January 2016 - Users - libvirt List Archives

[libvirt-users] ceph rbd pool and libvirt manageability (virt-install)
by Jelle de Jong 29 Aug '18

29 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, I created a rbd pool and activated it, but I can't seem to create volumes in it with virsh or virt-install? # virsh pool-dumpxml myrbdpool <pool type='rbd'> <name>myrbdpool</name> <uuid>2d786f7a-2df3-4d79-ae60-1535bcf1c6b5</uuid> <capacity unit='bytes'>6997998301184</capacity> <allocation unit='bytes'>10309227031</allocation> <available unit='bytes'>6977204658176</available> <source> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> <name>libvirt-pool</name> <auth type='ceph' username='libvirt'> <secret uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> </source> </pool> # virt-install --version 1.0.1 # virsh --version 1.2.9 I ended using virsh edit ceph-test.powercraft.nl and making creating the disk manually. <disk type='network' device='disk'> <auth username='libvirt'> <secret type='ceph' uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> <source protocol='rbd' name='libvirt-pool/kvm01-storage'> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> </source> <target dev='vdc' bus='virtio'/> </disk> I use virt-install a lot to define, import and undefine domains, how can I use virt-install to manage my rdb disks? Kind regards, Jelle de Jong -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iJwEAQECAAYFAlV1xlQACgkQ1WclBW9j5HkbPQP+PjNrzvlqysslOp2Yk7wH4Mxy 2sh2dn96G0KOAHEeEn3BN6IWlnD1TADZbHdpTtMwkdv48Xwn0sP1s+3QDM4pb3gP n+z+dVxS8FouDIy/eiso3IBCj3g4TWbEX8ZHqs3jKqe0lZgAXBzB9xYSUowcEBrZ ddkPbr8p8ozWyOG+9V8= =lkK7 -----END PGP SIGNATURE-----

2 3

[libvirt-users] virRandomBits - not very random
by Brian Rak 01 Jun '18

01 Jun '18

I just ran into an issue where I had about 30 guests get duplicate mac addresses assigned. These were scattered across 30 different machines. Some debugging revealed that: 1) All the host machines were restarted within a couple seconds of each other 2) All the host machines had fairly similar libvirtd pids (within ~100 PIDs of each other) 3) Libvirt seeds the RNG using 'time(NULL) ^ getpid()' This perfectly explains why I saw so many duplicate mac addresses. Why is the RNG seed such a predictable value? Surely there has to be a better source of a random seed then the timestamp and the pid? The PID seems to me to be a very bad source of any randomness. I just ran a test across 60 of our hosts. 43 of them shared their PID with at least one other machine.

7 13

[libvirt-users] Libvirt bite sized tasks
by Michal Privoznik 21 Mar '16

21 Mar '16

Dear lists, I've just started new wiki page which aim is to summarize small and trivial tasks, that starting contributors can take, investigate and implement. The aim is to give them something easy to start with while not scaring them out about complexity of our code. The page can be found here: http://wiki.libvirt.org/page/BiteSizedTasks The name is copied from qemu wiki: http://wiki.qemu.org/BiteSizedTasks Please, feel free to extend the list. I plan to use it in the future when interviewing GSoC candidates. Michal

2 1

[libvirt-users] Zombie processes being created when console buffer is full
by Peter Steele 11 Mar '16

11 Mar '16

We have been researching stuck zombie processes in our libvirt lxc containers. What we found was: 1) Each zombie’s parent was pid 1. init which symlinks to systemd. 2) In some cases, the zombies were launched by systemd, in others the zombie was inherited. 3) While the child is in the zombie state, the parent process (systemd) /proc/1/status shows no pending signals. 4) Attaching gdb to systemd, there was 1 thread and it was waiting in write() and the file being written was /dev/console. This write() to the console never returns. We operated under the assumption that systemd's SIGCHLD handler sets a bit and a foreground thread (the only thread) would see that child processes needed reaping. While the single thread is stuck in write(), the reaping never takes place. So why is write() blocking? The answer seems to be that there is nothing draining the console and eventually it blocks write() when its buffers become full. When we attached to the container's console, the buffer is cleared allowing systemd’s write() to return. The zombies are then reaped and everything goes back to normal. Our “solution” was more of a workaround. systemd was altered to log errors/warnings/etc to /dev/null instead of /dev/console. This prevented the problem, only in that the console buffer was unlikely to get filled up since systemd generally is the only then that writes to it. This is definitely a hack though. This may be a bug in the libvirt container library (you can't expect something to periodically connect to a container's console to empty it out). We suspect there may also be a configuration issue in our containers with regards to the console. Has anyone else observed this problem? Peter _______________________________________________ libvirt-users mailing list libvirt-users(a)redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users

