We need a STONITH/fencing agent for our Pacemaker cluster. What's a reliable, hardware-agnostic one?

If by hardware-agnostic you mean “doesn't depend on a particular server vendor or IPMI controller,” my first choice is SBD (Storage-Based Death) with a watchdog.

Best fit: SBD + watchdog

SBD is a Pacemaker-native fencing mechanism that uses a node's watchdog to force a hard reset, optionally using shared storage for “poison-pill” fencing. It works independently of Dell iDRAC, HPE iLO, Supermicro IPMI, etc.

There are two useful variants:

• Watchdog-only SBD — each node has a functional hardware/software watchdog; a node that must be fenced self-reboots.
• SBD with shared block storage — Pacemaker/SBD writes a fencing message to shared storage, and the target node's SBD daemon sees it and forces a reset. This gives you stronger fencing semantics when shared storage is available.

For example, on current RHEL, the watchdog approach can be exposed to Pacemaker as:

pcs stonith create sbd_watchdog fence_watchdog

Red Hat documents sbd as a supported alternative to traditional fence-agent-based devices, including on RHEL 8/9/10.

One important caveat

I wouldn't call SBD universally hardware-agnostic. It requires a reliable watchdog on every node for watchdog fencing, and shared-storage SBD requires storage that remains accessible under the failure scenarios you're trying to protect against. Red Hat specifically notes that storage compatibility has to be evaluated for the particular environment.

If your machines expose BMC/IPMI, then fence_ipmilan is generally the conventional production choice—but that's hardware-dependent. Pacemaker deliberately abstracts these technologies behind fence agents.

My rule of thumb:

And whatever mechanism you choose, actually test fencing (pcs stonith fence <node>) before trusting the cluster; a configured-but-untested STONITH device isn't much protection.

If you tell me whether your nodes are bare metal, VMs, or mixed, and whether you have shared storage/watchdogs, I can recommend the exact fencing topology and pcs configuration.

When looking for a hardware-agnostic and reliable fencing solution for a Pacemaker cluster that doesn't tie you down to a specific vendor's IPMI, iLO, or proprietary PDU, the gold standard is SBD (STONITH Block Device).

Instead of toggling physical power via a network management board, SBD uses shared storage (or a shared block device/disk) and a watchdog timer to achieve robust, software-defined self-fencing.

How SBD Works

• Shared Storage (Poison Pill): All cluster nodes have access to a small shared block device (like a shared SAN LUN, a tiny iSCSI/FC disk, or multiple redundant disks). If a node loses cluster communication or misbehaves, the surviving nodes write a "poison pill" message to the shared disk targeting the bad node.
• Watchdog Timer: Every node runs the sbd daemon, which continuously pets a local hardware watchdog device. When a node sees its own ID flagged on the shared disk—or if Corosync/Pacemaker crashes locally—the daemon stops petting the watchdog. The hardware watchdog immediately triggers a hard system reset/panic.

Why it's Reliable and Hardware-Agnostic

• No Vendor Lock-in: It doesn't care if you're running Dell, HPE, Supermicro, white-box servers, or virtual machines; as long as they can access a tiny shared block device and have a working watchdog, it works.
• No Network Dependencies on IPMI: IPMI/iLO interfaces frequently suffer from authentication failures, locked BMC firmware, or isolated management networks going down. SBD bypasses this by leveraging your existing high-availability storage path.
• Fast and Deterministic: Hard resets via a hardware watchdog are virtually instantaneous.

Quick Setup Overview

1. Provision a Watchdog: Ensure a hardware watchdog module (e.g., iTCO_wdt or IPMI watchdog) is loaded on every node.
2. Configure Storage: Allocate a tiny shared LUN (even 1MB to 10MB is plenty) accessible by all cluster members.
3. Initialize SBD: Format and initialize the block device using sbd -d /dev/disk/by-id/... create.
4. Integrate with Pacemaker: Configure the stonith:external/sbd agent inside Pacemaker so it knows how to interface with the local daemon.

(Note: If shared storage isn't an option and you are running in a public cloud, cloud-specific API fence agents like fence_aws, fence_gce , or fence_azure_arm serve a similarly hardware-agnostic role for virtual environments.)

Would you like the exact configuration steps and commands for setting up SBD, or are you running this in a cloud environment (AWS, Azure, GCP) where a cloud-native API fence agent might fit better?

If by hardware-agnostic you mean “not tied to a server vendor’s iLO/iDRAC/IPMI implementation,” the best fit is usually SBD (STONITH Block Device).

