September 2013 - Users - libvirt List Archives

[libvirt-users] Error Attaching Seventh VirtIO-SCSI Device to Guest
by McEvoy, James 09 Sep '13

09 Sep '13

I have run into a problem attempting to attach the seventh virtio-scsi device to a RHEL 6.4 Guest from a RHEL 6.4 host running libvirt version 0.10.2-18. I have a guest that is running RHEL6.4 where I can attach disks sda(boot), sdb, sdc, sdd, sde and sdf but when I try to attach sdg the virsh attach-disk command fails with the error: error: Failed to attach disk error: internal error Unable to determine model for scsi controller I logged Bug 996327 on this issue including an attached script to repro the bug but there has been no activity on that bug so far. This is the results when attaching virtio-scsi disks in a loop. Sdf is attached but sdg fails. virsh attach-disk --domain UEM004n1 --source /dev/GuestVols/UEM004-5 --target sdf --cache none --type disk --config --wwn 1fc7058865439717 --serial c7d11fc7058865439717 --shareable Disk attached successfully Vol UEM004-6 created virsh attach-disk --domain UEM004n1 --source /dev/GuestVols/UEM004-6 --target sdg --cache none --type disk --config --wwn 4d3ddb9d15b05e7e --serial 62fd4d3ddb9d15b05e7e --shareable error: Failed to attach disk error: internal error Unable to determine model for scsi controller The script to create and attach LVM volumes using virtio-scsi is available here: https://bugzilla.redhat.com/attachment.cgi?id=785925 Has anyone else run into this... I had the understanding that each virtio-controller could support 4K devices. --jim

2 3

[libvirt-users] internal error: unexpected migration status in setup
by Thomas Stein 08 Sep '13

08 Sep '13

Hello. Suddenly on one of my vm's i get: 2013-09-06 09:44:39.501+0000: 2277: error : qemuMonitorJSONGetMigrationStatusReply:2377 : internal error: unexpected migration status in setup This happens when i try to migrate /and/ when i try to do a "savevm". error: Failed to save domain domain to /opt/virt-backup- blockcopy/domain/domain-memory error: internal error: unexpected migration status in setup What is this migration status thing and how can i change that? thanks and best regards t.

1 0

[libvirt-users] Can I run a KVM guest with a btrfs subvolume as file system?
by Thomas Koch 07 Sep '13

07 Sep '13

Hi, I want to run a virtualized Debian stable KVM guest on a Debian stable host (to run untrusted stuff like Skype, Flash or eclipse with third-party plugins). Naturally host and guest will have many files in common and it would be nice to make us of btrfs deduplication. Now I found "direct kernel boot" but I could not find any documentation about it. Does it allow me to hand a btrfs subvolume of the host file system to the guest and the guest uses this subvolume as its own file system? I already asked this question here: http://serverfault.com/questions/536752/can-i-run-a-kvm-guest-with-a-btrfs- subvolume-as-file-system Regards, Thomas Koch

1 1

[libvirt-users] Is virsh supposed to work on Windows?
by Fernando Lozano 07 Sep '13

07 Sep '13

Hi there, Sorry for the cross-post, but I seeked help on this issue before on those lists, but nobody answered. :-( I'm trying to use virsh and virt-viewer on Windows. I'm running the latest binaries from http://spice-space.org/download.html, that is, virt-viewer-x64-0.5.7.msi on a Windows 7 64-bits computer. So far I got remote-viewer.exe to work, after some pain. But have no sucess using virt-viewer.exe and virsh.exe. Are they supposed to work, or am I loosing my time? I know the kvm host setup (a CentOS 6.3 machine) is fine, because I can connect using virsh from other CentOS and RHEL machines. I'm using TLS to secure connenctions to libvirtd, without client certs. I had a litthe trouble finding where to put certificate files on the windows machine, but using Sysinternals ProcessMonitor I found they have to be on the obvious path: C:\usr\x86_64-w64-mingw32\sys-root\mingw\etc\pki{CA,libvirt} Even then virsh can't connect: virsh # connect qemu://kvmhost/system error: Failed to connect to the hypervisor error: Unable to set close-on-exec flag: Success ProcessMonitor "strace" doesn't help me find what went wrong. I'm sure I'm using the same *.pem files that works for Linux clients. It looks like virsh is opening and reading those files ok. ProccessMonitor shows a TCP connect and a TCP Disconnect events to the correct IP and port, both resulting SUCCESS. Any ideas? What can I do to debug virsh on Windows and find why it isn't connecting to libvirt on CentOS? I tried -d and -l on Windows and Linux but can't find where the debug logs are saved. If you want, I can send ProcessMonitor captured events. For Red Hat folks out there: I need this working so I can get approval to buy subscriptions, The idea is production hosts will be RHEL. :-) If not, my boss may end up buying XenServer ;-) []s, Fernando Lozano

