Hi Boris, Its 7 osds nodes out of which 2 are acting as mon also. 1 mgr + mon node and 2 dedicated mon nodes Thanks, Gagan On Sat, Jan 31, 2026 at 6:45 PM Boris via ceph-users <ceph-users@ceph.io> wrote:

Hi Gagan, do I understand correctly that you have dedicated 5 Mon, 1 Mgr and 7 OSD nodes? 13 nodes i total?

And you only need to wipe 3 Mon and the mgr nodes?

If this is the case, you will not have problems with the data on the OSDs. You can just move the mgr to one of the good mon nodes and remove the mon nodes from quorum.

The cluster will be fine. You might need to adjust the ceph.conf on the clients, to not ise the mons you removed from the quorum.

Alternatively you can just wipe and reinstall the systems. Ceph should handle one missing node fine.

You also rarely need a dedicated node for mgr. you can run them together with the mons. They will failover of the acting mgr is not available anymore.

Cheers Boris

...

Am 31.01.2026 um 13:02 schrieb gagan tiwari via ceph-users < ceph-users@ceph.io>:

HI Guys, Our ceph cluster seems to be compromised by rootkit attack.

It has 5 mon including one mgr and 7 osd nodes.

We will need to reformat and reinstall OS on ceph mgr node and 2 ceph mon nodes.

2 mon nodes and 7 osd nodes are safe.

Ceph health status is showing ok. And the cluster is still working but very slow.

Please let me know how to proceed to have minimal disruption to the users and without any data loss

Thanks, Gagan _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io

---

ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io