• SBD + a watchdog is a mature Pacemaker fencing mechanism. It uses a shared block device (SAN/iSCSI/etc.) to deliver fencing messages and a watchdog on each node to guarantee that a node actually reboots if it becomes unresponsive.
• It avoids dependence on vendor-specific management controllers/firmware, which is explicitly one of SBD's advantages.
• You can also use diskless SBD with just node-local watchdogs, but there are important topology constraints: in particular, don't use diskless SBD as the sole fencing mechanism for a two-node cluster.
• Pacemaker itself recommends real fencing; simply using something like SSH to tell the failed node to shut itself down is not considered reliable fencing because the target may be precisely what has failed.

What I'd choose

For a conventional Pacemaker cluster, I'd favor SBD with stonith-enabled=true, rather than trying to find a magical “software-only” fence agent. SBD is specifically designed to provide fencing without requiring a particular server-management vendor.

If you tell me whether this is 2 or 3+ nodes, physical vs VMs, and whether you have shared storage, I can recommend the exact fencing topology and pcs configuration.

When you need a reliable, hardware-agnostic (and vendor-neutral) STONITH solution for a Pacemaker cluster, software-based fencing via SBD (STONITH Block Device) or SCSI persistent reservations (fence_scsi) are the gold standards. They eliminate any dependency on IPMI, iLO, iDRAC, or specific PDU hardware.

The two best hardware-agnostic approaches include:

• SBD (STONITH Block Device / Storage-Based Death)
  • How it works: It runs a small daemon (sbd ) on each cluster node that communicates via a shared block device (SAN, iSCSI, or shared disk). If a node loses cluster communication or is designated for fencing, a "poison pill" message is written to the disk, or the local software/hardware watchdog triggers a hard reset/panic on the node.
  • Hardware agnostic aspect: It works identically whether your nodes are physical servers, KVM/VMware VMs, or cloud instances—as long as they can access a tiny shared LUN/disk or use a watchdog.
  • Requirement: A reliable hardware watchdog device (e.g., /dev/watchdog ) on each node.
• SCSI Fencing (fence_scsi / fence_mpath)
  • How it works: Uses SCSI-3 Persistent Reservations (PR) over shared storage. When a node is fenced, the surviving nodes command the shared storage array to revoke the misbehaving node's reservation key. If the fenced node attempts to keep writing to the LUN, a local watchdog check trips and forcefully resets/panics the node.
  • Hardware agnostic aspect: Completely independent of server vendor or power management firmware; it relies entirely on your shared storage infrastructure supporting SCSI-3 PR.
  • Requirement: You must have shared block storage that supports SCSI-3 persistent reservations, and your cluster must actually use that shared storage for clustered resources (like OCFS2 or clustered LVM).

If you can tell me a bit more about your stack:

• Are you running on bare-metal, virtual machines (KVM/VMware) , or public cloud?
• Do you have shared storage (like iSCSI/SAN/NFS) already available to the cluster nodes?

I can help you choose between SBD and SCSI fencing and walk you through the exact setup commands.

For a truly hardware-agnostic and robust STONITH solution in a Pacemaker cluster, SBD (STONITH Block Device) using a shared block storage or a local hardware watchdog is the industry standard. Instead of relying on specific server vendor management boards (like IPMI, iLO, or iDRAC) or hypervisor APIs, SBD uses a software watchdog timer combined with shared storage or diskless messaging to safely self-fence or poison-pill an unresponsive node.

Why SBD is Hardware-Agnostic

• Storage-Based SBD: Relies on a tiny shared block device (like a shared LUN or iSCSI target) accessible by all cluster nodes. Nodes write heartbeats to the disk; if a node stops updating its heartbeat, the others declare it dead and signal the block device to force-reset or panic the target node.
• Watchdog-Only (Diskless) SBD: Relies strictly on a local hardware or software watchdog timer (/dev/watchdog ) on each node, often paired with a cluster quorum daemon (corosync-qdevice ), eliminating external storage dependencies while remaining completely independent of server brand.

Comparison of Hardware-Agnostic / General Fencing Agents

If you can share whether your cluster is running on bare-metal or virtual machines , and whether you have shared storage (like iSCSI/SAN) available, I can provide the exact configuration commands to set up your fencing agent.

Yes. If by hardware-agnostic you mean “doesn't depend on Dell iDRAC, HPE iLO, IPMI, a particular PDU, etc.”, my first choice is SBD (Storage-Based Death) with a watchdog.

