January 2016 - Users - libvirt List Archives

[libvirt-users] ceph rbd pool and libvirt manageability (virt-install)
by Jelle de Jong 28 Aug '18

28 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, I created a rbd pool and activated it, but I can't seem to create volumes in it with virsh or virt-install? # virsh pool-dumpxml myrbdpool <pool type='rbd'> <name>myrbdpool</name> <uuid>2d786f7a-2df3-4d79-ae60-1535bcf1c6b5</uuid> <capacity unit='bytes'>6997998301184</capacity> <allocation unit='bytes'>10309227031</allocation> <available unit='bytes'>6977204658176</available> <source> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> <name>libvirt-pool</name> <auth type='ceph' username='libvirt'> <secret uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> </source> </pool> # virt-install --version 1.0.1 # virsh --version 1.2.9 I ended using virsh edit ceph-test.powercraft.nl and making creating the disk manually. <disk type='network' device='disk'> <auth username='libvirt'> <secret type='ceph' uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> <source protocol='rbd' name='libvirt-pool/kvm01-storage'> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> </source> <target dev='vdc' bus='virtio'/> </disk> I use virt-install a lot to define, import and undefine domains, how can I use virt-install to manage my rdb disks? Kind regards, Jelle de Jong -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iJwEAQECAAYFAlV1xlQACgkQ1WclBW9j5HkbPQP+PjNrzvlqysslOp2Yk7wH4Mxy 2sh2dn96G0KOAHEeEn3BN6IWlnD1TADZbHdpTtMwkdv48Xwn0sP1s+3QDM4pb3gP n+z+dVxS8FouDIy/eiso3IBCj3g4TWbEX8ZHqs3jKqe0lZgAXBzB9xYSUowcEBrZ ddkPbr8p8ozWyOG+9V8= =lkK7 -----END PGP SIGNATURE-----

2 3

[libvirt-users] virRandomBits - not very random
by Brian Rak 01 Jun '18

01 Jun '18

I just ran into an issue where I had about 30 guests get duplicate mac addresses assigned. These were scattered across 30 different machines. Some debugging revealed that: 1) All the host machines were restarted within a couple seconds of each other 2) All the host machines had fairly similar libvirtd pids (within ~100 PIDs of each other) 3) Libvirt seeds the RNG using 'time(NULL) ^ getpid()' This perfectly explains why I saw so many duplicate mac addresses. Why is the RNG seed such a predictable value? Surely there has to be a better source of a random seed then the timestamp and the pid? The PID seems to me to be a very bad source of any randomness. I just ran a test across 60 of our hosts. 43 of them shared their PID with at least one other machine.

7 13

[libvirt-users] Libvirt bite sized tasks
by Michal Privoznik 20 Mar '16

20 Mar '16

Dear lists, I've just started new wiki page which aim is to summarize small and trivial tasks, that starting contributors can take, investigate and implement. The aim is to give them something easy to start with while not scaring them out about complexity of our code. The page can be found here: http://wiki.libvirt.org/page/BiteSizedTasks The name is copied from qemu wiki: http://wiki.qemu.org/BiteSizedTasks Please, feel free to extend the list. I plan to use it in the future when interviewing GSoC candidates. Michal

2 1

[libvirt-users] Zombie processes being created when console buffer is full
by Peter Steele 10 Mar '16

10 Mar '16

We have been researching stuck zombie processes in our libvirt lxc containers. What we found was: 1) Each zombie’s parent was pid 1. init which symlinks to systemd. 2) In some cases, the zombies were launched by systemd, in others the zombie was inherited. 3) While the child is in the zombie state, the parent process (systemd) /proc/1/status shows no pending signals. 4) Attaching gdb to systemd, there was 1 thread and it was waiting in write() and the file being written was /dev/console. This write() to the console never returns. We operated under the assumption that systemd's SIGCHLD handler sets a bit and a foreground thread (the only thread) would see that child processes needed reaping. While the single thread is stuck in write(), the reaping never takes place. So why is write() blocking? The answer seems to be that there is nothing draining the console and eventually it blocks write() when its buffers become full. When we attached to the container's console, the buffer is cleared allowing systemd’s write() to return. The zombies are then reaped and everything goes back to normal. Our “solution” was more of a workaround. systemd was altered to log errors/warnings/etc to /dev/null instead of /dev/console. This prevented the problem, only in that the console buffer was unlikely to get filled up since systemd generally is the only then that writes to it. This is definitely a hack though. This may be a bug in the libvirt container library (you can't expect something to periodically connect to a container's console to empty it out). We suspect there may also be a configuration issue in our containers with regards to the console. Has anyone else observed this problem? Peter _______________________________________________ libvirt-users mailing list libvirt-users(a)redhat.com https://www.redhat.com/mailman/listinfo/libvirt-users

2 3

[libvirt-users] UserID Permissions: Virtual Machine Manager vs virsh and Python
by David Ashley 22 Feb '16

22 Feb '16

I have added a user to the libvirt group on my CentOS 7.2 server and that user can successfully access the Virtual Machine Manager without authenticating as expected. This allows the user to perform all functions in the VMS as if they were root. This is acceptable as this is a private server with no outside access so security is not a real issue. But when that same user tries to perform functions with virsh or using a Python script that uses the libvirt module, the connection is just read-only. Why are the permissions different for these environments and what must I do to give the user r/w access in virsh or the Python script? David Ashley

3 4

[libvirt-users] Networking with qemu/kvm+libvirt
by Andre Goree 09 Feb '16

09 Feb '16

I have some questions regarding the way that networking is handled via qemu/kvm+libvirt -- my apologies in advance if this is not the proper mailing list for such a question. I am trying to determine how exactly I can manipulate traffic from a _guest's_ NIC using iptables on the _host_. On the host, there is a bridged virtual NIC that corresponds to the guest's NIC. That interface does not have an IP setup on it on the host, however within the vm itself the IP is configured and everything works as expected. During my testing, I've seemingly determined that traffic from the vm does NOT traverse iptables on the host, but I _can_ in fact see the traffic via tcpdump on the host. This seems odd to me, unless the traffic is passed on during interaction with the kernel, and thus never actually reaches iptables. I've gone as far as trying to log via iptables any and all traffic traversing the guest's interface on the host, but to no avail (iptables does not see any traffic from the guest's NIC on the host). Is this the way it's supposed to work? And if so, is there any way I can do IP/port redirection silently on the _host_? Thanks in advance for any insight that anyone can share :) -- Andre Goree -=-=-=-=-=- Email - andre at drenet.net Website - http://www.drenet.net PGP key - http://www.drenet.net/pubkey.txt -=-=-=-=-=-

2 5

[libvirt-users] generate interface MAC addresses in a particular order
by Andrei Perietanu 01 Feb '16

01 Feb '16

Hi all, I am using libvirt to manage VM on my system; after creating a VM (default no NICs are present in the configuration) you can add any number of interfaces to it (as long as they exist on the host). To do that, I edit the configuration xlm: vmXml = self.domain.XMLDesc() root = ET.fromstring(vmXml) devices = root.find('./devices') intf = ET.SubElement(devices,'interface') intf.set('type', 'bridge') src = ET.SubElement(intf,'source') src.set('bridge', bIntf) model = ET.SubElement(intf,'model') model.set('type', 'e1000') xml = ET.tostring(root) self.conn.defineXML(xml) Now the problem I have is that the MAC addresses are auto-generated and because of this there is no way to predict which interface number the newly added interface will map to, on the VM. Ideally, the first added interface is mapped to eth0/0, the second one eth0/1...etc. Since the mappings depend on the MAC addresses I figured that is the part I need to have control over. Any ideas? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

2 3

[libvirt-users] storage pool and volume usage question
by Paul Carlton 31 Jan '16