2 3

[libvirt-users] UserID Permissions: Virtual Machine Manager vs virsh and Python
by David Ashley 22 Feb '16

22 Feb '16

I have added a user to the libvirt group on my CentOS 7.2 server and that user can successfully access the Virtual Machine Manager without authenticating as expected. This allows the user to perform all functions in the VMS as if they were root. This is acceptable as this is a private server with no outside access so security is not a real issue. But when that same user tries to perform functions with virsh or using a Python script that uses the libvirt module, the connection is just read-only. Why are the permissions different for these environments and what must I do to give the user r/w access in virsh or the Python script? David Ashley

3 4

[libvirt-users] Networking with qemu/kvm+libvirt
by Andre Goree 10 Feb '16

10 Feb '16

I have some questions regarding the way that networking is handled via qemu/kvm+libvirt -- my apologies in advance if this is not the proper mailing list for such a question. I am trying to determine how exactly I can manipulate traffic from a _guest's_ NIC using iptables on the _host_. On the host, there is a bridged virtual NIC that corresponds to the guest's NIC. That interface does not have an IP setup on it on the host, however within the vm itself the IP is configured and everything works as expected. During my testing, I've seemingly determined that traffic from the vm does NOT traverse iptables on the host, but I _can_ in fact see the traffic via tcpdump on the host. This seems odd to me, unless the traffic is passed on during interaction with the kernel, and thus never actually reaches iptables. I've gone as far as trying to log via iptables any and all traffic traversing the guest's interface on the host, but to no avail (iptables does not see any traffic from the guest's NIC on the host). Is this the way it's supposed to work? And if so, is there any way I can do IP/port redirection silently on the _host_? Thanks in advance for any insight that anyone can share :) -- Andre Goree -=-=-=-=-=- Email - andre at drenet.net Website - http://www.drenet.net PGP key - http://www.drenet.net/pubkey.txt -=-=-=-=-=-

2 5

[libvirt-users] generate interface MAC addresses in a particular order
by Andrei Perietanu 01 Feb '16

01 Feb '16

Hi all, I am using libvirt to manage VM on my system; after creating a VM (default no NICs are present in the configuration) you can add any number of interfaces to it (as long as they exist on the host). To do that, I edit the configuration xlm: vmXml = self.domain.XMLDesc() root = ET.fromstring(vmXml) devices = root.find('./devices') intf = ET.SubElement(devices,'interface') intf.set('type', 'bridge') src = ET.SubElement(intf,'source') src.set('bridge', bIntf) model = ET.SubElement(intf,'model') model.set('type', 'e1000') xml = ET.tostring(root) self.conn.defineXML(xml) Now the problem I have is that the MAC addresses are auto-generated and because of this there is no way to predict which interface number the newly added interface will map to, on the VM. Ideally, the first added interface is mapped to eth0/0, the second one eth0/1...etc. Since the mappings depend on the MAC addresses I figured that is the part I need to have control over. Any ideas? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

2 3

[libvirt-users] storage pool and volume usage question
by Paul Carlton 31 Jan '16