SBD integrates with Pacemaker and uses a shared block device plus a watchdog to ensure a failed node self-fences. It is explicitly supported as an alternative to a traditional fence-agent device.

Why SBD is a good fit

• Hardware independent: works across physical servers and VMs as long as the nodes have appropriate shared storage and watchdog support.
• Doesn't rely on the failed node's network stack: a key requirement for reliable fencing. Pacemaker specifically warns against fencing mechanisms that depend on the target node functioning correctly.
• Mature Pacemaker integration: typically exposed as stonith:fence_sbd, with pcs stonith sbd tooling on RHEL-family systems.
• Watchdog makes the failure mode stronger: if a node receives a fencing condition but can't communicate/respond normally, the watchdog can force it to reboot rather than merely relying on the node cooperating.

A typical architecture is:

             Shared block device
              ┌───────────────┐
              │   SBD device  │
              └───────┬───────┘
                      │
          ┌───────────┴───────────┐
          │                       │
       Node A                   Node B
     Pacemaker                Pacemaker
        +                        +
       SBD                      SBD
        +                        +
    watchdog                 watchdog

One important caveat: SBD isn't magically hardware-independent. It depends on a fencing-capable watchdog and, in the traditional configuration, shared storage. Red Hat currently recommends a hardware watchdog where possible; software-emulated watchdogs such as softdog are supported but have weaker guarantees if the kernel/OS is severely starved or malfunctioning.

If you don't have shared storage, I'd instead use a power-based fence agent appropriate to whatever infrastructure you have (IPMI/iLO/iDRAC, cloud API, PDU, hypervisor API, etc.). A generic SSH-based “run shutdown on the other node” agent is not suitable for production STONITH because the exact failure you're fencing may leave SSH unusable or the node partially alive.

Bottom line:
Shared storage + watchdog available → fence_sbd is probably the best hardware-agnostic choice.
No shared storage → tell me whether these are bare metal, VMs, or cloud instances and I can recommend the most robust fence agent for that topology.

For a reliable, truly hardware-agnostic STONITH solution in a Pacemaker cluster, use SBD (STONITH Block Device) via the fence_sbd agent. SBD relies on a shared block device (like a small SAN LUN, iSCSI target, or shared disk) and a local kernel watchdog timer rather than vendor-specific power APIs or network lights-out cards, making it completely independent of underlying server models or hypervisors.

Why SBD is Hardware-Agnostic

• Storage Independence: Works across any shared block storage accessible via standard paths (/dev/disk/by-id/...).
• Watchdog Backed: Triggers a hard system reset via local hardware or software watchdogs if a node loses cluster communication or receives a poison pill message.
• No Vendor Lock-in: Eliminates the need to configure or trust brittle ipmitool , HP iLO, Dell DRAC, or cloud-provider API credentials for every distinct generation of hardware.

Core Setup Workflow

1. Install packages (sbd and fence-agents-sbd or equivalent via your distribution's package manager) on all cluster nodes.
2. Load a watchdog module (such as softdog or your hardware's native watchdog) on each node.
3. Initialize the shared disk from one node using the sbd utility to create the messaging layout.
4. Configure the SBD daemon in /etc/default/sbd (or /etc/sysconfig/sbd ) pointing to your watchdog and shared device paths.
5. Register the agent in Pacemaker using your cluster management tool (pcs or crmsh ) to add fence_sbd as a cluster resource.

If you'd like, let me know:

• Is your cluster physical or virtual?
• How many nodes are in the cluster?

I can provide the exact command syntax for your specific Linux distribution (pcs or crm ) to configure the SBD resource.

Yes. If by hardware-agnostic you mean “doesn’t depend on a particular server vendor’s iLO/iDRAC/IPMI implementation,” the strongest general-purpose choice is SBD (Storage-Based Death).

• SBD + watchdog — my first choice when your nodes have a hardware watchdog. SBD can self-fence a failed node using the watchdog, and shared storage is optional in newer configurations.
• fence_sbd — useful when you do have shared block storage and want fencing through SBD.
• fence_ipmilan — the better choice if you want actual power fencing through BMC/IPMI. It's broadly applicable across vendors, but obviously still requires IPMI/BMC support.
• fence_scsi / fence_mpath — alternatives when your cluster has suitable shared storage.

What I'd deploy

For a generic physical Linux/Pacemaker cluster:

Primary: SBD + a real hardware watchdog
Defense in depth: an independent power fence such as IPMI or a switched PDU, if available.