6 18

[libvirt-users] Compiling libvirt for Xenserver 6.2
by Faisal Ali 06 Sep '13

06 Sep '13

Hi, I am trying to compile libvirt-1.1.2 for Xenserver 6.2 using there DDK VM, however, it keeps giving error saying that it needs xenstore.h header file. However, I think Xenserver 6.2 is using older xs.h header file. Here is the excerpt of the beginning and end of the configure command ./configure . . checking for xenstore.h... no checking for xen/xen.h... yes checking for xen/version.h... yes checking for xen/dom0_ops.h... yes checking for xen/sys/privcmd.h... no checking for xen/linux/privcmd.h... no configure: error: You must install the Xen development package to compile Xen driver with -lxenstore How do compile with libvirt to look at xs.h file. Thanks

1 0

[libvirt-users] windows guest network kept down automatically when several windows guest running in one KVM host,
by cochen 05 Sep '13

05 Sep '13

Hi all: I have some kvm host(rhel 6.4, 2.6.32-358.0.1.el6.x86_64), I ran several windows guest on it(more than 10 guest on one host and the guest os are win7-32/win7-64/win2k8), but the guest network kept down automatically, lost package. I tried virtio drive and e1000 drive,but it didn't work. However, when I run cmd.exe ping some other subnet ip it worked. The host and guest are connected by bridge. Here is some configure infomation of my guest: <interface type='bridge'> <mac address='aa:aa:aa:49:39:71'/> <source bridge='kvmbr3'/> <model type='e1000'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </interface> brctl show as follow: kvmbr28000.b8ca3a5cbea2noeth2 vnet0 vnet11 vnet13 vnet15 vnet17 vnet19 vnet2 vnet21 vnet23 vnet25 vnet27 vnet29 vnet5 vnet7 vnet9 The /etc/sysctl.conf configure as follow: # Kernel sysctl configuration file for Red Hat Linux # # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and # sysctl.conf(5) for more details. # Controls IP packet forwarding net.ipv4.ip_forward = 0 #net.ipv4.ip_forward = 1 # Controls source route verification net.ipv4.conf.default.rp_filter = 1 # Do not accept source routing net.ipv4.conf.default.accept_source_route = 0 # Controls the System Request debugging functionality of the kernel kernel.sysrq = 0 # Controls whether core dumps will append the PID to the core filename. # Useful for debugging multi-threaded applications. kernel.core_uses_pid = 1 # Controls the use of TCP syncookies net.ipv4.tcp_syncookies = 1 # Disable netfilter on bridges. # Controls the default maxmimum size of a mesage queue kernel.msgmnb = 65536 # Controls the maximum size of a message, in bytes kernel.msgmax = 65536 # Controls the maximum shared segment size, in bytes kernel.shmmax = 68719476736 # Controls the maximum number of shared memory segments, in pages kernel.shmall = 4294967296 ########### add by operation V1.0 begin ############ net.ipv4.ip_local_port_range = 32768 65000 net.core.rmem_max = 8388608 net.core.wmem_max = 8388608 net.ipv4.tcp_rmem = 4096 87380 8388608 net.ipv4.tcp_wmem = 4096 65536 8388608 net.ipv4.tcp_max_syn_backlog = 8192 net.ipv4.tcp_window_scaling = 0 net.ipv4.tcp_sack = 0 net.ipv4.tcp_timestamps = 0 kernel.panic = 5 vm.swappiness = 51 ########### add by operation V1.0 end ############ net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0 #add by wdh #net.ipv4.conf.all.proxy_arp = 1 Best Regards, cochen

1 0

[libvirt-users] Create ESXi vmknic using libvirt xml
by varun bhatnagar 04 Sep '13

04 Sep '13

Hi, I am using libvirt on ESX hypervisor. Iam trying to create "vmknic" using virsh but all my attempts are failing. Can anyone help me in achieving this? Where can I find the xml template for this? or is there any wiki link which I can follow to achieve this? Regards, Varun

1 0

[libvirt-users] No valid cgroup for machine...
by Jaka Hudoklin 04 Sep '13

04 Sep '13

Hello! How do i get pass this error? offlinehacker:~/ $ virsh --debug 0 -c lxc:/// create o1.xml create: file(optdata): o1.xml error: Failed to create domain from o1.xml error: internal error: No valid cgroup for machine c1 My cgroups seem to be mounted: cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,release_agent=/run/current-system/systemd/lib/systemd/systemd-cgroups-agent,name=systemd) cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct,cpu) cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory) cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices) cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) mqueue on /dev/mqueue type mqueue (rw,relatime) I'm running libvirtd 1.1.1. Thanks!

2 2

[libvirt-users] Customize UNIX socket permissions
by Jonathan Lebon 04 Sep '13

04 Sep '13

Hi, I have a qemu domain which uses a virtio-serial port. On the host, the unix socket is created in /var/lib/libvirt/qemu. As non-root, I'd like to be able to communicate through this unix socket. The issue is that the socket is created as qemu:qemu with permissions 755 (does this come from libvirt's umask?). Is there any way to affect this permission from the domain's XML definition file? Even if it has to be created as qemu:qemu, having a permission of 775 would also be an acceptable solution. Thanks, Jonathan

2 1

[libvirt-users] Is virsh blockcommit supported? Thanks a lot
by Guozhonghua 04 Sep '13

04 Sep '13

I had test the command virsh blockcommit, but it failed, with the libvirt version 1.1.0, and qemu version 1.6.0. Is this feature being developing? Thanks root@cvk-31:/vms/images# virsh -v 1.1.0 root@cvk-31:/vms/images# qemu-img -V qemu-img version 1.6.0, Copyright (c) 2004-2008 Fabrice Bellard usage: qemu-img command [command options] root@cvk-31:/vms/images# virsh blockcommit Vmtest /vms/images/Vmtest1 --base /vms/image s/Vmtest1_base --top /vms/images/Vmtest1_base_1 --wait --verbose ;echo $? error: invalid argument: top '/vms/images/Vmtest1_base_1' in chain for '/vms/images/Vmtest1' has no backing file 1 root@cvk-31:/vms/images# qemu-img info /vms/images/Vmtest1_base_1 image: /vms/images/Vmtest1_base_1 file format: qcow2 virtual size: 9.8G (10485760000 bytes) disk size: 6.0M cluster_size: 2097152 backing file: /vms/images/Vmtest1_base root@cvk-31:/vms/images# qemu-img info --backing-chain /vms/images/Vmtest1 image: /vms/images/Vmtest1 file format: qcow2 virtual size: 9.8G (10485760000 bytes) disk size: 140M cluster_size: 2097152 backing file: /vms/images/Vmtest1_base_1 image: /vms/images/Vmtest1_base_1 file format: qcow2 virtual size: 9.8G (10485760000 bytes) disk size: 6.0M cluster_size: 2097152 backing file: /vms/images/Vmtest1_base image: /vms/images/Vmtest1_base file format: qcow2 virtual size: 9.8G (10485760000 bytes) disk size: 3.4G cluster_size: 2097152 root@cvk-31:/vms/images# virsh blockcommit Vmtest /vms/images/Vmtest1 --base /vms/image s/Vmtest1_base --wait --verbose ;echo $? error: invalid argument: could not find base '/vms/images/Vmtest1_base' below '/vms/images/Vmtest1' in chain for '/vms/images/Vmtest1' 1 root@cvk-31:/vms/images# ls -al /vms/images/Vmtest1_base -rw------- 1 root root 3705667584 Aug 23 10:19 /vms/images/Vmtest1_base root@cvk-31:/vms/images# qemu-img info /vms/images/Vmtest1_base image: /vms/images/Vmtest1_base file format: qcow2 virtual size: 9.8G (10485760000 bytes) disk size: 3.4G cluster_size: 2097152 ------------------------------------------------------------------------------------------------------------------------------------- ???????????????????????????????????????? ???????????????????????????????????????? ???????????????????????????????????????? ??? This e-mail and its attachments contain confidential information from H3C, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

2 5

[libvirt-users] libvirt-qemu/kvm passthru w/Intel 82598EB
by laurence.schuler 03 Sep '13

03 Sep '13

Hi, I am trying to configure two identical systems with the following setup. dom0: Centos 6 OS on Apple Xserve i7 server with PCI cards for 4GB FC (LSI FC949ES) and 10GB Ethernet (Intel 82598EB) dom1: Centos 5 OS with passthru mode of PCI 4GB FC and 10GB Ethernet (ixgbe and mptfc blacklisted in dom0) Everything starts ok, but networking in dom1 using the 10GB interface has extremely high rtt w/ping tests (20-30ms avg). I've tried a few tweaks I've discovered via googling, but nothing seems to help. (run libvirt as root, set privilege mode, etc) For validation, I have the same card in Dell hosts running Centos 6 natively and they get an avg rtt of .06ms or better. Furthemore the Dell will contact the dom1 but the connection has rtt avg times of about 6ms. With the ethernet interface on the motherboard of the Apple Xserve, I will see rtt times of .06ms within the dom1's, so I think this points to a problem with the Intel card passthru usage, perhaps interrupts handling?. Does anyone know if I need to set any special options for the ixgbe driver under libvirt? TIA, -- Laurence Schuler (Larry) Laurence.Schuler(a)nasa.gov Systems Support ADNET Systems, Inc Scientific Visualization Studio http://svs.gsfc.nasa.gov NASA/Goddard Space Flight Center, Code 606.4 phone: 1-301-286-1799 Greenbelt, MD 20771 fax: 1-301-286-1634 Note: I am not a government employee and have no authority to obligate any federal, state or local government to perform any action or payment.FC949ES

2 1

[libvirt-users] error: virDBusCallMethod
by Thomas Stein 03 Sep '13

03 Sep '13

Hello. Since upgrading to libvirt-1.1.2 i get this error: 2013-09-03 08:29:55.258+0000: 2281: error : virDBusCallMethod:1156 : The name org.freedesktop.machine1 was not provided by any .service files Also live migration doesn't seem to work anymore. There is no error except the above one but the machine is not accessible anymore after migration. The machine is running if i believe "virsh list" but as i said, no ping no nothing. How can i debug this further? thanks and cheers t.

2 2

[libvirt-users] libvirt_lxc heavy cpu usage ?
by zhongjj 03 Sep '13

03 Sep '13

I am running lxc via libvirt1.1.1, the cpu usage is heavy of process libvirt_lxc. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2384 root 20 0 10480 2048 1200 R 99.6 0.1 1291:39 libvirt_lxc 32157 root 20 0 10448 2032 1200 R 99.3 0.1 1316:02 libvirt_lxc 28228 root 20 0 10448 2064 1216 R 99.0 0.1 5663:43 libvirt_lxc 30461 root 20 0 10480 2048 1200 R 98.7 0.1 5663:15 libvirt_lxc btw: 0.9.3 is the same ,I googled it , only two reports . any suggestions ? thx

1 0

[libvirt-users] Running libvirt on a virtualized server
by Andre Gustavo Pereira da Silva 02 Sep '13