31 Jan '16

Hi I'm creating a storage volume in a storage pool (directory type). I'd like to create a volume that creates a file in a sub directory under the directory that the pool points to but am not able to work out how, maybe it is not possible? My pool was created using following xml... <pool type='dir'> <name>nova-local-pool</name> <target> <path>/home/pcarlton/openstack/stuff/instances</path> <permissions> <mode>0755</mode> <owner>1000</owner> <group>130</group> </permissions> </target> </pool> The volume was created using this xml... stgvol_xml = """ <volume> <name>4291f96a-759a-4b8a-bfe2-7a8ccb118b75-disk</name> <allocation>0</allocation> <capacity unit="G">1</capacity> <target> <format type='qcow2'/> <permissions> <owner>1000</owner> <group>130</group> <mode>0644</mode> <label>image_overlay</label> </permissions> </target> <backingStore> <path>/home/pcarlton/openstack/stuff/nova/instances/_base/07f224f72581f8e029e08ff96827d581b2321a7b</path> <format type='raw'/> <permissions> <owner>1000</owner> <group>130</group> <mode>0644</mode> <label>image_base</label> </permissions> </backingStore> </volume>""" All works ok but I'd like the create the 'disk' file in /home/pcarlton/openstack/stuff/nova/instances/4291f96a-759a-4b8a-bfe2-7a8ccb118b75 Thanks -- Paul Carlton Software Engineer Cloud Services Hewlett Packard Enterprise BUK03:T242 Longdown Avenue Stoke Gifford Bristol BS34 8QZ Mobile: +44 (0)7768 994283 Office: +44 (0)117 316 2189 Email: mailto:paul.carlton2@hpe.com irc: paul-carlton2 Hewlett-Packard Enterprise Limited registered Office: Cain Road, Bracknell, Berks RG12 1HN Registered No: 690597 England. The contents of this message and any attachments to it are confidential and may be legally privileged. If you have received this message in error, you should delete it from your system immediately and advise the sender. To any recipient of this message within HP, unless otherwise stated you should consider this message and attachments as "HP CONFIDENTIAL".

2 1

[libvirt-users] virt-viewer and virt-manager problem
by Pascal Legrand 30 Jan '16

30 Jan '16

Hello, here is my problem : i migrated an old debian server, with kvm host and guests vm, on a new one (wheezy to jessie). Everything worked fine on this old server. On the new server, i created a storage pool, copy the qcow2 guests files (from the old server) inside this storage pool, copy the xml guests files (from the old server) to /etc/libvirt/qemu , then virsh define guests and virsh start guests. Every guests works fine. My problem is about virt-viewer and virt-manager when i connect from my station to my kvm host from ssh (ssh -X 192.168.151.248). I cant use virt-manager or virt-user virt-manager display all the guests but i cant display the guest itself or the guest informations virt-viewer open a blanck window when i do vncviewer 192.168.151.248:5906 it works fine then i think the problem come from virt-viewer and virt-manager, but i cant see where is the problem. Does someone could help to solve this problem. Thanks -- Pascal

2 5

[libvirt-users] Zombie processes being created when console buffer is full
by Peter Steele 29 Jan '16

29 Jan '16

We have been researching stuck zombie processes in our libvirt lxc containers. What we found was: 1) Each zombie’s parent was pid 1. init which symlinks to systemd. 2) In some cases, the zombies were launched by systemd, in others the zombie was inherited. 3) While the child is in the zombie state, the parent process (systemd) /proc/1/status shows no pending signals. 4) Attaching gdb to systemd, there was 1 thread and it was waiting in write() and the file being written was /dev/console. This write() to the console never returns. We operated under the assumption that systemd's SIGCHLD handler sets a bit and a foreground thread (the only thread) would see that child processes needed reaping. While the single thread is stuck in write(), the reaping never takes place. So why is write() blocking? The answer seems to be that there is nothing draining the console and eventually it blocks write() when its buffers become full. When we attached to the container's console, the buffer is cleared allowing systemd’s write() to return. The zombies are then reaped and everything goes back to normal. Our “solution” was more of a workaround. systemd was altered to log errors/warnings/etc to /dev/null instead of /dev/console. This prevented the problem, only in that the console buffer was unlikely to get filled up since systemd generally is the only then that writes to it. This is definitely a hack though. This may be a bug in the libvirt container library (you can't expect something to periodically connect to a container's console to empty it out). We suspect there may also be a configuration issue in our containers with regards to the console. Has anyone else observed this problem? Peter