31 Jan '16

Hi I'm creating a storage volume in a storage pool (directory type). I'd like to create a volume that creates a file in a sub directory under the directory that the pool points to but am not able to work out how, maybe it is not possible? My pool was created using following xml... <pool type='dir'> <name>nova-local-pool</name> <target> <path>/home/pcarlton/openstack/stuff/instances</path> <permissions> <mode>0755</mode> <owner>1000</owner> <group>130</group> </permissions> </target> </pool> The volume was created using this xml... stgvol_xml = """ <volume> <name>4291f96a-759a-4b8a-bfe2-7a8ccb118b75-disk</name> <allocation>0</allocation> <capacity unit="G">1</capacity> <target> <format type='qcow2'/> <permissions> <owner>1000</owner> <group>130</group> <mode>0644</mode> <label>image_overlay</label> </permissions> </target> <backingStore> <path>/home/pcarlton/openstack/stuff/nova/instances/_base/07f224f72581f8e029e08ff96827d581b2321a7b</path> <format type='raw'/> <permissions> <owner>1000</owner> <group>130</group> <mode>0644</mode> <label>image_base</label> </permissions> </backingStore> </volume>""" All works ok but I'd like the create the 'disk' file in /home/pcarlton/openstack/stuff/nova/instances/4291f96a-759a-4b8a-bfe2-7a8ccb118b75 Thanks -- Paul Carlton Software Engineer Cloud Services Hewlett Packard Enterprise BUK03:T242 Longdown Avenue Stoke Gifford Bristol BS34 8QZ Mobile: +44 (0)7768 994283 Office: +44 (0)117 316 2189 Email: mailto:paul.carlton2@hpe.com irc: paul-carlton2 Hewlett-Packard Enterprise Limited registered Office: Cain Road, Bracknell, Berks RG12 1HN Registered No: 690597 England. The contents of this message and any attachments to it are confidential and may be legally privileged. If you have received this message in error, you should delete it from your system immediately and advise the sender. To any recipient of this message within HP, unless otherwise stated you should consider this message and attachments as "HP CONFIDENTIAL".

2 1

[libvirt-users] virt-viewer and virt-manager problem
by Pascal Legrand 29 Jan '16

29 Jan '16

Hello, here is my problem : i migrated an old debian server, with kvm host and guests vm, on a new one (wheezy to jessie). Everything worked fine on this old server. On the new server, i created a storage pool, copy the qcow2 guests files (from the old server) inside this storage pool, copy the xml guests files (from the old server) to /etc/libvirt/qemu , then virsh define guests and virsh start guests. Every guests works fine. My problem is about virt-viewer and virt-manager when i connect from my station to my kvm host from ssh (ssh -X 192.168.151.248). I cant use virt-manager or virt-user virt-manager display all the guests but i cant display the guest itself or the guest informations virt-viewer open a blanck window when i do vncviewer 192.168.151.248:5906 it works fine then i think the problem come from virt-viewer and virt-manager, but i cant see where is the problem. Does someone could help to solve this problem. Thanks -- Pascal

2 5

[libvirt-users] Zombie processes being created when console buffer is full
by Peter Steele 29 Jan '16

29 Jan '16

We have been researching stuck zombie processes in our libvirt lxc containers. What we found was: 1) Each zombie’s parent was pid 1. init which symlinks to systemd. 2) In some cases, the zombies were launched by systemd, in others the zombie was inherited. 3) While the child is in the zombie state, the parent process (systemd) /proc/1/status shows no pending signals. 4) Attaching gdb to systemd, there was 1 thread and it was waiting in write() and the file being written was /dev/console. This write() to the console never returns. We operated under the assumption that systemd's SIGCHLD handler sets a bit and a foreground thread (the only thread) would see that child processes needed reaping. While the single thread is stuck in write(), the reaping never takes place. So why is write() blocking? The answer seems to be that there is nothing draining the console and eventually it blocks write() when its buffers become full. When we attached to the container's console, the buffer is cleared allowing systemd’s write() to return. The zombies are then reaped and everything goes back to normal. Our “solution” was more of a workaround. systemd was altered to log errors/warnings/etc to /dev/null instead of /dev/console. This prevented the problem, only in that the console buffer was unlikely to get filled up since systemd generally is the only then that writes to it. This is definitely a hack though. This may be a bug in the libvirt container library (you can't expect something to periodically connect to a container's console to empty it out). We suspect there may also be a configuration issue in our containers with regards to the console. Has anyone else observed this problem? Peter

