June 2010 - Users - libvirt List Archives

[libvirt-users] Some missunderstanding in the wiki page
by Leopold Palomo-Avellaneda 01 Jul '10

01 Jul '10

Hi, I'm not in the list and I just would like to comment it to the comunity. So, if someone want to contact me, make CC to me in the reply. The wiki page [1] talk about networking, and show two typical configurations: "virtual network" and "shared physical device". The shared physical device has an error or something that could make confused, I think. What I want to say? In my case, I have a box with several nics, and I want to speciffy that ethX should be used exclusively but virtual domain X. The documentation is clear in this: The NAT based connectivity is useful for quick & easy deployments, or on machines with dynamic/sporadic networking connectivity. More advanced users will want to use full bridging, where the guest is connected directly to the LAN. The configuration (I have follow only the debian/ubuntu steps) shows that br0 has assigned an IP. I did the mistake to try to assign the same IP in the guest network configuration, I understand that, and obviously it doesn't work (duplicate IPs). So, to me, it would me more clear if the br0 interface has no IP. In my case, I have two nics: eth0 the interface for the host and eth1 for the guest. The eth1 part in my network/interfaces is: ... auto eth1 iface eth1 inet manual auto br0 iface br0 inet manual bridge_ports eth1 bridge_stp on bridge_maxwait 0 bridge_fd 0 ... and then in the guest you configure the IP as you want. In the host, eth1 (or whatever interface you bridge) has no IP, so it's not used, and the guest uses completely. What do you think? Regards, Leo [1] http://wiki.libvirt.org/page/Networking

2 3

[libvirt-users] SASL GSSAPI error "Key table entry not found"
by Adam Gray 01 Jul '10

01 Jul '10

My server and client are running Ubuntu Lucid, libvirt-bin 0.7.5-5ubuntu27, qemu-kvm-0.12.3+noroms-0ubuntu9 and I'm using virt-viewer-0.0.3-6ubuntu7.xul19 or virt-manager-0.8.2-2ubuntu8 to connect. I configured SASL2 to use GSSAPI for libvirt following the instructions in the libvirt docs, created a keytab with libvirt/my.fully.qualified.domain(a)MY-REALM.COM (has a dash fwiw) and pointed SASL2 and libvirt at /etc/krb5.keytab (changing the location of that doesn't seem to work for my version, but that's no biggie). So I sit on my client and run this: virsh -c qemu+tcp://my.fully.qualified.domain/system And I get this message on the client: error: authentication failed error: failed to connect to the hypervisor And this on the server logs: 16:37:35.278: error : remoteDispatchAuthSaslStart:3135 : sasl start failed -1 (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)) For fun, I ran kdestroy and tried again and got this: error: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_1000' not found)) error: failed to connect to the hypervisor So at least the client seems to be presenting my ticket properly, but the server is either looking for the wrong keytab entry or I can't read very well. -adam

4 7

[libvirt-users] how to match the ID of a LUN in a storage pool with the GUID on the target server
by Tom Georgoulias 01 Jul '10

01 Jul '10

I've configured a libvirt storage pool using an iscsi target from a Sun 7310 storage appliance and am using the LUNs in this target as volumes for my KVM guests. The setup is very similar to what Daniel covered in a recent blog posting: http://berrange.com/posts/2010/05/05/provisioning-kvm-virtual-machines-on-i… It works great, but I can't figure out how to match the volume names & path IQNs within the storage pool to the GUIDs on the target. For example, here's what I see when I use the vol-info command: # virsh vol-list kvm-target Name Path ----------------------------------------- 6.0.0.0 /dev/disk/by-path/ip-X.X.X.X:3260-iscsi-iqn.1986-03.com.sun:02:<snipped>-lun-0 6.0.0.1 /dev/disk/by-path/ip-X.X.X.X:3260-iscsi-iqn.1986-03.com.sun:02:<snipped>-lun-1 The IQN matches the targets IQN, but when I browse the LUNs from the storage system I do not see a way to determine which of them is *-lun-0 and which is *-lun-1, I only see a GUID and an alias name that I created. Is there any way to get that info (or something else that will do the job) from a virsh command? Thanks in advance for any help. Tom

2 5

[libvirt-users] Are memoryPeek and blockPeek still not supported?
by steven765＠yahoo.com 01 Jul '10

01 Jul '10

Hi, I just tried x=dom.blockPeek('disk',5,0,buf,0) and it returns AtrributeError: 'module' object has no attribute 'virDomainBlockPeek' I found this bug submission from early 09: https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=492683 Is that still correct are they not implemented. Or did i screw up the command? Thanks, Steve

1 0

[libvirt-users] Better error codes when stopping a VM that is already stopped
by Guido Winkelmann 01 Jul '10

01 Jul '10

Hi, Sometimes when stopping a virtual domain using virDomainDestroy(), I come across a domain that is already stopped. (For example when someone already stopped the domain manually using virsh or because the guest OS issued a shutdown.) This is a special case that I absolutely need to catch and handle. Unfortunately, when this happens, and I call virGetLastError() afterwards, I always just get the error code VIR_ERR_OPERATION_INVALID, which doesn't look very precise to me... Two questions about this: Is the domain not running at that moment the only possible condition that can trigger this particular error code when calling virDomainDestroy()? Can't we have a more obvious/precise error code in that case, like VIR_ERR_DOMAIN_NOT_RUNNING or something like that? Guido Winkelmann

4 6

[libvirt-users] FYI: a short guide to libvirt & network filtering iptables/ebtables use
by Daniel P. Berrange 01 Jul '10

