# Changing default verification algorithm: auto-verify-alg

**URL:** <https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166>\
**Category:** LINSTOR\
**Tags:** drbd, linstor\
**Created:** [March 3, 2026, 2:10pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166 "2026-03-03T14:10:12Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![kurbanaliev](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@kurbanaliev](https://forums.linbit.com/u/kurbanaliev)\
**Post date:** [March 3, 2026, 2:10pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/1 "2026-03-03T14:10:12Z")

</div>

Hello.  
I came across commit [https://github.com/torvalds/linux/commit/8522104f75bf1ce33d76ea425185da2a7fba5a70](https://github.com/torvalds/linux/commit/8522104f75bf1ce33d76ea425185da2a7fba5a70) indicating that support for the `crct10dif` algorithm was removed from the Linux kernel. Consequently, I decided to test the `crc32c` algorithm. During testing of verification algorithms in LINSTOR, I encountered ambiguous behavior regarding property inheritance and how values are displayed across different levels.

- **OS:** Ubuntu 24.04

- **LINSTOR Controller/Satellite:** 1.33.1

- **DRBD version:** 9.3

I attempted to change the verification algorithm at the **Resource Group** level using the following command:  
`linstor rg opt --verify-alg crc32c test`

As expected, the new value is visible at the Resource Group level:

```auto
root@test-node2:~# linstor rg lp test
+-----------------------------------------------------------+

| Key | Value |
|-----------------------------------------------------------|
| DrbdOptions/Net/verify-alg | crc32c |
+-----------------------------------------------------------+

```

However, when checking the Resource Definition properties, I still see a different key with the old value:

```auto
root@test-node2:~# linstor rd lp test
+---------------------------------------------------+

| Key | Value |
|---------------------------------------------------|
| DrbdOptions/auto-verify-alg | crct10dif |
+---------------------------------------------------+

```

Interestingly, the actual DRBD configuration correctly reflects the new setting. In the DRBD config, I see the new algorithm that I assigned to the Resource Group:

```auto
root@test-node3:~# drbdsetup show test
...
net {
    verify-alg "crc32c";
}
...

```

I can see that DRBD receives the correct configuration, but after changing the verification algorithm on the Resource Group, I expected this change to be reflected in the Resource Definition as well. The simultaneous coexistence of `auto-verify-alg` and `verify-alg` creates confusion from an administrative perspective.  
I would appreciate a clarification on the proper way to change the verification algorithm in LINSTOR.  
Is it possible to change the default algorithm for `auto-verify-alg`?  
Why is this property not updated or hidden when `verify-alg` is explicitly defined at the Resource Group level?

---

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://forums.linbit.com/u/candlerb)\
**Post date:** [March 3, 2026, 5:46pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/2 "2026-03-03T17:46:25Z")

</div>

> [@kurbanaliev](#):
>
> `DrbdOptions/auto-verify-alg`

Aside: have you found this option documented anywhere? I see it in the linstor source code, but I don’t see it in the linstor manual. (I’m sure it’s valid - linstor _does_ validate the property names - but I’d like to understand the semantics)