1 0

[libvirt-users] RX dropped packets on guests subnets
by pichon 27 Jan '16

27 Jan '16

Hello, I have first a question (and then may be a problem), that I have difficulties to understand and eventually to investigate. On each of my guests VM, I see constantly a RX dropped number increasing , Even if the VM does nothing ! ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.100.15 netmask 255.255.255.0 broadcast 192.168.100.255 inet6 fe80::5054:ff:fe36:ac80 prefixlen 64 scopeid 0x20<link> ether 52:54:00:36:ac:80 txqueuelen 1000 (Ethernet) RX packets 1966 bytes 122391 (119.5 KiB) RX errors 0 dropped 1288 overruns 0 frame 0 TX packets 552 bytes 99939 (97.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RX packets 4 bytes 340 (340.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 4 bytes 340 (340.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 (1) Is that a normal behaviour ? (2) Could you give me some hints where/how to investigate Here are a number of informations: - The virsh LAN setup - The VM XML description - iptables-save on the hosts - and then some packages version Thanks in advance Patrick My setup is as follow: An host running a Fedora 23 (minimal) and a VM guest running a Fedora 23 I have created 3 Networks , - 2 fully isolated ( mgt-private-lan and pre-private-lan) - 1 Nat via the host NIC Here after are the information related to the nat Network on which I have consistent increase of RX Dropped Packets virsh net-list Name State Autostart Persistent ---------------------------------------------------------- mgt-private-lan active yes yes nat-internet active yes yes prd-private-lan active yes yes virsh net-info nat-internet Name: nat-internet UUID: 4cff86b1-8e63-40be-ac9c-d3dcd405a9d3 Active: yes Persistent: yes Autostart: yes Bridge: virbr1 virsh net-dumpxml nat-internet <network connections='5'> <name>nat-internet</name> <uuid>4cff86b1-8e63-40be-ac9c-d3dcd405a9d3</uuid> <forward dev='eth0' mode='nat'> <nat> <port start='1024' end='65535'/> </nat> <interface dev='eth0'/> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:e4:ec:1b'/> <domain name='nat-internet'/> <ip address='192.168.100.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.100.128' end='192.168.100.254'/> </dhcp> </ip> </network> here is the XML of the VM [root@ks3 boot]# virsh dumpxml Network <domain type='kvm' id='5'> <name>Network</name> <uuid>006ec4e9-028c-4fef-94ec-4e9efbab61ff</uuid> <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='x86_64' machine='pc-i440fx-2.4'>hvm</type> <kernel>/var/lib/libvirt/boot/vmlinuz</kernel> <initrd>/var/lib/libvirt/boot/initramfs.img</initrd> <cmdline>root=/dev/vda selinux=0 audit=0 console=ttyS0 nosplash quiet</cmdline> <boot dev='hd'/> </os> <features> <acpi/> <apic/> </features> <cpu mode='custom' match='exact'> <model fallback='allow'>SandyBridge</model> </cpu> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup'/> <timer name='pit' tickpolicy='delay'/> <timer name='hpet' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <disk type='block' device='disk'> <driver name='qemu' type='raw' cache='none' io='native'/> <source dev='/dev/vault-storage/network-root'/> <backingStore/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw' cache='none' io='native'/> <source dev='/dev/vault-storage/network-bootswap'/> <backingStore/> <target dev='vdb' bus='virtio'/> <alias name='virtio-disk1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/> </disk> <controller type='usb' index='0' model='ich9-ehci1'> <alias name='usb'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x7'/> </controller> <controller type='usb' index='0' model='ich9-uhci1'> <alias name='usb'/> <master startport='0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0' multifunction='on'/> </controller> <controller type='usb' index='0' model='ich9-uhci2'> <alias name='usb'/> <master startport='2'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x1'/> </controller> <controller type='usb' index='0' model='ich9-uhci3'> <alias name='usb'/> <master startport='4'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'> <alias name='pci.0'/> </controller> <controller type='virtio-serial' index='0'> <alias name='virtio-serial0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </controller> <interface type='network'> <mac address='52:54:00:36:ac:80'/> <source network='nat-internet' bridge='virbr1'/> <target dev='vnet12'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='pty'> <source path='/dev/pts/5'/> <target port='0'/> <alias name='serial0'/> </serial> <console type='pty' tty='/dev/pts/5'> <source