FENCE_AGENT(8)

💖 FENCE_AGENT(8) — bestie edition 💖

okay so we're doing fence_virsh today, from the System Manager's Manual, and honestly? she's iconic. let's get into it. ✨

---

🌸 NAME 🌸

fence_virsh — the fence agent for virsh, no cap 🫶

---

🦋 DESCRIPTION 🦋

fence_virsh is a Power Fencing agent that works with virtual machines managed by libvirt. the way it does this is lowkey unhinged but it WORKS: it logs in via ssh to a dom0, and then it runs the virsh command over there, and virsh does literally all the actual work. she's just the messenger bestie 💅

by default, virsh needs the root account to do its thing properly. so yeah, you must allow ssh login in your sshd_config. no way around it, sorry babe 😭

the fence agent takes options on the command line and from stdin, because she's versatile like that. Fenced sends parameters through stdin when it execs the agent. but you can also just run the agent by itself with command line options — super useful for testing, and for turning outlets on or off from scripts. main character energy fr fr 👑

Vendor URL: http://libvirt.org — go say hi 🌈

---

✨ PARAMETERS ✨

okay this is the big one, grab a snack 🍓

• -o, --action=[action] — the fencing action. (Default Value: reboot)
• -c, --command-prompt=[prompt] — force a Python regex for the command prompt. (Default Value: ['\\[EXPECT\\]#'])
• -k, --identity-file=[filename] — identity file (the private key) for SSH 🔑
• -4, --inet4-only — forces the agent to use IPv4 addresses only
• -6, --inet6-only — forces the agent to use IPv6 addresses only
• -a, --ip=[ip] — IP address or hostname of the fencing device. This parameter is always required.
• -u, --ipport=[port] — TCP/UDP port to use for the connection with the device. (Default Value: 22)
• -p, --password=[password] — login password or passphrase
• -S, --password-script=[script] — script to run to retrieve the password
• -n, --plug=[id] — physical plug number on the device, or the UUID / identification of the machine. This parameter is always required.
• -x, --ssh — use an SSH connection. (Default Value: 1)
• --ssh-options=[options] — SSH options to use. (Default Value: -t '/bin/bash -c "PS1=\\[EXPECT\\]# /bin/bash --noprofile --norc"')
• -l, --username=[name] — login name. This parameter is always required.
• -q, --quiet — disable logging to stderr. heads up tho: it does not affect --verbose, --debug-file, or logging to syslog. 🙈
• -v, --verbose — verbose mode. you can stack multiple -v flags on the command line (like -vvv) to crank up the verbosity. more v's, more tea ☕
• --verbose-level — level of debugging detail in the output. defaults to the number of --verbose flags you specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).
• -D, --debug-file=[debugfile] — write debug information to the given file
• -V, --version — display version information and exit
• -h, --help — display help and exit
• --plug-separator=[char] — separator for the plug parameter when you're specifying more than 1 plug. (Default Value: ,)
• -C, --separator=[char] — separator for the CSV created by the list operation. (Default Value: ,)
• --delay=[seconds] — wait X seconds before fencing is started. (Default Value: 0)
• --disable-timeout=[true/false] — disable timeout (true/false). (default: true when run from Pacemaker 2.0+)
• --login-timeout=[seconds] — wait X seconds for the cmd prompt after login. (Default Value: 5)
• --missing-as-off — missing port returns OFF instead of failure
• --power-timeout=[seconds] — test X seconds for status change after ON/OFF. (Default Value: 20)
• --power-wait=[seconds] — wait X seconds after issuing ON/OFF. (Default Value: 0)
• --shell-timeout=[seconds] — wait X seconds for the cmd prompt after issuing a command. (Default Value: 3)
• --stonith-status-sleep=[seconds] — sleep X seconds between status calls during a STONITH action. (Default Value: 1)
• --retry-on=[attempts] — count of attempts to retry power on. (Default Value: 1)
• --use-sudo — use sudo (without password) when calling 3rd party software
• --ssh-path=[path] — path to the ssh binary. (Default Value: /usr/bin/ssh)
• --sudo-path=[path] — path to the sudo binary. (Default Value: /usr/bin/sudo)