Also, I’m not sure if `resource-definition list-properties` shows properties which are inherited from the resource group - and if it does, whether it’s possible to distinguish between inherited and explicitly-set properties.

```auto
brian@virtual1:~$ linstor rd l -r linstor_db
╭──────────────────────────────────────────────────────╮
┊ ResourceName ┊ ResourceGroup ┊ Layers ┊ State ┊
╞══════════════════════════════════════════════════════╡
┊ linstor_db ┊ linstor-db-grp ┊ DRBD,STORAGE ┊ ok ┊
╰──────────────────────────────────────────────────────╯
brian@virtual1:~$ linstor rg lp linstor-db-grp
╭──────────────────────────────────────────────────────────────────────╮
┊ Key ┊ Value ┊
╞══════════════════════════════════════════════════════════════════════╡
┊ DrbdOptions/Resource/auto-promote ┊ no ┊
┊ DrbdOptions/Resource/on-no-data-accessible ┊ io-error ┊
┊ DrbdOptions/Resource/on-no-quorum ┊ io-error ┊
┊ DrbdOptions/Resource/on-suspended-primary-outdated ┊ force-secondary ┊
┊ DrbdOptions/Resource/quorum ┊ majority ┊
┊ Internal/Drbd/QuorumSetBy ┊ user ┊
╰──────────────────────────────────────────────────────────────────────╯
brian@virtual1:~$ linstor rd lp linstor_db
╭─────────────────────────────────────────╮
┊ Key ┊ Value ┊
╞═════════════════════════════════════════╡
┊ DrbdOptions/Resource/quorum ┊ majority ┊
┊ DrbdOptions/auto-verify-alg ┊ crct10dif ┊
┊ DrbdPrimarySetOn ┊ VIRTUAL1 ┊
╰─────────────────────────────────────────╯
brian@virtual1:~$ /usr/sbin/drbdadm dump
...
        verify-alg crct10dif;

```

---

<div class="post-metadata">

**Author:** ![kurbanaliev](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@kurbanaliev](https://forums.linbit.com/u/kurbanaliev)\
**Post date:** [March 4, 2026, 1:38pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/3 "2026-03-04T13:38:54Z")

</div>

> [@candlerb](#):
>
> Aside: have you found this option documented anywhere?

No, I haven’t found this option in the documentation either.

> [@candlerb](#):
>
> I see it in the linstor source code, but I don’t see it in the linstor manual.

Is the value of `DrbdOptions/auto-verify-alg` hardcoded directly in the source code?

---

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://forums.linbit.com/u/candlerb)\
**Post date:** [March 4, 2026, 1:58pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/4 "2026-03-04T13:58:38Z")

</div>

I don’t really grok java, but if you hunt around the context you might find what its default is:

```auto
% egrep -R '\bauto-verify-alg\b' .
./debian/changelog: * auto-verify-alg: Improve disabled check
./server/src/main/java/com/linbit/linstor/InternalApiConsts.java: public static final String DRBD_AUTO_VERIFY_ALGO = "auto-verify-alg";
% egrep -R '\bDRBD_AUTO_VERIFY_ALGO\b' .
./server/src/main/java/com/linbit/linstor/InternalApiConsts.java: public static final String DRBD_AUTO_VERIFY_ALGO = "auto-verify-alg";
./controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscDfnAutoVerifyAlgoHelper.java: InternalApiConsts.DRBD_AUTO_VERIFY_ALGO, ApiConsts.NAMESPC_DRBD_OPTIONS
./controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscDfnAutoVerifyAlgoHelper.java: InternalApiConsts.DRBD_AUTO_VERIFY_ALGO,
./controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscDfnAutoVerifyAlgoHelper.java: rscDfnProps.removeProp(InternalApiConsts.DRBD_AUTO_VERIFY_ALGO, ApiConsts.NAMESPC_DRBD_OPTIONS);
./controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscDfnAutoVerifyAlgoHelper.java: InternalApiConsts.DRBD_AUTO_VERIFY_ALGO, ApiConsts.NAMESPC_DRBD_OPTIONS) != null)
./controller/src/main/java/com/linbit/linstor/core/apicallhandler/controller/CtrlRscDfnAutoVerifyAlgoHelper.java: rscDfnProps.removeProp(InternalApiConsts.DRBD_AUTO_VERIFY_ALGO, ApiConsts.NAMESPC_DRBD_OPTIONS);
./satellite/src/main/java/com/linbit/linstor/layer/drbd/resfiles/ConfFileBuilder.java: InternalApiConsts.DRBD_AUTO_VERIFY_ALGO, ApiConsts.NAMESPC_DRBD_OPTIONS);

```

And I noticed this:

```auto
./controller/src/main/java/com/linbit/linstor/dbcp/migration/k8s/crd/Migration_01_v1_15_0_init.java: "DrbdOptions/auto-verify-algo-allowed-list", "crct10dif-pclmul;crct10dif-generic;sha384-generic;sha512-generic;sha256-generic;md5-generic"

```

---

<div class="post-metadata">

**Author:** ![kurbanaliev](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@kurbanaliev](https://forums.linbit.com/u/kurbanaliev)\
**Post date:** [March 25, 2026, 11:53am UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/5 "2026-03-25T11:53:02Z")

</div>

Could you please explain how the parameter DrbdOptions/auto-verify-algo-allowed-user-list works?  
Does it restrict the selection of the verification algorithm from the list DrbdOptions/auto-verify-algo-allowed-list for the parameter DrbdOptions/auto-verify-alg?