path='/dev/pts/5'/> <target type='serial' port='0'/> <alias name='serial0'/> </console> <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/channel/target/Network.org.qemu.guest_agent.0'/> <target type='virtio' name='org.qemu.guest_agent.0' state='connected'/> <alias name='channel0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' port='5904' autoport='yes' listen='127.0.0.1'> <listen type='address' address='127.0.0.1'/> </graphics> <video> <model type='cirrus' vram='16384' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </memballoon> </devices> </domain> iptables-save # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *nat :PREROUTING ACCEPT [14895:623423] :INPUT ACCEPT [12645:432591] :OUTPUT ACCEPT [123:8518] :POSTROUTING ACCEPT [595:37490] -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 6514 -j DNAT --to-destination 192.168.100.10:6514 -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.12:80 -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.100.12:443 -A POSTROUTING -s 192.168.100.0/24 -d 224.0.0.0/24 -o eth0 -j RETURN -A POSTROUTING -s 192.168.100.0/24 -d 255.255.255.255/32 -o eth0 -j RETURN -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -j MASQUERADE COMMIT # Completed on Sat Jan 23 10:49:51 2016 # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *mangle :PREROUTING ACCEPT [1212763:799851388] :INPUT ACCEPT [169753:18403044] :FORWARD ACCEPT [1043010:781448344] :OUTPUT ACCEPT [123913:208199933] :POSTROUTING ACCEPT [1166923:989648277] -A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -o virbr3 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -o virbr2 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill COMMIT # Completed on Sat Jan 23 10:49:51 2016 # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [120960:207745702] -A INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -i virbr3 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr3 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr3 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr3 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -i virbr2 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr2 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr2 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr2 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -m string --string "GET /w00tw00t.at.ISC .SANS." --algo bm --to 70 -j DROP -A INPUT -m set --match-set banned src -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 23 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.100.12/32 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT -A FORWARD -d 192.168.100.12/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A FORWARD -d 192.168.100.10/32 -p tcp -m state --state NEW -m tcp --dport 6514 -j ACCEPT -A FORWARD -d 192.168.100.0/24 -i eth0 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.100.0/24 -i virbr1 -o eth0 -j ACCEPT -A FORWARD -i virbr1 -o virbr1 -j ACCEPT -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr3 -o virbr3 -j ACCEPT -A FORWARD -o virbr3 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr3 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr2 -o virbr2 -j ACCEPT -A FORWARD -o virbr2 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr2 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -m set --match-set banned src -j DROP -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A OUTPUT -o virbr1 -p udp -m udp --dport 68 -j ACCEPT -A OUTPUT -o virbr3 -p udp -m udp --dport 68 -j ACCEPT -A OUTPUT -o virbr2 -p udp -m udp --dport 68 -j ACCEPT COMMIT # Completed on Sat Jan 23 10:49:51 2016 rpm -qa | grep libvirt libvirt-daemon-driver-nodedev-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-storage-1.2.18.2-1.fc23.x86_64 libvirt-daemon-config-network-1.2.18.2-1.fc23.x86_64 libvirt-daemon-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-secret-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-network-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-nwfilter-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-qemu-1.2.18.2-1.fc23.x86_64 libvirt-daemon-kvm-1.2.18.2-1.fc23.x86_64 libvirt-client-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-interface-1.2.18.2-1.fc23.x86_64 rpm -qa | grep qemu qemu-common-2.4.1-5.fc23.x86_64 qemu-kvm-2.4.1-5.fc23.x86_64 qemu-img-2.4.1-5.fc23.x86_64 ipxe-roms-qemu-20150407-3.gitdc795b9f.fc23.noarch libvirt-daemon-driver-qemu-1.2.18.2-1.fc23.x86_64 qemu-system-x86-2.4.1-5.fc23.x86_64 rpm -qa | grep kvm qemu-kvm-2.4.1-5.fc23.x86_64 libvirt-daemon-kvm-1.2.18.2-1.fc23.x86_64

