- Users - libvirt List Archives

[libvirt-users] kernel panic when using root from virtfs
by Vasiliy Tolstov 11 Mar '14

11 Mar '14

I have strange kernel panic Kernel 3.13.3 vanilla root is mounted via 9p virtfs (readonly). virsh --version 1.2.1 qemu --version QEMU emulator version 1.7.0, Copyright (c) 2003-2008 Fabrice Bellard systemd version 210 Domain config: <domain type='kvm'> <name>build</name> <uuid>328891df-b3c3-aee9-eb5d-00007e7934f7</uuid> <memory unit='MiB'>512</memory> <currentMemory unit='MiB'>512</currentMemory> <vcpu placement='static'>2</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='x86_64' machine='pc-1.0'>hvm</type> <boot dev='hd'/> <kernel>/boot/vmlinuz-3.13.3</kernel> <initrd>/boot/initrd-3.13.3</initrd> <cmdline>ro root=virtfs:root console=tty0 console=ttyS0,115200n8 </cmdline> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>destroy</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <filesystem type='mount' accessmode='squash'> <driver type='path' wrpolicy='immediate'/> <source dir='/home/vtolstov/devel/vtolstov/lb/fs/x86_64'/> <target dir='root'/> <readonly/> </filesystem> <filesystem type='mount' accessmode='squash'> <driver type='path' wrpolicy='immediate'/> <source dir='/home/vtolstov/devel/vtolstov/lb/fs/var/log'/> <target dir='var/log'/> </filesystem> <filesystem type='mount' accessmode='squash'> <driver type='path' wrpolicy='immediate'/> <source dir='/home/vtolstov/devel/vtolstov/lb/fs/var/cache/paludis'/> <target dir='var/cache/paludis'/> </filesystem> <filesystem type='mount' accessmode='squash'> <driver type='path' wrpolicy='immediate'/> <source dir='/home/vtolstov/devel/vtolstov/lb/fs/var/db/paludis'/> <target dir='var/db/paludis'/> </filesystem> <controller type='virtio-serial' index='0'> <alias name='virtio-serial0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </controller> <controller type='pci' index='0' model='pci-root'> <alias name='pci0'/> </controller> <controller type='ide' index='0'> <alias name='ide0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> </controller> <interface type='network'> <mac address='52:54:00:00:02:4c'/> <source network='mighost'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> <serial type='pty'> <source path='/dev/pts/8'/> <target port='0'/> <alias name='serial0'/> </serial> <console type='pty' tty='/dev/pts/8'> <source path='/dev/pts/8'/> <target type='serial' port='0'/> <alias name='serial0'/> </console> <channel type='spicevmc'> <target type='virtio' name='com.redhat.spice.0'/> <alias name='channel0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <channel type='unix'> <source mode='bind' path='/var/lib/libvirt/qemu/build.agent'/> <target type='virtio' name='org.mighost.agent.0'/> <alias name='channel1'/> <address type='virtio-serial' controller='0' bus='0' port='2'/> </channel> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5905' autoport='yes' listen='0.0.0.0'> <listen type='address' address='0.0.0.0'/> </graphics> <video> <model type='vga' vram='9216' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </memballoon> </devices> <seclabel type='none'/> </domain> Sometimes i get error like: [ OK ] Reached target Initrd File Systems. Starting dracut mount hook... [ 14.326081] FDC 0 is a S82078B [ 14.644148] PANIC: double fault, error_code: 0x0 [ 14.640174] PANIC: double fault, error_code: 0x0 [ 14.640174] CPU: 0 PID: 130 Comm: systemd-udevd Not tainted 3.13.3 #2 [ 14.640174] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 14.640174] task: ffff88001faf0000 ti: ffff88001faee000 task.ti: ffff88001faee000 [ 14.640174] RIP: 0010:[<ffffffff81109df8>] [<ffffffff81109df8>] file_read_actor+0x58/0x160 [ 14.640174] RSP: 0018:ffff88001faefd60 EFLAGS: 00010206 [ 14.640174] RAX: 0000000000000000 RBX: ffff88001faefe10 RCX: 000000000000100f [ 14.640174] RDX: 0000000000000000 RSI: ffffea000070ebc0 RDI: 00007f94d60b3037 [ 14.640174] RBP: ffff88001faefd90 R08: 0000000000000002 R09: ffffea000070ebdc [ 14.640174] R10: 0000000000000023 R11: 0000000000000000 R12: 0000000000001000 [ 14.640174] R13: 000000000001f000 R14: ffff88001f9d5e00 R15: 0000000000001000 [ 14.640174] FS: 00007f94d60dc7c0(0000) GS:ffff88001f400000(0000) knlGS:0000000000000000 [ 14.640174] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 14.640174] CR2: 0000000000000000 CR3: 000000001fad9000 CR4: 00000000000006f0 [ 14.640174] Stack: [ 14.640174] ffff88001faefd70 ffff88001e025280 0000000000000021 0000000000001000 [ 14.640174] ffff88001f9d5e00 ffffea000070ebc0 ffff88001faefe58 ffffffff8110a1ca [ 14.640174] ffff88001f9d5e10 ffff88001faefe90 ffff88001faefea0 0000000000000000 [ 14.640174] Call Trace: [ 14.640174] [<ffffffff8110a1ca>] generic_file_aio_read+0x2ca/0x700 [ 14.640174] [<ffffffff811a11f6>] blkdev_aio_read+0x46/0x70 [ 14.640174] [<ffffffff8116c355>] do_sync_read+0x55/0x90 [ 14.640174] [<ffffffff8116c9e0>] vfs_read+0x90/0x160 [ 14.640174] [<ffffffff8116d4e4>] SyS_read+0x44/0xa0 [ 14.640174] [<ffffffff816ab07d>] system_call_fastpath+0x1a/0x1f [ 14.640174] Code: 38 31 c0 66 66 90 c6 01 00 66 66 90 85 c0 0f 85 bf 00 00 00 49 63 fc 48 8d 7c 39 ff 48 31 f9 48 f7 c1 00 f0 ff ff 74 11 66 66 90 <c6> 07 00 66 66 90 85 c0 0f 85 c6 00 00 00 65 ff 04 25 e0 c7 00 [ 14.640174] Kernel panic - not syncing: Machine halted. [ 14.644148] CPU: 1 PID: 126 Comm: systemd-udevd Not tainted 3.13.3 #2 [ 14.644148] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 14.644148] task: ffff88001fa42f80 ti: ffff88001fa84000 task.ti: ffff88001fa84000 [ 14.644148] RIP: 0010:[<ffffffff81109df8>] [<ffffffff81109df8>] file_read_actor+0x58/0x160 [ 14.644148] RSP: 0018:ffff88001fa85d60 EFLAGS: 00010206 [ 14.644148] RAX: 0000000000000000 RBX: ffff88001fa85e10 RCX: 000000000000100f [ 14.644148] RDX: 0000000000000000 RSI: ffffea0000708340 RDI: 00007f94d60cb037 [ 14.644148] RBP: ffff88001fa85d90 R08: 0000000000000002 R09: ffffea000070835c [ 14.644148] R10: 000000000000003b R11: 0000000000000001 R12: 0000000000001000 [ 14.644148] R13: 0000000000007000 R14: ffff88001f9d3900 R15: 0000000000001000 [ 14.640174] Shutting down cpus with NMI [ 14.644148] FS: 00007f94d60dc7c0(0000) GS:ffff88001f500000(0000) knlGS:0000000000000000 [ 14.644148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 14.644148] CR2: 0000000000000000 CR3: 000000001fa67000 CR4: 00000000000006e0 [ 14.644148] Stack: [ 14.644148] ffff88001fa85d70 ffff88001e2522c0 0000000000000039 0000000000001000 [ 14.644148] ffff88001f9d3900 ffffea0000708340 ffff88001fa85e58 ffffffff8110a1ca [ 14.644148] ffff88001f9d3910 ffff88001fa85e90 ffff88001fa85ea0 0000000000000000 [ 14.644148] Call Trace: [ 14.644148] [<ffffffff8110a1ca>] generic_file_aio_read+0x2ca/0x700 [ 14.644148] [<ffffffff811a11f6>] blkdev_aio_read+0x46/0x70 [ 14.644148] [<ffffffff8116c355>] do_sync_read+0x55/0x90 [ 14.644148] [<ffffffff8116c9e0>] vfs_read+0x90/0x160 [ 14.644148] [<ffffffff8116d4e4>] SyS_read+0x44/0xa0 [ 14.644148] [<ffffffff816ab07d>] system_call_fastpath+0x1a/0x1f [ 14.644148] Code: 38 31 c0 66 66 90 c6 01 00 66 66 90 85 c0 0f 85 bf 00 00 00 49 63 fc 48 8d 7c 39 ff 48 31 f9 48 f7 c1 00 f0 ff ff 74 11 66 66 90 <c6> 07 00 66 66 90 85 c0 0f 85 c6 00 00 00 65 ff 04 25 e0 c7 00 -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru jabber: vase(a)selfip.ru

1 0

Re: [libvirt-users] cgroup for VM - does it work properly?
by Martin Pavlásek 11 Mar '14

