The executor uses pcmk_monitor_timeout, but the controller considers a recurring monitor to have timed out after its op timeout expires. If pcmk_monitor_timeout is long, a stonith stop action can fail: the monitor is declared as timed out before the pcmk_monitor_timeout expires, the stop action is requested, and its timer begins counting down, but the stop action can't begin until after the monitor finishes or pcmk_monitor_timeout expires.
Separately, the pcmk_monitor_timeout default is 60s, while the default for generic monitor operations is 20s. We need to investigate how each is used and how they interact, and possibly either change the pcmk_monitor_timeout default to 20s, special-case fence device monitors in the scheduler to use the pcmk_monitor_timeout default, or some other improvement.
Once it is all straightened out, we should update Pacemaker Explained with the correct information about the topic along the lines of CLPR#2107.
Related: