[libvirt-users] converting save/dump output into physical memory image
by Andrew Tappert
A lot of people in the security community, myself included, are
interested in memory forensics these days. Virtualization is a natural
fit with memory forensics because it allows one to get access to a
guest's memory without having to introduce any extra software into the
guest or otherwise interfere with it. Incident responders are
particularly interested in getting memory dumps from systems they're
investigating.
Virsh has "save" and "dump" commands for storing the state of a guest to
a file on disk, but memory of KVM guests doesn't get saved in the
"standard" input format for memory forensics tools, which is a raw
physical memory image. (This is what you'd get via the classical "dd
/dev/mem" approach or the contemporary equivalent using the crash
driver; and VMware Server and Workstation produce .vmem files, which are
such raw physical memory images, when a guest is paused or snapshotted.)
In order to analyze the memory of Libvirt/KVM guests with my Linux
memory forensics software, Second Look, I've created a tool for
converting Libvirt-QEMU-save files (output of virsh save command) or
QEMU-savevm files (output of virsh dump command) to raw physical memory
images.
I've got a basic working capability, though I'm still tracking down some
problems with a guest allocated 8GB RAM--not all the memory seems to be
present in the save or dump file. And I haven't tested very extensively
yet, version support is limited to what I myself am currently running, etc.
I'd like to know if this is a capability that others are interested in.
Is this something that would be of interest to the Libvirt project if I
were to contribute the code, or to the KVM project, or do you think it
best exists as a separate project?
I've also got a proof-of-concept tool for converting hibernate images to
raw physical memory images. Perhaps a collection of tools for
converting various memory dump formats would be a good project. Anyone
else interested in this kind of stuff? As an author of commercial
memory forensics software I've got a vested interest in availability of
good memory acquisition capabilities. But there are a number of people
working on FOSS Linux memory analysis tools, too...
Andrew
11 years, 11 months
[libvirt-users] small webGUI?
by Stefan G. Weichinger
Greetings,
at a customer we run a single VM for a specific application.
Unfortunately this VM does not start automatically with the host
although I checked the relevant box within virtual machine manager.
I assume upgrading libvirt might help (we run 0.8.7-r1 right now, gentoo
linux).
Aside from that it would be good to have a simple WebGUI for the users
to let them press START just in case. They run Windows on their machines
so I can't give them VMM ...
Could you point me at the most simple GUI to do that?
I'd prefer something very lightweight without too much requirements (for
example I'd like to avoid installing mysql for that ;-) ).
Thank you, Stefan
12 years, 9 months
[libvirt-users] Compatibility with Parallels Virtouzo
by Andreas Mauf
Hi,
will libvirt work with the commercial parallels virtuozzo, too? Cause
the linux version of virtuozzo is based on openvz, which ist supported
by libvirt.
Does someone have some experencies with that?
Thanks for any feedback,
Andreas
--
SysEleven GmbH
Rosenthaler Str. 34/35
10178 Berlin
Firmensitz: Berlin
Registergericht: AG Berlin Charlottenburg, HRB 108571 B
Geschäftsführer: Marc Korthaus
12 years, 10 months
[libvirt-users] ANNOUNCE: oz 0.5.0 release
by Chris Lalancette
All,
I'm pleased to announce release 0.5.0 of Oz. Oz is a program for doing
automated installation of guest operating systems with limited input from the
user.
Release 0.5.0 is a bugfix and feature release for Oz. Some of the
highlights between Oz 0.4.0 and 0.5.0 are:
- Replace icicle-nc binary with a shell script to try various methods. Besides
being more portable, this also allows us to convert Oz to a noarch RPM (thanks
to Padraig Brady)
- Support for Ubuntu 6.06
- Support for md5sum/sha1sum/sha256sum checking of ISOs after download
- New -x flag for oz-install to write the libvirt XML file to a user-specified
location (thanks to Steve Dake)
- Support for OpenSUSE customization
- Support for F-15 customization (thanks to Steve Dake)
- Support for running commands at the end of package installation (thanks to
Steve Dake)
Fedora 14 and RHEL-6 packages are available for this release. Note that to
install the RHEL-6 packages, you must be running RHEL-6.1 or later.
Instructions of how to get and use Oz are available at
http://aeolusproject.org/oz.html
If you have any questions or comments about Oz, please feel free to contact
aeolus-devel(a)lists.fedorahosted.org or me (clalance(a)redhat.com) directly.
