- Users - libvirt List Archives

Re: [libvirt-users] disable libvirt-nwfilter
by Michal Privoznik 07 May '19

07 May '19

[Please keep the list CC-ed as it may help somebody from future when searching for solution to the same problem] On 5/6/19 6:08 PM, nakata(a)geekpit.org wrote: > Am 2019-05-06 16:26, schrieb Michal Privoznik: >> On 5/6/19 3:44 PM, nakata(a)geekpit.org wrote: >>> Hi, >>> >>> i want to disable the nwfilter functionality of libvirt. >>> It's surely nice for some people, nevertheless i don't want libvirt >>> to alter any netfilter rules, neither i want the according >>> functionality even available. >> >> It's not only NWFilter that will inject firewall rules. Depending on >> configuration it might also be the default network. >> >>> I know about nwfilter-undefine, but what i'm looking for is an option >>> to globally disable this functionality at all. Some config flag or >>> similar. >>> How can i achieve that? >> >> Unless you have a domain <interface/> defined so that it uses a >> nwfilter then no firwall rules are added by nwfilter code. >> >> If you still want to remove nwfilter module then just uninstall it, >> e.g. via: >> >> dnf remove libvirt-daemon-driver-nwfilter libvirt-daemon-config-nwfilter >> >> Michal > > Hi, > > me again. > Another question libvirt is adding chains. Where do i disable these: > > chains are LIBVIRT-{FWO,FWX,FWI, INP, OUT} > > These are absolutely and explicit unwanted. > Adding new rich features for folks is a fine thing, but i need an opt out. > Please, how do i get rid of it? As I've said, there are two sources which cause libvirt to insert FW rules. By uninstalling nwfilter module you've eliminated one. But since you're still able to run the domain this step was useless because your domain doesn't have nwfilter configured for any of its <interface/>-s and thus nwfilter module did nothing but sit there. The other module that is inserting FW rules is network module. Currently, when libvirtd is starting it reads all the configs of defined networks. If a NATed network is found then it creates those LIBVIRT-* chains and when the network is started then all the rules will be placed into those chains to not contaminate config set by sysadmin. There is patch to postpone creating the chains unitl network actually is starting: https://www.redhat.com/archives/libvir-list/2019-April/msg01547.html So your options here are: a) undefine all NATed networks (typically there's 'default' network) b) uninstall network module (but this will render all domains using <interface type='network'/> unable to start). As an extension to a) you can have a network with <forward mode='open'/> which preserves all the advantages of having a libvirt network but does not install any FW rules. Of course, any comments to aforementioned patch are welcome too. Michal

1 0

[libvirt-users] Autodetecting backing file properties when using vol-create-as
by Gionatan Danti 06 May '19

