March 2016 - Users - libvirt List Archives

[libvirt-users] VM's in a HA-configuration - synchronising vm config files
by Lentes, Bernd 02 Mar '16

02 Mar '16

Hi, i'd like to establish a HA-Cluster with two nodes. My services will run inside vm's, the vm's are stored on a FC SAN, so every host has access to the vm's. But how can i keep the config files (xml-files under /etc/libvirt/qemu) synchronised ? Is there a possibility to store the config files somewhere else ? E.g. a partitition with ocfs2 on the SAN ? If not, what would you do ? Otherweise i'm thinking of a cron-job who synchronises the file each minute with rsync. Bernd -- Bernd Lentes Systemadministration institute of developmental genetics Gebäude 35.34 - Raum 208 HelmholtzZentrum München bernd.lentes(a)helmholtz-muenchen.de phone: +49 (0)89 3187 1241 fax: +49 (0)89 3187 2294 Wer Visionen hat soll zum Hausarzt gehen Helmut Schmidt Helmholtz Zentrum Muenchen Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH) Ingolstaedter Landstr. 1 85764 Neuherberg www.helmholtz-muenchen.de Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Dr. Alfons Enhsen, Renate Schlusen (komm.) Registergericht: Amtsgericht Muenchen HRB 6466 USt-IdNr: DE 129521671

3 4

[libvirt-users] which is the config file for a vm ?
by Lentes, Bernd 02 Mar '16

02 Mar '16

Hi, i have a weird problem. I have a vm (KVM) which seems to run fine. I believe the respective config file for this vm is /etc/libvirt/qemu/MausDB.xml. This is it: ========================================================= <domain type='kvm'> <name>MausDB</name> <uuid>d4c7956c-b57f-967a-0454-99835a3a740b</uuid> <memory unit='KiB'>2353792</memory> <currentMemory unit='KiB'>2353792</currentMemory> <vcpu placement='static'>2</vcpu> <os> <type arch='x86_64' machine='pc-i440fx-1.4'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-kvm</emulator> <disk type='file' device='disk'> <driver name='qemu' type='raw'/> <source file='/var/lib/kvm/images/MausDB/disk0.raw'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hda' bus='ide'/> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <controller type='pci' index='0' model='pci-root'/> <controller type='ide' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> </controller> <interface type='bridge'> <mac address='52:54:00:37:92:03'/> <source bridge='br0'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='vnc' port='-1' autoport='yes'/> <video> <model type='cirrus' vram='9216' heads='1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </memballoon> </devices> </domain> ============================================================= As you see, the vm has one NIC. Its MAC-Address is: '52:54:00:37:92:03'. I also see that MAC when i edit the config via virsh. But when i boot that vm, it has a nic with another MAC: '52:54:00:37:92:B2' ??? lspci shows me just one nic in the vm. This MAC-Address is also visible in the Virtual Machine Manager. Pictures you find here: https://hmgubox.helmholtz-muenchen.de:8001/d/51feb02c02/ I thought the xml-file in /etc/libvirt/qemu ist the only responsable one. It is that one which is configured when i issue a 'edit domain' in virsh. Or ? Where does the VMM stores the configuration of the domains ? I found another xml: /var/run/libvirt/qemu/MausDB.xml . Inside it there is the MAC the booted vm has. What is the purpose of this xml ? Also ps inside the host shows the MAC which is in the booted vm: root 28237 4.8 2.4 2886084 2416116 ? Sl Feb29 55:16 /usr/bin/qemu-kvm -name MausDB -S -machine pc-i440fx-1.4,accel=kvm,usb=off -m 2299 -smp 2,sockets=2,cores=1,threads=1 -uuid d4c7956c-b57f-967a-0454-99835a3a740b -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/MausDB.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -boot strict=on -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/var/lib/kvm/images/MausDB/disk0.raw,if=none,id=drive-virtio-disk0,format=raw -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x4,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive if=none,id=drive-ide0-0-0,readonly=on,format=raw -device ide-cd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -netdev tap,fd=22,id=hostnet0,vhost=on,vhostfd=23 -device virtio-net-pci,netdev=hostnet0,id=net0, mac=52:54:00:37:92:b2,bus=pci.0,addr=0x3 -vnc 127.0.0.1:0 -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x5 Can anyone help sorting this out ? Bernd -- Bernd Lentes Systemadministration institute of developmental genetics Gebäude 35.34 - Raum 208 HelmholtzZentrum München bernd.lentes(a)helmholtz-muenchen.de phone: +49 (0)89 3187 1241 fax: +49 (0)89 3187 2294 Wer Visionen hat soll zum Hausarzt gehen Helmut Schmidt Helmholtz Zentrum Muenchen Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH) Ingolstaedter Landstr. 1 85764 Neuherberg www.helmholtz-muenchen.de Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Dr. Alfons Enhsen, Renate Schlusen (komm.) Registergericht: Amtsgericht Muenchen HRB 6466 USt-IdNr: DE 129521671

