- Users - libvirt List Archives

[libvirt-users] Remote connect using virsh qemu+ssh hangs / PolicyKit issue
by Trey Dockendorf 20 Sep '11

20 Sep '11

I'm attempting to remote connect to my KVM instance using virsh, but all the commands hang. When issuing the below command, nothing on the remote system happens, and no errors are displayed, (hostname changed) $ virsh --debug 5 --log /var/lib/foreman/virsh.log -c qemu+ssh://foreman@kvmhost.tld:16509/system?no_tty=1 This is the uncommented lines in /etc/libvirt/libvirtd.conf ---------- listen_tls = 0 listen_tcp = 1 listen_addr = "<omitted, set to management NIC>" log_level = 1 log_filters="1:remote 1:event 1:qemu" log_outputs="1:syslog:libvirtd 1:file:/var/log/libvirt/libvirtd.log" This is the only debug output I get in /var/log/libvirt/libvirtd.log during the remote connection attempt ----------- 17:56:04.579: debug : virEventRunOnce:595 : Poll got 1 event 17:56:04.580: debug : virEventDispatchTimeouts:405 : Dispatch 3 17:56:04.580: debug : virEventDispatchHandles:450 : Dispatch 10 17:56:04.580: debug : virEventDispatchHandles:464 : i=0 w=1 17:56:04.580: debug : virEventDispatchHandles:464 : i=1 w=2 17:56:04.580: debug : virEventDispatchHandles:464 : i=2 w=3 17:56:04.580: debug : virEventDispatchHandles:464 : i=3 w=4 17:56:04.580: debug : virEventDispatchHandles:464 : i=4 w=5 17:56:04.580: debug : virEventDispatchHandles:464 : i=5 w=6 17:56:04.580: debug : virEventDispatchHandles:464 : i=6 w=7 17:56:04.580: debug : virEventDispatchHandles:464 : i=7 w=8 17:56:04.580: debug : virEventDispatchHandles:477 : Dispatch n=7 f=13 w=8 e=1 0x1629640 17:56:04.580: debug : virEventAddHandleImpl:113 : Add handle fd=20 events=1 cb=0x4196e0 opaque=0x1629640 17:56:04.580: debug : virEventInterruptLocked:664 : Skip interrupt, 1 -1447459072 17:56:04.580: debug : virEventDispatchHandles:464 : i=8 w=9 17:56:04.580: debug : virEventDispatchHandles:464 : i=9 w=10 17:56:04.580: debug : virEventCleanupTimeouts:495 : Cleanup 3 17:56:04.580: debug : virEventCleanupHandles:536 : Cleanupo 11 17:56:04.580: debug : virEventCleanupTimeouts:495 : Cleanup 3 17:56:04.580: debug : virEventCleanupHandles:536 : Cleanupo 11 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=0 w=1, f=5 e=1 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=1 w=2, f=7 e=1 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=2 w=3, f=14 e=1 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=3 w=4, f=15 e=1 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=4 w=5, f=17 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=5 w=6, f=18 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=6 w=7, f=19 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=7 w=8, f=13 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=8 w=9, f=12 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=9 w=10, f=11 e=25 17:56:04.580: debug : virEventMakePollFDs:373 : Prepare n=10 w=15, f=20 e=1 17:56:04.580: debug : virEventCalculateTimeout:314 : Calculate expiry of 3 timers 17:56:04.580: debug : virEventCalculateTimeout:344 : Timeout at 0 due in -1 ms 17:56:04.580: debug : virEventRunOnce:593 : Poll on 11 handles 0x7f35a4001240 timeout -1 I've already opened up the firewall for port 16509, and allowed the user foreman (member of libvirt_admin) to manage libvirt via PolicyKit Relevant line in iptables, 5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:16509 /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla ----------- [libvirt Remote Access] Identity=unix-group:libvirt_admin Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes Originally I had created the file /etc/polkit-1/localauthority/50-local.d/51-libvirt-foreman-remote-access.pkla with contents below, and had the file 50-libvirt-remote-access.pkla only allowing a single user. /etc/polkit-1/localauthority/50-local.d/51-libvirt-foreman-remote-access.pkla ---------- [libvirt Foreman Remote Access] Identity=unix-user:foreman Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes However I wasn't able to connect to libvirt on the host itself, and the logs indicated it was a PolicyKit block, so my second problem/question...Is it possible to have multiple local PolicyKit *.pkla files or can only one exist? From the documentation here, http://wiki.libvirt.org/page/SSHPolicyKitSetup, it seems like so long as the names are unique then multiple would be allowed. Reason that's key is I'm using Puppet and will have multiple servers/applications needing access and being restricted to a single file to manage will be a problem. Connecting locally with a specific pkla for "foreman"... ----------- $ virsh -c qemu:///system error: authentication failed error: failed to connect to the hypervisor /var/log/libvirt/libvirtd.log --------- 17:50:06.102: debug : virRunWithHook:914 : Command stderr: Not authorized. 17:50:06.103: error : remoteDispatchAuthPolkit:3810 : Policy kit denied action org.libvirt.unix.manage from pid 29640, uid 503, result: 256 Thanks - Trey

