Hi Gagan, do I understand correctly that you have dedicated 5 Mon, 1 Mgr and 7 OSD nodes? 13 nodes i total?
And you only need to wipe 3 Mon and the mgr nodes? If this is the case, you will not have problems with the data on the OSDs. You can just move the mgr to one of the good mon nodes and remove the mon nodes from quorum. The cluster will be fine. You might need to adjust the ceph.conf on the clients, to not ise the mons you removed from the quorum. Alternatively you can just wipe and reinstall the systems. Ceph should handle one missing node fine. You also rarely need a dedicated node for mgr. you can run them together with the mons. They will failover of the acting mgr is not available anymore. Cheers Boris > Am 31.01.2026 um 13:02 schrieb gagan tiwari via ceph-users > <[email protected]>: > > HI Guys, > Our ceph cluster seems to be compromised by rootkit > attack. > > It has 5 mon including one mgr and 7 osd nodes. > > We will need to reformat and reinstall OS on ceph mgr node and 2 ceph mon > nodes. > > 2 mon nodes and 7 osd nodes are safe. > > Ceph health status is showing ok. And the cluster is still working but very > slow. > > Please let me know how to proceed to have minimal disruption to the users > and without any data loss > > Thanks, > Gagan > _______________________________________________ > ceph-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ ceph-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
