Proxmox high availability (HA) restarts a VM on a healthy node when the node it runs on fails. It does not prevent the short outage of the reboot, but it removes the need for someone to wake up and start VMs by hand.
Before you start
- A Proxmox cluster with at least three nodes (or two nodes plus a QDevice) so quorum survives one failure (cluster setup).
- Shared or replicated storage for HA VMs: Ceph, NFS/iSCSI, or ZFS replication (with possible data loss since the last replication).
- A reliable, preferably redundant, network for cluster traffic (corosync).
- Hardware watchdog support is recommended; Proxmox uses a software watchdog by default.
How Proxmox HA works
- Each node runs a local resource manager; one node acts as the cluster resource manager.
- If a node loses quorum, its watchdog fences it (it reboots itself) so the VM never runs twice.
- After fencing, the VM is started on another node from the shared storage.
Warning: HA with only two nodes and no QDevice cannot keep quorum when one fails, so nothing will be moved. Plan three votes.
Create an HA group (optional)
- Datacenter → HA → Groups → Create.
- Select the nodes allowed to run the VMs and give them priorities (higher runs first).
- Tick restricted if VMs must never run outside this group.
Add VMs as HA resources
- Datacenter → HA → Resources → Add, or on the VM More → Manage HA.
- Choose the VM, the group, the requested state
started, and limits for restart and relocate attempts. - Save. The HA status page shows the resource as managed.
Test failover
- In a maintenance window, pull the network cable or power off a node with a test HA VM.
- After the fencing delay (about two minutes), watch the VM start on another node.
- Bring the node back and check the cluster with
pvecm statusandha-manager status.
For planned work, put a node in maintenance mode so HA moves VMs first: ha-manager crm-command node-maintenance enable pve2.
Troubleshooting
- VM not moved after failure: the cluster lost quorum, or the disk was on local storage.
- Nodes rebooting unexpectedly: corosync network drops trigger fencing; give corosync a dedicated, stable link.
- Resource in error state: fix the cause, then set it to
disabledand back tostarted.
Frequently asked questions
Is HA the same as live migration?
No. Live migration moves running VMs for planned work; HA restarts VMs after a failure.
Do I still need backups with HA?
Yes. HA protects against host failure, not deleted files or corruption.
Can containers use HA?
Yes, LXC containers can be HA resources too.