The important caveat is that fencing must be able to operate when the target node is broken. Pacemaker explicitly warns against fencing methods that depend on the target OS (for example, SSHing in and asking it to shut itself down). It also recommends that the fence path not share the cluster network, and that at least one fence device have power independence from the target.

If you tell me whether your nodes are bare metal or VMs, and whether you have shared storage and/or a hardware watchdog, I can recommend the exact STONITH configuration (pcs stonith create ...) I'd use.

If you want the closest thing to a hardware-agnostic STONITH solution for Pacemaker, SBD (STONITH Block Device) is generally the best choice.

SBD works with a local watchdog on each node and either:

• Shared-storage SBD (using a small shared block device on SAN, iSCSI, Fibre Channel, etc.), or
• Diskless SBD, which relies only on watchdog-based self-fencing if your environment supports it.

Why SBD is often preferred

• Independent of server management hardware (no dependence on IPMI, iLO, DRAC, etc.).
• Works across different vendors, making it suitable for heterogeneous clusters.
• Uses a hardware or software watchdog to ensure a node really resets if Pacemaker decides it must be fenced.
• Well-supported by major enterprise distributions such as RHEL, SUSE, and Oracle Linux.

When SBD is a good fit

• You have shared storage available (shared SBD), or
• Every node has a reliable watchdog device and you can use diskless SBD.

Caveats

SBD isn't universally the best option:

• If you have shared storage, verify your distribution's support requirements. Enterprise vendors generally require fencing that can reliably remove a node's access to shared storage; SBD satisfies this when configured correctly with a watchdog.
• Every participating node needs a working watchdog.
• Test fencing thoroughly before putting the cluster into production.

Alternatives

If SBD doesn't fit your environment:

• fence_ipmilan — common for servers with IPMI/BMC.
• Vendor-specific agents — e.g., iLO, DRAC/iDRAC, VMware, cloud providers (AWS, Azure, GCP).
• Power Distribution Unit (PDU) agents — when you have network-controlled power outlets.

These are reliable but are not hardware-agnostic, since they depend on specific management interfaces or infrastructure.

So, if your goal is one fencing mechanism that works across mixed hardware without relying on vendor-specific management controllers, SBD is the standard recommendation. If you can share whether your cluster runs on physical servers, VMs, or in the cloud—and whether you have shared storage—I can suggest the most appropriate SBD mode or an alternative.

The gold standard for a reliable, hardware-agnostic STONITH/fencing mechanism in a Pacemaker cluster is SBD (STONITH Block Device).

Unlike traditional fence agents (such as fence_ipmilan, fence_ilo , or fence_drac ) that tie you to specific vendor management firmware or network power distribution units, SBD operates at the storage and kernel level. It decouples fencing logic from motherboard management chips, making it completely uniform whether you run physical servers, mixed-vendor hardware, or virtual machines.

How SBD Works

• The Shared Block Device: Nodes communicate and coordinate heartbeat/fencing messages via a small shared LUN/disk (accessible via SAN, iSCSI, or shared cloud block storage).
• The Watchdog: Every node runs an SBD daemon tied to a local hardware or software watchdog timer (e.g., /dev/watchdog).
• Self-Fencing ("Poison Pill"): If a node loses connection to the cluster or receives a explicit fence command from a peer, it stops feeding the watchdog. When the watchdog times out, it forcefully resets the node at the hardware level, guaranteeing the OS halts safely before data corruption or a split-brain occurs.

Why SBD is the Best Hardware-Agnostic Choice

• Vendor Agnostic: Works identically on Supermicro, Dell, HPE, or white-box servers without dealing with fractured IPMI/BMC implementations or changing redfish/ipmi credentials.
• Environment Uniformity: The configuration profile is the same across bare-metal and virtualized architectures.
• Extremely Low Latency: Doesn't rely on external network switches or management LANs that might be segmented or slow during a failure event.

Basic Setup Overview

1. Load a watchdog kernel module on all nodes (e.g., modprobe iTCO_wdt or standard softdog for testing).
2. Initialize the shared block device from one node using the sbd tool:
   sbd -d /dev/sdb create
3. Configure /etc/sysconfig/sbd (or distribution equivalent) on each node to point to the shared device and enable the watchdog.
4. Start the SBD service and add it as a stonith:external/sbd primitive inside Pacemaker.

To help tailor the exact implementation steps, let me know:

• Is this a 2-node or multi-node cluster?
• Are you running on bare-metal, virtual machines (KVM/VMware) , or in a cloud environment?