01 Jul '10

I just wrote this to assist some Red Hat folks understanding what libvirt does with iptables, and thought it is useful info for the whole libvirt community. When I have time I'll adjust this content so that it can fit into the website in relevant pages/places. Firewall / network filtering in libvirt ======================================= There are three pieces of libvirt functionality which do network filtering of some type. At a high level they are: - The virtual network driver. This provides a isolated bridge device (ie no physical NICs enslaved). Guest TAP devices are attached to this bridge. Guests can talk to each other & the host, and optionally the wider world. - The QEMU driver MAC filtering This provides a generic filtering of MAC addresses to prevent the guest spoofing its MAC address. This is mostly obsoleted by the next item, so won't be discussed further. - The network filter driver This provides fully configurable, arbitrary network filtering of traffic on guest NICs. Generic rulesets are defined at the host level to control traffic in some manner. Rules sets are then associated with individual NICs of a guest. While not as expressive as directly using iptables/ebtables, this can still do nearly everything you would want to on a guest NIC filter. The virtual network driver ========================== The typical configuration for guests is to use bridging of the physical NIC on the host to connect the guest directly to the LAN. In RHEL6 there is also the possibility of using macvtap/sr-iov and VEPA connectivity. None of this stuff plays nicely with wireless NICs, since they will typically silently drop any traffic with a MAC address that doesn't match that of the physical NIC. Thus the virtual network driver in libvirt was invented. This takes the form of an isolated bridge device (ie one with no physical NICs enslaved). The TAP devices associated with the guest NICs are attached to the bridge device. This immediately allows guests on a single host to talk to each other and to the host OS (modulo host IPtables rules). libvirt then uses iptables to control what further connectivity is available. There are three configurations possible for a virtual network at time of writing - isolated: all off-node traffic is completely blocked - nat: outbound traffic to the LAN is allowed, but MASQUERADED - forward: outbound traffic to the LAN is allowed The latter 'forward' case requires the virtual network be on a separate sub-net from the main LAN, and that the LAN admin has configured routing for this subnet. In the future we intend to add support for IP subnetting and/or proxy-arp. This allows for the virtual network to use the same subnet as the main LAN & should avoid need for the LAN admin to configure special routing. Libvirt will optionally also provide DHCP services to the virtual network using DNSMASQ. In all cases, we need to allow DNS/DHCP queries to the host OS. Since we can't predict whether the host firewall setup is already allowing this, we insert 4 rules into the head of the INPUT chain target prot opt in out source destination ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Note we have restricted our rules to just the bridge associated with the virutal network, to avoid opening undesirable holes in the host firewall wrt the LAN/WAN. The next rules depend on the type of connectivity allowed, and go in the main FORWARD chain: type=isolated ------------- Allow traffic between guests. Deny inbound. Deny outbound. target prot opt in out source destination ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=nat -------- Allow inbound related to an established connection. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=routed ----------- Allow inbound, but only to our expected subnet. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr2 0.0.0.0/0 192.168.124.0/24 ACCEPT all -- virbr2 * 192.168.124.0/24 0.0.0.0/0 ACCEPT all -- virbr2 virbr2 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr2 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr2 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Finally, with type=nat, there is also an entry in the POSTROUTING chain to apply masquerading target prot opt in out source destination MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 The network filter driver ========================= This driver provides a fully configurable network filtering capability that leverages ebtables, iptables and ip6tables. This was written by the libvirt guys at IBM and although its XML schema is defined by libvirt, the conceptual model is closely aligned with the DMTF CIM schema for network filtering http://www.dmtf.org/standards/cim/cim_schema_v2230/CIM_Network.pdf The filters are managed in libvirt as a top level, standalone object. This allows the filters to then be referenced by any libvirt object that requires their functionality, instead tieing them only to use by guest NICs. In the current implementation, filters can be associated with individual guest NICs via the libvirt domain XML format. In the future we might allow filters to be associated with the virtual network objects. Further we're expecting to define a new 'virtual switch' object to remove the complexity of configuring bridge/sriov/vepa networking modes. This make also end up making use of network filters. There are a new set of virsh commands for managing network filters virsh nwfilter-define define or update a network filter from an XML file virsh nwfilter-undefine undefine a network filter virsh nwfilter-dumpxml network filter information in XML virsh nwfilter-list list network filters virsh nwfilter-edit edit XML configuration for a network filter There are equivalently named C APIs for each of these commands. As with all objects libvirt manages, network filters are configured using an XML format. At a high level the format looks like this: <filter name='no-spamming' chain='XXXX'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule ...> .... </rule> <filterref filter='XXXX'/> </filter> Every filter has a name and UUID which serve as unique identifiers. A filter can have zero-or-more <rule> elements which are used to actually define network controls. Filters can be arranged into a DAG, so zero-or-more <filterref/> elements are also allowed. Cycles in the graph are not allowed. The <rule> element is where all the interesting stuff happens. It has three attributes, an action, a traffic direction and an optional priority. eg <rule action='drop' direction='out' priority='500'> Within the rule there are a wide variety of elements allowed, which do protocol specific matching. Supported protocols currently include 'mac', 'arp', 'rarp', 'ip', 'ipv6', 'tcp/ip', 'icmp/ip', 'igmp/ip', 'udp/ip', 'udplite/ip' 'esp/ip', 'ah/ip', 'sctp/ip', 'tcp/ipv6', 'icmp/ipv6', 'igmp/ipv6', 'udp/ipv6', 'udplite/ipv6', 'esp/ipv6', 'ah/ipv6', 'sctp/ipv6'. Each protocol defines what is valid inside the <rule> element, the general pattern though is <protocol match='yes|no' attribute1='value1' attribute2='value2'/> so, eg a TCP protocol, matching ports 0-1023 would be expressed as: <tcp match='yes' srcportstart='0' srcportend='1023'/> Attributes can included references to variables defined by the object using the rule. So the guest XML format allows each NIC to have a MAC address and IP address defined. These are made available to filters via the variables $IP and $MAC. So to define a filter the prevents IP address spoofing we can simply match on source IP address != $IP <filter name='no-ip-spoofing' chain='ipv4'> <rule action='drop' direction='out'> <ip match='no' srcipaddr='$IP' /> </rule> </filter> I'm not going to go into details on all the other protocol matches you can do, because it'll take far too much space. You can read about the options here http://libvirt.org/formatnwfilter.html#nwfelemsRulesProto Out of the box in RHEL6/Fedora rawhide, libvirt ships with a set of default useful rules # virsh nwfilter-list UUID Name ---------------------------------------------------------------- 15b1ab2b-b1ac-1be2-ed49-2042caba4abb allow-arp 6c51a466-8d14-6d11-46b0-68b1a883d00f allow-dhcp 7517ad6c-bd90-37c8-26c9-4eabcb69848d allow-dhcp-server 3d38b406-7cf0-8335-f5ff-4b9add35f288 allow-incoming-ipv4 5ff06320-9228-2899-3db0-e32554933415 allow-ipv4 db0b1767-d62b-269b-ea96-0cc8b451144e clean-traffic f88f1932-debf-4aa1-9fbe-f10d3aa4bc95 no-arp-spoofing 772f112d-52e4-700c-0250-e178a3d91a7a no-ip-multicast 7ee20370-8106-765d-f7ff-8a60d5aaf30b no-ip-spoofing d5d3c490-c2eb-68b1-24fc-3ee362fc8af3 no-mac-broadcast fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is 'clean-traffic'. This pulls together all the building blocks into one filter that you can then associate with a guest NIC. This stops the most common bad things a guest might try, IP spoofing, arp spoofing and MAC spoofing. To look at the rules for any of these just do virsh nwfilter-dumpxml FILTERNAME|UUID They are all stored in /etc/libvirt/nwfilter, but don't edit files there directly. Use 'virsh nwfilter-define' to update them. This ensures the guests have their iptables/ebtables rules recreated. To associate the clean-trafffic filter with a guest, edit the guest XML config and change the <interface> element to include a <filterref> and also specify the whitelisted <ip addres/> the guest is allowed to use <interface type='bridge'> <mac address='52:54:00:56:44:32'/> <source bridge='br1'/> <ip address='10.33.8.131'/> <target dev='vnet0'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> If no <ip address> is included, the network filter driver will activate its 'learning mode'. This uses libpcap to snoop on network traffic the guest sends and attempts to identify the first IP address it uses. It then locks traffic to this address. Obviously this isn't entirely secure, but it does offer some protection against the guest being trojaned once up & running. In the future we intend to enhance the learning mode so that it looks for DHCPOFFERS from a trusted DHCP server and only allows the offered IP address to be used. Now, how is all this implemented... The network filter driver uses a combination of ebtables, iptables and ip6tables, depending on which protocols are referenced in a filter. The out of the box 'clean-traffic' filter rules only require use of ebtables. If you want to do matching at tcp/udp/etc protocols (eg to add a new filter 'no-email-spamming' to block port 25), then iptables will also be used. The driver attempts to keep its rules separate from those that the host admin might already have configured. So the first thing it does with ebtables, is to add two hooks in POSTROUTING & PREROUTING chains, to redirect traffic to custom chains. These hooks match on the TAP device name of the guest NIC, so they should not interact badly with any administrator defined rules Bridge chain: PREROUTING, entries: 1, policy: ACCEPT -i vnet0 -j libvirt-I-vnet0 Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT -o vnet0 -j libvirt-O-vnet0 To keep things managable & easy to follow, the driver will then create further sub-chains for each protocol then it needs to match against: Bridge chain: libvirt-I-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j I-vnet0-ipv4 -p ARP -j I-vnet0-arp -p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -j DROP Bridge chain: libvirt-O-vnet0, entries: 4, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -j DROP Finally, come the actual implementation of the filters. These example is showing the 'clean-traffic' filter implementation. I'm not going to explain what this is doing now :-) Bridge chain: I-vnet0-ipv4, entries: 2, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p IPv4 --ip-src ! 10.33.8.131 -j DROP Bridge chain: O-vnet0-ipv4, entries: 1, policy: ACCEPT -j ACCEPT Bridge chain: I-vnet0-arp, entries: 6, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p ARP --arp-mac-src ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-src ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: O-vnet0-arp, entries: 5, policy: ACCEPT -p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-dst ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: I-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -s 52:54:0:56:44:32 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP Bridge chain: O-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP NB, we would have liked to include the prefix 'libvirt-' in all of our chain names, but unfortunately the kernel limits names to a very short maximum length. So only the first two custom chains can include that prefix. The others just include the TAP device name + protocol name. If I define a new filter 'no-spamming' and then add this to the 'clean-traffic' filter, I can illustrate how iptables usage works. # cat > /root/spamming.xml <<EOF <filter name='no-spamming' chain='root'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule action='drop' direction='out' priority='500'> <tcp dstportstart='25' dstportend='25'/> </rule> </filter> EOF # virsh nwfilter-define /root/spamming.xml # virsh nwfilter-edit clean-traffic ...add <filterref filter='no-spamming'/> All active guests immediately have their iptables/ebtables rules rebuilt. The network filter driver deals with iptables in a very similar way. First it separates out its rules from those the admin may have defined, by adding a couple of hooks into the INPUT/FORWARD chains Chain INPUT (policy ACCEPT 13M packets, 21G bytes) target prot opt in out source destination libvirt-host-in all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 5532K packets, 3010M bytes) target prot opt in out source destination libvirt-in all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-out all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-in-post all -- * * 0.0.0.0/0 0.0.0.0/0 These custom chains, then do matching based on the TAP device name, so they won't open holes in the admin defined matches for the LAN/WAN (if any). Chain libvirt-host-in (1 references) target prot opt in out source destination HI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in (1 references) target prot opt in out source destination FI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in-post (1 references) target prot opt in out source destination ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 Chain libvirt-out (1 references) target prot opt in out source destination FO-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Finally, we can see the interesting bit which is the actual implementation of my filter to block port 25 access: Chain FI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 Chain FO-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:25 Chain HI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 One thing in looking at this that you may notice is that if there are many guests all using the same filters, we will be duplicating the iptables rules over & over for each guest. This is merely a limitation of the current rules engine implementation. At the libvirt object modelling level you can clearly see we've designed the model so that filter rules are define in one place, and indirectly referenced by guests. Thus it should be possible to change the impl in the future so that we can share the actual iptables/ebtables rules for each guest to create a more scalable system. The stuff in current libvirt is more or less the very first working impl we've had of this stuff, so there's not been much optimization work yet. Also notice that at the XML level we don't expose the fact that we are using iptables or ebtables at all. The rule definition is done in terms of network protocols. Thus if we ever find a need, we could plug in an alternative implementation that calls out to a different firewall implementation instead of ebtables/iptables (providing that impl was suitably expressive of course) Finally, in terms of problems we have in deployment. The biggest problem is that if the admin does 'service iptables restart' all our work gets blown away. We've experimented with using lokkit to record our custom rules in a persistent config file, but that caused different problem. Admins who were not using lokkit for their config found that all their own rules got blown away. So we threw away our lokkit code. Instead we document that if you run 'service iptables restart', you need to send SIGHUP to libvirt to make it recreate its rules. Finally a reminder, that the main documentation we have on this is online at http://libvirt.org/formatnwfilter.html Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[libvirt-users] VirtualBox driver : creating storage for a new machine
by Christian Patsch 29 Jun '10