2 5

[libvirt-users] starting a domain only when you have enough resources
by Andrei Perietanu 27 Jan '16

27 Jan '16

Hi all, I am running KVM on a 3.18 kernel. The system runs and Atom processor with 2Gb RAM. Using KVM you obviously can over allocate your resources: say you have 4 guests each configured with 1GB ram. Running all four at the same time, depending on the workload, can crash the system - I get a kernel trace when this happens. But let's consider a simpler case: one guest with 1.5 Gb RAM, ubuntu 14.03. During the installation the system will again crash. The memory statistics (top or proc/meminfo) will show that the FreeMemory goes down to 12Mb when this happens - which kind of makes sense considering the host will require some RAM to run. But the question is: does libvirt offer any way to prevent this from happening? Some way of not allowing the user to start a guest unless you have enough free memory. I know how much ram each guest has configured but that is not enough. I need to know how much the system has available, and just reading the free memory statistic does not help much since that is only a snapshot - when running a guest you can have 1gb free now, and 10 mb free 2 min later. Any ideas? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

2 6

[libvirt-users] Remote Vbox connection to windows host
by Pavlo Shchelokovskyy 26 Jan '16

26 Jan '16

Hi all, I'd like to use libvirt to control/have access to virtual machines created with VirtualBox _on a Windows host_ (from the Linux guest of the same Windows-hosted VirtualBox). It is for testing purposes only,, so security does not matter much. Is it possible at all? I have some troubles understanding the note in bold at https://libvirt.org/drvvbox.html. Does that mean that one has to have a (running) libvirt daemon on the same host where VirtualBox is running to have a remote connection to this hypervizor with libvirt? Best regards, -- Dr. Pavlo Shchelokovskyy Senior Software Engineer Mirantis Inc www.mirantis.com

1 0

[libvirt-users] Adding a Virtio Serial Controller
by Jean-Pierre Ribeauville 22 Jan '16

22 Jan '16

H, As I want to add a channel device programmatically via libvirt API , I got an error due to the fact that the Guest has no VirtIO Serial Controller in its configuration. Is it possible to add it via libvirt API ? Thx for help. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] executing libvirt commands as a different user
by Andrei Perietanu 21 Jan '16

21 Jan '16

I am using the libvirt API to manage VMs on the system, using a python wrapper to execute commands. I need to allow a webserver to access these commands and mostly read information about the VMs. The problem is that when using the web interface you use are basically running the commands as different user. Since libvirtd is run as root by default you get permission errors. Is there any way of getting around this without using polkit? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

3 2

[libvirt-users] Error after failed external snapshot.
by Dominique Ramaekers 21 Jan '16

21 Jan '16

Hi, I use this procedure to backup my VM's: http://wiki.libvirt.org/page/Live-disk-backup-with-active-blockcommit It works on my current host: Compiled against library: libvirt 1.2.16 Using library: libvirt 1.2.16 Gebruikte API: QEMU 1.2.16 Draaiende hypervisor: QEMU 2.1.0 Now I'm doing a test on a testing host: Compiled against library: libvirt 1.2.21 Using library: libvirt 1.2.21 Gebruikte API: QEMU 1.2.21 Draaiende hypervisor: QEMU 2.5.0 The first time, the active block commit failed because the block action was stuck on 100% and I got this error: 'block copy still active: disk 'vda' not ready for pivot yet' I did a 'virsh blockjob PCVIRT1 vda -abort' and started 'virsh blockcommit PCVIRT1 vda --active --verbose -pivot' again. This way, the external snapshot was commited ok. Now I get this error when I want to create an external snapshot: fout: internal error: kan QEMU commando 'transaction' niet uitvoeren: The feature 'snapshot' is not enabled I can't find a lot of information about this. Some help will be appreciated. Greetings, Dominique.

1 1

Re: [libvirt-users] channel device "state" value missing within OpenStack Kilo version
by Jean-Pierre Ribeauville 21 Jan '16

