- Users - libvirt List Archives

[libvirt-users] Easy solution for custom firewall rules- is it possible?
by Joshua Kramer 04 Jun '19

04 Jun '19

Hello All- I've looked in several places and haven't found an answer to this question: is it possible to have libvirt add custom rules to iptables for virtual network interfaces? I took a look at the "Firewall and Network Filtering in Libvirt" page and it seems overly complicated for what I want to do. Given an interface virbr2 and its network 192.168.4.0/24, libvirt installs the following rules in iptables. Essentially, these rules will drop any packets for the interface virbr2 where the source or destination is not on the 192.168.4.0/24 network. -P FORWARD ACCEPT -A FORWARD -d 192.168.4.0/24 -o virbr2 -j ACCEPT -A FORWARD -s 192.168.4.0/24 -i virbr2 -j ACCEPT -A FORWARD -i virbr2 -o virbr2 -j ACCEPT -A FORWARD -o virbr2 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr2 -j REJECT --reject-with icmp-port-unreachable I have a VPN server on the 4/24 network- and it hands out addresses in the 8/24 network. So I would like libvirt to also create the following rules in iptables: -A FORWARD -d 192.168.8.0/24 -o virbr2 -j ACCEPT -A FORWARD -s 192.168.8.0/24 -i virbr2 -j ACCEPT I've tried creating direct rules in firewalld for the FORWARD_direct chain. Firewalld happily creates those rules, but they are never reached, because they fall AFTER the libvirt rules. I've also tried creating an IP address on the virbr2 interface in the 8/24 network, but that doesn't work either. How can I get this done? Thanks!! -JK

3 2

[libvirt-users] logging of domains
by Lentes, Bernd 30 May '19

30 May '19

Hi, recently i had some domains stopped without any obvious reason for me. Unfortunately i didn't find the cause. I'd like to log information about the domains that i have more information the next time this will happen. In /etc/libvirt/libvirtd.conf i have: log_level = 3 log_outputs="3:file:/var/log/libvirt/libvirtd.log" which creates enormous log files, but with logrotate and xz i can manage that. But i think this is just related to libvirtd. The logs for the domains under /var/log/libvirt/qemu are poor and very small, nearly no information. Is there a way to be more verbose with the domains so that i may find helpful information in these logs when the domains stop for the next time ? Thanks. Bernd -- Bernd Lentes Systemadministration Institut für Entwicklungsgenetik Gebäude 35.34 - Raum 208 HelmholtzZentrum münchen bernd.lentes(a)helmholtz-muenchen.de phone: +49 89 3187 1241 phone: +49 89 3187 3827 fax: +49 89 3187 2294 http://www.helmholtz-muenchen.de/idg wer Fehler macht kann etwas lernen wer nichts macht kann auch nichts lernen Helmholtz Zentrum Muenchen Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH) Ingolstaedter Landstr. 1 85764 Neuherberg www.helmholtz-muenchen.de Stellv. Aufsichtsratsvorsitzender: MinDirig. Dr. Manfred Wolter Geschaeftsfuehrung: Prof. Dr. med. Dr. h.c. Matthias Tschoep, Heinrich Bassler, Kerstin Guenther Registergericht: Amtsgericht Muenchen HRB 6466 USt-IdNr: DE 129521671

2 1

[libvirt-users] libvirt blkiotune mechanism
by Maksym Isaiev 30 May '19

30 May '19

Hello! We are using oVirt in our infrastructure, which uses libvirt as backend. Last time we needed to activate storage QoS aka libvirt blkiotune parameters. So some questions appeared about how libvirt limitation mechanism works: 1. What happened to overlimit storage traffic in small time period after we apply blkiotune parameters on high loaded virtual machine on fly: a) All over-limit traffic pulled into some queue, where all disk transactions can be successfully finished with QoS throughput? b) All over-limitation data dropped and opened transactions state became failed? c) All active transactions finishes on speed beyond blkiotune parameters limit, but all new transactions immediately are limited based on configured limits? Thanks in advance!