29 Jun '10

Hi, Another thing I'm strugglin with: When creating a new domain from scratch using the proposed XML format in the documentation, everything works fine - basically. A problem that I'd like to solve now is that I would expect to be able to create new volumes within libvirt. I started with a basic XML file in order to define a pool, but virsh told me that creating pools is not supported by the VirtualBox hypervisor. >From the code and different hints I learned that there is only one pool with a dummy UUID, named "default-pool". Next I tried to create a new volume from a XML file, but the only thing I'm getting are segmentation faults. Has anybody used this approach successfully ? Otherwise I assume that I have to create the VDI files manually using VirtualBox GUI/VBoxManage or vboxshell.py. Thanks in advance, Regards, Christian

2 1

[libvirt-users] VirtualBox headless
by Christian Patsch 29 Jun '10

29 Jun '10

Hello, I'm trying to use the VirtualBox/vbox driver together with libvirt 0.8.1 on a Ubuntu Lucid Machine, VirtualBox Release 3.1. The goal is to run the virtual machines headless and to connect using RDP. When starting a virtual domain using 'virsh start <domainname>' the GUI of VirtualBox will pop up and I see no option to prevent this. If X is not running, the virsh command will terminate with 'unknown failure'. I've found some hints on inclusion of the headless statement in the 'graphics' part of the XML definition file, but when I tree to adopt this, the editing of the file will crash. Has anyone achieved to manage VBox machines with libvirt on a headless server ? Thanks in advance for some hints or experiences with this issue, Christian

2 2

[libvirt-users] can't access VM after Fedora 13 KVM install
by Joel Uckelman 28 Jun '10

28 Jun '10

Hi, I'm installing a Fedora 13 virtual host on a Fedora 13 system, like this: virt-install --ram 2048 --vcpus 4 --name test --os-type linux \ --os-variant fedora13 --disk /var/lib/libvirt/images/test.img,size=10 \ --cdrom /var/lib/libvirt/Fedora-13-x86_64-DVD.iso --vnc --noautoconsole I connect to the installer using virt-manager, and the install appears to complete successfully. Then, I reboot the virtual machine and reconnect with virt-manager. What I see is this: Starting SeaBios (version 0.5.1) gPXE (http://etherboot.org) - 00:04.0 C900 PCI2.10 PnP BBS PMM7FE0@10 C900 Booting from Hard Disk... If I connect to the VM's console using 'virsh console', there's no output at all. I don't see anything in /var/log/messages or /var/log/libvirt that looks like an error. So, I'm not sure what's going on here, as this is the first time I've done anything with virtualization. Has my VM hung, or is this what's supposed to happen? I was expecting that somewhere along the line that my VM would get an IP address via DHCP so I could SSH to it, but don't see anything indicating that has happend, or what the IP address is if it has. Is something broken here, or have I missed a crucial step? -- J.

1 1

[libvirt-users] network interface management in bridge firewall configuration
by Aleksander Trofimowicz 28 Jun '10

28 Jun '10

Hello, I'm just wondering why I can't manage my network interfaces through libvirt when the following kernel parameters are turned on: net.bridge.bridge-nf-call-ip6tables net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-arptables Is it a bug or by design? If the latter, could someone explain me premises of such decision? I'm aware of security implications of mixing conntrack and bridge bits, so we can skip that point. This behaviour is noticeable when using: libvirt-0.8.1-1.fc13.x86_64 netcf-libs-0.1.6-1.fc13.x86_64 -- thanks, aleksander trofimowicz

2 1

[libvirt-users] sound problem
by Stephen Liu 25 Jun '10

25 Jun '10

Hi folks, KVM - 1:0.12.4+dfsg-1~bpo50+1 0 host - Debian 5.0 I have been suffering on sound problem for sometimes. Please advise whether the same has been solved. If YES please advice how to solve it. TIA B.R. Stephen L

1 0

[libvirt-users] i need help
by Jounewe Lambang Paul Roland 24 Jun '10

24 Jun '10

I am french student who works on a libvirt projet, it consists to get information from an hypervisor by using libvirt API in perl in cgi script but i have a great problem. I wrote my script and its works in EPIC but when i am trying to run it from apache web server as a CGI script, it goes wrong and i have this message: libvirt code 38 message: can no recv data: ssh connect to host myZenhost.mydomaine.fr port 22 in my browser. i made libvirtd installation and tried command line virsh -c xen+ssh://root@myZenhost.mydomain.fr wich works correctly i dont know what wrong.I run the script to remote xen hypervisor as root with a good config of ssh (transport mode), I realize that the environment variables of root account (client) is not the same with apache webserver, and i am set the same path in apache env variable but there are no change. please i need your help to fix this problem. Cdt. Paul Roland JOUNEWE LAMBANGIngénieur Réseaux TélécomMob:+336 03 74 60 565, Av Albert 1er 95600 Eaubonne-France le mensonge est comme une bulle d'air qu'on tente désespérément de retenir au fond d'une récipient plein d'eau, tôt ou tard il finit par remonter en surface.

