[dropping libvir-list, which is for development issue; yours is more of a usage issue] On 12/16/2013 01:32 PM, Vasiliy Tolstov wrote: Yes, it is possible to take snapshots of a vm with practically 0 downtime, and once you have an external snapshot, you can probe the state of the filesystem in that snapshot with no interruption to the vm. I suggest taking an external snapshot both before and after the point where the guest is performing unknown changes (your choice of disk-only or full snapshot with RAM state as well; but it sounds like disk-only may be sufficient if you are just comparing disk contents between two snapshots), then look into the tools provided by libguestfs for comparing file systems between two snapshots. But while taking snapshots is possible with no downtime, you do have to be prepared for the difficulties of rolling back if you don't like what you found when comparing two snapshots. To begin with, libvirt support for reverting to external snapshots is still incomplete, so you'll end up doing some things manually (the archives of this list discusses the topic, or ask more questions as you have them); you also have the inherent issue that a rollback is hard to distinguish from guest downtime (any rollback to an earlier point in time is somewhat similar to downtime between the point of the snapshot and the point where you decided to rollback, because after the rollback, the guest behaves as if no useful work was done in that stretch of time). -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org