1 0

[libvirt-users] Snapshot of single block device
by jarek 29 May '19

29 May '19

Hello! I have a guest with one qcow2 disk image (vda) and one physical partition (sda) from host. When I'm trying to get snapshot with: virsh snapshot-create-as ..... It fails with message: error: unsupported configuration: source for disk 'sda' is not a regular file; refusing to generate external snapshot name I understand, that it is not possible to make a snapshot of physical device, but it is enough for me to take snapshot of vda. How to force virsh to ignore sda ? best regards Jarek

2 3

[libvirt-users] [Libvirt failed to claim Virtual Functions on hostdev network after VM reboot]
by Fuzail Ahmad 29 May '19

29 May '19

Problem Statement: Libvirt failed to claim Virtual Functions on hostdev network after VM reboot. Version-Release number of selected component (if applicable): libvirtd (libvirt) 2.0.0 kernel-4.1.12-112.16.4.el7uek.x86_64 Reproducible: Not always Description: I am doing a reboot of Virtual machines and sometimes one of the VM does not start and fail with the following error In total I have spun 3 VMs out of which 2 gets started and 1 of them fail with the below error. [root@sriov2 ~]# virsh start VM3 error: Failed to attach interface error: internal error: network 'hostnet' requires exclusive access to interfaces, but none are available [root@sriov2 ~]# virsh net-dumpxml hostnet <network connections='2'> <name>hostnet</name> <uuid>c1fb4ead-21b8-4d69-8ad9-669c55b3dfc7</uuid> <forward mode='hostdev' managed='yes'> <address type='pci' domain='0x0000' bus='0x0f' slot='0x10' function='0x0'/> <address type='pci' domain='0x0000' bus='0x0f' slot='0x10' function='0x2'/> </forward> </network> However, "ip link show" command shows 8 VFs in total. # ip link show ens2 ens2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP mode DEFAULT qlen 1000 link/ether 00:0a:f7:d5:a7:50 brd ff:ff:ff:ff:ff:ff vf 0 MAC 52:54:00:6d:7c:a0, spoof checking off, link-state auto vf 1 MAC 52:54:00:44:c9:b6, spoof checking off, link-state auto vf 2 MAC 52:54:00:30:7a:86, spoof checking off, link-state auto vf 3 MAC c6:9a:1b:82:90:ea, spoof checking off, link-state auto vf 4 MAC 46:db:e2:33:c7:a4, spoof checking off, link-state auto vf 5 MAC 76:65:e1:f7:82:78, spoof checking off, link-state auto vf 6 MAC 8e:a0:8b:e5:1a:66, spoof checking off, link-state auto vf 7 MAC ba:f4:83:19:80:bf, spoof checking off, link-state auto # Please, letme know if I need to attach any additional information. Regards Fuzail

3 2

[libvirt-users] libvirtd not starting
by Lothar Schilling 22 May '19

22 May '19

Hi everybody, I've set up an new CentOS 7.6.1810 server. Then, via yum I installed qemu-kvm libvirt libvirt-python libguestfs-tools virt-install. There were no problems. But when I try to systemctl start libvirtd I get the following message: "libvirtd: process 472: arguments to dbus_message_iter_append_basic() were incorrect, assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in file ../../dbus/dbus-message.c line 2754." Starting libvirtd manually just by issuing the command "libvirtd" without any further arguments is working, though. I do not have the slightest idea what is going on, especially as I didn't change anything about the config files. Any help would be appreciated, thank you Lothar Schilling

3 8

[libvirt-users] VM bootup got failed with systemd/dbus error messages
by PRIYANKA M A 22 May '19

22 May '19

We are having one server machine (ubuntu 16.04 OS) with 10 VMs. When the server is rebooted, some VMs got failed to boot with systemd/dbus error messages. Rebooting the affected VMs resolves this issue. Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.DisplayManager': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.NetworkManager': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.login1': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.Accounts': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.Avahi': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to NameOwnerChanged signal for 'org.freedesktop.ModemManager1': Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to subscribe to activation signal: Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to register name: Connection timed out Jan 30 20:40:02 VM systemd[1]: Failed to set up API bus: Connection timed out an 30 20:40:32 VM dbus[1009]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out Jan 30 20:40:32 VM systemd-logind[998]: Failed to enable subscription: Failed to activate service 'org.freedesktop.systemd1': timed out Jan 30 20:40:32 VM systemd-logind[998]: Failed to fully start up daemon: Connection timed out Host machine specifications:- OS : Ubuntu 16.04 Kernel : 4.15.0-47-generic CPUs : 48 ( 2*12*2) RAM : 64G VM specifications:- OS : Ubuntu 16.04 Kernel : 4.13.16 CPUs : 8 RAM : 4G Attached the full log file. Kindly help us to resolve this issue with a permanent fix. *With Best Regards,* M A PRIYANKA VVDN Technologies Pvt Ltd *Cell : * +91 8489574081 | *Skype :* priyankamathavan27 -- _Disclaimer: _© 2019 VVDN Technologies Pvt. Ltd. This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful.__