3 3

[libvirt-users] Insert iptables rules with network hook
by Dieter Späth 01 Mar '16

01 Mar '16

Hi, I want to add iptables rules between existing rules and the rules created by libvirt (forward type=nat). I did try the hook /etc/libvirt/hooks/network network_name start begin - and /etc/libvirt/hooks/network network_name started begin - It seems like the libvirt iptables rules are already inserted when this hook is executed. Simply use I instead of A does not work either because the rules should be inserted between the existing one and the libvirt rules. Also the custom rules should be deleted after the hoook /etc/libvirt/hooks/network network_name stopped end - is executed. Does a hook exists which is executed after the network is started but before the libvirt rules are inserted? Is it possible the use a custom chain for the libvirt iptables rules instead of directly writing them into the INPUT chain? I think of some thing like INPUT VIRT_VIBR0 all -- * virbr0 0.0.0.0/0 0.0.0.0/0 VIRT_VIBR0 all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 and VIRT_VIBR0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable thanks & regards dieter

1 0

[libvirt-users] nwfilter : iptables rules not working
by jf grunt 01 Mar '16

01 Mar '16

Hi, I contact you as i have difficulties to use nwfilter with KVM host. I want to implemente flow filtering between my Linux guests. I created the following filter : cat admin-dmz-internet.xml <filter name='admin-dmz-internet'>   <filterref filter='clean-traffic' />  <rule action='accept' direction='in'> <tcp dstportstart='22'/> </rule>  <rule action='accept' direction='out'> <tcp dstipaddr='192.168.150.50' dstportstart='22' /> </rule>  <rule action='drop' direction='inout'> <all/> </rule> </filter> then i define it : irsh nwfilter-define admin-dmz-internet.xml Filtre réseau admin-dmz-internet défini depuis admin-dmz-internet.xml The filters are defined : virsh nwfilter-list UUID Nom ------------------------------------------------------------------ 4ae1f709-4767-4148-9b02-9065da3d8d8a admin-dmz-internet 7d32639b-5e6e-4dfe-b07b-e798bbd89adb allow-arp I then assigned the filter to mv VM : <interface type='network'> <mac address='52:54:00:36:7d:99'/> <source network='adm-from-net'/> <ip address='192.168.130.229' family='ipv4'/> <model type='virtio'/> <filterref filter='admin-dmz-internet'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> and restart libvirtd and start the VM systemctl restart libvirtd virsh start externeSSH Howerver the filter don"t work, i can do allow flow that i want.... :( To debug i looked at the iptables rules. We see that no packet go to the rules for the filter : Chain FI-vnet0 (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22 ctstate ESTABLISHED ctdir REPLY 0 0 RETURN tcp -- * * 0.0.0.0/0 192.168.150.50 tcp dpt:22 ctstate NEW,ESTABLISHED ctdir ORIGINAL 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FO-vnet0 (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,ESTABLISHED ctdir ORIGINAL 0 0 ACCEPT tcp -- * * 192.168.150.50 0.0.0.0/0 tcp spt:22 ctstate ESTABLISHED ctdir REPLY 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain HI-vnet0 (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22 ctstate ESTABLISHED ctdir REPLY 0 0 RETURN tcp -- * * 0.0.0.0/0 192.168.150.50 tcp dpt:22 ctstate NEW,ESTABLISHED ctdir ORIGINAL 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain libvirt-host-in (1 references) pkts bytes target prot opt in out source destination 0 0 HI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in (1 references) pkts bytes target prot opt in out source destination 0 0 FI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in-post (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 Chain libvirt-out (1 references) pkts bytes target prot opt in out source destination 0 0 FO-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 --physdev-is-bridged How can i make the rules work? I am under Centos 7 and the libvirtd is as is : rpm -qa | grep libvirt libvirt-daemon-kvm-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-config-network-1.2.17-13.el7_2.3.x86_64 libvirt-python-1.2.17-2.el7.x86_64 libvirt-client-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-network-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-secret-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-nodedev-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-qemu-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-storage-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-config-nwfilter-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-interface-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-lxc-1.2.17-13.el7_2.3.x86_64 libvirt-daemon-driver-nwfilter-1.2.17-13.el7_2.3.x86_64 libvirt-1.2.17-13.el7_2.3.x86_64 Thanks in advance for your help. Regards, JF

1 0

[libvirt-users] libvirt-ext transport
by Nidhi D 01 Mar '16

01 Mar '16

I cannot find any documentation regarding usage of ext mode of transport for VM Migration in libvirt. Can anyone give me ideas? Nidhi

1 0