06 May '19

Hi all, experimenting with vol-create-as, I think it should autodetect some data - filesize and backing file format, specifically. However, the current implementation require us to specify both filesize and backing file format. Considering that qemu-img already autodetects these data, there are any reason for the lack of autodetect by libvirt? Should I open a bugzilla issue? Below you can find a practical example of what I mean. System is CentOS Linux release 7.6.1810 (Core) with libvirt-4.5.0-10.el7_6.4.x86_64 Please let me know if I am missing something. Thanks. # create base file [root@singularity images]# qemu-img create base.qcow2 8G -f qcow2 Formatting 'base.qcow2', fmt=qcow2 size=8589934592 cluster_size=65536 lazy_refcounts=off refcount_bits=16 [root@singularity images]# qemu-img info base.qcow2 image: base.qcow2 file format: qcow2 virtual size: 8.0G (8589934592 bytes) disk size: 17K cluster_size: 65536 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 corrupt: false # create overlay1.qcow2 via qemu-img; note how backing file format is autodetected ("-f qcow2" regards the overlay file itself) [root@singularity images]# qemu-img create -b /var/lib/libvirt/images/base.qcow2 overlay1.qcow2 -f qcow2 Formatting 'overlay1.qcow2', fmt=qcow2 size=8589934592 backing_file=/var/lib/libvirt/images/base.qcow2 cluster_size=65536 lazy_refcounts=off refcount_bits=16 [root@singularity images]# qemu-img info overlay1.qcow2 image: overlay1.qcow2 file format: qcow2 virtual size: 8.0G (8589934592 bytes) disk size: 17K cluster_size: 65536 backing file: /var/lib/libvirt/images/base.qcow2 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 corrupt: false # try the same with virsh vol-create-as; note how you must specify filesize and the backing file format is *wrong* (leading to an unusable overlay disk) [root@singularity images]# virsh vol-create-as default overlay2.qcow2 8G --format qcow2 --backing-vol /var/lib/libvirt/images/base.qcow2 Vol overlay2.qcow2 created [root@singularity images]# qemu-img info overlay2.qcow2 image: overlay2.qcow2 file format: qcow2 virtual size: 8.0G (8589934592 bytes) disk size: 17K cluster_size: 65536 backing file: /var/lib/libvirt/images/base.qcow2 backing file format: raw Format specific information: compat: 0.10 refcount bits: 16 -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

1 1

[libvirt-users] disable libvirt-nwfilter
by nakata＠geekpit.org 06 May '19

06 May '19

Hi, i want to disable the nwfilter functionality of libvirt. It's surely nice for some people, nevertheless i don't want libvirt to alter any netfilter rules, neither i want the according functionality even available. I know about nwfilter-undefine, but what i'm looking for is an option to globally disable this functionality at all. Some config flag or similar. How can i achieve that? greetings

2 1

[libvirt-users] VM: Unable to enable scatter-gather / tx-checksumming / tcp-segmentation offload
by Harsh Gondaliya 06 May '19

06 May '19

In my Linux VM, I am unable to change scatter-gather / tx-checksumming / TCP-segmentation offload features by ethtool command. I am using virtio nic with vhostuser port backend. It shows me an error: Cannot change tx-checksumming Cannot change scatter-gather Cannot change tcp-segmentation offload Could not change any device features Ony running command ethtool -k ens3, I get the following: [image: image.png] If there is something that needs to be changed in the domain XML itself then please guide me what changes to do?

2 2

[libvirt-users] Running all my virtual machines with a low priority
by R. Diez 02 May '19

02 May '19

Hi all: I have an Ubuntu 18.04 system. What is the easiest way to run all of my virtual machines with a low priority? Say a "nice" level of 15. I just do not want my virtual machines to have too much of an impact in any other processes on the system. Thanks in advance, rdiez

3 8

[libvirt-users] NUMA revisited
by Patrick Meyer 02 May '19

02 May '19

Moin libvirters, I'm looking into the current numa settings for a large-ish libvirt/qemu based setup and I ended up having a couple of questions: 1) Has kernel.numa_balancing completely replaced numad or is there still a time and place for numad when we have a modern kernel? 2) Should I pin vCPUs to numa nodes and/or use numatune at all, when using kernel.numa_balancing? 3) The libvirt domain xml elements for vcpu and numatune.memory have placement options. According to the docs setting them to auto will query numad for a good placements. Should I keep numad running just for this? 4) Should I still expose the numa topology via cpu.numa.cell if I use the auto placement for vcpu and numatune? 5) Does the cpus attribute in the cpu.numa.cell elements reference vCPU cores or the real physical CPU cores? Most examples reference them as ranges, which confuses me as on my numa hosts node0 has cores 0,2,4.. and node1 the others. I'd like to benchmark a couple of different options using our production workloads once I actually have grasp what combinations could make any sense. Maybe somebody would like to share the cpu/memory/numa settings they ended up with and why? Thanks a lot, Patrick Meyer

1 0

[libvirt-users] Unable to have TSO GSO feature in VM
by Harsh Gondaliya 02 May '19

02 May '19

I am trying to turn ON TSO in my Ubuntu Virtual machine but it gives me the following error: [image: image.png] Also on doing *ethtool -k ens3* all the features are marked as [fixed]. How to use libvirt to configure VM to have TSO?

