What is the difference between freezing the system and freezing a Group? Which is better for maintenance?

Freezing a system prevents VCS from onlining a Service Group onto that system. This is usually done when a machine in the cluster is unstable or undergoing maintenance, and you don't want VCS to try to failover a Group to that machine. However, if a Group is already online on a frozen system, VCS can still offline that Group. Freezing a Service Group is the most common practice when maintenance needs to be done on the nodes while VCS is still running. When you freeze a Group, VCS and its Agents will take no action (not even calling Clean) on that Group or its Resources no matter what happens to the resources. That means you can take down your services, like IP's, filesystems, databases and applications, and VCS won't do anything. VCS won't offline the Group, or offline any resources. VCS also won't online anything in that Group, and it won't online that Group anywhere. This basically "locks" the Group on a node, and prevents it from onlining until you unfreeze the Group. One thing that may be surprising is that VCS will still monitor a frozen Group and its resources. So, during maintenance, VCS might tell you that your resources have faulted, or the Group is offline. If you manually bring everything back up after maintenance, VCS monitoring should refresh and see all your resources and the Group are online again. This is a good thing, since it is best to know if VCS thinks your Group and its resources are online before you unfreeze the Group. 

To freeze a Group: 

haconf -makerw hagrp -freeze {Group name} -persistent 

haconf -dump -makero 

To unfreeze a Group: 

haconf -makerw hagrp -unfreeze {Group name} -persistent 

haconf -dump -makero