--
Chris Lalancette
12 years, 10 months
[libvirt-users] vnc over ssh failing
by Pete Ashdown
I'm using virt-manager 0.8.6 client side on Ubuntu 11.04. I can't get vnc
over ssh to work to a kvm guest running on a Ubuntu 10.04 host.
kvmhost:~> virsh vncdisplay testing
:0
kvmhost:~> telnet 127.0.0.1 5900
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
RFB 003.008
Client virt-manager debug:
2011-06-24 11:28:56,055 (console:923): Starting connect process for
proto=vnc trans=tcp connhost=192.168.1.10 connuser=pashdown connport=None
gaddr=127.0.0.1 gport=5900 gsocket=None
2011-06-24 11:28:56,120 (console:810): Viewer disconnected
I can reach the console with:
xtightvncviewer -via 192.168.1.10 127.0.0.1:0
Any suggestions are appreciated.
12 years, 10 months
[libvirt-users] Starting libvirtd cuts off host access to external network
by PLD
I've spent some hours on this without success - any help greatly
appreciated.
I've just done a new RHEL6 setup, with a KVM guest (first time). The
basic installation works fine until I start libvirtd; at this point, the
host machine loses access to the external network:
step 1: ping from host to network works; external machine on network can
ping both eth0 and br1 on the host
step 2: /sbin/service libvirtd start
step 3: ping from host to network fails; external machine on the network
can't ping either eth0 or br1 on the host
Stopping libvirtd (/sbin/service libvirtd stop) makes no difference -
the network remains unreachable.
Any idea why this would happen? I have installed a kvm guest, using the
default network script at /etc/libvirtd/qemu/networks/default.xml
(although I've changed the IP addresses to be on my subnet, and the DHCP
server returns only one address).
I have also configured a bridge; I've attached ifcfg-eth0, ifcfg-eth1,
and ifcfg-br1 below. I haven't changed any iptables configuration. If I
run the guest (also RHEL6) the guest can talk to the host, but it can't
see the outside world.
Thanks -
Paul
================================================
ifcfg-eth0:
-----------
NM_CONTROLLED="no"
DEVICE="eth0"
HWADDR=00:16:E6:8A:C7:20
ONBOOT=yes
TYPE=Ethernet
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System eth0"
NETMASK=255.255.255.0
BOOTPROTO=dhcp
ifcfg-eth1:
-----------
NM_CONTROLLED="no"
DEVICE="eth1"
HWADDR=00:16:E6:8A:C7:21
ONBOOT=yes
TYPE=Ethernet
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System eth1"
BRIDGE=br1
NETMASK=255.255.255.0
ifcfg-br1:
----------
NM_CONTROLLED="no"
DEVICE=br1
BOOTPROTO=dhcp
ONBOOT=yes
TYPE=Bridge
DELAY=0
12 years, 11 months
Re: [libvirt-users] libvirt-users Digest, Vol 18, Issue 17
by m m
Yes, I also think that iptables module should be loaded before libvirt-bin
and I have seen a post which regarded loading conntrack modules and these
modules also seem to be necessary...
I know a little about Upstart in Ubuntu. However, I still don't know how to
properly solve this problem.
ip_tables module depend on other modules being loaded and since I don't know
the full list of modules which should be loaded (for IP tables to work) I
don't know how to handle that. Besides, even if I had this list, it could
change for some time, so it is not a good idea to rely on that.
Version which I have installed is the newest release from Ubuntu
repositories.
Thank you for help.
I will be grateful for any further suggestions.
2011/6/13 <libvirt-users-request(a)redhat.com>
> Send libvirt-users mailing list submissions to
> libvirt-users(a)redhat.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www.redhat.com/mailman/listinfo/libvirt-users
> or, via email, send a message with subject or body 'help' to
> libvirt-users-request(a)redhat.com
>
> You can reach the person managing the list at
> libvirt-users-owner(a)redhat.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of libvirt-users digest..."
>
>
> Today's Topics:
>
> 1. Re: libvirt-bin MOSTLY fails to create default virtual
> network (Laine Stump)
> 2. Boot delay (Jeff)
> 3. e: How to disconnect the ISO image using virsh (Jeff)
> 4. Difference between function Migrate and Migrate2 (Abhishek Gupta)
> 5. Re: Boot delay (Michal Privoznik)
> 6. hook scripts - not in Ubuntu packages? (Whit Blauvelt)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sun, 12 Jun 2011 12:03:17 -0400
> From: Laine Stump <laine(a)laine.org>
> To: libvirt-users(a)redhat.com
> Subject: Re: [libvirt-users] libvirt-bin MOSTLY fails to create
> default virtual network
> Message-ID: <4DF4E345.7060104(a)laine.org>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> On 06/06/2011 03:24 PM, m m wrote:
> > I have observed 3 scenarios after I reboot the host with 2 guests
> > (which are supposed to autostart after boot/reboot of the host):
> > 1. Default network is created but I can not ping guests. Gests don't
> > have assigned IP address or they both have IP address 192.168.122.100.