1 0

[libvirt-users] Cloning a volume via storage XML
by Weller, Lennart 30 Apr '19

30 Apr '19

Hello everyone, After the Bug with libvirt was found and fixed by Michal I am now looking for a way to actually do the task I intended to do. I cannot find any information if it is possible to clone a base-volume a la vol- clone for ceph rbd. As I posted in my addendum to the first post here I thought something like this volume xml would do the job: <volume> <name>coreos00.disk</name> <capacity unit="bytes">9116319744</capacity> <target> <format type="raw"></format> <permissions> <mode>644</mode> </permissions> </target> <backingStore> <path>vmdisks/coreos_2023</path> <format type="raw"></format> </backingStore> </volume> But even with the fix applied this simply creates an empty volume of the given size. Granted this has no information about the snapshot so I was sceptical that this would be enough in the first place. If the vol-clone is not an option right now via volume xml it's not that wild as I could just patch the terraform-libvirt-provider to do the task beforehand but I wanted to know if it there exists an option for libvirt to do it automatically when provided with an xml. I can't find any options in the storage xml documentation so my guess would be no. Kind regards, Lennart Weller

1 1

[libvirt-users] libvirtd via unix socket using system uri
by lameventanas＠gmail.com 30 Apr '19

30 Apr '19

I want to run libvirtd as a special user, and allowing users that belong to a special group to connect via qemu+unix:///system (eg: unix socket). I did everything necessary to do so: created a libvirt user and group, added the libvirt user to the kvm group, added my normal user to the libvirt group, and made sure the socket is owned by libvirt:libvirt with permissions set to 770. libvirtd starts successfully, but when I try to connect as the normal user I get this error: bash$ virsh --connect qemu+unix://system error: failed to connect to the hypervisor error: invalid argument: using unix socket and remote server 'system' is not supported. A trace shows virsh is not even trying to open the socket. I want to use the socket because I just need local connectivity and don't want to run sasl and set up certificates for this, but at the same time want to run libvirtd as a dedicated user. Is there any reason to prevent libvirt from being used like this?

4 10

[libvirt-users] Error connecting to hypervisor
by Sukrit Bhatnagar 29 Apr '19

29 Apr '19

Hi, I have compiled and installed libvirt from git checkout and started libvirtd service. The version is 5.3.0 and I have done system-wide installation. When I do a `virsh list`, I get the following error: error: failed to connect to the hypervisor error: Unable to encode message header Similarly, the libvirtd instance shows the following error: 2019-04-23 21:36:57.777+0000: 1807: info : libvirt version: 5.3.0 2019-04-23 21:36:57.777+0000: 1807: info : hostname: dell 2019-04-23 21:36:57.777+0000: 1807: error : virNetSocketReadWire:1803 : End of file while reading data: Input/output error Furthermore, virnetmessagetest show the following error: $ VIR_TEST_DEBUG=1 ./virnetmessagetest TEST: virnetmessagetest 1) Message Header Encode ... libvirt: XML-RPC error : Unable to encode message header FAILED 2) Message Header Decode ... libvirt: XML-RPC error : Unable to decode message length FAILED 3) Message Payload Encode ... libvirt: XML-RPC error : Unable to encode message header FAILED 4) Message Payload Decode ... libvirt: XML-RPC error : Unable to decode message length FAILED 5) Message Payload Stream Encode ... libvirt: XML-RPC error : Unable to encode message header FAILED I am also compiling qemu from source and the virsh commands ran fine when I was using libvirt 4.7.0 from Fedora repository. Any ideas how I can solve this issue? Thanks, Sukrit

3 3