1 0

[libvirt-users] RX dropped packets on guests subnets
by pichon 26 Jan '16

26 Jan '16

Hello, I have first a question (and then may be a problem), that I have difficulties to understand and eventually to investigate. On each of my guests VM, I see constantly a RX dropped number increasing , Even if the VM does nothing ! ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.100.15 netmask 255.255.255.0 broadcast 192.168.100.255 inet6 fe80::5054:ff:fe36:ac80 prefixlen 64 scopeid 0x20<link> ether 52:54:00:36:ac:80 txqueuelen 1000 (Ethernet) RX packets 1966 bytes 122391 (119.5 KiB) RX errors 0 dropped 1288 overruns 0 frame 0 TX packets 552 bytes 99939 (97.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RX packets 4 bytes 340 (340.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 4 bytes 340 (340.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 (1) Is that a normal behaviour ? (2) Could you give me some hints where/how to investigate Here are a number of informations: - The virsh LAN setup - The VM XML description - iptables-save on the hosts - and then some packages version Thanks in advance Patrick My setup is as follow: An host running a Fedora 23 (minimal) and a VM guest running a Fedora 23 I have created 3 Networks , - 2 fully isolated ( mgt-private-lan and pre-private-lan) - 1 Nat via the host NIC Here after are the information related to the nat Network on which I have consistent increase of RX Dropped Packets virsh net-list Name State Autostart Persistent ---------------------------------------------------------- mgt-private-lan active yes yes nat-internet active yes yes prd-private-lan active yes yes virsh net-info nat-internet Name: nat-internet UUID: 4cff86b1-8e63-40be-ac9c-d3dcd405a9d3 Active: yes Persistent: yes Autostart: yes Bridge: virbr1 virsh net-dumpxml nat-internet <network connections='5'> <name>nat-internet</name> <uuid>4cff86b1-8e63-40be-ac9c-d3dcd405a9d3</uuid> <forward dev='eth0' mode='nat'> <nat> <port start='1024' end='65535'/> </nat> <interface dev='eth0'/> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:e4:ec:1b'/> <domain name='nat-internet'/> <ip address='192.168.100.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.100.128' end='192.168.100.254'/> </dhcp> </ip> </network> here is the XML of the VM [root@ks3 boot]# virsh dumpxml Network <domain type='kvm' id='5'> <name>Network</name> <uuid>006ec4e9-028c-4fef-94ec-4e9efbab61ff</uuid> <memory unit='KiB'>1048576</memory> <currentMemory unit='KiB'>1048576</currentMemory> <vcpu placement='static'>1</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='x86_64' machine='pc-i440fx-2.4'>hvm</type> <kernel>/var/lib/libvirt/boot/vmlinuz</kernel> <initrd>/var/lib/libvirt/boot/initramfs.img</initrd> <cmdline>root=/dev/vda selinux=0 audit=0 console=ttyS0 nosplash quiet</cmdline> <boot dev='hd'/> </os> <features> <acpi/> <apic/> </features> <cpu mode='custom' match='exact'> <model fallback='allow'>SandyBridge</model> </cpu> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup'/> <timer name='pit' tickpolicy='delay'/> <timer name='hpet' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <disk type='block' device='disk'> <driver name='qemu' type='raw' cache='none' io='native'/> <source dev='/dev/vault-storage/network-root'/> <backingStore/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </disk> <disk type='block' device='disk'> <driver name='qemu' type='raw' cache='none' io='native'/> <source dev='/dev/vault-storage/network-bootswap'/> <backingStore/> <target dev='vdb' bus='virtio'/> <alias name='virtio-disk1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/> </disk> <controller type='usb' index='0' model='ich9-ehci1'> <alias name='usb'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x7'/> </controller> <controller type='usb' index='0' model='ich9-uhci1'> <alias name='usb'/> <master startport='0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0' multifunction='on'/> </controller> <controller type='usb' index='0' model='ich9-uhci2'> <alias name='usb'/> <master startport='2'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x1'/> </controller> <controller type='usb' index='0' model='ich9-uhci3'> <alias name='usb'/> <master startport='4'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'> <alias name='pci.0'/> </controller> <controller type='virtio-serial' index='0'> <alias name='virtio-serial0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </controller> <interface type='network'> <mac address='52:54:00:36:ac:80'/> <source network='nat-internet' bridge='virbr1'/> <target dev='vnet12'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='pty'> <source path='/dev/pts/5'/> <target port='0'/> <alias name='serial0'/> </serial> <console type='pty' tty='/dev/pts/5'> <source path='/dev/pts/5'/> <target type='serial' port='0'/> <alias name='serial0'/> </console> <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/channel/target/Network.org.qemu.guest_agent.0'/> <target type='virtio' name='org.qemu.guest_agent.0' state='connected'/> <alias name='channel0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' port='5904' autoport='yes' listen='127.0.0.1'> <listen type='address' address='127.0.0.1'/> </graphics> <video> <model type='cirrus' vram='16384' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x0a' function='0x0'/> </memballoon> </devices> </domain> iptables-save # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *nat :PREROUTING ACCEPT [14895:623423] :INPUT ACCEPT [12645:432591] :OUTPUT ACCEPT [123:8518] :POSTROUTING ACCEPT [595:37490] -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 6514 -j DNAT --to-destination 192.168.100.10:6514 -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.12:80 -A PREROUTING -d 151.80.45.157/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.100.12:443 -A POSTROUTING -s 192.168.100.0/24 -d 224.0.0.0/24 -o eth0 -j RETURN -A POSTROUTING -s 192.168.100.0/24 -d 255.255.255.255/32 -o eth0 -j RETURN -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.100.0/24 ! -d 192.168.100.0/24 -o eth0 -j MASQUERADE COMMIT # Completed on Sat Jan 23 10:49:51 2016 # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *mangle :PREROUTING ACCEPT [1212763:799851388] :INPUT ACCEPT [169753:18403044] :FORWARD ACCEPT [1043010:781448344] :OUTPUT ACCEPT [123913:208199933] :POSTROUTING ACCEPT [1166923:989648277] -A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -o virbr3 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -o virbr2 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill COMMIT # Completed on Sat Jan 23 10:49:51 2016 # Generated by iptables-save v1.4.21 on Sat Jan 23 10:49:51 2016 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [120960:207745702] -A INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -i virbr3 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr3 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr3 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr3 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -i virbr2 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i virbr2 -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -i virbr2 -p udp -m udp --dport 67 -j ACCEPT -A INPUT -i virbr2 -p tcp -m tcp --dport 67 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -m string --string "GET /w00tw00t.at.ISC .SANS." --algo bm --to 70 -j DROP -A INPUT -m set --match-set banned src -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 23 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -d 192.168.100.12/32 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT -A FORWARD -d 192.168.100.12/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A FORWARD -d 192.168.100.10/32 -p tcp -m state --state NEW -m tcp --dport 6514 -j ACCEPT -A FORWARD -d 192.168.100.0/24 -i eth0 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.100.0/24 -i virbr1 -o eth0 -j ACCEPT -A FORWARD -i virbr1 -o virbr1 -j ACCEPT -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr3 -o virbr3 -j ACCEPT -A FORWARD -o virbr3 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr3 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr2 -o virbr2 -j ACCEPT -A FORWARD -o virbr2 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr2 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -m set --match-set banned src -j DROP -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A OUTPUT -o virbr1 -p udp -m udp --dport 68 -j ACCEPT -A OUTPUT -o virbr3 -p udp -m udp --dport 68 -j ACCEPT -A OUTPUT -o virbr2 -p udp -m udp --dport 68 -j ACCEPT COMMIT # Completed on Sat Jan 23 10:49:51 2016 rpm -qa | grep libvirt libvirt-daemon-driver-nodedev-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-storage-1.2.18.2-1.fc23.x86_64 libvirt-daemon-config-network-1.2.18.2-1.fc23.x86_64 libvirt-daemon-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-secret-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-network-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-nwfilter-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-qemu-1.2.18.2-1.fc23.x86_64 libvirt-daemon-kvm-1.2.18.2-1.fc23.x86_64 libvirt-client-1.2.18.2-1.fc23.x86_64 libvirt-daemon-driver-interface-1.2.18.2-1.fc23.x86_64 rpm -qa | grep qemu qemu-common-2.4.1-5.fc23.x86_64 qemu-kvm-2.4.1-5.fc23.x86_64 qemu-img-2.4.1-5.fc23.x86_64 ipxe-roms-qemu-20150407-3.gitdc795b9f.fc23.noarch libvirt-daemon-driver-qemu-1.2.18.2-1.fc23.x86_64 qemu-system-x86-2.4.1-5.fc23.x86_64 rpm -qa | grep kvm qemu-kvm-2.4.1-5.fc23.x86_64 libvirt-daemon-kvm-1.2.18.2-1.fc23.x86_64

2 5

[libvirt-users] starting a domain only when you have enough resources
by Andrei Perietanu 26 Jan '16

26 Jan '16

Hi all, I am running KVM on a 3.18 kernel. The system runs and Atom processor with 2Gb RAM. Using KVM you obviously can over allocate your resources: say you have 4 guests each configured with 1GB ram. Running all four at the same time, depending on the workload, can crash the system - I get a kernel trace when this happens. But let's consider a simpler case: one guest with 1.5 Gb RAM, ubuntu 14.03. During the installation the system will again crash. The memory statistics (top or proc/meminfo) will show that the FreeMemory goes down to 12Mb when this happens - which kind of makes sense considering the host will require some RAM to run. But the question is: does libvirt offer any way to prevent this from happening? Some way of not allowing the user to start a guest unless you have enough free memory. I know how much ram each guest has configured but that is not enough. I need to know how much the system has available, and just reading the free memory statistic does not help much since that is only a snapshot - when running a guest you can have 1gb free now, and 10 mb free 2 min later. Any ideas? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

2 6

[libvirt-users] Remote Vbox connection to windows host
by Pavlo Shchelokovskyy 26 Jan '16

26 Jan '16

Hi all, I'd like to use libvirt to control/have access to virtual machines created with VirtualBox _on a Windows host_ (from the Linux guest of the same Windows-hosted VirtualBox). It is for testing purposes only,, so security does not matter much. Is it possible at all? I have some troubles understanding the note in bold at https://libvirt.org/drvvbox.html. Does that mean that one has to have a (running) libvirt daemon on the same host where VirtualBox is running to have a remote connection to this hypervizor with libvirt? Best regards, -- Dr. Pavlo Shchelokovskyy Senior Software Engineer Mirantis Inc www.mirantis.com

1 0

[libvirt-users] Adding a Virtio Serial Controller
by Jean-Pierre Ribeauville 21 Jan '16

21 Jan '16

H, As I want to add a channel device programmatically via libvirt API , I got an error due to the fact that the Guest has no VirtIO Serial Controller in its configuration. Is it possible to add it via libvirt API ? Thx for help. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] executing libvirt commands as a different user
by Andrei Perietanu 21 Jan '16

21 Jan '16

I am using the libvirt API to manage VMs on the system, using a python wrapper to execute commands. I need to allow a webserver to access these commands and mostly read information about the VMs. The problem is that when using the web interface you use are basically running the commands as different user. Since libvirtd is run as root by default you get permission errors. Is there any way of getting around this without using polkit? Thanks, Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

3 2

[libvirt-users] Error after failed external snapshot.
by Dominique Ramaekers 21 Jan '16

21 Jan '16

Hi, I use this procedure to backup my VM's: http://wiki.libvirt.org/page/Live-disk-backup-with-active-blockcommit It works on my current host: Compiled against library: libvirt 1.2.16 Using library: libvirt 1.2.16 Gebruikte API: QEMU 1.2.16 Draaiende hypervisor: QEMU 2.1.0 Now I'm doing a test on a testing host: Compiled against library: libvirt 1.2.21 Using library: libvirt 1.2.21 Gebruikte API: QEMU 1.2.21 Draaiende hypervisor: QEMU 2.5.0 The first time, the active block commit failed because the block action was stuck on 100% and I got this error: 'block copy still active: disk 'vda' not ready for pivot yet' I did a 'virsh blockjob PCVIRT1 vda -abort' and started 'virsh blockcommit PCVIRT1 vda --active --verbose -pivot' again. This way, the external snapshot was commited ok. Now I get this error when I want to create an external snapshot: fout: internal error: kan QEMU commando 'transaction' niet uitvoeren: The feature 'snapshot' is not enabled I can't find a lot of information about this. Some help will be appreciated. Greetings, Dominique.