> > 2. Default network is not created.
> > 3. Default netork is properly created and everything works fine.
> > In each case guests are started and they work properly. Cases 1. and
> > 2. happen a lot more often then case 3.
> >
> > My solutions:
> > - When I restart libvirt-bin then everything is fine.
> > - When I set 'sleep 40' in 'pre-start' section of
> > /etc/init/libvirt-bin.conf and modify 'start on' section in the
> > following way:
> >
> > start on (runlevel [2345] and net-device-up IFACE=br0)
> >
> > then everything works fine.
> >
> >
> > However, none of the above solutions indeed solves the problem.
> > Please, let me know if there is solution to this problem or what are
> > your suggestions regarding this issue.
> >
> > ****
> > HOST$ uname -a
> > Linux ras 2.6.32-32-server #62-Ubuntu SMP Wed Apr 20 22:07:43 UTC 2011
> > x86_64 GNU/Linux
> >
> > GUEST1 and GUEST2
> > $ uname -a
> > Linux server1-desktop 2.6.32-32-generic #62-Ubuntu SMP Wed Apr 20
> > 21:54:21 UTC 2011 i686 GNU/Linux
> >
> > HOST$ libvirtd --version
> > libvirtd (libvirt) 0.7.5
> >
> > My idea was that some kernel modules sometimes are loaded before
> > libvirt-bin starts, and sometimes libvirt-bin starts earlier, or in
> > the middle of loading of these modules, that is why 3 scenarios can be
> > observed.
> > That is why I have added:
> > cp /proc/modules /home/wsadmin2/modules1
> > cp /proc/modules /home/wsadmin2/modules2
> > to 'pre-start' and 'post-start' parts respectively of
> > /etc/init/libvirt-bin.conf.
> >
> > Of course, beween execution of
> > - pre-start part
> > - exec /usr/sbin/libvirtd -d
> > - post-start part
> > other kernel modules can be loaded, so we can not be sure which
> > additional modules in file 'modules2' were indeed loaded before
> > libvirtd was actually started.
> >
> > Here are my observations:
> > Scenatio 1.
> > 33 (fixed) modules were logged - call them BASE MODULES.
> >
> > Scenatio 2.
> > Beside BASE MODULES + the following modules were loaded:
> >
> > > iptable_filter 1841 0 - Live 0xffffffffa007c000
> > > ip_tables 18201 1 iptable_filter, Live 0xffffffffa0172000
> > > x_tables 22361 1 ip_tables, Live 0xffffffffa0164000
>
> In your "scenario 1" the modules necessary for iptables to function
> haven't been loaded. Each virtual network requires a set of iptables
> rules to function properly, and if there is no iptables, the rules can't
> be added and network creation fails. Your libvirtd.log confirms that
> problem:
>
> 10:06:06.980: error : networkAddIptablesRules:750 : failed to add
> iptables rule to allow DHCP requests from 'virbr0': Invalid argument
>
>
> 0.7.5 is quite old (> 1 year), is there perhaps a newer pre-built
> version of libvirt available for your release of Ubuntu?
>
> It seems that Ubuntu's method of starting up libvirtd (at least on your
> machine) is missing a dependency to force iptables to be loaded before
> libvirtd starts. I'm unfamiliar with Ubuntu/debian startup stuff
> (upstart, I guess), but that's where you need to look for the solution.
>
> I found the following in the ubuntu bug database, which seems similar,
> but not identical (basically the system networking isn't completely
> ready by the time the autostart domains are brought up):
>
> https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/495394
>
> >
> > Scenatio 3.
> > Beside BASE MODULES + the following modules were loaded:
> >
> > $ diff modules1 modules2
> > 1c1,6
> > < iptable_filter 1841 0 - Live 0xffffffffa008b000
> > ---
> > > xt_state 1490 14 - Live 0xffffffffa01ab000
> > > xt_tcpudp 2667 12 - Live 0xffffffffa01a5000
> > > nf_conntrack_ipv4 12742 14 - Live 0xffffffffa019b000
> > > nf_conntrack 73326 2 xt_state,nf_conntrack_ipv4, Live
> 0xffffffffa017d000
>
> conntrack is used by iptables. I haven't tried it, but wouldn't be
> surprised if adding rules that required conntrack failed if it hadn't
> been loaded, or something like that.