1 0

[libvirt-users] libvirt does not recognize all devices in iscsi and mpath pools in a predictable manner
by Guido Winkelmann 19 Sep '11

19 Sep '11

Hi, I'm using libvirt 0.8.3 on Fedora 14 (as I wrote earlier, I'm having some trouble updating to the newest version), and I'm having problems getting iscsi and mpath storage pools to work in a usable and consistent manner. I have two storage pools defined on the host machine, one for raw iscsi- devices and one for those same iscsi devices device-mapped by multipath. They look like this: <pool type='iscsi'> <name>iscsi01</name> <source> <host name='10.3.1.15'/> <device path='iqn.1984-05.com.dell:powervault.md3200i.6782bcb0000859f3000000004d3eec7d'/> </source> <target> <path>/dev/disk/by-id</path> </target> </pool> and: <pool type="mpath"> <name>mpath01</name> <target> <path>/dev/mapper</path> </target> </pool> I chose <path>/dev/disk/by-id</path> over /dev/disk/by-path for the iscsi pool because I need to be able to migrate running virtual machines to other hosts, so the actual device paths for the disks need to be the same on all hosts in the cluster. I have two LUNs configured in the iSCSI array, and when I list the volumes in the iscsi pool, I get this: virsh # vol-list iscsi01 Name Pfad ----------------------------------------- 23.0.0.1 /dev/disk/by-id/wwn-0x6782bcb0000859f3000007004e680190 23.0.0.2 /dev/disk/by-id/scsi-36782bcb0000859f3000007294e6e73f2 Apparently, for some weird reason, libvirt chooses one naming scheme for one of the volumes and another for the other one. This a problem for me for two reasons. 1 - Once I create a new lun for a new VM, rescan the iscsi bus and refresh libvirt's pool (see my mail from 24th of August on this list), I need to be able to automatically and reliably identify the corresponding new volumes in libvirt's volume list, so I can initialize them by copying an OS image onto them and then assign them to the new virtual machine. This is made a lot harder if libvirt randomly switches between naming schemes - though still feasible if I'm aware of the problem. 2 - I need to be able to migrate running VMs to a different host machine, in case the current one is overloaded or in need of maintenance. This is bound to be problematic if the storage volumes go by different path names on the different hosts. Both LUNs do appear under both naming schemes under /dev/disk/by-id: ls /dev/disk/by-id/ [...] scsi-36782bcb0000859f3000007004e680190 [...] scsi-36782bcb0000859f3000007294e6e73f2 scsi-36a4badb00b0f910012e0fccb07606fe6 [...] wwn-0x6782bcb0000859f3000007004e680190 [...] wwn-0x6782bcb0000859f3000007294e6e73f2 wwn-0x6a4badb00b0f910012e0fccb07606fe6 [...] (snipped some irrelevant parts) With the mpath pool, it's even worse: One of the two volumes is completely missing: virsh # vol-list mpath01 Name Pfad ----------------------------------------- dm-3 /dev/mapper/36782bcb0000859f3000007004e680190 Both iscsi volumes have in fact been picked up by multipathd and do appear in /dev/mapper/, too, but no matter how often I say refresh-pool mpath01, it will always only show the one volume. Does anybody know of these problems or how to work around them? Are these problems solved in newer versions? (I could not find anyhting in the bugtracker...) Guido

