apache/hadoop · error · BadFencingConfigurationException

No fencer configured for {}

Error message

No fencer configured for {}

What it means

Before promoting a standby to active, failover tooling (hdfs haadmin -failover) and the ZKFC call checkFencingConfigured to guarantee the old active can be fenced. NNHAServiceTarget parses dfs.ha.fencing.methods at construction; if no fencer was produced (fencer == null) — or an earlier parse failure was stashed in fenceConfigError — BadFencingConfigurationException('No fencer configured for <target>') is thrown.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/NNHAServiceTarget.java:193

        "ZKFC address not relevant when auto failover is off");
    assert zkfcAddr != null;
    
    return zkfcAddr;
  }
  
  void setZkfcPort(int port) {
    assert autoFailoverEnabled;
          
    this.zkfcAddr = new InetSocketAddress(addr.getAddress(), port);
  }

  @Override
  public void checkFencingConfigured() throws BadFencingConfigurationException {
    if (fenceConfigError != null) {
      throw fenceConfigError;
    }
    if (fencer == null) {
      throw new BadFencingConfigurationException(
          "No fencer configured for " + this);
    }
  }
  
  @Override
  public NodeFencer getFencer() {
    return fencer;
  }
  
  @Override
  public String toString() {
    return "NameNode at " + (lifelineAddr != null ? lifelineAddr : addr);
  }

  public String getNameServiceId() {
    return this.nsId;
  }
  

View on GitHub (pinned to 2add963021)

Solutions

1. Set dfs.ha.fencing.methods in hdfs-site.xml, e.g. sshfence (plus ssh private-key config) or 'shell(/bin/true)' for test clusters.
2. For sshfence, configure dfs.ha.fencing.ssh.private-key-files and passwordless ssh from the ZKFC/NN user to the other NN's root or NN user.
3. Make sure the property is present on every NameNode and on any host running haadmin/ZKFC, then retry the failover.
4. If the message repeats after configuring, verify the fencer expression parses (check NameNode/ZKFC logs for the original fenceConfigError).

Example fix

<!-- before: no fencer -->
<!-- after: production ssh fencer with fallback -->
<property>
  <name>dfs.ha.fencing.methods</name>
  <value>sshfence</value>
</property>
<property>
  <name>dfs.ha.fencing.ssh.private-key-files</name>
  <value>/home/hdfs/.ssh/id_rsa</value>
</property>

<!-- test-cluster alternative -->
<property>
  <name>dfs.ha.fencing.methods</name>
  <value>shell(/bin/true)</value>
</property>

String methods = conf.get(DFSConfigKeys.DFS_HA_FENCING_METHODS_KEY);
if (methods == null || methods.trim().isEmpty()) {
  throw new IllegalStateException("dfs.ha.fencing.methods is required before "
      + "failover; configure sshfence or shell(...) on every NN/zkfc host");
}
// dry-run the fencer parse
NodeFencer fencer = new NodeFencer(new HdfsConfiguration(conf), methods);
if (fencer == null) throw new IllegalStateException("fencer spec unparseable: " + methods);

try {
  target.checkFencingConfigured();
} catch (BadFencingConfigurationException e) {
  throw new IllegalStateException("Refusing failover without a fencer: set "
      + "dfs.ha.fencing.methods (e.g. sshfence) on this host and the peer", e);
}

When it happens

Trigger: HA is enabled and failover is attempted, but dfs.ha.fencing.methods is absent or empty on the node performing the failover/ZKFC; or the fencer spec is malformed so parsing failed and the error is replayed at this check.

Common situations: HA configured except the fencing property; dfs.ha.fencing.methods set on NameNodes but missing on the admin/gateway host where haadmin runs; fencer string with bad syntax after an edit; test clusters set up without sshfence.

Related errors

• {} is in observer state. Cannot be failover target
• Unable to determine service address for namenode '{}'
• Unable to determine the name service ID.
• ${className} does not support seekToNewSource.
• {} does not support method msync

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/91af48fcfe8d6840. Report an issue: GitHub.