node:
name = node2
cluster = ocfs2
number = 1
ip_address = 10.10.0.1
ip_port = 7777
cluster:
name = ocfs2
node_count = 2

Now you reconfigure ocfs2-tools with the default values :

sudo dpkg-reconfigure ocfs2-tools

then restart services :

sudo /etc/init.d/o2cb restart
sudo /etc/init.d/ocfs2 restart

If your fiber card connected to your host/storage, and virtual disks created and presented you should run fdisk to see it :

$ sudo fdisk -l
Disk /dev/sda: 1073.7 GB, 1073741824000 bytes
255 heads, 63 sectors/track, 130541 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x02020202

the result have been truncated to show only one virtual disk, and you might see multiple /dev/sda, /dev/sdb, /dev/sdc… according to your configuration in addition to your local hard disks. What I have done is creating a 1TB partition that I will share between my two nodes :

$ sudo fdisk /dev/sda

In fdisk menu choose “n” for new partition, and choose your partition size according to your requirements. Then use “w” to write changes and exit.

Finally we create a ocfs2 partition table :

$ mkfs.ocfs2 /dev/sda

mount your partition :

$ sudo mkdir /archives
$sudo mount -t ocfs2 /dev/sda /archives

or you can add it to fstab to mount automatically on boot :

$ /dev/sda /archives ocfs2 _netdev 0 0

The _netdev option is used here to prevent the system from attempting to mount these file systems until the network has been enabled on the system.

You want to test your new partition, and you will notice that every file/folder created on node1 is automatically available on node2, and vise-versa.

Enjoy !

Related Posts

1. Two nodes Load balance and Failover with keepalived and Ubuntu Server 10.04 x64 »
2. Create a Master Master MySQL replication – Ubuntu Server 10.04 x64 »
3. Ubuntu Howto Fix Repository Signature Verification Issues »

First you will need to set at least two IPs (10.10.0.1 and 10.10.0.2) for your servers, and one virtual (10.10.0.3) shared between the two servers, you will have for the first interface :

# The primary network interface
auto eth0
iface eth0 inet static
address 10.10.0.1
netmask 255.255.255.0
network 10.10.0.0
broadcast 10.10.0.255
gateway 10.10.0.250
auto eth0:0
iface eth0:0 inet static
address 10.10.0.3
netmask 255.255.255.0
network 10.10.0.0
broadcast 10.10.0.255

and the second interface :

# The primary network interface
auto eth0
iface eth0 inet static
address 10.10.0.2
netmask 255.255.255.0
network 10.10.0.0
broadcast 10.10.0.255
gateway 10.10.0.250
auto eth0:0
iface eth0:0 inet static
address 10.10.0.3
netmask 255.255.255.0
network 10.10.0.0
broadcast 10.10.0.255

Then we can start by installing keepalived (v1.1.17 is available in Ubuntu repositories)

sudo apt-get install keepalived

You will have to create two configuration files for the first node 10.10.0.1 (Master) and second node 10.10.0.2 (Backup). So we add in the master node :

usr01@server01:~$ sudo nano /etc/keepalived/keepalived.conf
# Keepalived Configuration File
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 10
priority 200
virtual_ipaddress {
10.10.0.3/24
}
notify_master "/etc/keepalived/notify.sh del 10.10.0.3"
notify_backup "/etc/keepalived/notify.sh add 10.10.0.3"
notify_fault "/etc/keepalived/notify.sh add 10.10.0.3"
}
virtual_server 10.10.0.3 80 {
delay_loop 30
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 10.10.0.1 80 {
weight 100
HTTP_GET {
url {
path /index.php
digest d41d8cd98f00b204e9800998ecf8427e
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 2
}
}
real_server 10.10.0.2 80 {
weight 100
HTTP_GET {
url {
path /index.php
digest d41d8cd98f00b204e9800998ecf8427e
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 2
}
}
}


And in the backup node :

usr01@server02:~$ cat /etc/keepalived/keepalived.conf
# Keepalived Configuration File
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 10
priority 100
virtual_ipaddress {
10.10.0.3/24
}
notify_master "/etc/keepalived/notify.sh del 10.10.0.3"
notify_backup "/etc/keepalived/notify.sh add 10.10.0.3"
notify_fault "/etc/keepalived/notify.sh add 10.10.0.3"
}
virtual_server 10.10.0.3 80 {
delay_loop 30
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 10.10.0.1 80 {
weight 100
HTTP_GET {
url {
path /check.txt
digest d41d8cd98f00b204e9800998ecf8427e
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 2
}
}
real_server 10.10.0.2 80 {
weight 100
HTTP_GET {
url {
path /check.txt
digest d41d8cd98f00b204e9800998ecf8427e
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 2
}
}
}

The hash is created using, notice that you can add exception so apache don’t log check.txt requests.

usr01@server01:~$ genhash -s 10.10.0.1 -p 80 -u /check.txt
MD5SUM = d41d8cd98f00b204e9800998ecf8427e
usr01@server01:~$ genhash -s 10.10.0.2 -p 80 -u /check.txt
MD5SUM = d41d8cd98f00b204e9800998ecf8427e

Also in both nodes we have to add a small utility to notify (/etc/keepalived/notify.sh) :


#!/bin/bash
VIP="$2"
case "$1" in
add)
/sbin/iptables -A PREROUTING -t nat -d $VIP -p tcp -j REDIRECT
;;
del)
/sbin/iptables -D PREROUTING -t nat -d $VIP -p tcp -j REDIRECT
;;
*)
echo "Usage: $0 {add|del} ipaddress"
exit 1
esac
exit 0

Launch keepalived on the two nodes :

sudo /etc/init.d/keepalived start

Now we need to enable ip_forward on the two nodes permanently

net.ipv4.ip_forward = 1

restart network on the two nodes

sudo /etc/init.d/networking restart

And we can check that load balancing is working correctly on Master :

usr01@server02:~$ sudo ipvsadm -L -n
[sudo] password for usr01:
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 10.10.0.3:80 rr persistent 50
-> 10.10.0.1:80 Local 100 0 0
-> 10.10.0.2:80 Route 100 0 0

Also on Backup server

usr01@server02:~$ sudo ipvsadm -L -n
[sudo] password for usr01:
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 10.10.0.3:80 rr persistent 50
-> 10.10.0.1:80 Route 100 0 0
-> 10.10.0.2:80 Local 100 0 0

We are almost done, we only need to add a preroute rule on the backup node manually to get started :

usr01@server02$ iptables -A PREROUTING -t nat -d 10.10.0.3 -p tcp -j REDIRECT
usr01@server02$ iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere 10.10.0.3
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination

That’s all.

Now you can connect to http://10.10.0.3 and you can notice load distributed between two nodes internally. In case one of the nodes fail, it will takes few seconds until the backup server notice the failure and update its iptables prerouting rule. When apache service goes down, you will notice that request on port 80 will be automatically redirected to second node.

As I have mentioned in the beginning, failover control cannot goes without downtime in such architecture, but it still great to distribute load if you are limited in hardware.

Finally, it will be much easier (even faster) to load balance using Round Robin DNS from active directory for example, if you can manage to monitor failed service or node, however this architecture remain better on failover even with a short downtime.

Related Posts

1. Shared OCFS2 partition on Ubuntu Server 10.04 x64 »
2. Create a Master Master MySQL replication – Ubuntu Server 10.04 x64 »
3. Ubuntu Howto Fix Repository Signature Verification Issues »