1 0

[libvirt-users] Domain did not show up error
by Matt Wallace 24 Jun '10

24 Jun '10

Hi all, I've run into an issue with using libvirt via the ruby bindings. When trying to create a new domain via xml, I get the following error: libvir: QEMU error : internal error Domain webserver.staging.myco.com didn't show up When I check using virsh, the domain has been defined and shows as "running" when I execute "list --all" but does not show up when I execute "list" nor will it let me connect via "console webserver.staging.myco.com". Can anyone shed any light on why this might be? O/S: Centos 5.4 Ruby: ruby 1.8.5 (2006-08-25) [x86_64-linux] Libvirt: 0.6.3 If you need any more information, please let me know. If you want to see the code that is being used, it's cucumber-vhost (http://github.com/proffalken/cucumber-vhost) Thanks, Matt

1 0

[libvirt-users] Obtaining UTC Time from Remote VM Host
by Development 24 Jun '10

24 Jun '10

Quick question on whether it is possible to use the libvirt API exposed by the libvirt DLL compiled on a Vista machine to obtain the system time in UTC of the remote machine hosting several VMs? Many thanks...

2 2

[libvirt-users] Qemu backend: Cannot start new domains after some time
by Guido Winkelmann 24 Jun '10

24 Jun '10

Hi, After using libvirt+qemu for a while, I'm finding that I can no longer reliably start new domains. Most of the time when I try, I'm getting this, or something like it: virsh # start dhcpv6server error: Failed to start domain dhcpv6server error: monitor socket did not show up.: No such file or directory The same thing happens when trying to start the domain using the C-API. This happens particularly often when there are any domains running that are using a lot of CPU, even when most of the physical cores of the host machine are still sitting idle. (I've created a number of Linux VMs, with one CPU core each, that do nothing but calculate primes in an endless loop for load-testing purposes.) If I destroy all of the high-load domains, I can usually start up new domains again. The time between requesting the domain startup and the error message being printed varies greatly, from less than a second to more than a minute. The host machine is running Fedora 12 with libvirt 0.8.1 and qemu-kvm 0.12.4. Any ideas what might be causing this, and what can be done about it? It would be a big problem for us if we cannot start any new domains just because some of the existing ones are using a lot of CPU... Regards, Guido

1 0

Re: [libvirt-users] Question about the remote Authentication in the libvirt Java bindings
by Bryan Kearney 22 Jun '10

22 Jun '10

Dustin: I am adding this response to the libvirt list as well so that others may see it. The authorization is done via a callback. The ConnectAuthDefault() that you are using is one such implementation. You could create your own subclass of ConnectAuth, and override the method: public abstract int callback(Credential[] cred); And then provide the username/password in that fashion. Look at the ConnectAuthDefault in the case statement how it chooses to ask for username and password. -- bk On 06/21/2010 10:35 PM, Dustin Xiong wrote: > Dear Bryan Kearney： > > I hava a question about the remote authentication of the libvirt java > bindings. I run the test.java of the libvirt-java-0.4.3.tar.gz. I can > connect the remote host use the > > ConnectAuth defaultAuth = new ConnectAuthDefault(); > try{ conn = new Connect("xen+ssh://192.168.0.146/", defaultAuth, 0); > > Then I input the remote host's ssh password, I can connect the host. > If I don't want to input the ssh password, I want write the password > into the libvirt or libvirt-java' src code. > How can modify the libvirt or libvirt-java src code, the libvirt will > auto connect to the remote host without user input the ssh code. > > Thanks for help. > > -Dustin

1 0

[libvirt-users] How to get supported feature list in driver
by Ryota Ozaki 21 Jun '10

21 Jun '10

Hello Is there an easy way to get supported feature (API) list in each driver? The function would be to return a list which describes which APIs are supported and which APIs are not. Thanks in advance ozaki-r

2 2

[libvirt-users] libvirtError: poll on socket failed: Interrupted system call
by jeremy avnet 19 Jun '10

19 Jun '10

Hello. I just upgraded from libvirt 0.7.0 to 0.7.5 in Ubuntu Lucid and now my application will get into a hung state. I have to kill it at which point I get the following error from the Python bindings: Traceback (most recent call last): File "/usr/local/app/vm.py", line 246, in launch vm.create() File "/usr/lib/python2.6/dist-packages/libvirt.py", line 300, in create if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self) libvirtError: poll on socket failed: Interrupted system call Some searches turned up a patch involving signals sent by ncurses apps resizing, but this is not an ncurses app. It's a daemonized Python Twisted application. Unfortunately, this problem is making it so the application hangs indefinitely until we kill it and start it again. Any suggestions as to what might be causing this? Thanks! .:. jeremy

1 0

[libvirt-users] java.lang.UnsatisfiedLinkError: jnidispatch (/com/sun/jna/linux-i386/libjnidispatch.so) not found in resource path
by Rafael Braga 18 Jun '10

18 Jun '10

Hi everybody, I'm trying to run the sample of the site, but is not working. In fact, already includes jna.jar in my class path, see. What can it be? -- Rafael Braga

1 1

[libvirt-users] Snapshots - can't take a snapshot with running VM
by Julian Robbins 17 Jun '10

17 Jun '10

Hi I'm quite new to KVM/libvirt0 so hope you can help I'm using Ubuntu Lucid 10.04 and libvirt0 0.8.1 When I try a :- snapshot create vm_name I get an error, ie 'error -5 while writing' Googling doesnt bring anything up. Taking snapshots of a vm when it isnt running works fine. Can I really only create snapshots of a vm when it isnt running ? -- Kind regards Julian

2 4

[libvirt-users] cannot acquire state change lock
by Julian Robbins 17 Jun '10

17 Jun '10

Hi I keep getting libvirtError: Timed out during operation: cannot acquire state change lock errors - what does this mean exactly ? Using Ubuntu 64 bit 10.04 host and guest -- Kind regards Julian Robbins

2 1

[libvirt-users] libvirt API hangs
by Zhang Qian 17 Jun '10

17 Jun '10

Hi, I have someVMs in my KVM hosts(RHEL 5.5), I found when run "virsh save <domain> <file>" to save a VM, the command "virsh dominfo <domain>" will hang until the save command finishes. Is this libvirt's behavior? Or KVM/QEMU's? This may impact the performance. Thanks, Qian

2 1

[libvirt-users] Bridge with macvtap problem
by Eduardo 16 Jun '10

16 Jun '10

Hi friends! I'm using libvirt 0.8.1 with qemu-kvm 0.12.4 on Linux 2.6.34. At the moment there are 2 virtual machines running inside that host without problem. They are using the macvtap feature for networking share. But I can't do ping from the host to the guest, but I need this. And whatever communication between them. Ping with other host is normal. Below follows the xml domain definition of one guest: <domain type='kvm' id='2'> <name>vox2</name> <uuid>2e143f6e-5506-8073-c5fc-3ea92fc2b579</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>2</vcpu> <os> <type arch='x86_64' machine='pc-0.12'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <source file='/virtual/vox2.qcow2'/> <target dev='sda' bus='scsi'/> <alias name='scsi0-0-0'/> <address type='drive' controller='0' bus='0' unit='0'/> </disk> <controller type='scsi' index='0'> <alias name='scsi0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </controller> <interface type='direct'> <mac address='52:54:00:2f:fe:3d'/> <source dev='eth0' mode='bridge'/> <target dev='macvtap1'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </interface> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5901' autoport='no' keymap='pt-br'/> <video> <model type='vmvga' vram='9216' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> </devices> </domain> P.S.: The default network of libvirt is disabled. -- *Eduardo Ramos* Asterisk Manager Linux User www.freedominterface.org +55 12 81129581 exten=>eduardo,1,hangup()

