## Name

ctdb-tunables — CTDB tunable configuration variables

## DESCRIPTION

CTDB's behaviour can be configured by setting run-time tunable variables. This lists and describes all tunables. See the ctdb(1) listvars, setvar and getvar commands for more details.

The tunable variables are listed alphabetically.

### AllowClientDBAttach

Default: 1

When set to 0, clients are not allowed to attach to any databases. This can be used to temporarily block any new processes from attaching to and accessing the databases. This is mainly used for detaching a volatile database using 'ctdb detach'.

### AllowUnhealthyDBRead

Default: 0

When set to 1, ctdb allows database traverses to read unhealthy databases. By default, ctdb does not allow reading records from unhealthy databases.

### ControlTimeout

Default: 60

This is the default setting for timeout for when sending a control message to either the local or a remote ctdb daemon.

### DatabaseHashSize

Default: 100001

Number of the hash chains for the local store of the tdbs that ctdb manages.

### DatabaseMaxDead

Default: 5

Maximum number of dead records per hash chain for the tdb databses managed by ctdb.

### DBRecordCountWarn

Default: 100000

When set to non-zero, ctdb will log a warning during recovery if a database has more than this many records. This will produce a warning if a database grows uncontrollably with orphaned records.

### DBRecordSizeWarn

Default: 10000000

When set to non-zero, ctdb will log a warning during recovery if a single record is bigger than this size. This will produce a warning if a database record grows uncontrollably.

### DBSizeWarn

Default: 1000000000

When set to non-zero, ctdb will log a warning during recovery if a database size is bigger than this. This will produce a warning if a database grows uncontrollably.

### DeferredAttachTO

Default: 120

When databases are frozen we do not allow clients to attach to the databases. Instead of returning an error immediately to the client, the attach request from the client is deferred until the database becomes available again at which stage we respond to the client.

This timeout controls how long we will defer the request from the client before timing it out and returning an error to the client.

### DeterministicIPs

Default: 0

When set to 1, ctdb will try to keep public IP addresses locked to specific nodes as far as possible. This makes it easier for debugging since you can know that as long as all nodes are healthy public IP X will always be hosted by node Y.

The cost of using deterministic IP address assignment is that it disables part of the logic where ctdb tries to reduce the number of public IP assignment changes in the cluster. This tunable may increase the number of IP failover/failbacks that are performed on the cluster by a small margin.

### DisableIPFailover

Default: 0

When set to non-zero, ctdb will not perform failover or failback. Even if a node fails while holding public IPs, ctdb will not recover the IPs or assign them to another node.

When this tunable is enabled, ctdb will no longer attempt to recover the cluster by failing IP addresses over to other nodes. This leads to a service outage until the administrator has manually performed IP failover to replacement nodes using the 'ctdb moveip' command.

### ElectionTimeout

Default: 3

The number of seconds to wait for the election of recovery master to complete. If the election is not completed during this interval, then that round of election fails and ctdb starts a new election.

### EnableBans

Default: 1

This parameter allows ctdb to ban a node if the node is misbehaving.

When set to 0, this disables banning completely in the cluster and thus nodes can not get banned, even it they break. Don't set to 0 unless you know what you are doing. You should set this to the same value on all nodes to avoid unexpected behaviour.

### EventScriptTimeout

Default: 30

Maximum time in seconds to allow an event to run before timing out. This is the total time for all enabled scripts that are run for an event, not just a single event script.

Note that timeouts are ignored for some events ("takeip", "releaseip", "startrecovery", "recovered") and converted to success. The logic here is that the callers of these events implement their own additional timeout.

### FetchCollapse

Default: 1

This parameter is used to avoid multiple migration requests for the same record from a single node. All the record requests for the same record are queued up and processed when the record is migrated to the current node.

When many clients across many nodes try to access the same record at the same time this can lead to a fetch storm where the record becomes very active and bounces between nodes very fast. This leads to high CPU utilization of the ctdbd daemon, trying to bounce that record around very fast, and poor performance. This can improve performance and reduce CPU utilization for certain workloads.

### HopcountMakeSticky

Default: 50

For database(s) marked STICKY (using 'ctdb setdbsticky'), any record that is migrating so fast that hopcount exceeds this limit is marked as STICKY record for `StickyDuration` seconds. This means that after each migration the sticky record will be kept on the node `StickyPindown`milliseconds and prevented from being migrated off the node.

This will improve performance for certain workloads, such as locking.tdb if many clients are opening/closing the same file concurrently.