---

💅 ACTIONS 💅

here's what she can actually do, bestie:

• on — power on machine. ⚡
• off — power off machine.
• reboot — reboot machine.
• status — this returns the status of the plug / virtual machine.
• list — list available plugs with aliases / virtual machines, if there's support for more than one device. returns N/A otherwise.
• list-status — list available plugs with aliases / virtual machines and their power state, if it can be obtained without additional commands.
• monitor — check the health of the fence device 🩺
• metadata — display the XML metadata describing this resource.
• manpage — the operational behavior of this is not known. (yeah. that's literally what it says. we don't know either 💀)
• validate-all — validate if all required parameters are entered.

---

🎀 STDIN PARAMETERS 🎀

same vibes, but these ones come in through stdin. note the underscore names and the Obsoletes: notes — those are the old names that got replaced, keep them in mind iykyk:

• action — fencing action. (Default Value: reboot)
• command_prompt — force Python regex for command prompt. (Default Value: ['\\[EXPECT\\]#']) Obsoletes: cmd_prompt
• identity_file — identity file (private key) for SSH
• inet4_only — forces agent to use IPv4 addresses only
• inet6_only — forces agent to use IPv6 addresses only
• ip — IP address or hostname of fencing device. This parameter is always required. Obsoletes: ipaddr
• ipport — TCP/UDP port to use for connection with device. (Default Value: 22)
• password — login password or passphrase. Obsoletes: passwd
• password_script — script to run to retrieve password. Obsoletes: passwd_script
• plug — physical plug number on device, UUID or identification of machine. This parameter is always required. Obsoletes: port
• ssh — use SSH connection. (Default Value: 1) Obsoletes: secure
• ssh_options — SSH options to use. (Default Value: -t '/bin/bash -c "PS1=\\[EXPECT\\]# /bin/bash --noprofile --norc"')
• username — login name. This parameter is always required. Obsoletes: login
• quiet — disable logging to stderr. does not affect --verbose or --debug-file or logging to syslog.
• verbose — verbose mode. multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.
• verbose_level — level of debugging detail in output. defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).
• debug_file — write debug information to given file. Obsoletes: debug
• version — display version information and exit
• help — display help and exit
• plug_separator — separator for plug parameter when specifying more than 1 plug. (Default Value: ,)
• separator — separator for CSV created by list operation. (Default Value: ,)
• delay — wait X seconds before fencing is started. (Default Value: 0)
• disable_timeout — disable timeout (true/false). (default: true when run from Pacemaker 2.0+)
• login_timeout — wait X seconds for cmd prompt after login. (Default Value: 5)
• missing_as_off — missing port returns OFF instead of failure
• power_timeout — test X seconds for status change after ON/OFF. (Default Value: 20)
• power_wait — wait X seconds after issuing ON/OFF. (Default Value: 0)
• shell_timeout — wait X seconds for cmd prompt after issuing command. (Default Value: 3)
• stonith_status_sleep — sleep X seconds between status calls during a STONITH action. (Default Value: 1)
• retry_on — count of attempts to retry power on. (Default Value: 1)
• use_sudo — use sudo (without password) when calling 3rd party software. Obsoletes: sudo
• ssh_path — path to ssh binary. (Default Value: /usr/bin/ssh)
• sudo_path — path to sudo binary. (Default Value: /usr/bin/sudo)

---

reminder bestie: virsh wants root by default, so make sure your sshd_config lets root ssh in, otherwise this whole thing is just a vibe and not a fence 😭

---

okay that's the whole page!! this is fence_virsh (Fence Agent), dated 2009-10-20, and it lives in section FENCE_AGENT(8). she's been serving since '09 and she's still slaying. periodt 💖✨🦋🎀💅🫶👑