21 Jan '16

Hi, Discard this request , I was investigating on the wrong compute node. It works fine. Sorry for incovenience. Regards, J.P. De : Jean-Pierre Ribeauville Envoyé : mercredi 20 janvier 2016 16:18 À : 'libvirt-users(a)redhat.com' Objet : channel device "state" value missing within OpenStack Kilo version Hi, I've installed a OpenStack KILO all-in-one . For private need , I've to add a channel device to all my GUESTS on my compute node. It works fine (e.g. via a virsh command). Problem is that , in the xml describing the Guest , this 'state' value : <target type='virtio' name='agent' state='disconnected'/> showing if the channel is connected on the Guest side is missing. Does it mean that some qemu/KVM components are too old within KILO OpenStack release ? FYI , here are the installed related packages versions coming with KILO: libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-storage-1.2.8-16.el7_1.4.x86_64 libvirt-python-1.2.8-7.el7_1.1.x86_64 libvirt-daemon-1.2.8-16.el7_1.4.x86_64 libvirt-gconfig-0.1.7-3.el7.x86_64 libvirt-client-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nodedev-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-glib-0.1.7-3.el7.x86_64 libvirt-daemon-driver-interface-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-secret-1.2.8-16.el7_1.4.x86_64 libvirt-gobject-0.1.7-3.el7.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep kvm qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep qemu libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 qemu-guest-agent-2.1.0-4.el7.x86_64 qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.6.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.8.x86_64 ipxe-roms-qemu-20130517-6.gitc4bce43.el7.noarch Thanks for help, Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] channel device "state" value missing within OpenStack Kilo version
by Jean-Pierre Ribeauville 21 Jan '16

21 Jan '16

Hi, I've installed a OpenStack KILO all-in-one . For private need , I've to add a channel device to all my GUESTS on my compute node. It works fine (e.g. via a virsh command). Problem is that , in the xml describing the Guest , this 'state' value : <target type='virtio' name='agent' state='disconnected'/> showing if the channel is connected on the Guest side is missing. Does it mean that some qemu/KVM components are too old within KILO OpenStack release ? FYI , here are the installed related packages versions coming with KILO: libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-storage-1.2.8-16.el7_1.4.x86_64 libvirt-python-1.2.8-7.el7_1.1.x86_64 libvirt-daemon-1.2.8-16.el7_1.4.x86_64 libvirt-gconfig-0.1.7-3.el7.x86_64 libvirt-client-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nodedev-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-glib-0.1.7-3.el7.x86_64 libvirt-daemon-driver-interface-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-secret-1.2.8-16.el7_1.4.x86_64 libvirt-gobject-0.1.7-3.el7.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep kvm qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep qemu libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 qemu-guest-agent-2.1.0-4.el7.x86_64 qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.6.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.8.x86_64 ipxe-roms-qemu-20130517-6.gitc4bce43.el7.noarch Thanks for help, Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] unable to dissect libvirt rpc packets using wireshark plugin
by gowrishankar 20 Jan '16

20 Jan '16

Hi, I am trying libvirt plugin in wireshark to dissect RPC payload in TCP, but finding dissector code not really working. My env is Fedora core 21 (x86_64) and installed packages are as follow: wireshark-1.12.6-1.fc21.x86_64 libvirt-wireshark-1.2.9.3-2.fc21.x86_64 Earlier, just after installation, I noticed libvirt.so available only in /usr/lib64/wireshark/plugins/1.12.5/ . Wireshark could not load libvirt plugin. So, I copied above .so into 1.12.6/ under same plugins folder, following it wireshark could list libvirt as supported protocol. tshark -G protocols | grep libvirt Libvirt libvirt libvirt However, on checking with some pcaps which has libvirt RPC calls captured on wire, wireshark does not list libvirt RPC packets, as I search for "libvirt" protocol in pcap. Have anyone experienced this before or if you have any pointer that I could check in my env, that would be very helpful. -- Regards, Gowrishankar M

2 6

[libvirt-users] Trouble with volume permissions
by Frank Laszlo 20 Jan '16

20 Jan '16

I'm working on an integration that uses QCOW2 volumes with backing stores. I have qemu configured to run as the "qemu" user, which seems to be fine. I now need to make sure my volumes are readable by this user. However, it seems the volume being created is owned by root, instead of "qemu" as I'd expect it to be. I tried various things and was unable to get it to create the file as the correct user. I've supplied a link to the XML I'm using to create the volumes. If anyone has any ideas it would be massively helpful. Thanks Link to XML: http://pastebin.com/kbg9n6kW -- Frank Laszlo Nexcess - Beyond Hosting 21700 Melrose Ave. Southfield, MI. 48075 Cell: +1.248.602.6123 Phone: +1.866.639.2377 Fax: +1.248.281.0473

