LPIC-3 304: Virtualization & High Availability — Deep Dive Study Guide

The LPIC-3 304: Virtualization & High Availability exam covers hardware virtualization (KVM, Xen), OS-level virtualization (LXC/LXD), high-availability clustering with Pacemaker, block-level replication with DRBD, load balancing, and cluster storage. This guide provides comprehensive coverage of each objective.

KVM Virtualization

Architecture

KVM (Kernel-based Virtual Machine) turns the Linux kernel into a type-1 hypervisor using hardware virtualization extensions (Intel VT-x / AMD-V). QEMU provides device emulation, and libvirt provides management abstraction.

libvirt and virsh

# Check virtualization support
grep -E "(vmx|svm)" /proc/cpuinfo
kvm-ok

# List active VMs
virsh list

# List all VMs (including inactive)
virsh list --all

# Get VM details
virsh dominfo vm1

# Start and stop VMs
virsh start vm1
virsh shutdown vm1
virsh destroy vm1   # Force power-off

# VM lifecycle
virsh suspend vm1
virsh resume vm1
virsh reboot vm1

VM Provisioning with virt-install

# Create a new VM from ISO
virt-install \
  --name vm1 \
  --memory 4096 \
  --vcpus 2 \
  --disk size=50,format=qcow2,bus=virtio \
  --cdrom /iso/debian-12.iso \
  --network network=default,model=virtio \
  --graphics vnc,listen=0.0.0.0 \
  --os-variant debian12

# Create VM with existing disk image
virt-install \
  --name vm2 \
  --memory 8192 \
  --vcpus 4 \
  --disk /var/lib/libvirt/images/vm2.qcow2,bus=virtio \
  --import \
  --network bridge=br0,model=virtio \
  --os-variant linux

# Unattended installation with --location
virt-install \
  --name web1 \
  --memory 2048 \
  --vcpus 1 \
  --disk size=20 \
  --location http://deb.debian.org/debian/dists/stable/main/installer-amd64/ \
  --extra-args "auto preseed/url=http://web/preseed.cfg"

Network Configurations

Mode	Guest-to-Host	Guest-to-External	Notes
NAT (default)	Yes	Via masquerading	Built-in DHCP and DNS
Bridged	Yes	Yes (same network)	Requires bridge interface
Isolated	Yes	No	Private virtual network
passthrough	Yes	Yes (PCI/VFIO)	Direct device assignment

# Create a bridge on the host
nmcli con add type bridge ifname br0
nmcli con add type ethernet ifname eno1 master br0

# Attach VM to bridge
virt-install --network bridge=br0 ...

Storage Configurations

# Create qcow2 disk
qemu-img create -f qcow2 vm1.qcow2 50G
qemu-img create -f qcow2 -b base.qcow2 -F qcow2 vm1.qcow2  # Backing file (thin provisioning)

# Resize disk
qemu-img resize vm1.qcow2 +20G

# Convert disk format
qemu-img convert -f raw -O qcow2 disk.raw disk.qcow2

# Add disk to VM
virsh attach-disk vm1 /var/lib/libvirt/images/data.qcow2 vdb --persistent
virsh detach-disk vm1 vdb --persistent

Live Migration

# Migrate running VM to another host (shared storage)
virsh migrate --live vm1 qemu+ssh://dest-host/system

# Non-shared storage migration with copying
virsh migrate --live --copy-storage-all vm1 qemu+ssh://dest-host/system

# Tunneled migration (encrypted over SSH)
virsh migrate --live --tunnelled vm1 qemu+ssh://dest-host/system

Xen Hypervisor

Xen uses a different architecture than KVM, with a privileged Domain 0 (Dom0) that manages unprivileged DomU guests.