1 0

[libvirt-users] howto search this mailing list archive?
by Julian Robbins 16 Jun '10

16 Jun '10

Another quickie I've long and hard (honest !), but can't find a way to search this ml's archives. How do you do this ? -- Kind regards Julian Robbins

2 1

[libvirt-users] apparmor and kvm/libvirt
by Julian Robbins 16 Jun '10

16 Jun '10

Hi After kindly answering my question on snapshots not working whilst vm is on, i find that apparmor is still disturbing the process where snapshots can get written But although i should just be able to disable apparmor for my vm in virt-manager, whilst vm is off; that when i start the vm the apparmor settings go back to being enabled and set to dynamic This is stopping me from taking snapshots again whilst vm is on. :-( I have also tried disabling the apparmor profile for libvirt on the host but this appears to have had no effect. I know very little about appamor and it is not particularly important to be used in this case. I am using Ubuntu 10.04 LTS on both host and guest 64 bit. -- Kind regards Julian Robbins

1 0

[libvirt-users] SCM_RIGHTS file error when attaching device?
by steven765＠yahoo.com 16 Jun '10

16 Jun '10

So I just upgraded to 0.8.1-1 and virt-manager 8.4 when i try to attach my network card that's been perfectly fine in the past i now get... virsh # attach-device gnome /etc/libvirt/qemu/nic.xml error: Failed to attach device from /etc/libvirt/qemu/nic.xml error: internal error unable to send TAP file handle: No file descriptor supplied via SCM_RIGHTS Any thoughts?

2 1

[libvirt-users] How to configure kvm development environment
by Avdhoot Joshi 15 Jun '10

15 Jun '10

Hi, Installed RHEL 5.5 on AMD Opteron. [root@wlng-ppcore-nd3 ~]# uname -a Linux wlng-ppcore-nd3 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@wlng-ppcore-nd3 ~]# virsh version Compiled against library: libvir 0.6.3 Using library: libvir 0.6.3 Using API: QEMU 0.6.3 Running hypervisor: QEMU 0.9.1 This is the default version of virsh using libvirt 0.6.3. Downloaded libvirt 0.8.1, configured it as follows: $ configure $ make $ make install What should be done so that virsh uses the latest 0.8.1 libvirtd binary, how to completely stop 0.6.3? I want to execute a program using virDomainMemoryStats which is available only in latest libvirtd. Thanks, Avdhoot

1 0

Re: [libvirt-users] Problems moving qemu machine to libvirt
by Gunnar Thielebein 15 Jun '10

15 Jun '10

Hi Erik, thanks for the solution provided. I tried that but unfortunately it spits out this error message: > Traceback (most recent call last): > File "/usr/share/virt-manager/virtManager/engine.py", line 588, in run_domain > vm.startup() > File "/usr/share/virt-manager/virtManager/domain.py", line 150, in startup > self._backend.create() > File "/usr/lib/python2.6/dist-packages/libvirt.py", line 300, in create > if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self) > libvirtError: internal error cannot parse QEMU version number in '' Looks to me that libvirt does some version checks with the emulator-node and don't get reliable output. The wrapper script: /etc/libvirt/kvmvde: > #!/bin/bash > exec /usr/bin/kvm "$@" \ > -net nic,vlan=0,model=virtio,macaddr=52:54:61:44:21:23 \ > -net vde,vlan=0,group=libvirtd,mode=0770,sock=/var/run/vde.ctl The xml section: ... > <devices> > <emulator>/etc/libvirt/kvmvde</emulator> > <disk type='file' device='disk'> > <source file='/var/lib/libvirt/images/vlxp01-gt/tmp7Jiyzz.qcow2'/> > <target dev='hda' bus='ide'/> > </disk> ... Btw. is the bridge entry really necessary in the xml file? I wonder if this wouldn't also work, but I am not at this step, currently: => http://libvirt.org/formatdomain.html#elementsNICSSlirp "Generic ethernet connection" > ... > <devices> > <interface type='ethernet'/> > ... > <interface type='ethernet'> > <target dev='vnet7'/> > <script path='/etc/qemu-ifup-mynet'/> > </interface> > </devices> > ... Perhaps this is a place to also start the vde hub? On 10.06.2010 13:34, Erik de Castro Lopo wrote: > #!/bin/bash > exec /usr/bin/kvm $@ \ > -net nic,vlan=0,model=rtl8139,macaddr=52:54:61:44:21:23 \ > -net vde,vlan=0,group=vde2-net,mode=0770,sock=/var/run/kvm-vde-ctl Any reason no to use the virtio driver? Best, Gunnar

1 0

[libvirt-users] Functionality of virsh net-edit
by Arseny Klimovsky 15 Jun '10

15 Jun '10

Hi, I am using version libvirt on debian lenny from backports repository, version 0.7.6-1~bpo50+1, amd64. Th functionality of "virsh net-edit" command is not very clearly documented, and I think it should change a configuration of a running network. But I see it doesn't. So, I want to add new host, for example: #I have old configuration root@xxx:/etc/libvirt/qemu/networks# virsh net-edit default Network default XML configuration edited. #Here I added new line: new host definition root@xxx:/etc/libvirt/qemu/networks# cat default.xml #Here I see that new line root@xxx:/etc/libvirt/qemu/networks# virsh net-dumpxml default root@xxx:/etc/libvirt/qemu/networks# virsh net-edit default #Here I see exactly the old network definition Is this behaviour expected? If yes, how to just add new host on a running network? -- Arseny Klimovsky

2 1

[libvirt-users] Documentation Bug: struct virSchedParameter missing value field
by Guido Winkelmann 14 Jun '10

14 Jun '10

Hi, The libvirt documentation under http://libvirt.org/html/libvirt-libvirt.html#virSchedParameter fails to list the "value" member, even though that is kind of essential for using the struct. This is what the documentation says: struct virSchedParameter{ charfield[VIR_DOMAIN_SCHED_FIELD_LENGTH] field : parameter name int type : parameter type } This is how it looks in the actual header file: typedef struct _virSchedParameter virSchedParameter; struct _virSchedParameter { char field[VIR_DOMAIN_SCHED_FIELD_LENGTH]; /* parameter name */ int type; /* parameter type */ union { int i; /* data for integer case */ unsigned int ui; /* data for unsigned integer case */ long long int l; /* data for long long integer case */ unsigned long long int ul; /* data for unsigned long long integer case */ double d; /* data for double case */ char b; /* data for char case */ } value; /* parameter value */ }; This one had me scratching my head for a while, because the way it is documented, it's absolutely not clear how the struct is supposed to be used. Only after studying the virsh source code for a while did I notice that this struct apparently has more members than the documentation lets on... Guido

1 0

[libvirt-users] Missing target dev for interface
by jeremy avnet 11 Jun '10

11 Jun '10

I have over 20 guests running on a particular host and the three longest running ones are missing the network device information in their XML description: <interface type='network'> <mac address='54:52:10::f2:c5'/> <source network='local'/> </interface> Compared to the others which have: <interface type='network'> <mac address='54:52:d1:32:0a:a1'/> <source network='local'/> <target dev='vnet13'/> </interface> This is problematic as I wanted to use domifstat on the domains. Using the packet counts shown via ifconfig on the host, I was able to determine what the vnet interface should be, but passing that to domifstat doesn't work: $ virsh domifstat maki221 vnet13 Connecting to uri: qemu:///system error: Failed to get interface stats guest19 vnet13 error: invalid argument in invalid path, 'vnet13' is not a known interface How did this happen? Is there a way I can get libvirt to know about the interfaces? And the guest OS's network connections work fine. Thanks! .:. jeremy