>
> > > nf_defrag_ipv4 1481 1 nf_conntrack_ipv4, Live 0xffffffffa0177000
> > > iptable_filter 1841 1 - Live 0xffffffffa008b000
> > 3c8
> > < x_tables 22361 1 ip_tables, Live 0xffffffffa0162000
> > ---
> > > x_tables 22361 3 xt_state,xt_tcpudp,ip_tables, Live 0xffffffffa0162000
> >
> > Other observations:
> > Scenatio 1.
> > No errors in libvirtd.log
> > Scenario 2.
> >
> > 10:06:06.980: error : networkAddIptablesRules:750 : failed to add
> > iptables rule to allow DHCP requests from 'virbr0': Invalid argument
> > (...)
> > 10:06:08.630: error : qemudNetworkIfaceConnect:1445 : Failed to add
> > tap interface to bridge 'virbr0': No such device
> > 10:06:08.630: error : qemuAutostartDomain:584 : Failed to autostart VM
> > 'cluster_server1': Failed to add tap interface to bridge 'virbr0': No
> > such device
> >
> > 10:06:08.921: info : qemudDispatchSignalEvent:390 : Received
> > unexpected signal 17
> > 10:06:08.927: debug : virExecWithHook:617 : LC_ALL=C /usr/bin/kvm -help
> > 10:06:08.938: info : qemudDispatchSignalEvent:390 : Received
> > unexpected signal 17
> > 10:06:09.000: error : qemudNetworkIfaceConnect:1445 : Failed to add
> > tap interface to bridge 'virbr0': No such device
> > 10:06:09.000: error : qemuAutostartDomain:584 : Failed to autostart VM
> > 'cluster_server2': Failed to add tap interface to bridge 'virbr0': No
> > such device
> > (...)
> > Scenatio 3.
> > No errors in libvirtd.log
> >
> >
> > I didn't see any valuable logs in /var/log/boot.log,
> > /var/log/messages, /var/log/syslog. Please let me know if you want to
> > see them anyway or have any suggestions right away.
> >
> >
> > _______________________________________________
> > libvirt-users mailing list
> > libvirt-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/libvirt-users
>
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 13 Jun 2011 08:25:00 -0500
> From: Jeff <jwk1230(a)gmail.com>
> To: libvirt-users(a)redhat.com
> Subject: [libvirt-users] Boot delay
> Message-ID: <4609858C-FB73-4E8A-B81B-3EDCBB83B755(a)gmail.com>
> Content-Type: text/plain; charset=us-ascii
>
> Is there a method of tweaking the boot sequence of a KVM instance so that
> you can delay the process for X number of seconds? I don't have enough time
> between starting the KVM and connecting via VNC.
>
> Thanks
>
> Jeff
>
>
>
> ------------------------------
>
> Message: 3
> Date: Fri, 10 Jun 2011 15:12:36 -0500
> From: Jeff <jwk1230(a)gmail.com>
> To: Osier Yang <jyang(a)redhat.com>, libvirt-users(a)redhat.com
> Subject: [libvirt-users] e: How to disconnect the ISO image using
> virsh
> Message-ID: <F301FBCE-65F1-411A-980E-EF8B6A46241B(a)gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> I am trying to detach an ISO from a KVM machine and I've tried both
> attach-disk using " " in the file path as well as the update-device option
> but am getting this error
>
> error: Failed to update device from /var/run/libvirt/qemu/kvmtest1.xml
> error: XML description for unknown device type is not well formed or
> invalid.
>
> I tried doing a virsh edit on the xml file to remove the source file path
> to the ISO, as I assume is the correct method, and then running the virsh
> update-device but it's not working.
>
> Can anyone advise the correct steps to detach a device from a running
> and/or offline domain?
>
> Additionally - anyone have any guidance on how to attach a CD device to a
> domain that is currently shutdown, for example, if I wanted to boot the
> domain to a rescue CD image?
>
> Thanks
>
> Jeff
>
>
> ? 2011?03?31? 15:17, Masanari Iida ??:
> Somebody sent me a tips.
> Following command do what I wanted to do.
> Thanks.
>
> attach-disk guest01 " " hdc --driver file --type cdrom
> --mode readonly
> Also using "update-device" with an xml which doesn't specify
> the source file path will work.