Component	Role
Dom0	Privileged management domain (usually Linux)
DomU	Unprivileged guest (PV, HVM, or PVH)
Xen Hypervisor	Runs directly on hardware, below Dom0
xl	Xen management toolstack (replaces xm)

Xen Usage

# List domains
xl list

# Create a PV (para-virtualized) guest
xl create /etc/xen/vm1.cfg

# DomU config: /etc/xen/vm1.cfg
kernel = "/boot/vmlinuz-6.1"
ramdisk = "/boot/initrd.img-6.1"
memory = 2048
name = "vm1"
vcpus = 2
disk = ["phy:/dev/vg_xen/vm1-root,xvda2,w"]
root = "/dev/xvda2"

# Migrate Xen guest
xl migrate vm1 dest-host

# Save and restore
xl save vm1 /tmp/vm1.state
xl restore /tmp/vm1.state

PV vs HVM vs PVH

• PV (Paravirtualized): Guest kernel is modified for Xen. No hardware virtualization required. Best performance but requires kernel support.
• HVM (Hardware Virtual Machine): Full hardware virtualization. Unmodified guests run with QEMU device emulation.
• PVH: Hybrid — uses PV for I/O but HVM for CPU/memory. Best of both worlds.

LXC/LXD Containers

LXC Commands

# List containers
lxc-ls -f

# Create a container
lxc-create -t download -n container1 -- --dist debian --release bookworm --arch amd64

# Start and attach
lxc-start -n container1 -d
lxc-attach -n container1

# Execute command in container
lxc-attach -n container1 -- apt update

# Snapshot
lxc-snapshot -n container1
lxc-snapshot -n container1 -L    # list snapshots
lxc-snapshot -n container1 -r snap0  # restore

LXD (Next-Gen LXC)

# Initialize LXD
lxd init

# Launch a container
lxc launch ubuntu:24.04 my-container

# List containers
lxc list

# Execute commands
lxc exec my-container -- apt upgrade

# Configure resource limits
lxc config set my-container limits.memory 2GB
lxc config set my-container limits.cpu 2

# File operations
lxc file pull my-container/etc/hosts .
lxc file push hosts my-container/etc/hosts

# Snapshot management
lxc snapshot my-container backup1
lxc restore my-container backup1

# Container images
lxc image list
lxc image copy ubuntu:24.04 local: --alias my-ubuntu

LXC vs KVM Comparison

Feature	LXC/LXD	KVM
Isolation	Kernel namespace	Hardware virtualization
Performance	Near-native	~95% native
Kernel	Shared with host	Independent
Boot time	Milliseconds	Seconds
Use case	Microservices, Dev	Full OS, Windows, Security isolation

Pacemaker/Corosync Clustering

Architecture

• Corosync: Provides messaging, membership, and quorum services
• Pacemaker: Cluster resource manager that handles failover
• Resource Agents: Scripts that manage start/stop/monitor of services

Cluster Setup

# Install on all nodes
apt-get install pacemaker corosync pcs

# Authenticate nodes (run on one node)
pcs host auth node1 node2 -u hacluster

# Create cluster
pcs cluster setup mycluster node1 node2

# Start cluster
pcs cluster start --all

# Check status
pcs status
crm_mon -1

Resource Configuration

# Disable STONITH (lab only — never in production)
pcs property set stonith-enabled=false

# Set quorum policy
pcs property set no-quorum-policy=ignore

# Create a virtual IP resource
pcs resource create virtual_ip ocf:heartbeat:IPaddr2 \
  ip=10.0.0.100 cidr_netmask=24 \
  op monitor interval=10s

# Create a webserver resource group
pcs resource create web_server systemd:nginx \
  op monitor interval=30s
pcs resource group add webservice virtual_ip web_server

# Create a filesystem resource
pcs resource create web_fs ocf:heartbeat:Filesystem \
  device=/dev/drbd0 directory=/var/www fstype=ext4

# Resource constraints
pcs constraint colocation add web_fs with drbd_master INFINITY
pcs constraint order drbd_master then web_fs

Fencing (STONITH)

# IPMI fencing
pcs stonith create ipmi-fence fence_ipmilan \
  pcmk_host_list="node1 node2" \
  ipaddr=10.0.0.201 login=admin passwd=secret \
  lanplus=1

# Check fence device
pcs stonith show ipmi-fence

# Test fencing
pcs stonith fence node1

DRBD (Distributed Replicated Block Device)