1 0

[libvirt-users] GVT-g - suboptimal user experience
by Alex Ivanov 20 May '19

20 May '19

Hi. In the current state of gvt-g the user experience is suboptimal. So my question is what are the ETAs for following features: 1. Accelerated virt-manager console using gvt-g device 2. Custom resolutions or dynamic resolution 3. UEFI VMs support (Windows guest) Thanks.

4 6

[libvirt-users] virtio-user intarfece
by Avi Cohen 19 May '19

19 May '19

Hello all i have multiple workload containers connected to my DPDK-app. I have another special container - which all packets are mirrored to it. Is it possible for zero-copy reason - that all virtio interfaces shared memory between my DPDK-app and workload containers - can be accessed by this special container ? it means that for every workload container X this is a shared memory between the:

1 1

Re: [libvirt-users] [libvirt] surprising <backingStore type='file'> setting in domain.xml
by Thomas Stein 17 May '19

17 May '19

(switched to libvirt-users as it seems to be more appropriate) On 2019-05-16 23:02, Eric Blake wrote: > On 5/16/19 10:20 AM, Thomas Stein wrote: >> Hello all. >> >> My currently used versions: libvirt-5.2.0 and qemu-4.0.0. >> >> Here is my problem. I'm struggeling since a few weeks with a strange >> behaviour by either qemu or libvirt. After a reboot of >> the hardware node the $domain.xml contains suddenly a backingStore >> setting which was not there before reboot. >> Something like that: >> >> <devices> >> <emulator>/usr/bin/qemu-system-x86_64</emulator> >> <disk type='file' device='disk'> >> <driver name='qemu' type='qcow2'/> >> <source >> file='/var/lib/libvirt/shinymail/shinymail_weekly.qcow2-2019-05-15'/> >> <backingStore type='file'> >> <format type='qcow2'/> >> <source file='/var/lib/libvirt/images/shinymail.qcow2'/> > > Yes, this matches: > >> </backingStore> >> <target dev='vda' bus='virtio'/> >> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' >> function='0x0'/> >> </disk> >> ... >> >> This obviousely happens after a backup has been running. The Backup >> Script looks like this: >> >> <snip> >> virsh snapshot-create-as --domain shinymail weekly --diskspec >> vda,file=/var/lib/libvirt/shinymail/shinymail_weekly.qcow2-$(date >> +%Y-%m-%d) --disk-only --atomic --no-metadata > > the effects of this command. > > Ultimately, I'm TRYING to get my new 'virsh domain-backup' command > integrated into the next libvirt release, which has the advantage of > performing a backup WITHOUT having to modify the <domain> XML. But > until > that happens, any time you use 'virsh snapshot-create-as' as part of a > sequence for performing backups, you ARE modifying the <domain> XML, > and > if you want to revert to the external backup, or if... Cool. Will it be in 5.4.0 already? >> >> cp ... >> >> virsh blockcommit shinymail vda --active --verbose --pivot >> <snip> > > ...blockcommit fails for whatever reason to undo the effects of > 'snapshot-create-as' in creating a temporary overlay, then yes, you do > have to worry about the temporary overlay being in the way, where > you'll > have to manually edit the <domain> definition to match the actual disk > layouts you really want. So you're saying blockcommit fails me somehow? What i'm asking myself is, why does this problem suddenly appear. It worked literally for years this way. thanks for your answer Eric. cheers t. >> >> So after that "dmblklist shinymail" does show the right source file >> but >> after a reboot it tries to use the weekly snapshot >> again which leads to filesystem errors. >> >> Someone has an idea what could cause such a behaviour? >>

1 0