2 2

[libvirt-users] Config Errro when Creating a virtual device attachment to backend
by huachao yao 15 Sep '11

15 Sep '11

Hi, buddy, I want to create a virtual device attachment to backend. The domain is running, and my code phase is as below: xmlConfiguration = "<devices><sound model='es1370'/></devices>"; virDomainAttachDevice(dom,xmlConfiguration); But the exception "libvir: Domain Config error : XML error: unknown device type " happen when running. Is it something wrong in the XML configuration? What should i do to deal with such Config error ? ps: the hypervisor is KVM.

2 1

Re: [libvirt-users] Libvirt daemon usage question
by Eric Blake 15 Sep '11

15 Sep '11

[let's keep the list in the loop] On 09/14/2011 04:07 PM, Trey Dockendorf wrote: >> Given your original qeustion, if your management apps really do require > 0.8.8 APIs, then you'll need to upgrade libvirtd on your CentOS host to be > at least 0.8.8 in order to honor your management app requests, or else > modify your management app to gracefully implement fallbacks to older API > approaches that were available in 0.8.1. >> > > How risky is it to implement a newer version of libvirt in something like > centos? I figure based on the huge number of dependencies that its not > something to safely do. So far we building my libvirt rpms Ive only used > the same source for the version with centos and the libvirt specs provided > in the fedora src rpms. Do the specs know to check for specific versions of > dependencies? There's not that many source dependencies for building a newer libvirt out-of-the-box on top of CentOS. You might also find https://fedoraproject.org/wiki/Virtualization_Preview_Repository as a useful example for the amount of effort involved in running newer virt tools on top of an otherwise stable repository. Also, search the list archives; the topic of installing the latest libvirt on CentOS or RHEL 5 has come up several times recently, with various tidbits of good advice. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

2 1

[libvirt-users] Libvirt daemon usage question
by Trey Dockendorf 14 Sep '11

14 Sep '11

I could use some help with clarification on the use of the libvirtd daemon with regards to managing remote KVM instances. Right now I have a CentOS 6 KVM server (libvirt-0.8.1), but would like to use some management applications that require higher version (0.8.8). First, is it possible to run the libvirtd daemon from within a VM, or does it require active kvm kernel module? Secondly, could a daemon running in say Fedora 15 (0.8.8) be used to communicate with my CentOS 6 daemon (0.8.1). Does this sort of model present a problem if the KVM host is not using the same or close to the same version as the remote libvirtd? My understanding of how to use libvirtd remotely is a bit weak, so any clarification would be greatly appreciated. Thanks - Trey

2 1

[libvirt-users] How to install libvirt 0.9.4 RPM on Fedora 14?
by Guido Winkelmann 14 Sep '11

14 Sep '11

Hi, I'm trying to install the newest version of libvirt and libvirt-client from the rpms at ftp://libvirt.org/libvirt/ on a Fedora 14 machine. The naming of the rpms as "libvirt-0.9.4-1.fc14.x86_64.rpm" suggests that this is exactly the system this was made for, however, installation still does not go smoothly. When I try to install these packages with yum install libvirt-client-0.9.4-1.fc14.x86_64.rpm \ libvirt-0.9.4-1.fc14.x86_64.rpm , some of the dependencies get resolved automatically, but not all of them, and I get these error messages: Error: Package: libvirt-0.9.4-1.fc14.x86_64 (/libvirt-0.9.4-1.fc14.x86_64) Requires: libblktapctl.so.1.0()(64bit) Error: Package: libvirt-client-0.9.4-1.fc14.x86_64 (/libvirt- client-0.9.4-1.fc14.x86_64) Requires: libnetcf.so.1(NETCF_1.4.0)(64bit) Error: Package: libvirt-0.9.4-1.fc14.x86_64 (/libvirt-0.9.4-1.fc14.x86_64) Requires: libnetcf.so.1(NETCF_1.4.0)(64bit) Apparently, I need newer versions of netcf-libs and xen-libs. Where do I get these from? There don't appear to be any official rpms or that for Fedora 14... Regards, Guido