11 Mar '14

On Thu 06 Mar 2014 20:16:45 CET, Martin Pavlásek wrote: > On 06/03/14 10:35, Daniel P. Berrange wrote: >> On Thu, Mar 06, 2014 at 12:32:28AM +0100, Martin Pavlásek wrote: >>> Hi >>> >>> I tried to restrict usage of some running VM by cpu.shares (i.e. set to >>> 10 from original 1024) on loaded system and it seem doesn't work as I >>> expected... all running processes has same CPU usage (by htop) :-/ >>> Does anyone has same experience? >> The cpu.shares variable doesn't provide absolute restriction on >> CPU usage, rather it is doing relative prioritization. >> >> eg if you have 2 cgroups that are at the same level in the hierarchy >> and you give one shares=512 and one shared=1024, then the latter VM >> will get twice the CPU scheduler time of the former. If the latter >> VM is completely idle though, the former VM will not be capped in any >> way. >> >> If you want absolute caps then you need to use period/quota settings. >> Also you want todo this via the virsh schedinfo command, not accessing >> cgroups directly. >> >> Regards, >> Daniel > Thanks Daniel for reply, nice example! > In my case I've got quite weird results > > guest: dd if=/dev/zero of=/dev/null for simulating heavy load > host: dd if=... same as guest (to make host also loaded) > > host: htop for watching CPU usage (host has only one core), qemu (one > VM, two threads) + dd (host) = 99% usage that is correct, as expected > host: virsh schedinfo --set cpu_shares=10 <domain-ID> > ...but whole load is still distributed equally - still ~30% for each. > > All processes are under itself default cgroup, so / for host dd and each > VM in their own (something like /machine/<domain-name>). I didn't change > any cgroup directly in this case. > After that qemu processes should shoconsume significantly less cpu than > others, isn't it (change "relative priority" from 1024 to 10)? > Limiting by period or quota works, but I would be really happy to use > just cpu.shares - I don't want to write own process scheduler, weights > of cpu sharing is sufficient for me. > > Do you have idea why this behaviour happen? > Regards > I just find out what was wrong... :-) cpu.shares is applied only to process in same cgroup, so all common processes belong to / (cgroup root), all VMs under /machine/. So dd running on host belongs to /, but when I set cpu.shares of any VM, it wouldn't apply as I expected, because these processes are exists in different cgroups. PS: I'm sorry Danied for answer only to you, I've mismatched Reply and Reply to all... -- -- Martin Pavlásek <mpavlase(a)redhat.com> OpenStack QA Associate/Red Hat Czech/BRQ irc: mpavlase

1 0

[libvirt-users] Fwd: How to get guest's cpu and mem usage with Java APIs
by Enrico De Maio 11 Mar '14

11 Mar '14

I would like to know how much memory and cpu virtual machine are using so yes guest's perspective. I'm building a web app that has to alert the user when the vm is going to be stressed and I would like to do this in terms of mem and cpu usage. Thanks in advance for your support, Enrico De Maio On Mon, Mar 10, 2014 at 7:16 PM, Eric Blake <eblake(a)redhat.com> wrote: > On 03/10/2014 04:54 AM, Enrico De Maio wrote: > > Hi everybody, > > > > I'm using libvirt java api bindings for my thesis. I would like to know > if > > there is a way to obtain live information about cpu and mem usage of a > > domain. > > Are you asking the question from the host's perspective (how much > resources has the host given to the guest) or from the guest's > perspective (how much is the guest actively using, even if the host has > given it more)? Libvirt already provides several API calls. such as the > ones used by 'virsh cpu-stats' and 'virsh dommemstat'; you may have to > do some code reading to figure out what C calls the virsh code made in > order to find the same API under the Java bindings. > > -- > Eric Blake eblake redhat com +1-919-301-3266 > Libvirt virtualization library http://libvirt.org > >

2 1

[libvirt-users] How to get guest's cpu and mem usage with Java APIs
by Enrico De Maio 11 Mar '14

11 Mar '14

Hi everybody, I'm using libvirt java api bindings for my thesis. I would like to know if there is a way to obtain live information about cpu and mem usage of a domain. Regards, Enrico De Maio Skype: enrico.de.maio Mobile: +39 338 205 3397

2 1

[libvirt-users] Question about virtio drivers
by pa1n_0 11 Mar '14

11 Mar '14

Hello, Any ideas from which version of virtio drivers support well high-end configuration like >= 8 physicals CPUs and >=24Go. I know that using the last version is the way to do but someone would like to know an accurate version. Thanks for answer.