2 1

[libvirt-users] guest memory monitor
by frankpersist＠gmail.com 20 Jan '16

20 Jan '16

Hi, everyone, My hypervisor is kvm, when I use libvirt-java api to get guest vm memory information, I found what libvirt can not get real memory(within the vm)statistic, libvirt can only get information from .xml file(such as vmName.xml <currentMemory> lable) in host. My question is, does libvirt support memory monitor(within vm)? if it's true, how to get. if false, what is the difficulty? Thank you. frankpersist(a)gmail.com

2 1

[libvirt-users] how to setup a watchdog?
by lejeczek 15 Jan '16

15 Jan '16

hi everybody I'm testing Qemu's watchdog. My understanding was that hardware (here qemu's watchdog) would take action(cold reboot) the system if there is no ping from the OS watchdog, so I thought stopping watchdog service in VM should be a quick test. I have this in the guest: <watchdog model='i6300esb' action='reset'> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </watchdog> and I see /dev/watchdog in my guest. Yet nothing happens. I must be missing something, an expert said it's config problem? many thanks

1 0

[libvirt-users] libvirt + ceph rbd will hang
by 王李明 14 Jan '16

14 Jan '16

hi all： I use openstack icehouse and libvirt 0.10 version use the quem+ceph to save vm disk when I do serval operation for example migrate vm、snapshot vm the libvirtd will be hang I guess whether the ceph rbd will cause this error anyone can help me? Wang Liming

1 0

[libvirt-users] virsh attach-device : Bus 'pci.0' does not support hotplugging.
by Keyur Bhalerao 14 Jan '16

14 Jan '16

Hi , Trying to attach a disk to existing VM using virsh attach-device - XML <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='none' io='native'/> <source file='/var/lib/libvirt/images/guest.qcow2'/> <target dev='vdc' bus='virtio'/> </disk> After executing the command I am getting - [root@cent7 ~]# virsh attach-device lib-virt-man-001 newDisk.xml error: Failed to attach device from newDisk.xml error: internal error: unable to execute QEMU command 'device_add': Bus 'pci.0' does not support hotplugging. [root@cent7 ~]# virsh version Compiled against library: libvirt 1.2.17 Using library: libvirt 1.2.17 Using API: QEMU 1.2.17 Running hypervisor: QEMU 1.5.3 While searching on this issue found that some have suggested to install following - modprobe acpiphp modprobe pci_hotplug I am not sure if this is QEMU issue or libvirt issue. Any help in this would be appreciated. Thanks, Keyur Bhalerao

1 0

[libvirt-users] RBD snapshots
by Emmanuel Lacour 14 Jan '16

14 Jan '16

Dear libvirt users, I'm stuck on this subject and would appreciate a working example as this looks a supported feature :) After many tries and packages backports, here is my current setup: qemu 2.5 libvirt 3.0 ceph hammer on Debian jessie. Here is the relevent domain xml parts: <disk type='network' device='disk' snapshot='internal'> <driver name='qemu' type='raw'/> <auth username='libvirt'> <secret type='ceph' uuid='xxxxxxxxxxxxxxxx'/> </auth> <source protocol='rbd' name='libvirt-pool/vm-test'> <host name='192.168.253.1' port='6789'/> <host name='192.168.253.3' port='6789'/> <host name='192.168.253.254' port='6789'/> <snapshot name='backup'/> </source> <backingStore/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> After several tries, I discovered the snapshot option in source tag, and that I need to pre-create this snapshot using rbd so the vm can start. But then I tried: # virsh snapshot-create-as vm-test error: unsupported configuration: internal snapshot for disk vda unsupported for storage type raw # virsh snapshot-create-as vm-test snap1 --memspec file=/tmp/vm-test.mem --diskspec vda,snapshot=internal error: unsupported configuration: internal snapshot for disk vda unsupported for storage type raw # virsh snapshot-create-as vm-test snap1 --disk-only --atomic --diskspec vda,snapshot=internal error: unsupported configuration: active qemu domains require external disk snapshots; disk vda requested internal and some other test, without any success:( What I just would like to achieve is to do a consistent disk snapshot of the VM without VM shutdown (suspend is ok) and using virsh as this seems supported (I can manually run rbd snap create, I know). And if possible whol mem+disk consistent snapshot without downtime :) Any hint to make this working, as anyone out ther having succes in such process?

1 0