02 Sep '13

Hi everyone I'm trying to create a virtual machine using OpenNebula [1] on a centos 6.4 server, but i'm facing some erros using kvm / libvirt. This server is running on a virtual machine created on XCP. Then, my infrastructure is: XCP 1.6 (hypervisor - dom0) + CentOS 6.4 (running on a XCP VM) + OpenNebula 4.0.1 (installed on CentOS). In the host machine, I have the same infrastructure. The problem I'm facing is that, by following the tutorial [2], i've noticed that neither the parameter 'vmx' nor 'svm' is listed on the CPU information provided by the virtual machine where the centOs is running. However, if i run the same command in XCP hypervisor, the parameter 'vmx' is listed. That is, the CPU informations provided by XCP are different from those provided by its virtual machines. My question is: is it possible to use libvirt in this scenario? Here are some messages: - Libvirt log on centoOS (XCP VM): Aug 27 13:26:21 localhost libvirtd: 9945: info : libvirt version: 0.10.2, package: 18.el6_4.9 (CentOS BuildSystem <http://bugs.centos.org>, 2013-07-02-11:19:29, c6b8.bsys.dev.centos.org) Aug 27 13:26:21 localhost libvirtd: 9945: error : udevGetDMIData:1502 : Failed to get udev device for syspath '/sys/devices/virtual/dmi/id' or '/sys/class/dmi/id' Aug 27 13:26:21 localhost kernel: Ebtables v2.0 registered Aug 27 13:26:22 localhost kernel: lo: Disabled Privacy Extensions Aug 27 13:26:40 localhost polkitd[10145]: started daemon version 0.96 using authority implementation `local' version `0.96' Aug 27 13:28:35 localhost libvirtd: 9937: error : qemuProcessStart:3696 : unsupported configuration: Domain requires KVM, but it is not available. Check that virtualization is enabled in the host BIOS, and host configuration is setup to load the kvm modules. Aug 27 13:28:35 localhost libvirtd: 9937: error : qemuRemoveCgroup:768 : internal error Unable to find cgroup for one-8 Aug 27 13:28:35 localhost libvirtd: 9937: warning : qemuProcessStop:4349 : Failed to remove cgroup for one-8 - On XCP hypervisor: [root@xenserver2 ~]# egrep '(vmx|svm)' --color=always /proc/cpuinfo flags: fpu de tsc msr pae mce cx8 apic sep mtrr mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht nx constant_tsc nonstop_tsc aperfmperf pni vmx est ssse3 sse4_1 sse4_2 popcnt hypervisor arat tpr_shadow vnmi flexpriority ept vpid flags: fpu de tsc msr pae mce cx8 apic sep mtrr mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht nx constant_tsc nonstop_tsc aperfmperf pni vmx est ssse3 sse4_1 sse4_2 popcnt hypervisor arat tpr_shadow vnmi flexpriority ept vpid flags: fpu de tsc msr pae mce cx8 apic sep mtrr mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht nx constant_tsc nonstop_tsc aperfmperf pni vmx est ssse3 sse4_1 sse4_2 popcnt hypervisor arat tpr_shadow vnmi flexpriority ept vpid flags: fpu de tsc msr pae mce cx8 apic sep mtrr mca cmov pat clflush acpi mmx fxsr sse sse2 ss ht nx constant_tsc nonstop_tsc aperfmperf pni vmx est ssse3 sse4_1 sse4_2 popcnt hypervisor arat tpr_shadow vnmi flexpriority ept vpid - On centOS (XCP VM): [root@centos2 ~]# cat /proc/cpuinfo processor: 0 vendor_id: GenuineIntel cpu family: 6 model: 44 model name: Intel(R) Xeon(R) CPU E5606 @ 2.13GHz stepping: 2 cpu MHz: 2133.486 cache size: 8192 KB fpu: yes fpu_exception: yes cpuid level: 11 wp: yes flags: fpu de tsc msr pae cx8 sep cmov pat clflush mmx fxsr sse sse2 ss ht syscall nx lm rep_good aperfmperf unfair_spinlock pni ssse3 cx16 pcid sse4_1 sse4_2 popcnt hypervisor lahf_lm arat epb dts bogomips: 4266.97 clflush size: 64 cache_alignment: 64 address sizes: 40 bits physical, 48 bits virtual thanks André Gustavo Recife-PE Brazil [1] http://opennebula.org/documentation:archives:rel1.4:libvirtapi [2]http://www.howtoforge.com/virtualization-with-kvm-on-a-centos-6.4-server

1 0

[libvirt-users] How to add uplink in ESXi virtual switch
by varun bhatnagar 02 Sep '13

