Re: piranha problem?

> failover ldap {
>      active = 1
>      address = .......1.156 eth0:0
>      vip_nmask = 255.255.0.0
>      port = 389
>      timeout = 30
>      start_cmd = "/etc/rc.d/init.d/ldap start"
>      stop_cmd = "/etc/rc.d/init.d/ldap stop"

This looks fine. But as Ed told you, you *must* specify either a 
send_string or a send_program *and* an expect_string.

If you don't, it'll just try to connect to port 389, which can't tell 
for sure if your LDAP server would answer a query.

I don't know the LDAP protocol and whether it's text based or not. If 
it's text based like HTTP, you can easily use send_string (replace "GET 
/ HTTP/1.0" by a correct LDAP request). If it's not text based, use an 
external program (send_program) which will do the test for you.

As an example, consider the following HTTP tester, which query a page 
called piranha.php to make sure PHP is working. This piranha.php would 
return different results based upon whatever you decide.

cat test_http_php.sh
#! /bin/bash
wget -O- http://$1/piranha.php | grep '^OK$'
[ $? -eq 0 ] && echo ITWORKS ||echo FAIL

in your lvs.cf, you should write :
send_program = /location/to/test_http_php.sh
expect_string = ITWORKS

See the shell : it expects OK by itself on a line from the webserver. If 
it finds it, it prints ITWORKS, which piranha compares to the supplied 
expect_string.

In your case, replace wget by whatever openldap or whatever can be used 
to query you LDAP server.

> failover ipsec {
>      active = 1
>      address = ......1.156 eth0:0

Same VIP as service ldap, that's not fine, because you'd force a 
failover of both services even if only one fails. Assign a different IP 
here, on a separate interface (say eth0:1)

>      port = 389

This can't be 389, but IPSEC port's !

>      stop_cmd = "/etc/rc.d/init.d/ipsec stop; ifconfig ipsec0 down; 
> rmmod ipsec"

You *can't* use semi-colons here. If you really need to run several 
things, write a shell script. BTW, why do you need to ifdown ipsec0 ? 
Doesn't the init script do it for you ? Why do you rmmod ipsec ? IT 
can't hurt to have it ready for the next failover :)

-- 
Sébastien BONNET