3 3

[libvirt-users] using virsh (or something) to convert from KVM domain XML to vmx...
by Frank Hauptle 14 Sep '11

14 Sep '11

HI folks, For reasons I'd rather not go into (not my choice) we are moving our current virtual servers at the uni here, (using KVM and libvirt) to outsourced vmware ESX and vcenter. I really don't want to use the Vcenter Converter to create running esx vm's from within the KVM VM's as I feel that doing it within the client VM is inefficient and slow. Thus far however, I've not found anything that gives me any other alternatives. I thought perhaps the domxml-to-native virsh function demo'd at http://libvirt.org/drvesx.html#xmlexport would be the go, but that appears to be just a way to change from libvirt managed esx to native vmx. Converting the KVM raw img files to vmdk has been easy, converting the KVM domain XML to vmx appears to be impossible unless you do it by hand. Have I missed some cool/feature that would do this? Apologies if I'm going about this all wrong, What I know about vmware, I could write on the head of a pin with a felt tip pen.. kindest regards Frank UWA

1 0

[libvirt-users] cpu time totals
by Igor Serebryany 13 Sep '11

13 Sep '11

Hi! I'm comparing the cpu usage of a VM from virDomainGetInfo and the usages returned per-vcpu from virDomainGetVcpus and the totals do not match up. I expect that the cpu usages reported per-vcpu, when summed, should equal the total cpu usage of the domain, but there is quite a large gap between them. Is there something I'm missing? See this example code using the python bindings: >>> import libvirt >>> c = libvirt.open('qemu:///system') >>> d = c.lookupByID(51) >>> d.info()[4] 111390000000L >>> d.vcpus()[0] [(0, 1, 12720000000L, 1), (1, 1, 2980000000L, 0), (2, 1, 3150000000L, 1), (3, 1, 2600000000L, 0)] >>> sum([vcpu[2] for vcpu in d.vcpus()[0]]) 21520000000L >>> d.info()[4] - sum([vcpu[2] for vcpu in d.vcpus()[0]]) 91760000000L Why is this additional 91 seconds not reflected in time spent by the vcpus? What exactly is the meaning of the cpuTime parameter of the virVcpuInfo struct? Thanks, --Igor

2 1

[libvirt-users] Reg: Difference between chroot & pivot_root
by Alphonse Hansel Anthony 13 Sep '11

13 Sep '11

Hi, What is the difference between chroot & pivot_root. They don't seem obvious based on the man pages apart from the below mentioned caveats. 1) Inherited Open file descriptors, have to be explicitly closed. 2) Does not change CWD of the process, which can be overcome by doing a chdir before & after chroot call. Any information on this would be useful. Thanks, Alphonse

3 4

[libvirt-users] Reg: VETH Device pair creation using iproute2.
by Alphonse Hansel Anthony 13 Sep '11

13 Sep '11

Hi, While using libvirt to start a LXC, I am facing an error related to NETNS, specifically related to the VETH device pair creation. The code related to this is present in libvirt/src/lxc/veth.c # ip link add veth0 type veth peer name veth1 Garbage instead of arguments "peer ...". Try "ip link help". # ip -V ip utility, iproute2-ss110629 # uname -r 2.6.32.39 # The devices "veth0" & "veth1" does not exist in /sys/class/net/ But the same command works with iproute2-ss100519 (older version). Is this a known issue in the latest version or am I doing something wrong? Any info in this regard would be useful. -Alphonse

1 0