1 1

Re: [libvirt-users] channel device "state" value missing within OpenStack Kilo version
by Jean-Pierre Ribeauville 20 Jan '16

20 Jan '16

Hi, Discard this request , I was investigating on the wrong compute node. It works fine. Sorry for incovenience. Regards, J.P. De : Jean-Pierre Ribeauville Envoyé : mercredi 20 janvier 2016 16:18 À : 'libvirt-users(a)redhat.com' Objet : channel device "state" value missing within OpenStack Kilo version Hi, I've installed a OpenStack KILO all-in-one . For private need , I've to add a channel device to all my GUESTS on my compute node. It works fine (e.g. via a virsh command). Problem is that , in the xml describing the Guest , this 'state' value : <target type='virtio' name='agent' state='disconnected'/> showing if the channel is connected on the Guest side is missing. Does it mean that some qemu/KVM components are too old within KILO OpenStack release ? FYI , here are the installed related packages versions coming with KILO: libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-storage-1.2.8-16.el7_1.4.x86_64 libvirt-python-1.2.8-7.el7_1.1.x86_64 libvirt-daemon-1.2.8-16.el7_1.4.x86_64 libvirt-gconfig-0.1.7-3.el7.x86_64 libvirt-client-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nodedev-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-glib-0.1.7-3.el7.x86_64 libvirt-daemon-driver-interface-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-secret-1.2.8-16.el7_1.4.x86_64 libvirt-gobject-0.1.7-3.el7.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep kvm qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep qemu libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 qemu-guest-agent-2.1.0-4.el7.x86_64 qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.6.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.8.x86_64 ipxe-roms-qemu-20130517-6.gitc4bce43.el7.noarch Thanks for help, Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] channel device "state" value missing within OpenStack Kilo version
by Jean-Pierre Ribeauville 20 Jan '16

20 Jan '16

Hi, I've installed a OpenStack KILO all-in-one . For private need , I've to add a channel device to all my GUESTS on my compute node. It works fine (e.g. via a virsh command). Problem is that , in the xml describing the Guest , this 'state' value : <target type='virtio' name='agent' state='disconnected'/> showing if the channel is connected on the Guest side is missing. Does it mean that some qemu/KVM components are too old within KILO OpenStack release ? FYI , here are the installed related packages versions coming with KILO: libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-storage-1.2.8-16.el7_1.4.x86_64 libvirt-python-1.2.8-7.el7_1.1.x86_64 libvirt-daemon-1.2.8-16.el7_1.4.x86_64 libvirt-gconfig-0.1.7-3.el7.x86_64 libvirt-client-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nodedev-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-network-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-config-nwfilter-1.2.8-16.el7_1.4.x86_64 libvirt-glib-0.1.7-3.el7.x86_64 libvirt-daemon-driver-interface-1.2.8-16.el7_1.4.x86_64 libvirt-daemon-driver-secret-1.2.8-16.el7_1.4.x86_64 libvirt-gobject-0.1.7-3.el7.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep kvm qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 libvirt-daemon-kvm-1.2.8-16.el7_1.4.x86_64 [root@localhost bin]# rpm -qa | grep qemu libvirt-daemon-driver-qemu-1.2.8-16.el7_1.4.x86_64 qemu-guest-agent-2.1.0-4.el7.x86_64 qemu-kvm-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.6.x86_64 qemu-kvm-common-1.5.3-86.el7_1.8.x86_64 qemu-img-1.5.3-86.el7_1.8.x86_64 ipxe-roms-qemu-20130517-6.gitc4bce43.el7.noarch Thanks for help, Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

[libvirt-users] unable to dissect libvirt rpc packets using wireshark plugin
by gowrishankar 20 Jan '16

20 Jan '16

Hi, I am trying libvirt plugin in wireshark to dissect RPC payload in TCP, but finding dissector code not really working. My env is Fedora core 21 (x86_64) and installed packages are as follow: wireshark-1.12.6-1.fc21.x86_64 libvirt-wireshark-1.2.9.3-2.fc21.x86_64 Earlier, just after installation, I noticed libvirt.so available only in /usr/lib64/wireshark/plugins/1.12.5/ . Wireshark could not load libvirt plugin. So, I copied above .so into 1.12.6/ under same plugins folder, following it wireshark could list libvirt as supported protocol. tshark -G protocols | grep libvirt Libvirt libvirt libvirt However, on checking with some pcaps which has libvirt RPC calls captured on wire, wireshark does not list libvirt RPC packets, as I search for "libvirt" protocol in pcap. Have anyone experienced this before or if you have any pointer that I could check in my env, that would be very helpful. -- Regards, Gowrishankar M

2 6

[libvirt-users] Trouble with volume permissions
by Frank Laszlo 20 Jan '16

20 Jan '16

I'm working on an integration that uses QCOW2 volumes with backing stores. I have qemu configured to run as the "qemu" user, which seems to be fine. I now need to make sure my volumes are readable by this user. However, it seems the volume being created is owned by root, instead of "qemu" as I'd expect it to be. I tried various things and was unable to get it to create the file as the correct user. I've supplied a link to the XML I'm using to create the volumes. If anyone has any ideas it would be massively helpful. Thanks Link to XML: http://pastebin.com/kbg9n6kW -- Frank Laszlo Nexcess - Beyond Hosting 21700 Melrose Ave. Southfield, MI. 48075 Cell: +1.248.602.6123 Phone: +1.866.639.2377 Fax: +1.248.281.0473

2 1

[libvirt-users] guest memory monitor
by frankpersist＠gmail.com 20 Jan '16

20 Jan '16

Hi, everyone, My hypervisor is kvm, when I use libvirt-java api to get guest vm memory information, I found what libvirt can not get real memory(within the vm)statistic, libvirt can only get information from .xml file(such as vmName.xml <currentMemory> lable) in host. My question is, does libvirt support memory monitor(within vm)? if it's true, how to get. if false, what is the difficulty? Thank you. frankpersist(a)gmail.com

2 1

[libvirt-users] how to setup a watchdog?
by lejeczek 14 Jan '16

14 Jan '16

hi everybody I'm testing Qemu's watchdog. My understanding was that hardware (here qemu's watchdog) would take action(cold reboot) the system if there is no ping from the OS watchdog, so I thought stopping watchdog service in VM should be a quick test. I have this in the guest: <watchdog model='i6300esb' action='reset'> <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/> </watchdog> and I see /dev/watchdog in my guest. Yet nothing happens. I must be missing something, an expert said it's config problem? many thanks

1 0

[libvirt-users] libvirt + ceph rbd will hang
by 王李明 14 Jan '16

14 Jan '16

hi all： I use openstack icehouse and libvirt 0.10 version use the quem+ceph to save vm disk when I do serval operation for example migrate vm、snapshot vm the libvirtd will be hang I guess whether the ceph rbd will cause this error anyone can help me? Wang Liming

1 0

[libvirt-users] virsh attach-device : Bus 'pci.0' does not support hotplugging.
by Keyur Bhalerao 13 Jan '16

13 Jan '16

Hi , Trying to attach a disk to existing VM using virsh attach-device - XML <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='none' io='native'/> <source file='/var/lib/libvirt/images/guest.qcow2'/> <target dev='vdc' bus='virtio'/> </disk> After executing the command I am getting - [root@cent7 ~]# virsh attach-device lib-virt-man-001 newDisk.xml error: Failed to attach device from newDisk.xml error: internal error: unable to execute QEMU command 'device_add': Bus 'pci.0' does not support hotplugging. [root@cent7 ~]# virsh version Compiled against library: libvirt 1.2.17 Using library: libvirt 1.2.17 Using API: QEMU 1.2.17 Running hypervisor: QEMU 1.5.3 While searching on this issue found that some have suggested to install following - modprobe acpiphp modprobe pci_hotplug I am not sure if this is QEMU issue or libvirt issue. Any help in this would be appreciated. Thanks, Keyur Bhalerao