### KeepaliveInterval

Default: 5

How often in seconds should the nodes send keep-alive packets to each other.

### KeepaliveLimit

Default: 5

After how many keepalive intervals without any traffic should a node wait until marking the peer as DISCONNECTED.

If a node has hung, it can take `KeepaliveInterval` * (`KeepaliveLimit` + 1) seconds before ctdb determines that the node is DISCONNECTED and performs a recovery. This limit should not be set too high to enable early detection and avoid any application timeouts (e.g. SMB1) to kick in before the fail over is completed.

### LCP2PublicIPs

Default: 1

When set to 1, ctdb uses the LCP2 ip allocation algorithm.

### LockProcessesPerDB

Default: 200

This is the maximum number of lock helper processes ctdb will create for obtaining record locks. When ctdb cannot get a record lock without blocking, it creates a helper process that waits for the lock to be obtained.

### LogLatencyMs

Default: 0

When set to non-zero, ctdb will log if certains operations take longer than this value, in milliseconds, to complete. These operations include "process a record request from client", "take a record or database lock", "update a persistent database record" and "vaccum a database".

### MaxQueueDropMsg

Default: 1000000

This is the maximum number of messages to be queued up for a client before ctdb will treat the client as hung and will terminate the client connection.

### MonitorInterval

Default: 15

How often should ctdb run the 'monitor' event in seconds to check for a node's health.

### MonitorTimeoutCount

Default: 20

How many 'monitor' events in a row need to timeout before a node is flagged as UNHEALTHY. This setting is useful if scripts can not be written so that they do not hang for benign reasons.

### NoIPFailback

Default: 0

When set to 1, ctdb will not perform failback of IP addresses when a node becomes healthy. When a node becomes UNHEALTHY, ctdb WILL perform failover of public IP addresses, but when the node becomes HEALTHY again, ctdb will not fail the addresses back.

Use with caution! Normally when a node becomes available to the cluster ctdb will try to reassign public IP addresses onto the new node as a way to distribute the workload evenly across the clusternode. Ctdb tries to make sure that all running nodes have approximately the same number of public addresses it hosts.

When you enable this tunable, ctdb will no longer attempt to rebalance the cluster by failing IP addresses back to the new nodes. An unbalanced cluster will therefore remain unbalanced until there is manual intervention from the administrator. When this parameter is set, you can manually fail public IP addresses over to the new node(s) using the 'ctdb moveip' command.

### NoIPHostOnAllDisabled

Default: 0

If no nodes are HEALTHY then by default ctdb will happily host public IPs on disabled (unhealthy or administratively disabled) nodes. This can cause problems, for example if the underlying cluster filesystem is not mounted. When set to 1 on a node and that node is disabled, any IPs hosted by this node will be released and the node will not takeover any IPs until it is no longer disabled.

### NoIPTakeover

Default: 0

When set to 1, ctdb will not allow IP addresses to be failed over onto this node. Any IP addresses that the node currently hosts will remain on the node but no new IP addresses can be failed over to the node.

### PullDBPreallocation

Default: 10*1024*1024

This is the size of a record buffer to pre-allocate for sending reply to PULLDB control. Usually record buffer starts with size of the first record and gets reallocated every time a new record is added to the record buffer. For a large number of records, this can be very inefficient to grow the record buffer one record at a time.

### QueueBufferSize

Default: 1024

This is the maximum amount of data (in bytes) ctdb will read from a socket at a time.

For a busy setup, if ctdb is not able to process the TCP sockets fast enough (large amount of data in Recv-Q for tcp sockets), then this tunable value should be increased. However, large values can keep ctdb busy processing packets and prevent ctdb from handling other events.

### RecBufferSizeLimit

Default: 1000000

This is the limit on the size of the record buffer to be sent in various controls. This limit is used by new controls used for recovery and controls used in vacuuming.

### RecdFailCount

Default: 10

If the recovery daemon has failed to ping the main dameon for this many consecutive intervals, the main daemon will consider the recovery daemon as hung and will try to restart it to recover.

### RecdPingTimeout

Default: 60

If the main dameon has not heard a "ping" from the recovery dameon for this many seconds, the main dameon will log a message that the recovery daemon is potentially hung. This also increments a counter which is checked against `RecdFailCount` for detection of hung recovery daemon.

### RecLockLatencyMs

Default: 1000

When using a reclock file for split brain prevention, if set to non-zero this tunable will make the recovery dameon log a message if the fcntl() call to lock/testlock the recovery file takes longer than this number of milliseconds.