---

<div class="post-metadata">

**Author:** ![rp9](https://yyz1.discourse-cdn.com/flex003/user_avatar/forums.linbit.com/rp9/32/38_2.png) [@rp9](https://forums.linbit.com/u/rp9)\
**Post date:** [April 8, 2026, 1:55pm UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/6 "2026-04-08T13:55:18Z")

</div>

the `auto-verify-algo-allowed-user-list` allows additional shash algorithms to be considered by Linstor, so it doesn’t override the linstor list, just expand it.

---

<div class="post-metadata">

**Author:** ![kurbanaliev](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@kurbanaliev](https://forums.linbit.com/u/kurbanaliev)\
**Post date:** [April 23, 2026, 9:57am UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/8 "2026-04-23T09:57:37Z")

</div>

@rp9 Hello Rene! if you have a moment, I’d appreciate it if you could answer my questions.  
In our current Linstor configuration, the `crct10dif` algorithm is used for the `DrbdOptions/auto-verify-alg` parameter.

We would like to clarify the system behavior in case of an operating system upgrade where this algorithm `crct10dif` may be unavailable or not present in the kernel:

Will Linstor automatically select an alternative available algorithm for the `DrbdOptions/auto-verify-alg` parameter?

Is it possible to explicitly control the selection of the algorithm for `DrbdOptions/auto-verify-alg`, and if so, what is the recommended approach?

From a best practice perspective, would it be more appropriate to explicitly configure `DrbdOptions/Net/verify-alg` and fix the algorithm manually instead of using `DrbdOptions/auto-verify-alg`?

Which approach is generally recommended in production environments: relying on `DrbdOptions/auto-verify-alg` or explicitly setting `DrbdOptions/Net/verify-alg`?

Additionally, we have observed in our test scenario that the `DrbdOptions/Net/verify-alg` parameter takes precedence over `DrbdOptions/auto-verify-alg` (provided it is not disabled). Could you please confirm whether this behavior is expected?

Thank you in advance for your clarification.

---

<div class="post-metadata">

**Author:** ![rp9](https://yyz1.discourse-cdn.com/flex003/user_avatar/forums.linbit.com/rp9/32/38_2.png) [@rp9](https://forums.linbit.com/u/rp9)\
**Post date:** [April 23, 2026, 11:02am UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/9 "2026-04-23T11:02:54Z")

</div>

> [@kurbanaliev](#):
>
> We would like to clarify the system behavior in case of an operating system upgrade where this algorithm `crct10dif` may be unavailable or not present in the kernel:
> 
> Will Linstor automatically select an alternative available algorithm for the `DrbdOptions/auto-verify-alg` parameter?

Yes, that is why there is the auto-verify-algorithm option, it will get all available kernel algorithms  
and choose the highest common priority algorithm.

> [@kurbanaliev](#):
>
> Is it possible to explicitly control the selection of the algorithm for `DrbdOptions/auto-verify-alg`, and if so, what is the recommended approach?

Yes, you would set the `DrbdOptions/auto-verify-algo-disable` property on controller or resource-group level. e.g.:  
`linstor c sp DrbdOptions/auto-verify-algo-disable true`

and if you want an explicit one set it also on controller or resource-groupe level e.g.:  
`linstor c opt --verify-alg sha256`

> [@kurbanaliev](#):
>
> From a best practice perspective, would it be more appropriate to explicitly configure `DrbdOptions/Net/verify-alg` and fix the algorithm manually instead of using `DrbdOptions/auto-verify-alg`?