1 0

[libvirt-users] RBD snapshots
by Emmanuel Lacour 13 Jan '16

13 Jan '16

Dear libvirt users, I'm stuck on this subject and would appreciate a working example as this looks a supported feature :) After many tries and packages backports, here is my current setup: qemu 2.5 libvirt 3.0 ceph hammer on Debian jessie. Here is the relevent domain xml parts: <disk type='network' device='disk' snapshot='internal'> <driver name='qemu' type='raw'/> <auth username='libvirt'> <secret type='ceph' uuid='xxxxxxxxxxxxxxxx'/> </auth> <source protocol='rbd' name='libvirt-pool/vm-test'> <host name='192.168.253.1' port='6789'/> <host name='192.168.253.3' port='6789'/> <host name='192.168.253.254' port='6789'/> <snapshot name='backup'/> </source> <backingStore/> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> After several tries, I discovered the snapshot option in source tag, and that I need to pre-create this snapshot using rbd so the vm can start. But then I tried: # virsh snapshot-create-as vm-test error: unsupported configuration: internal snapshot for disk vda unsupported for storage type raw # virsh snapshot-create-as vm-test snap1 --memspec file=/tmp/vm-test.mem --diskspec vda,snapshot=internal error: unsupported configuration: internal snapshot for disk vda unsupported for storage type raw # virsh snapshot-create-as vm-test snap1 --disk-only --atomic --diskspec vda,snapshot=internal error: unsupported configuration: active qemu domains require external disk snapshots; disk vda requested internal and some other test, without any success:( What I just would like to achieve is to do a consistent disk snapshot of the VM without VM shutdown (suspend is ok) and using virsh as this seems supported (I can manually run rbd snap create, I know). And if possible whol mem+disk consistent snapshot without downtime :) Any hint to make this working, as anyone out ther having succes in such process?

1 0

[libvirt-users] vdsm hook issues
by Jean-Pierre Ribeauville 12 Jan '16

12 Jan '16

Hi, 1) is it enough to add a hook.py in /usr/libexec/vdsm/hooks/before_vm_start directory , and then shut down and reboot a guest to see this hook.py invoked ? 2) when running manually my hook.py, I got following error : ImportError: No module named hooking Do I have to install anything to solve this issue ? Thanks for help. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

2 2

Re: [libvirt-users] libvirt-users Digest, Vol 73, Issue 12 ] Failure when attaching a device
by Jean-Pierre Ribeauville 12 Jan '16

12 Jan '16

Hi, I think that issue is due to the fact that my Guest is a transient domain. When shutting down it or migrating to another host , then virsh list --all doesn't show this Guest anymore. How may I make this Guest a persistent one ? ( i.e. this Guest has been created via RHEV-M GUI) Thx for hlep. Regards, J.P. -----Message d'origine----- De : libvirt-users-bounces(a)redhat.com [mailto:libvirt-users-bounces@redhat.com] De la part de libvirt-users-request(a)redhat.com Envoyé : lundi 11 janvier 2016 21:25 À : libvirt-users(a)redhat.com Objet : libvirt-users Digest, Vol 73, Issue 12 Send libvirt-users mailing list submissions to libvirt-users(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/libvirt-users or, via email, send a message with subject or body 'help' to libvirt-users-request(a)redhat.com You can reach the person managing the list at libvirt-users-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of libvirt-users digest..." Today's Topics: 1. Networking with qemu/kvm+libvirt (Andre Goree) 2. Failure when attaching a device (Jean-Pierre Ribeauville) 3. Re: Networking with qemu/kvm+libvirt (Laine Stump) 4. Unable to validate doc against .... (Jean-Pierre Ribeauville) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 Jan 2016 14:25:21 -0500 From: Andre Goree <andre(a)drenet.net> To: libvirt-users(a)redhat.com Subject: [libvirt-users] Networking with qemu/kvm+libvirt Message-ID: <100725aa681e75449b9da623e7a7cf1a(a)drenet.net> Content-Type: text/plain; charset=UTF-8; format=flowed I have some questions regarding the way that networking is handled via qemu/kvm+libvirt -- my apologies in advance if this is not the proper mailing list for such a question. I am trying to determine how exactly I can manipulate traffic from a?_guest's_ NIC using iptables on the _host_. On the host, there is a bridged virtual NIC that corresponds to the guest's NIC. That interface does not have an IP setup on it on the host, however within the vm itself the IP is configured and everything works as expected. During my testing, I've seemingly determined that traffic from the vm does NOT traverse iptables on the host, but I _can_ in fact see the traffic via tcpdump on the host. This seems odd to me, unless the traffic is passed on during interaction with the kernel, and thus never actually reaches iptables. I've gone as far as trying to log via iptables any and all traffic traversing the guest's interface on the host, but to no avail (iptables does not see any traffic from the guest's NIC on the host). Is this the way it's supposed to work? And if so, is there any way I can do IP/port redirection silently on the _host_? Thanks in advance for any insight that anyone can share :) -- Andre Goree -=-=-=-=-=- Email - andre at drenet.net Website - http://www.drenet.net PGP key - http://www.drenet.net/pubkey.txt -=-=-=-=-=- ------------------------------ Message: 2 Date: Mon, 11 Jan 2016 19:35:29 +0000 From: Jean-Pierre Ribeauville <jpribeauville(a)axway.com> To: "libvirt-users(a)redhat.com" <libvirt-users(a)redhat.com> Subject: [libvirt-users] Failure when attaching a device Message-ID: <1051EFB4D3A1704680C38CCAAC5836D292F0218E(a)WPTXMAIL2.ptx.axway.int> Content-Type: text/plain; charset="iso-8859-1" Hi, I'm facing following issue ( or misunderstanding from my side) I try to attach a device to a running guest ; I want to do it persistently and without having to restart the GUEST . By using options "-live - persistent" , I got following error : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used.xml" --live --persistent Please enter your authentication name: root@ldc01omv01 Please enter your password: error: Failed to attach device from ../data/channel_omnivision_to_be_used.xml error: Requested operation is not valid: cannot modify device on transient domain [root@ldc01omv01 data]# virsh -r list --all Id Name State ---------------------------------------------------- 8 VM_RHEL7-2 running 11 W2008R2-2 running 12 VM_RHEL7-1 running By using options "-live " , I got following error : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used.xml" --live Please enter your authentication name: root@ldc01omv01 Please enter your password: error: Failed to attach device from ../data/channel_omnivision_to_be_used.xml error: Unable to read from monitor: Connection reset by peer [root@ldc01omv01 data]# virsh -r list --all Id Name State ---------------------------------------------------- 8 VM_RHEL7-2 running 11 W2008R2-2 running [root@ldc01omv01 data]# And then the Guest is powered off !! If I try to attach device when the Guest is off , then : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used_1.xml" --config --persistent Please enter your authentication name: root@ldc01omv01 Please enter your password: error: failed to get domain 'VM_RHEL7-1' error: Domain not found: no domain with matching name 'VM_RHEL7-1' FYI , xml file contents is : <channel type='unix'> <source mode='bind' path='//var/lib/libvirt/qemu/VM_RHEL7-1_omnivision_1.agent'/> <target type='virtio' name='omnivision_1.agent'/> </channel> I'm using libvirt-1.2.17-13.el7.x86_64 Any help is welcome. Thanks. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez ? l'environnement avant d'imprimer.