2 2

[libvirt-users] Multipath pools - practical for use?
by Justin Clift 10 Jun '10

10 Jun '10

Hi all, Writing up some Fedora documentation, and looking to figure out the best way of mapping multipath network(!) LUNs to pools in libvirt. ie Infiniband SRP LUNs, but would probably apply to Fibre Channel equally as well. There are two approaches I can think of easily: a) Large LUNs (ie TB+) that are mapped to a host server as disk, with each LUN being configured as an LVM pool. This lets the host slice the pool up into volumes with the libvirt volume creation commands. b) Pre-purposed LUNs mapped to a host server as disk, but passed through directly to their respective guests. ie Something like Oracle, with 3 SAN LUNs mapped to guest FOO for its database data In a non-libvirt world I'd look at configuring the LUNs on the host with persistent name using multipath, then present them appropriately to whatever needs them from there. However, libvirt has a pool type called "multipath". Looking at the docs online, it doesn't appear to be all that fully featured at this point. Seems more of a brief mention and footnote, so I'm wondering whether to use it or skip it for now in the Fedora docs. Anyone have thoughts/suggestions/etc? :) Regards and best wishes, Justin Clift -- Salasaga - Open Source eLearning IDE http://www.salasaga.org

2 1

[libvirt-users] about virDomainSave and virDomainRestore
by Camilo Aguilar 10 Jun '10

10 Jun '10

Hi there, There is some special reason to require a virConnectPtr param in virDomainRestore ? Regards, Camilo

1 1

[libvirt-users] unknown procedure: 159
by DevOs Virt 10 Jun '10

10 Jun '10

Hi, I started using libvirt few days back...while using virDomainMemoryStats API, got "unknown procedure: 159" runtime error code is ------------------------------------------------------------------------------------------------------------------------------------- virDomainMemoryStatPtr statPtr; statPtr = malloc(VIR_DOMAIN_MEMORY_STAT_NR* sizeof (virDomainMemoryStatStruct)); unsigned int flags=0; int Ret; Ret = virDomainMemoryStats(domPtr,statPtr, VIR_DOMAIN_MEMORY_STAT_NR,flags); ------------------------------------------------------------------------------------------------------------------------------------- Machine details: ------------------------------------------------------------------------------------------------------------------------------------ [root@wlng-ppcore-nd3 hellolibvirt]# uname -a Linux wlng-ppcore-nd3 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@wlng-ppcore-nd3 hellolibvirt]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 5.5 (Tikanga) ------------------------------------------------------------------------------------------------------------------------------------ virsh details: [root@wlng-ppcore-nd3 hellolibvirt]# virsh version Compiled against library: libvir 0.8.1 Using library: libvir 0.8.1 Using API: QEMU 0.8.1 Running hypervisor: QEMU 0.9.1 ------------------------------------------------------------------------------------------------------------------------------------ There are two libvirtd installations here.. ------------------------------------------------------------------------------------------------------------------------------------ [root@wlng-ppcore-nd3 sbin]# pwd /usr/sbin [root@wlng-ppcore-nd3 sbin]# ls -l libvirtd -rwxr-xr-x 1 root root 380064 Jun 10 02:33 libvirtd [root@wlng-ppcore-nd3 sbin]# ./libvirtd --version ./libvirtd (libvirt) 0.6.3 ------------------------------------------------------------------------------------------------------------------------------------ [root@wlng-ppcore-nd3 sbin]# pwd /usr/local/sbin [root@wlng-ppcore-nd3 sbin]# ls -l total 3084 -rwxr-xr-x 1 root root 3152977 Jun 10 01:25 libvirtd [root@wlng-ppcore-nd3 sbin]# ./libvirtd --version ./libvirtd (libvirt) 0.8.1 ------------------------------------------------------------------------------------------------------------------------------------ found a link which mentions libvirtd can be old hence this error is possible... not sure how to configure the latest libvirtd? How to solve "unknown procedure: 159" runtime error? Thanks, osvdev

1 0

Re: [libvirt-users] upgrading from 0.7.2 to 0.8.1
by Todd, John A 09 Jun '10

09 Jun '10

I'm still interested in knowing what vbox:///system is, but I figured out that I have manually specify -with-xen when building to get Xen support. If after I get the Xen development package and rebuild it still doesn't work, I'll drop a line here. - JT From: Todd, John A Sent: Tuesday, June 08, 2010 1:39 PM To: 'libvirt-users(a)redhat.com' Subject: upgrading from 0.7.2 to 0.8.1 Hi, I had 0.7.2 running as an out-of-the-box version of libvirtd I ran xend and it could connect to xen:/// (with virsh) I'm trying to build a eucalyptus cloud and its not working, saying 'cannot connect to xen:///' and I don't know why. So I figure I'd get the source and try and figure it out....and upgrade while I was at it. I got 0.8.1 from source, built it and installed it. First of all, it installed everything using /usr/local as its root, is this configurable? I mean doing that it left my 0.7.2 still there and I had to do some magic to replace it with the new stuff. Now it connects to vbox:///system fine, but can't see xen:/// What's vbox:///system anyway? Could it be my xend is talking to old binaries? (though I don't know what they would be exactly) Is there some configuration (beyond the certificate stuff which I did to get libvirt actually up and running) with 0.8.1 (or in general as configuration for 0.7.2 was done behind the scene as part of OS install) That I need to do so it can connect to xen:/// again? I'm not subscribed to the list, please email responses directly to me at todjo06(a)ca.com Thanks. - Q

1 0

[libvirt-users] upgrading from 0.7.2 to 0.8.1
by Todd, John A 09 Jun '10

09 Jun '10

Hi, I had 0.7.2 running as an out-of-the-box version of libvirtd I ran xend and it could connect to xen:/// (with virsh) I'm trying to build a eucalyptus cloud and its not working, saying 'cannot connect to xen:///' and I don't know why. So I figure I'd get the source and try and figure it out....and upgrade while I was at it. I got 0.8.1 from source, built it and installed it. First of all, it installed everything using /usr/local as its root, is this configurable? I mean doing that it left my 0.7.2 still there and I had to do some magic to replace it with the new stuff. Now it connects to vbox:///system fine, but can't see xen:/// What's vbox:///system anyway? Could it be my xend is talking to old binaries? (though I don't know what they would be exactly) Is there some configuration (beyond the certificate stuff which I did to get libvirt actually up and running) with 0.8.1 (or in general as configuration for 0.7.2 was done behind the scene as part of OS install) That I need to do so it can connect to xen:/// again? I'm not subscribed to the list, please email responses directly to me at todjo06(a)ca.com Thanks. - Q

1 0

[libvirt-users] Best practices on backingup/restore VMs
by Arthur Pemberton 09 Jun '10

09 Jun '10

I just moved from F11 to F13 and I'm find no information on the best way to restore VMs. I had just copied /var/lib/libvirt (with the VMs off) as part of my backup (I already backup all of /etc). But virt-manager doesn't allow creations of VMs without installing. Also, as a side note, the search feature on the website doesn't seem to allow me to search using documentation only. -- Fedora 13 (www.pembo13.com)

2 2

[libvirt-users] Dual-boot and also use raw disk in virtual machine
by Richard Walker 07 Jun '10