>
> On Thu, Mar 31, 2011 at 3:29 PM, Masanari Iida<standby24x7 gmail com>
> wrote:
> Hello,
>
> I can attach disc ISO image to cd-rom from virsh.
> And I can replace the ISO image from disc1 to disc2 using the 2nd example.
>
> (example)
> attach-disk guest01 /root/disc1.iso hdc --driver file --type cdrom
> --mode readonly
> attach-disk guest01 /root/disc2.iso hdc --driver file --type cdrom
> --mode readonly
>
> My question is, how can I disconnect the image from the cdrom drive using
> virsh.
> Because, if I try to detach-disk hdc, I got following errors.
>
> virsh # detach-disk guest01 hdc
> error: Failed to detach disk
> error: this function is not supported by the connection driver:
> This type of device cannot be hot unplugged
>
> What I can do is possible from virt-manager's "Disconnect" button,
> (next to source path: line) from Hardware's TAB, Disk hdc screen.
> I want to do this from virsh.
>
> OS: RHEL5.6
> libvirt-0.8.2-15.el5_6.1 is used.
>
> Regards,
> Masanari Iida
>
> _______________________________________________
> libvirt-users mailing list
> libvirt-users redhat com
> https://www.redhat.com/mailman/listinfo/libvirt-users
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://www.redhat.com/archives/libvirt-users/attachments/20110610/f4acfe...
> >
>
> ------------------------------
>
> Message: 4
> Date: Sat, 11 Jun 2011 06:39:46 +0530
> From: Abhishek Gupta <cs1090174(a)cse.iitd.ernet.in>
> To: libvirt-users(a)redhat.com
> Subject: [libvirt-users] Difference between function Migrate and
> Migrate2
> Message-ID: <BANLkTinv6XiRMz=rS88A-U-b2Hz3SVTesg(a)mail.gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> I was reading the API reference for the libvirt, when I came across
> the function? virDomainMigrate and virDomainMigrate2. I am unable to
> find the difference between the two. Can someone please tell the
> difference in the application of the two?
>
> --
> Abhishek
>
>
>
> ------------------------------
>
> Message: 5
> Date: Mon, 13 Jun 2011 17:21:02 +0200
> From: Michal Privoznik <mprivozn(a)redhat.com>
> To: Jeff <jwk1230(a)gmail.com>
> Cc: libvirt-users(a)redhat.com
> Subject: Re: [libvirt-users] Boot delay
> Message-ID: <4DF62ADE.60209(a)redhat.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> On 13.06.2011 15:25, Jeff wrote:
> > Is there a method of tweaking the boot sequence of a KVM instance so that
> you can delay the process for X number of seconds? I don't have enough time
> between starting the KVM and connecting via VNC.
> >
> You might consider using virt-viewer. It simply waits for domain to
> boot, if it is down.
>
> Your other option is to create hook script:
> http://libvirt.org/hooks.html
> and put conditional sleep there, because libvirt just before running a
> domain tries to execute qemu with some arguments (e.g. -help) to qeury
> its capabilities. And you don't want your hook script to delay that.
>
> So you need something like this:
>
> if [ $2 == "start" ]; then
> sleep 5
> fi
>
> > Thanks
> >
> > Jeff
> >
> > _______________________________________________
> > libvirt-users mailing list
> > libvirt-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/libvirt-users
>
> Michal
>
>
>
> ------------------------------
>
> Message: 6
> Date: Mon, 13 Jun 2011 11:42:44 -0400
> From: Whit Blauvelt <whit.virt(a)transpect.com>
> To: libvirt-users(a)redhat.com
> Subject: [libvirt-users] hook scripts - not in Ubuntu packages?
> Message-ID: <20110613154244.GA28777(a)black.transpect.com>
> Content-Type: text/plain; charset=us-ascii
>
> On Mon, Jun 13, 2011 at 05:21:02PM +0200, Michal Privoznik wrote:
>
> > Your other option is to create hook script:
> > http://libvirt.org/hooks.html
>
> That looks useful.
>
> On several Ubuntu systems, with Ubuntu libvirt 0.8.8 and 0.8.3 packages
> installed, there's no libvirt/hooks/ directory at all. Is this a directory
> that can simply be created and used under libvirt, or does using this
> feature on Ubuntu require custom installation?
>
> Thanks,
> Whit
>
>
>
> ------------------------------
>
> _______________________________________________
> libvirt-users mailing list
> libvirt-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/libvirt-users
>
> End of libvirt-users Digest, Vol 18, Issue 17
> *********************************************
>
12 years, 11 months