2 2

[libvirt-users] Unable to validate doc against ....
by Jean-Pierre Ribeauville 12 Jan '16

12 Jan '16

Hi, By trying to add this device : <channel type='unix'> <source mode='bind' path='//var/lib/libvirt/qemu/VM_RHEL7-1_omnivision_1.agent'/> <target type='virtio' name='omnivision_1.agent'/> </channel> Within config file by issuing virsh edit , I got following error when to saving the config file : Unable to validate doc against /usr/share/libvirt/schemas/domain.rng Extra element devices in interleave I'm using libvirt-1.2.17-13.el7.x86_64 Is there my mistake or a known issue ( quite sure it was working with former release) Thx for help. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

2 1

[libvirt-users] Software Offloading Performance Issue on increasing VM's (TSO enabled ) pushing traffic
by Piyush R Srivastava1 12 Jan '16

12 Jan '16

Hi, Problem- Offloading (in Software) for VM generated packets ( TSO enabled in VM's ) degrades severely with increase in VM's on a host. On increasing VM's ( which are pushing traffic simultaneously ) on a compute node- - % offloaded packets coming out of VM's ( TSO enabled ) on tap port / veth-pair decreases significantly - Size of offloaded packets coming out of VM's (TSO enabled ) on tap porty / veth pair decreases significantly We are using OpenStack setup. Throughput for SNAT Test ( iperf client at VM and server at external network machine ) is SIGNIFICANTLY less that DNAT Test ( server at VM and client at external network machine). For 50 VM's ( 25 VM on each compute node on a 2 Compute Node setup ) SNAT throughput is 30% less than DNAT Throughput. I was hoping to get community feedback on what is controlling the software offloading of VM packets and how can we improve it ? NOTE- This seems to be one of the bottlenecks in SNAT which is affecting throughput at TX side on Compute Node. Improving this would help in improving SNAT test network performance. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Description- We have a testbed OpenStack deployment. We boot 1, 10 and 25 VM's on a single compute node and start iperf traffic. ( VM's are iperf client ). We then simultaneously do tcpdump at the veth-pair connecting the VM to the OVS Bridges. Tcpdump data shows that on increasing the VM's on a host, the % of offloaded packets degrades severely ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Host configuration- 12 cores ( 24 vCPU ), 40 GB RAM [root rhel7-25 ~]# uname -a Linux rhel7-25.in.ibm.com 3.10.0-229.el7.x86_64 #1 SMP Thu Jan 29 18:37:38 EST 2015 x86_64 x86_64 x86_64 GNU/Linux VM MTU is set to 1450 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Analysis- Following is the % of non-offloaded packets observed at the tap ports / veth pair ( connected to VM's TO OVS Bridge ) ------------------------------------ | VMs on 1 Compute Node | % Non-Offloaded packets | |-----------------------------------| | 1 | 11.11% | | 10 | 71.78% | | 25 | 80.44% | |----|--------- | Thus we see significant degradation in offloaded packets when 10 and 25 VM's are sending iperf data simultaneously. ( TSO enabled VM's ) Non-Offloaded packets means Ethernet Frame of size 1464 ( VM MTU is 1450 ). Thus the packets coming out of the VM's (TSO enabled ) are majority non-offloaded as we increase VM's on a host. ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Tcpdump details- Iperf Server IP- 1.1.1.34 For 1 VM, we see majority offloaded packets and also large sized offloaded frames- [piyush rhel7-34 25]$ cat qvoed7aa38d-22.log | grep "> 1.1.1.34.5001" | head -n 30 14:36:26.331073 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 74: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 0 14:36:26.331917 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 66: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 0 14:36:26.331946 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 90: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 24 14:36:26.331977 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 7056: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 6990 14:36:26.332018 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 5658: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 5592 14:36:26.332527 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 7056: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 6990 14:36:26.332560 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 9852: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 9786 14:36:26.333024 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 8454: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 8388 14:36:26.333054 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 7056: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 6990 14:36:26.333076 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 4260: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 4194 14:36:26.333530 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 16842: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 16776 14:36:26.333568 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 4260: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 4194 14:36:26.333886 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 21036: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 20970 14:36:26.333925 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 2862: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 2796 14:36:26.334303 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 21036: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 20970 14:36:26.334349 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 2862: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 2796 14:36:26.334741 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 22434: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 22368 14:36:26.335118 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 25230: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 25164 14:36:26.335566 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 25230: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 25164 14:36:26.336007 fa:16:3e:98:41:8b > fa:16:3e:ef:5f:16, IPv4, length 23832: 10.20.7.3.50395 > 1.1.1.34.5001: tcp 23766 For 20 VM's, we see reduction is size of offloaded packets and also the size of offloaded packets is reduced. Tcpdump for one of the 10 VM's ( similar characterization for all 10 VM's )- [piyush rhel7-34 25]$ cat qvo255d8cdd-90.log | grep "> 1.1.1.34.5001" | head -n 30 15:09:25.024790 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 74: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 0 15:09:25.026834 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 66: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 0 15:09:25.026870 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 90: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 24 15:09:25.027186 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.027213 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 5658: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 5592 15:09:25.032500 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 5658: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 5592 15:09:25.032539 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 1464: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 1398 15:09:25.032567 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.035122 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.035631 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.035661 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.038508 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.038904 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 15:09:25.039300 fa:16:3e:b9:f8:ec > fa:16:3e:c1:de:cc, IPv4, length 7056: 10.20.18.3.36798 > 1.1.1.34.5001: tcp 6990 For 25 VM's, we see very less offloaded packets and also the size of offloaded packets is reduced. Tcpdump for one of the 25 VM's ( similar characterization for all 25 VM's )- 15:52:31.544316 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.544340 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545034 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545066 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 5658: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 5592 15:52:31.545474 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545501 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 2862: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 2796 15:52:31.545539 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 2862: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 2796 15:52:31.545572 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 7056: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 6990 15:52:31.545736 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545807 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545813 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545934 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545956 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.545974 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 15:52:31.546012 fa:16:3e:3c:7d:78 > fa:16:3e:aa:af:d5, IPv4, length 1464: 10.20.10.3.45892 > 1.1.1.34.5001: tcp 1398 Thanks and regards, Piyush Raman Mail: pirsriva(a)in.ibm.com

1 0

[libvirt-users] Question regarding networking and qemu/kvm+libvirt
by Andre Goree 11 Jan '16

11 Jan '16

I have a question concerning the workings of networking in qemu/kvm+libvirt -- my apologies in advance if this is the wrong mailing list for such a question. I have a host machine with which I'm trying to redirect network traffic coming from a guest's NIC to a different IP. There is a bridged adapter on the host (without an IP configured on it) that is used by my guest's NIC -- the IP, etc. is configured within the guest. From what I can tell, the traffic is not traversing iptables on the host, BUT I can see traffic leaving the guest's NIC (on the host) using tcpdump. I've gone as far as logging all traffic on the vm's NIC (on the host) using iptables just to confirm that the host's iptables is not seeing the traffic. I'm wondering, is this the expected behavior? And if so, how then can redirect specific traffic from the guest (transparently) to a different IP? -- Andre Goree -=-=-=-=-=- Email - andre at drenet.net Website - http://www.drenet.net PGP key - http://www.drenet.net/pubkey.txt -=-=-=-=-=-

1 0

[libvirt-users] Failure when attaching a device
by Jean-Pierre Ribeauville 11 Jan '16

11 Jan '16

Hi, I'm facing following issue ( or misunderstanding from my side) I try to attach a device to a running guest ; I want to do it persistently and without having to restart the GUEST . By using options "-live - persistent" , I got following error : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used.xml" --live --persistent Please enter your authentication name: root@ldc01omv01 Please enter your password: error: Failed to attach device from ../data/channel_omnivision_to_be_used.xml error: Requested operation is not valid: cannot modify device on transient domain [root@ldc01omv01 data]# virsh -r list --all Id Name State ---------------------------------------------------- 8 VM_RHEL7-2 running 11 W2008R2-2 running 12 VM_RHEL7-1 running By using options "-live " , I got following error : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used.xml" --live Please enter your authentication name: root@ldc01omv01 Please enter your password: error: Failed to attach device from ../data/channel_omnivision_to_be_used.xml error: Unable to read from monitor: Connection reset by peer [root@ldc01omv01 data]# virsh -r list --all Id Name State ---------------------------------------------------- 8 VM_RHEL7-2 running 11 W2008R2-2 running [root@ldc01omv01 data]# And then the Guest is powered off !! If I try to attach device when the Guest is off , then : [root@ldc01omv01 data]# virsh attach-device VM_RHEL7-1 "../data/channel_omnivision_to_be_used_1.xml" --config --persistent Please enter your authentication name: root@ldc01omv01 Please enter your password: error: failed to get domain 'VM_RHEL7-1' error: Domain not found: no domain with matching name 'VM_RHEL7-1' FYI , xml file contents is : <channel type='unix'> <source mode='bind' path='//var/lib/libvirt/qemu/VM_RHEL7-1_omnivision_1.agent'/> <target type='virtio' name='omnivision_1.agent'/> </channel> I'm using libvirt-1.2.17-13.el7.x86_64 Any help is welcome. Thanks. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