If you don’t use `drbdadm verify` at all, you could simply disable it, as it saves some communication cycles and maybe drbd adjusts. Or as in the example above set a  
algorithm that will avialable on all platforms like `sha256`.

> [@kurbanaliev](#):
>
> Which approach is generally recommended in production environments: relying on `DrbdOptions/auto-verify-alg` or explicitly setting `DrbdOptions/Net/verify-alg`?
> 
> Additionally, we have observed in our test scenario that the `DrbdOptions/Net/verify-alg` parameter takes precedence over `DrbdOptions/auto-verify-alg` (provided it is not disabled). Could you please confirm whether this behavior is expected?

Yes, I’m pretty sure this is intended to give the users choice the higher priority.

---

<div class="post-metadata">

**Author:** ![kurbanaliev](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@kurbanaliev](https://forums.linbit.com/u/kurbanaliev)\
**Post date:** [April 24, 2026, 8:57am UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/10 "2026-04-24T08:57:41Z")

</div>

Thank you so much for your reply!!!

---

<div class="post-metadata">

**Author:** ![candlerb](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@candlerb](https://forums.linbit.com/u/candlerb)\
**Post date:** [October 8, 2026, 10:28am UTC](https://forums.linbit.com/t/changing-default-verification-algorithm-auto-verify-alg/1166/11 "2026-10-08T10:28:03Z")

</div>

FYI, this bit me in a PVE8 to PVE9 upgrade. After upgrading one node, the new PVE 7.0 kernel cannot configure resources from linstor:

```plaintext
root@virtual5:/home/brian# journalctl -eu linstor-satellite
...
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.717 [DeviceManager] INFO LINSTOR/Satellite/479904 SYSTEM - DRBD regenerated resource file: /var/lib/linstor.d/linstor_db.res
...
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.807 [DeviceManager] ERROR LINSTOR/Satellite/479904 SYSTEM - Restoring resource file from backup: linstor_db
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.818 [DeviceManager] ERROR LINSTOR/Satellite/479904 SYSTEM - Failed to adjust DRBD resource linstor_db [Report number 6AC76E6D-B63BE-000000]

```

```plaintext
brian@virtual1:~$ linstor error-reports show 6AC76E6D-B63BE-000000
...
drbdsetup new-peer linstor_db 0 --_name=virtual1 --verify-alg=crct10dif --shared-secret=kEZ97aaMcMPv7Amb6reY --cram-hmac-alg=sha1

The external command sent the following error information:
 [ne] minor 1002 (vol:0) /dev/sata_ssd/linstor_db_00000 missing from kernel
linstor_db: Failure: (146) VERIFYAlgNotAvail
additional info from kernel:
failed to allocate crct10dif for verify

Command 'drbdsetup new-peer linstor_db 0 --_name=virtual1 --verify-alg=crct10dif --shared-secret=kEZ97aaMcMPv7Amb6reY --cram-hmac-alg=sha1' terminated with exit code 10
drbdadm: new-peer linstor_db: skipped due to earlier error

```

```plaintext
root@virtual5:/home/brian# grep verify /var/lib/linstor.d/linstor_db.res
        verify-alg "crct10dif";

```

So I’d strongly suggest fixing up the verify-alg _before_ doing an upgrade. I’m going to have to try to sort it mid-upgrade ☹

Good news: `linstor c sp DrbdOptions/auto-verify-algo-disable true` was enough to bring all the drbd resources back to life. After this, `verify-alg` is no longer present in `/var/lib/linstor.d/*.res`. Then `linstor c opt --verify-alg sha256` adds it back in again.

Bad news: `DrbdOptions/auto-verify-algo-disable true` also disables `cram-hmac-alg` and `shared-secret` in the network connection parameters. You can end up in a state where the resource has this enabled on one side but not the other (depending on when linstor satellites are restarted), so they [refuse to connect](https://forums.linbit.com/t/linstor-drbd-one-side-with-authentication-one-without/1291/2) until this is resolved.