07 Jun '10

I've got a new computer with two SATA disks. I installed a minimal Fedora 13 64-bit on the first disk. I shut down the computer, unplugged the first disk, booted up and installed Windows 7 on the second disk. Then I shut down, and plugged the first disk back in. I added a grub option to boot Windows from the second disk. All fine so far - I had a working dual boot system. Then in F13 using virt-manager I created a virtual machine using the second disk as a raw disk. Well, the only option I had (using virt-manager, at least) was to configure it as an IDE disk. Booting this virtual machine gets as far as "Starting Windows", and the animation appears (a dot or two), and then BSOD. Running the Windows diagnosis didn't help. I gave up. Then, keeping the same virtual machine configuration, I installed Windows 7 again into the virtual machine. I shut down the computer and booted from the second disk. Saw "Starting Windows", and the animation got a bit further, but got a BSOD again. Now running sfdisk -l /dev/sdb in the F13 host shows: Disk /dev/sdb: 121601 cylinders, 255 heads, 63 sectors/track Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0 Device Boot Start End #cyls #blocks Id System /dev/sdb1 * 0+ 12- 13- 102400 7 HPFS/NTFS start: (c,h,s) expected (0,32,33) found (2,0,33) end: (c,h,s) expected (12,223,19) found (205,3,19) /dev/sdb2 12+ 121601- 121589- 976657408 7 HPFS/NTFS start: (c,h,s) expected (12,223,20) found (205,3,20) end: (c,h,s) expected (1023,254,63) found (1023,15,63) /dev/sdb3 0 - 0 0 0 Empty /dev/sdb4 0 - 0 0 0 Empty So there is some obvious disagreement about the partition table. Am I going to be able to get this to work?

2 8

[libvirt-users] host OS can't access internet but guest OS with bridge can
by scar 06 Jun '10

06 Jun '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 i have a desktop with ubuntu 9.04 on it... it needs to be updated but i can't access the internet since its last reboot. it has linux 2.6.28-18-generic on it, and libvirt 0.6.1-0ubuntu5.1. i setup libvirt for bridging, and a guest OS i have running can access the internet fine. when i try to ping someplace from the host, it can resolve the hostname but i get "Destination Host Unreachable" errors. it uses the router for DNS, and i can access the router and other local computers fine. $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 br0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.1 0.0.0.0 UG 100 0 0 br0 $ -----BEGIN PGP SIGNATURE----- iEYEAREIAAYFAkwKkZMACgkQXhfCJNu98qCt3wCffrY0VvAL0eA+uoVjHOIgnBax 5isAoPJTwxX/KLSOxA9UZDwO6a4ALkLx =LE+h -----END PGP SIGNATURE-----

1 0

[libvirt-users] libvirt with opennebula
by marwen marwen 03 Jun '10

03 Jun '10

hello I'm currently using libvirt and opennebula. I have installed the libvirt with the driver of opennebule "ONE" and I test the installation. /********************************************************/ oneadmin@node016 ~]$ virsh -c one:/// Welcome to virsh, the virtualization interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh # list Id Name State ---------------------------------- virsh # /********************************************************/ but I can not see the list of machines that run in the cluster node (Xen and KVM) I want to know if this is a problem of configuration files ( libvirtd.conf and oned.conf). can you help me to overcome this problem thank you

2 3

[libvirt-users] Virsh blkstat doesn't work on Xen HVM
by 張文哲 03 Jun '10

03 Jun '10

Hi I tried to use virsh blkstat to get information of a block, but it returns an error message as shown below This function works fine in KVM, but fail in XEN. I tried XEN 3.4.3 ,4.0.0 and 4.0.1 with libvirt 0.7.1 from fedora yum server and 0.8.1 from libvirt . All of them are fail to get the block status. The following is the config file and error message of virsh domblkstat. Any one knows how to make this function work? [root@localhost ~]# virsh dumpxml vm1 <domain type='xen' id='1'> <name>vm1</name> <uuid>12af1ed4-2f2d-f02d-9a2a-5d4f377889d5</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type>hvm</type> <loader>/usr/lib/xen/boot/hvmloader</loader> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/usr/lib64/xen/bin/qemu-dm</emulator> <disk type='file' device='disk'> <driver name='file'/> <source file='/var/lib/libvirt/images/vm1.img'/> <target dev='hda' bus='ide'/> </disk> <disk type='file' device='cdrom'> <target dev='hdc' bus='ide'/> <readonly/> </disk> <interface type='bridge'> <mac address='00:16:36:0f:fb:7a'/> <source bridge='eth0'/> <script path='/etc/xen/scripts/vif-bridge'/> <target dev='vif1.0'/> </interface> <serial type='pty'> <source path='/dev/pts/0'/> <target port='0'/> </serial> <console type='pty' tty='/dev/pts/0'> <source path='/dev/pts/0'/> <target port='0'/> </console> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5900' autoport='yes' keymap='en-us'/> <sound model='es1370'/> </devices> </domain> [root@localhost ~]# virsh domblkstat vm1 hda error: Failed to get block stats vm1 hda error: internal error read_bd_stats: Failed to read any block statistics

1 0

[libvirt-users] PCI Passthrough
by Jonathan Tripathy 03 Jun '10

03 Jun '10

Hi Everyone, When I try and assign a physical device to a guest using virt-manager, libvirt throws an error: "Failed to create inactive domain" I'm using libvirt 0.8.1 which I compiled myself, along with Xen 4.0 on Ubuntu 10.04 Dom0 I'm also using virt-manager 0.8.4 which I compiled myself. Any help would be appreciated Thanks

1 0

[libvirt-users] Virsh blkstat doesn't work on Xen HVM
by wenche_chang＠trend.com.tw 03 Jun '10

03 Jun '10

Hi I tried to use virsh blkstat to get information of a block, but it returns an error message as shown below This function works fine in KVM, but fail in XEN. I tried XEN 3.4.3 ,4.0.0 and 4.0.1 with libvirt 0.7.1 from fedora yum server and 0.8.1 from libvirt . All of them are fail to get the block status. The following is the config file and error message of virsh domblkstat. Any one knows how to make this function work? [root@localhost ~]# virsh dumpxml vm1 <domain type='xen' id='1'> <name>vm1</name> <uuid>12af1ed4-2f2d-f02d-9a2a-5d4f377889d5</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type>hvm</type> <loader>/usr/lib/xen/boot/hvmloader</loader> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <devices> <emulator>/usr/lib64/xen/bin/qemu-dm</emulator> <disk type='file' device='disk'> <driver name='file'/> <source file='/var/lib/libvirt/images/vm1.img'/> <target dev='hda' bus='ide'/> </disk> <disk type='file' device='cdrom'> <target dev='hdc' bus='ide'/> <readonly/> </disk> <interface type='bridge'> <mac address='00:16:36:0f:fb:7a'/> <source bridge='eth0'/> <script path='/etc/xen/scripts/vif-bridge'/> <target dev='vif1.0'/> </interface> <serial type='pty'> <source path='/dev/pts/0'/> <target port='0'/> </serial> <console type='pty' tty='/dev/pts/0'> <source path='/dev/pts/0'/> <target port='0'/> </console> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5900' autoport='yes' keymap='en-us'/> <sound model='es1370'/> </devices> </domain> [root@localhost ~]# virsh domblkstat vm1 hda error: Failed to get block stats vm1 hda error: internal error read_bd_stats: Failed to read any block statistics TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system. TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

1 0

[libvirt-users] JSON support
by Camilo Aguilar 03 Jun '10

03 Jun '10

Are there any efforts to support JSON in libvirt ?