1 0

[libvirt-users] "connection refused", but server is listening
by Pasquale Dir 09 Mar '14

09 Mar '14

netstat -lptu gives me tcp6 0 0 [::]:16514 [::]:* LISTEN 1314/libvirtd so the server is correctly listening on interfaces. My /etc/libvirt/libvirtd settings are defaulted. My /etc/default/libvirt-bin has "-d -l" options so server is listening. If I do virsh -c qemu://143.225.229.190/system (that is my ip or an ip belonging to my network) I get "connection refused". How come? And note that if I put my address, 143.225.229.190, as listening address in the libvirtd conf file, I get "this address class is not supported".

2 3

[libvirt-users] create ovs port without root
by Vasiliy Tolstov 08 Mar '14

08 Mar '14

Hello! How can i operate with openvswitch without root rights? For example - i can add my user to kvm group and create vm from libvirt with my own user, but now i'm failed with creating port. errors in logs: Mar 06 14:04:46 selfip.ru ovs-vsctl[19065]: ovs|00001|vsctl|INFO|Called as ovs-vsctl --timeout=5 -- --if-exists del-port Mar 06 14:04:46 selfip.ru ovs-vsctl[19065]: ovs|00002|vsctl|ERR|'del-port' command requires at least 1 arguments Mar 06 14:04:46 selfip.ru libvirtd[6418]: internal error: Child process (ovs-vsctl --timeout=5 -- --if-exists del-port) unexpected exit status 1: ovs-vsctl: 'del-port' command requires at least 1 arguments Mar 06 14:04:46 selfip.ru libvirtd[6418]: Unable to delete port (null) from OVS: Operation not permitted -- Vasiliy Tolstov, e-mail: v.tolstov(a)selfip.ru jabber: vase(a)selfip.ru

5 6

[libvirt-users] ISO refuses to let vm starts (and is not mentioned in config)
by Mauricio Tavares 08 Mar '14

08 Mar '14

Trying to start one of my vms, a centos one at that, but am getting the following message: [root@vmhost ~]# virsh start voip --paused error: Failed to start domain voip error: cannot open file '/var/tmp/FreePBX-5.211.65-3-x86_64-Full-1388073872.iso': No such file or directory [root@vmhost ~]# But, virsh dumpxml voip shows no info onto the .iso <disk type='file' device='disk'> <driver name='qemu' type='raw' cache='none' io='native'/> <source file='/dev/vmhost_vg0/voip'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hda' bus='ide'/> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='hdb' bus='ide'/> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='1'/> </disk> Log file is not particularly helpful: 2014-03-04 22:57:46.121+0000: shutting down 2014-03-05 23:42:18.528+0000: shutting down 2014-03-05 23:47:07.375+0000: shutting down 2014-03-06 00:56:32.908+0000: shutting down 2014-03-06 01:11:32.582+0000: shutting down So, the question is how did this iso got involved in this specific vm? I can start my other vms without them even knowing about this .iso.

1 2

[libvirt-users] Attaching a hostdev on startup
by Mat Arge 07 Mar '14

07 Mar '14

Hello! I have written a script which attaches some USB tokens as hostdev devices to (qemu) VMs managed by libvirt. This works fine as long as I call the script manually. But what I really want to do, is run this scrip from a startup hook, so that whenever a Vm is started, it looks if there are appopriate tokens available for attachment. But when the script is run from the hook, it (along with the whole libvirtd) freezes. That doesn't really come as a surprise, since http://libvirt.org/hooks.html explicitely states A hook script must not call back into libvirt, as the libvirt daemon is already waiting for the script to exit. A deadlock is likely to occur. How can I get around this problem? cheers Mat

1 0

[libvirt-users] Providing fallback DNS servers via DHCP
by Florian Rüchel 07 Mar '14

07 Mar '14

Hello everyone, TL;DR: Is ist possible to provide a secondary DNS (e.g. 8.8.8.8) via DHCP in addition to the gateway (in my case 10.0.1.1)? I use libvirt to manage all my qemu-based VMs. I have set up a local NAT-network which includes all my VMs (and some physical servers integrated via VPN). Everything works fine, but ocassionally, I have to restart the network (when I add instances for example). In that case, my VMs loose their local network connection until I restart them. However, some instances can not be restarted at will and so a change in network configuration means they loose their local connectivity. However, they still have a second network device that has an external static IP. This IP can still connect and be connected to, so it is feasible to loose the connection on the local network. Unfortunately though, libvirt (through dnsmasq's DHCP) broadcasts itself as the only DNS. This results in name resolution going down. If I add e.g. 8.8.8.8 to resolv.conf, I can resolve names again (except local ones, of course). So it would be nice if the DHCP would directly supply additional DNS servers. For dnsmasq, I would add to the configuration something like dhcp-option=6,0.0.0.0,8.8.8.8 However, looking through the archive, I found that you guys prefer to keep it implementation agnostic and thus you do not provide the option to set this directly (since this is dnsmasq-only). So I was wondering if there is any way to achieve this with libvirt? Is there already an implemented way I could not find? Or is there maybe a *generic* option to provide some kind of extra-configuration specific to the implementation? Or is my only solution to make sure the clients manually add a second DNS by themselves? Regards, Florian