02 Sep '13

Hi, I have an ESXi server, on top of it I have created one VM whose IP address is 192.168.79.1. I want to connect to the VM on ESXi server from my host machine but I am not able to do it. I have created a network "networkforSC" and I have pasted my xml file content below but I am not able to add any uplink (how to add it?) . Below is the xml file of my node as well as the network which I am creating on my ESXi server *<domain type='vmware'>* *<name>testNode</name>* *<uuid>50115e16-9bdc-49d7-f171-53c4d7f91710</uuid>* *<memory>1048576</memory>* *<currentMemory>1048576</currentMemory>* *<vcpu>1</vcpu>* *<console>/dev/console</console>* *<os>* *<type arch='x86_64'>hvm</type>* *</os>* *<devices>* *<disk type='file' device='disk'>* *<source file='[datastore1] testNode/testNode.vmdk'/>* *<target dev='sda' bus='scsi'/>* *<address type='drive' controller='0' bus='0' unit='0'/>* *</disk>* *<controller type='scsi' index='0' model='lsilogic'/>* ** *<interface type='bridge'>* *<mac address='00:50:56:25:48:c7'/>* *<source bridge='VM Network'/>* *</interface>* *<interface type='bridge'>* *<source bridge='test'/>* *</interface>* *</devices>* *</domain>* ########################################## Network File: *<network>* *<name>networkforSC</name>* *<portgroup name='test'>* *</portgroup>* *</network>* I have checked the network which got created on the server. As I have not attached any uplink (vmnic0) I can not see it (I want to attach it). #esxcli network vswitch standard list * * *networkforSC* *Name: networkforSC* *Class: etherswitch* *Num Ports: 128* *Used Ports: 2* *Configured Ports: 128* *MTU: 1500* *CDP Status: listen* *Beacon Enabled: false* *Beacon Threshold: 3* *Beacon Required By:* *Uplinks:* *Portgroups: test* Can anyone please help me out in adding the uplink and also can anyone tell me whether I am going in a right direction so that I could ping my virtual machine created on ESXi server. Regards, Varun

1 0

[libvirt-users] remote xenserver problem
by linxiao.st＠centerm.com.cn 02 Sep '13

02 Sep '13

HI： I’m a user of your libvirt, and it help me a lot of time. Thank you for your greate work! However,I found some understand problems,the following is my test environment: 1.I use the version of libvirt is libvirt1.1.1,when I want to use the command like this: #virsh -c xenapi://<my localip>/?no_verify=1 #virsh :list #enter username for<my localip>:root #enter password for<my localip>: it return correct list,but when i input virsh --all list this #virsh list --all it most of time return correct lists,but sometimes returns interal error:TRANSPORT_FAULT:56 why? With my good wishes! linxiao.st(a)centerm.com.cn

1 0

[libvirt-users] Redhat VM is not getting IP from DHCP
by Praveen Kumar 02 Sep '13

02 Sep '13

Hi, Below is the steps which I performed but not getting the IP of the guest. * Created a fresh VM (RHEL-6.4-server-x86_64) * Checked ifconfig output ( Getting IP from DHCP server) * Took xml dump. * Changed UUID in the xml * Changed MAC in the xml * Changed Name * defined a another VM using changed xml. * boot it up and checked the ifconfig status.( Not able to get IP) If same steps I follow in fedora guest then it's working as expected (getting the IP from DHCP). Any Suggestions? -- Praveen Kumar

1 0

[libvirt-users] how to setup network filter
by Jiaan Zeng 02 Sep '13

02 Sep '13

Hi All, I am new to libvirt and encounter a strange problem to set up network filter in a NAT network. I launched VMs in a single host using NAT, i.e. interface type='network'. Now I want to control the outbound traffic from VM instance - only allow the VM to asses a set of ip addresses. My network filter xml is as follows. The problem is once I change the VM xml, shutdown and start VM, VM cannot get ip address. /var/log/libvirt/libvirt.log shows " error : virNetDevGetIndex:656 : Unable to get index for interface vnet2: No such device" error. But when I remove the drop rule in the filter xml, VM can get IP address. I even tried the clean-traffic filter shipped with libvirt. VM throws the same error above. Any idea why this happens? How can I implement outbound traffic control in libvirt? Thanks a lot. <filter name='filter-test'> <rule action='accept' direction='in' priority='500'> <tcp dstportstart='22'/> </rule> <rule action='accept' direction='out' priority='500'> <ip dstipaddr='IP1'/> </rule> <rule action='accept' direction='out' priority='500'> <ip dstipaddr='IP2'/> </rule> <rule action='drop' direction='out' priority='500'> <all/> </rule> </filter> The VM network section XML looks like this <interface type='network'> <mac address='52:54:00:0d:f1:ce'/> <source network='default'/> <filterref filter='filter-test'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> -- Regards, Jiaan

1 0