1 0

Re: [libvirt-users] operation forbidden Read Only Access
by Jean-Pierre Ribeauville 11 Jan '16

11 Jan '16

Hi, I found an answer : Use virConnectOpenAuth() instead of virConnectOpenReadOnly(). As my piece of code is running silently (without user connected) , by using virConnectOpenAuth() , is it possible to avoid to prompt user to get user /password ? Thx. J.P. -----Message d'origine----- De : libvirt-users-bounces(a)redhat.com [mailto:libvirt-users-bounces@redhat.com] De la part de libvirt-users-request(a)redhat.com Envoyé : vendredi 8 janvier 2016 12:51 À : libvirt-users(a)redhat.com Objet : libvirt-users Digest, Vol 73, Issue 6 Send libvirt-users mailing list submissions to libvirt-users(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/libvirt-users or, via email, send a message with subject or body 'help' to libvirt-users-request(a)redhat.com You can reach the person managing the list at libvirt-users-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of libvirt-users digest..." Today's Topics: 1. Unable to retrieve Guest IP Addresses via libvirt API (Jean-Pierre Ribeauville) 2. Re: Unable to retrieve Guest IP Addresses via libvirt API (Martin Kletzander) 3. Re: Unable to retrieve Guest IP Addresses via libvirt API (Jean-Pierre Ribeauville) 4. Re: libvirtd and polkit: internal error: No Unix Process ID (Daniel P. Berrange) 5. operation forbidden Read Only Access (Jean-Pierre Ribeauville) ---------------------------------------------------------------------- Message: 1 Date: Thu, 7 Jan 2016 19:31:57 +0000 From: Jean-Pierre Ribeauville <jpribeauville(a)axway.com> To: "libvirt-users(a)redhat.com" <libvirt-users(a)redhat.com> Subject: [libvirt-users] Unable to retrieve Guest IP Addresses via libvirt API Message-ID: <1051EFB4D3A1704680C38CCAAC5836D292F01EF8(a)WPTXMAIL2.ptx.axway.int> Content-Type: text/plain; charset="iso-8859-1" Hi , Despite the fact that my Guest has an IP address , by running this piece of code on a KVM host : ifaces_count = F_virDomainInterfaceAddresses(domain, &ifaces,VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE, NULL); ifaces_count = F_virDomainInterfaceAddresses(domain, &ifaces,VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT, NULL); I'm not able to get a ifaces_count different from -1 Additionnaly : - IP Addresses are not present within the xmldesc of this Guest.(not sure that they should appear there) I'm running libvirt-1.2.17-13.el7.x86_64 Did I misunderstood something ? As ovirt manager shows the address correctly , it should be possible to get it via libvirt ... Thanks for help. J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez ? l'environnement avant d'imprimer.

2 2

[libvirt-users] centos6.5 libvirt 1.2.14 virsh hang
by 王李明 11 Jan '16

11 Jan '16

hi all： my environment is centos6.5 libvirt version is 1.2.14-1 qemu version is 1.7.0-1 I use openstack create a windows guest about two days later I run virsh list but the the process is hang virsh list can not return any thing it hang look like this： then I run /etc/init.d/libvirtd restart it show libivrtd stop faild and start failed i will use the gdb and find the gdb can not print any process stack look like this： I run /etc/init.d/libvirtd status it show libvired dead but subsys locked who can help me ? thans

2 1

[libvirt-users] operation forbidden Read Only Access
by Jean-Pierre Ribeauville 11 Jan '16

11 Jan '16

Hi, When issuing virDomainInterfaceAddresses() libvirt C language API, I got following error: libvirt: Domain Config error : operation forbidden: read only access prevents virDomainInterfaceAddresses How may I ask for a non-readonly connexion ? ( looks like to be RO by default) Thx for help. Regards, J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

2 1

[libvirt-users] Unable to retrieve Guest IP Addresses via libvirt API
by Jean-Pierre Ribeauville 11 Jan '16

11 Jan '16

Hi , Despite the fact that my Guest has an IP address , by running this piece of code on a KVM host : ifaces_count = F_virDomainInterfaceAddresses(domain, &ifaces,VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_LEASE, NULL); ifaces_count = F_virDomainInterfaceAddresses(domain, &ifaces,VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT, NULL); I'm not able to get a ifaces_count different from -1 Additionnaly : - IP Addresses are not present within the xmldesc of this Guest.(not sure that they should appear there) I'm running libvirt-1.2.17-13.el7.x86_64 Did I misunderstood something ? As ovirt manager shows the address correctly , it should be possible to get it via libvirt ... Thanks for help. J.P. Ribeauville P: +33.(0).1.47.17.20.49 . Puteaux 3 Etage 5 Bureau 4 jpribeauville(a)axway.com<mailto:jpribeauville@axway.com> http://www.axway.com<http://www.axway.com/> P Pensez à l'environnement avant d'imprimer.

3 3

[libvirt-users] "INTx fd" busy error on VM startup at boot, subsequent startup okay
by Michael Gratton 11 Jan '16

11 Jan '16

Hey all, I'm getting an error starting a libvirt managed qemu/kvm VM at physical host boot time, but manually starting it afterwards works fine. This is on a Ubuntu Wily i7-4790 box running Linux 4.2 and libvirt 1.2.16. There is a legacy (5V) PCI card being passed through to the VM, the error seems to relate to that. The error that always appears at boot in `/var/log/libvirt/qemu/test-vm.log` is: > 2016-01-11T05:29:28.487935Z qemu-system-x86_64: -device > vfio-pci,host=05:00.0,id=hostdev0,bus=pci.0,addr=0x4: vfio: Error: > Failed to setup INTx fd: Device or resource busy > 2016-01-11T05:29:28.488148Z qemu-system-x86_64: -device > vfio-pci,host=05:00.0,id=hostdev0,bus=pci.0,addr=0x4: Device > initialization failed > 2016-01-11T05:29:28.488169Z qemu-system-x86_64: -device > vfio-pci,host=05:00.0,id=hostdev0,bus=pci.0,addr=0x4: Device > 'vfio-pci' could not be initialized After the physical machine has completed booting, starting the VM via virsh or virt-manager works fine. The card is an old Firewire card. I have blacklisted the firewire modules on the physical machine so they aren't loaded, but is it possible that the kernel, udev or some other process still has access to the device when systemd starts the libvirt-bin service? Any clues greatly appreciated. Thanks, //Mike -- ⊨ Michael Gratton, Percept Wrangler. ⚙ <http://mjog.vee.net/>

1 0

[libvirt-users] libvirtd and polkit: internal error: No Unix Process ID
by Benedikt Heine 09 Jan '16

09 Jan '16

Hi all, I want to use libvirtd and polkit to create simple access restricitions for incoming TLS connections. libvirtd.conf: > ... > auth_tls = "sasl" > access_drivers = [ "polkit" ] > ... > tls_no_verify_certificate = 1 SASL and TLS in combination is already working without any faults. After activating access_drivers, the setup breaks, cause the access is denied. without polkit: > [root@inexor-test ~]# virsh --connect qemu+tls://vm0.host.b3be.de/system > Please enter your authentication name: inexor@vm0 > Please enter your password: > Welcome to virsh, the virtualization interactive terminal. > ... with polkit: > [root@inexor-test ~]# virsh --connect qemu+tls://vm0.host.b3be.de/system > Please enter your authentication name: inexor@vm0 > Please enter your password: > error: failed to connect to the hypervisor > error: access denied I deactivated any self-written polkit-rules and had been able to track down the problem to communication with libvirtd and polkit (via pkttyagent). For every incoming connection, libvirtd logs this: > Jan 04 15:12:41 vm0 libvirtd[17075]: Unable to verify TLS peer: No certificate was found. > Jan 04 15:12:41 vm0 libvirtd[17075]: Certificate check failed Unable to verify TLS peer: No certificate was found. > Jan 04 15:12:45 vm0 libvirtd[17075]: internal error: No UNIX process ID available > Jan 04 15:12:45 vm0 libvirtd[17075]: access denied > Jan 04 15:12:45 vm0 libvirtd[17075]: access denied > Jan 04 15:12:45 vm0 libvirtd[17075]: Cannot recv data: Input/output error > Jan 04 15:12:47 vm0 libvirtd[17075]: Unable to verify TLS peer: No certificate was found. Additionally, what I found: After every libvirtd-restart the unit polkit.service loggs an Registered and directly after an Unregsitered Auth Agent. > Jan 04 15:28:29 vm0 polkitd[2670]: Registered Authentication Agent for unix- process:17225:3691193 (system bus name :1.97 [/usr/bin/pkttyagent --notify-fd 4 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) > Jan 04 15:28:30 vm0 polkitd[2670]: Unregistered Authentication Agent for unix- process:17225:3691193 (system bus name :1.97, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale C) (disconnected from bus) (Correct! In the first second it registers and shortly it unregisteres again) Could someone please provide me a hint how to make libvirtd and polkit talk to each other? Sincerely, Bene polkit-version: 0.113 libvirt-version: 1.3.0 Running on Archlinux (init: systemd)