2 1

[libvirt-users] Working example of logical storage pool and volume creation?
by Justin Clift 03 Jun '10

03 Jun '10

Hi all, Does anyone have a working example of creation of a logical storage pool and volume? I'm hitting a wall getting logical volumes to work on RHEL 6 beta. There's a single drive I'm trying to setup (sdc) as a libvirt managed logical storage pool, but all volume creation on it fails. Here's what I'm finding so far: Prior to any storage pool work, only the host boot drive (sda) is in lvm. # vgs VG #PV #LV #SN Attr VSize VFree vg_host2 1 3 0 wz--n- 465.27g 0 # pvs PV VG Fmt Attr PSize PFree /dev/sda2 vg_host2 lvm2 a- 465.27g 0 # ls -la /dev/mapper total 0 drwxr-xr-x. 2 root root 120 Jun 1 03:12 . drwxrwxrwt. 21 root root 3920 Jun 1 03:12 .. crw-rw----. 1 root root 10, 58 May 31 14:08 control lrwxrwxrwx. 1 root root 7 May 31 14:10 vg_host2-lv_home -> ../dm-7 lrwxrwxrwx. 1 root root 7 May 31 14:08 vg_host2-lv_root -> ../dm-0 lrwxrwxrwx. 1 root root 7 May 31 14:10 vg_host2-lv_swap -> ../dm-8 # Creation of a logical storage pool, using sdc: # virsh pool-define-as guest_images_lvm logical - - /dev/sdc libvirt_lvm /dev/mapper Pool guest_images_lvm defined # virsh pool-info guest_images_lvm Name: guest_images_lvm UUID: 17398035-8000-7252-ab25-58db95aed130 State: inactive # virsh pool-build guest_images_lvm Pool guest_images_lvm built # The physical device and volume group are seen in lvm: # pvs PV VG Fmt Attr PSize PFree /dev/sda2 vg_host2 lvm2 a- 465.27g 0 /dev/sdc libvirt_lvm lvm2 a- 465.76g 465.76g # vgs VG #PV #LV #SN Attr VSize VFree libvirt_lvm 1 0 0 wz--n- 465.76g 465.76g vg_host2 1 3 0 wz--n- 465.27g 0 # Starting the logical pool works: # virsh pool-start guest_images_lvm Pool guest_images_lvm started # Creation of volumes fail: # virsh vol-create-as guest_images_lvm volume1 8G error: Failed to create vol volume1 error: internal error '/sbin/lvcreate --name volume1 -L 8388608K /dev/mapper' exited with non-zero status 3 and signal 0: Volume group name expected (no slash) Run `lvcreate --help' for more information. # So, it looked like "/dev/mapper" in the pool-define-as command should have instead been the LVM volume group again. That doesn't work either though: # virsh pool-define-as guest_images_lvm logical - - /dev/sdc libvirt_lvm libvirt_lvm Pool guest_images_lvm defined # virsh pool-build guest_images_lvm Pool guest_images_lvm built # virsh pool-start guest_images_lvm Pool guest_images_lvm started # virsh vol-create-as guest_images_lvm volume1 8G error: Failed to create vol volume1 error: cannot read path 'libvirt_lvm/volume1': No such file or directory Looking in the libvirtd logs for this last attempt, the volume was actually successfully created. But libvirtd then checks for it's presence (wrongly!), doesn't find it, and then lvremove's it: 03:01:24.000: debug : virRunWithHook:832 : /sbin/lvcreate --name volume1 -L 8388608K libvirt_lvm ... 03:01:24.223: debug : virRunWithHook:848 : Command stdout: Logical volume "volume1" created ... 03:01:24.223: error : virStorageBackendLogicalCreateVol:616 : cannot read path 'libvirt_lvm/volume1': No such file or directory ... 03:01:24.223: debug : virRunWithHook:832 : /sbin/lvremove -f libvirt_lvm/volume1 Guessing I'm either doing something wrong, or hitting bugs, or ? Anyone have ideas/suggestions/etc? Regards and best wishes, Justin Clift -- Salasaga - Open Source eLearning IDE http://www.salasaga.org

1 1

[libvirt-users] Mount options for fs type storage pools?
by Justin Clift 03 Jun '10

03 Jun '10

Hi all, Presently writing up "Storage Pool" docs for the Fedora Virtualisation Guide. (using both virsh and virt-manager) Having trouble finding out how to specify mount options for fs type storage pools. For example: # virsh pool-define-as guest_images_fs fs - - /dev/sdc1 - "/guest_images" Pool guest_images_fs defined # virsh pool-build guest_images_fs Pool guest_images_fs built # virsh pool-start guest_images_fs Pool guest_images_fs started # mount | grep guest_images /dev/sdc1 on /guest_images type ext4 (rw) # Notice that /guest_images is mounted with default options. Nothing wrong with that, but lets say the SysAdmin has a need to pass specific mount options. (ie journal_checksum, or noatime, or nodiratime, etc) Checked the virStorageBackendFileSystemMount() function in present git master, and it doesn't look like mount options are considered for anything other than Gluster? How to do it, or is it best to not use libvirt to manage the mounting of this type of storage when options are needed? Regards and best wishes, Justin Clift -- Salasaga - Open Source eLearning IDE http://www.salasaga.org

2 2

[libvirt-users] Host should not touch passed-through USB device, how?
by Andreas Ntaflos 02 Jun '10

02 Jun '10

Hello list, this may be off topic but it is closely related to my Libvirt adventures so maybe you can help me. I want to pass a USB device (a USB Huawei E620 modem) through to a KVM guest. Pass-through in general works fine and the modem is visible in the guest. However, the host still sees it and sometimes tries to access it (such modems seem to also be USB storage devices). This naturally leads to conflicts and I believe this crashed the guest very badly yesterday. So I am looking for a way to make sure the host passes through the USB device (in its entirety) without trying to touch it and claim it as its own. Preferably without disabling the USB storage subsystem completely on the host. Any ideas? Is there a best practice for such things in the Libvirt world? Or any other world? Thanks! Andreas -- Andreas Ntaflos GPG Fingerprint: 6234 2E8E 5C81 C6CB E5EC 7E65 397C E2A8 090C A9B4

3 3

[libvirt-users] Qemu driver not supporting VIR_DOMAIN_DEVICE_MODIFY_CONFIG yet?
by Guido Winkelmann 02 Jun '10

02 Jun '10

Hi, According to the docs on http://libvirt.org/html/libvirt-libvirt.html#virDomainDetachDeviceFlags I ought to be able to do virDomainDetachDeviceFlags( <domain>, <devicexml>, VIR_DOMAIN_DEVICE_MODIFY_LIVE | VIR_DOMAIN_DEVICE_MODIFY_CONFIG); to detach a volume both from a currently running VM instance and permanently from the defined config file. If I actually try that, though, I'm getting this error: libvir: QEMU error : Requested operation is not valid: cannot modify the persistent configuration of a domain The same thing happens whether or not the domain is running and also happens if I leave out the "VIR_DOMAIN_DEVICE_MODIFY_LIVE" part. Does the qemu driver simply not support VIR_DOMAIN_DEVICE_MODIFY_CONFIG yet (libvirt 0.8.1), or is there some other problem here? Guido

2 1

[libvirt-users] Monitoring KVM Machine Uptimes
by Karsten Knese 02 Jun '10

02 Jun '10

Hey folks. Currently, I am working on an accounting-solution for Private Cloud with Eucalyptus as my bachelor-thesis. Eucalyptus bases on libvirt providing the KVM machines. Part of the thesis is kind of measurement for the uptimes of each instance in the cloud. As Eucalyptus is based on libvirt, i want to know if there is kind of tool already setup for monitoring a vm in terms of uptimes, cputimes and disk i/o. If not, can anyone give me a hint, how i could grep these facts? I found a tool called "virt-top" which monitors the vm, but for me there is to much overhead. Thanks for you support. cheers, Karsten

2 1

[libvirt-users] FailOver IP
by Christian Hermann 02 Jun '10

02 Jun '10

hi guys! i`am new to libvirt and i want using kvm with a ipv4 failover ip-address. so this addres has the netmask 255.255.255.255. this ip is directly bind to my root server by my provider. so i can not use it on an other server. can you tell me how i can use this ip address on a kvm virtual maschine, build with libvirt? Kind regards, Chris

1 0