Resource Configuration

# /etc/drbd.d/web.res
resource web {
   protocol C;
   on node1 {
      device /dev/drbd0;
      disk /dev/vg_drbd/web-data;
      address 10.0.0.1:7788;
   }
   on node2 {
      device /dev/drbd0;
      disk /dev/vg_drbd/web-data;
      address 10.0.0.2:7788;
   }
}

DRBD Commands

# Create metadata
drbdadm create-md web

# Enable resource
drbdadm up web

# Set primary (initial setup — on one node only)
drbdadm primary --force web

# View status
drbdadm status
cat /proc/drbd

# Switch primary role
drbdadm primary web
drbdadm secondary web

# Resync after split-brain
drbdadm -- --discard-my-data connect web

DRBD Replication Protocols

Protocol	Description	Durability
A	Asynchronous — write acknowledged when local disk write completes	Potential data loss on primary failure
B	Semi-synchronous — acknowledged when reaches peer's memory buffer	Data loss only on simultaneous failure
C	Synchronous — acknowledged when written to both local and peer disk	Zero data loss

Load Balancing

keepalived (VRRP)

# /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
   state MASTER
   interface eth0
   virtual_router_id 50
   priority 100
   advert_int 1
   authentication {
      auth_type PASS
      auth_pass secret123
   }
   virtual_ipaddress {
      10.0.0.100/24 dev eth0
   }
}

virtual_server 10.0.0.100 80 {
   delay_loop 6
   lb_algo rr
   lb_kind NAT
   protocol TCP
   real_server 10.0.0.10 80 {
      weight 1
      HTTP_GET {
         url { path /health }
      }
   }
   real_server 10.0.0.11 80 {
      weight 1
      HTTP_GET {
         url { path /health }
      }
   }
}

# Manage
systemctl restart keepalived
ip addr show   # Virtual IP should appear on master

HAProxy

# /etc/haproxy/haproxy.cfg
global
   log /dev/log local0
   chroot /var/lib/haproxy
   stats socket /run/haproxy/admin.sock mode 660 level admin

defaults
   mode http
   timeout connect 5000ms
   timeout client 50000ms
   timeout server 50000ms

frontend http-in
   bind *:80
   default_backend servers

backend servers
   balance roundrobin
   option httpchk GET /health
   server web1 10.0.0.10:80 check weight 10
   server web2 10.0.0.11:80 check weight 10
   server web3 10.0.0.12:80 check weight 5 backup

HAProxy Stats

# Enable stats interface
listen stats
   bind *:8080
   stats enable
   stats uri /
   stats auth admin:password

Cluster Storage

GFS2 (Global File System 2)

# Create GFS2 on shared storage
mkfs.gfs2 -p lock_dlm -j 2 -t mycluster:web /dev/drbd0

# Mount (on both nodes)
mount /dev/drbd0 /var/www

# GFS2 management
gfs2_tool sb /dev/drbd0 all
gfs2_edit -p journal /dev/drbd0

OCFS2 (Oracle Cluster File System 2)

# Create OCFS2
mkfs.ocfs2 --cluster-stack=o2cb --cluster-name=mycluster /dev/sdb1

# Mount
mount -t ocfs2 /dev/sdb1 /shared

# Management
o2info --fs /shared
tunefs.ocfs2 -Q "LABEL=shared_data" /dev/sdb1

---

Test Your Knowledge with Practice Exams

Ready to put this knowledge to the test? Our LPI practice portal includes 200+ realistic questions covering LPIC-1, LPIC-2, LPIC-3, and DevOps Tools Engineer certifications. Study mode, timed exams, domain breakdowns, and weak-area analysis included.

Start Free Preview →

Related Articles

• LPIC-3 Certification Guide — "LPIC-3 Certification Guide"
• LPIC-3 300: Mixed Environment — Deep Dive Study Guide — "LPIC-3 300 Mixed Environment Deep Dive"
• LPIC-3 303: Security — Deep Dive Study Guide — "LPIC-3 303 Security Deep Dive"
• Is LPIC Worth It in 2026? — Salary impact, employer demand, and certification ROI
• LPIC vs RHCSA vs CompTIA Linux+ — Which certification path is right for you?
• Browse All LPI Resources — Full library of study guides, deep dives, and practice questions