2 2

[libvirt-users] remove cdrom after installing os on a guest
by Andrei Perietanu 08 Jan '16

08 Jan '16

Hi all, I have the following issue, and I hope someone know a way to handle it. I need to grammatically need to create/install a guest OS using the libvirt API. Currently what I do: 1. create a xml with the vm configuration (this will include a path to the iso image) 2. connection.defineXML(<my_config>) 3. vm = connection.lookupByName(<domain_name>) 4. vm.create() This will create a new guest and boot the iso to install the OS. But after installation, when I restart, It again boots from the cdrom. So obviously I need remove the cdrom somehow. I could edit the xml and manually remove the cdrom, but the problem here is how do I know when to do that - i.e. how do I know if the OS has been installed or not? If I use virsh-install to create a guest with the same configuration, after the OS is installed, the cdrom is automatically removed form the guest configuration. Any help is greatly appreciated. Andrei -- The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you receive this in error please contact the sender and delete the material from any computer immediately. It is the policy of Klas Limited to disavow the sending of offensive material and should you consider that the material contained in the message is offensive you should contact the sender immediately and also your I.T. Manager. Klas Telecom Inc., a Virginia Corporation with offices at 1101 30th St. NW, Washington, DC 20007. Klas Limited (Company Number 163303) trading as Klas Telecom, an Irish Limited Liability Company, with its registered office at Fourth Floor, One Kilmainham Square, Inchicore Road, Kilmainham, Dublin 8, Ireland.

3 2

[libvirt-users] API for retrieving resource metrics from VMs?
by BYEONG-GI KIM 06 Jan '16

06 Jan '16

Hello. I'm a new getting started to learn the libvirt API. I've tried to find APIs which retrieve resource metrics such as cpu, disk, memory, and network I/O usages, but I could find few related thing; I was intended to use libvirt-Java binding first, it seems I'd be better to use the others like Python binding or C API though. The Java binding API is likely to provide very limited API list comparing with the above APIs so far. So, I'd like to know which APIs can retrieve that resources from VMs. I don't care about the language, but I really want to know whether such APIs even exists or not. As far as I know, cpu, memory, and network I/O seems being provided, but I'm not sure disk usage per VMs can be obtained via libvirt API. Thanks in advance. Best regards bgkim

5 9

[libvirt-users] Efficient live disk backup with active blockcommit : Failed 'block-commit': Could not reopen file: Permission denied
by Keyur Bhalerao 06 Jan '16

06 Jan '16

Hi , Working on the simple POC : Advanced snapshot using libvirt and qemu . Following are the exact steps which are followed . 1. Created as base VM - Ubuntu 15.10 with following libvirt and qemu versions Using library: libvirt 1.2.16 Using API: QEMU 1.2.16 Running hypervisor: QEMU 2.3.0 QEMU emulator version 2.3.0 (Debian 1:2.3+dfsg-5ubuntu9.1), Copyright (c) 2003-2008 Fabrice Bellard 2.Created nested VM (vm-01) using VirtManager on base VM. 3.Used following commands to take the multiple snapshots - virsh # list Id Name State ---------------------------------------------------- 7 vm-01 running virsh # domblklist vm-01 Target Source ------------------------------------------------ vda /home/ubuntu/vm-01.img hda /dev/sr0 snapshot-create-as --domain vm-01 snap1 --diskspec vda,file=/var/lib/libvirt/sn1.qcow2 --disk-only --atomic snapshot-create-as --domain vm-01 snap2 --diskspec vda,file=/var/lib/libvirt/sn2.qcow2 --disk-only --atomic virsh #snapshot-list vm-01 ------------------------------------------------------------ snap1 2015-12-07 11:51:51 -0800 disk-snapshot snap2 2015-12-07 11:52:28 -0800 disk-snapshot virsh # snapshot-list vm-01 --tree snap1 | +- snap2 List the current block device in use, again. It can be noticed, the new overlay 'sn2.qcow2' is the current disk in use: virsh # domblklist vm-01 Target Source ------------------------------------------------ vda /var/lib/libvirt/sn2.qcow2 hda /dev/sr0 Now that the backup is finished, perform active blockcommit by live mergning contents of sn2 into base: ubuntu@keyurubuntu:~$ virsh blockcommit vm-01 vda --active --verbose --pivot error: internal error: unable to execute QEMU command 'block-commit': Could not reopen file: Permission denied I am not sure why this is getting as permission denied. I have tried couple of times reinstalling and creating new VMs . Every time when i have tried to block-commit getting landed into same error. Is there any troubleshooting or solution to this issue. Stuck on this issue for last 2 days. Quick help much appreciated. Thanks, Keyur Bhalerao Reference used - http://wiki.libvirt.org/page/Live-disk-backup-with-active-blockcommit - http://kashyapc.com/2012/09/14/externaland-live-snapshots-with-libvirt/

3 7

[libvirt-users] Hypervisor loses network connectivity
by Phill Edwards 04 Jan '16

04 Jan '16

I have been running KVM on a CentOS 7.1 host for a few months. I have one "main" host server plus a "backup" host server. Some time ago everything was running fine on "main", but all of a sudden the server became non-contactable on it's network interface. I could no longer SSH in and therefore couldn't run virt-manager. I don't know what caused this and I had to bring all the VMs up on "backup" and they've been running OK there ever since. Over the last few days I've rebuilt "main" and again all was going well and I migrated 4 of the 5 VMs back onto it. Then this morning I came to set up the final VM on "main" which is a Sophos firewall machine with 3 NICs (I have 3 physical NICs). Nothing uses 2 of the 3 NICs except the Sophos VM. I unplugged one of the ethernet cables from "backup" and plugged it into the 3rd NIC on "main" and all of a sudden "main" froze and again all network connectivity was lost. I rebooted it but the problem still remains that it's not contactable over the network and is therefore totally non-functional. When I log in at the console and run "ip a" I can see various network interfaces including br0 with the expected IP address - so it looks like it's got network connectivity but it hasn't. Has anyone else experienced this and know why it happens and how to fix it? I don't think I fancy rebuilding everything a 3rd time as it seems likely to happen again. Depending on why it's happening I'm thinking of moving off CentOS onto Ubuntu as the host OS, or moving away from KVM altogether. Thanks in advance for any help you can give.

2 1

[libvirt-users] External snapshot warning.
by Dominique Ramaekers 03 Jan '16

03 Jan '16

Hi, If I make an external snapshot using the method of active block commit, I get these messages after the block commit: $virsh snapshot-create-as CmsrvAPP2 --name onderhoudscript --disk-only --atomic --quiesce --no-metadata Domein snapshot onderhoudscript is aangemaakt $virsh blockcommit CmsrvAPP2 vda --verbose --pivot 2016-01-03 18:14:52.784+0000: 15861: info : libvirt version: 1.2.16, package: 1.2.16-2ubuntu11.15.10.1 2016-01-03 18:14:52.784+0000: 15861: warning : virEventPollUpdateTimeout:268 : Ignoring invalid update timer -1 Successfully pivoted I've googled the 'invalid update timer -1' warning and found some messages about losing disk data after snapshot commits (using an other methode of snapshotting). I've done some tests with snapshotting, creating a file in the guest, doing the blockcommit. And I don't notice something weird. The only weird thing is: it only happens with one of the ten guests that run on the host... Should I worry about this? Greetings and thanks in advance, Dominique.

1 0