### RecoverInterval

Default: 1

How frequently in seconds should the recovery daemon perform the consistency checks to determine if it should perform a recovery.

### RecoverPDBBySeqNum

Default: 1

When set to zero, database recovery for persistent databases is record-by-record and recovery process simply collects the most recent version of every individual record.

When set to non-zero, persistent databases will instead be recovered as a whole db and not by individual records. The node that contains the highest value stored in the record "__db_sequence_number__" is selected and the copy of that nodes database is used as the recovered database.

By default, recovery of persistent databses is done using __db_sequence_number__ record.

### RecoverTimeout

Default: 120

This is the default setting for timeouts for controls when sent from the recovery daemon. We allow longer control timeouts from the recovery daemon than from normal use since the recovery dameon often use controls that can take a lot longer than normal controls.

### RecoveryBanPeriod

Default: 300

The duration in seconds for which a node is banned if the node fails during recovery. After this time has elapsed the node will automatically get unbanned and will attempt to rejoin the cluster.

A node usually gets banned due to real problems with the node. Don't set this value too small. Otherwise, a problematic node will try to re-join cluster too soon causing unnecessary recoveries.

### RecoveryDropAllIPs

Default: 120

If a node is stuck in recovery, or stopped, or banned, for this many seconds, then ctdb will release all public addresses on that node.

### RecoveryGracePeriod

Default: 120

During recoveries, if a node has not caused recovery failures during the last grace period in seconds, any records of transgressions that the node has caused recovery failures will be forgiven. This resets the ban-counter back to zero for that node.

### RepackLimit

Default: 10000

During vacuuming, if the number of freelist records are more than `RepackLimit`, then the database is repacked to get rid of the freelist records to avoid fragmentation.

Databases are repacked only if both `RepackLimit` and `VacuumLimit` are exceeded.

### RerecoveryTimeout

Default: 10

Once a recovery has completed, no additional recoveries are permitted until this timeout in seconds has expired.

### SeqnumInterval

Default: 1000

Some databases have seqnum tracking enabled, so that samba will be able to detect asynchronously when there has been updates to the database. Everytime a database is updated its sequence number is increased.

This tunable is used to specify in milliseconds how frequently ctdb will send out updates to remote nodes to inform them that the sequence number is increased.

### StatHistoryInterval

Default: 1

Granularity of the statistics collected in the statistics history. This is reported by 'ctdb stats' command.

### StickyDuration

Default: 600

Once a record has been marked STICKY, this is the duration in seconds, the record will be flagged as a STICKY record.

### StickyPindown

Default: 200

Once a STICKY record has been migrated onto a node, it will be pinned down on that node for this number of milliseconds. Any request from other nodes to migrate the record off the node will be deferred.

### TakeoverTimeout

Default: 9

This is the duration in seconds in which ctdb tries to complete IP failover.

### TDBMutexEnabled

Default: 0

This paramter enables TDB_MUTEX_LOCKING feature on volatile databases if the robust mutexes are supported. This optimizes the record locking using robust mutexes and is much more efficient that using posix locks.

### TickleUpdateInterval

Default: 20

Every `TickleUpdateInterval` seconds, ctdb synchronizes the client connection information across nodes.

### TraverseTimeout

Default: 20

This is the duration in seconds for which a database traverse is allowed to run. If the traverse does not complete during this interval, ctdb will abort the traverse.

### VacuumFastPathCount

Default: 60

During a vacuuming run, ctdb usually processes only the records marked for deletion also called the fast path vacuuming. After finishing `VacuumFastPathCount` number of fast path vacuuming runs, ctdb will trigger a scan of complete database for any empty records that need to be deleted.

### VacuumInterval

Default: 10

Periodic interval in seconds when vacuuming is triggered for volatile databases.

### VacuumLimit

Default: 5000

During vacuuming, if the number of deleted records are more than `VacuumLimit`, then databases are repacked to avoid fragmentation.

Databases are repacked only if both `RepackLimit` and `VacuumLimit` are exceeded.

### VacuumMaxRunTime

Default: 120

The maximum time in seconds for which the vacuuming process is allowed to run. If vacuuming process takes longer than this value, then the vacuuming process is terminated.

### VerboseMemoryNames

Default: 0

When set to non-zero, ctdb assigns verbose names for some of the talloc allocated memory objects. These names are visible in the talloc memory report generated by 'ctdb dumpmemory'.

## SEE ALSO

ctdb(1), ctdbd(1), ctdbd.conf(5), ctdb(7), http://ctdb.samba.org/