1 0

[libvirt-users] Python-libvirt in a virtual environment.
by Sijo Jose 07 Mar '14

07 Mar '14

Hi, Could you guide me to install libvirt in a virtual environment..? OR How python-libvirt could be used within a virtual environment after installing it, in the system. Regards Sijo

3 4

[libvirt-users] how to disable vnet_hdr through libvirt
by Jianfeng Tang 07 Mar '14

07 Mar '14

Hi, I am using libvirt and virsh to create my VM on KVM. It works fine. However, I need to turn off vnet_hdr for virtio interface. Does anyone know how to do it through libvirt? Thanks.

3 5

[libvirt-users] Migration failure after libvirt upgradation
by Shweta Salaria 06 Mar '14

06 Mar '14

Team, I'm trying to migrate a domain offline(shutdown mode) using libvirt-python API 'migrateToURI' but it gives me an error : libvirt: QEMU Driver error : Requested operation is not valid: domain is not running When I tried the same API for live migration(running and suspend mode), it gives me an error: libvirt: QEMU Driver error : Unsafe migration: Migration may lead to data corruption if disks use cache != none Below are the versions of the virtualization softwares I am using currently : Hypervisor : KVM qemu : 1.0 qemu-kvm : 1.0 Libvirt : 1.2.1 Earlier, I had performed offline and live migration *successfully* with these versions: Hypervisor : KVM qemu : 1.0 qemu-kvm : 1.0 libvirt : 0.9.8 Also, I would like to know whether it's possible to migrate a domain having snapshots? Kindly guide me through this. Thanks in advance Regards, Shweta

1 0

[libvirt-users] How to enable mount loop device in LXC using libvirt LXC driver
by Du Jun 06 Mar '14

06 Mar '14

When I try to mount loop device in a linux container, I got the following error message: mount: Could not find any loop device. Maybe this kernel does not know about the loop device? (If so, recompile or `modprobe loop'.) I wonder how to enable mount loop device in LXC using libvirt LXC driver? -- Thanks! Du Jun

2 1

[libvirt-users] Fail to convert LXC container configuration into a domain XML fragment
by Du Jun 06 Mar '14

06 Mar '14

Hi, all, I used lxc-tools to create a linux container. I am trying to transfrom LXC container configuration into a domain XML fragment using the following command: *$ virsh -c lxc:/// domxml-from-native lxc /var/lib/lxc/my_conatiner/config* However, I get the error message, error: this function is not supported by the connection driver: virConnectDomainXMLFromNative It seems that *virConnectDomainXMLFromNative *is not supported in libvrit LXC driver. However, I find the command in the official documentation of libvirt. Besides, my libvirt's version is 1.2.2(the latest version). I wonder whether I can convert LXC container configuration into a domain XML fragment using *domxml-from-native*? If I can't, how cant I translate it? PS: I care about the rules in my LXC container configuration file, such as: *lxc.aa_profile = unconfined* *lxc.cgroup.devices.deny = a* *# Allow any mknod (but not using the node)* *lxc.cgroup.devices.allow = c *:* m* *lxc.cgroup.devices.allow = b *:* m* *lxc.cgroup.devices.allow = b 7:* rwm* I just don't know how to express the rules above using xml format. Please help! Thanks! -- Best Regards, Du Jun

2 1

[libvirt-users] Simple Networkfilter not working as expected.
by Matthias Babisch 06 Mar '14

06 Mar '14

Hello People. I have produced a very simple networkfilter that is not work as I would expect it. Perhaps one of you knows what I did wrong? I made this little filter: <filter name='my-test-no-ip-spoofing' priority='-700'> <rule action='drop' direction='out' priority='-999'> <all match='no' srcipaddr='$IP'/> </rule> </filter> I could attach it directly to a VM (and defined an IP-Adress in the network-interface there). Then it produced iptables rules that look like this: Chain FI-vnetnn (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * ! IP 0.0.0.0/0 (This is the rule governing the input via the virtual device into the bridge, is as expected.) Chain HI-vnetnn (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * ! IP 0.0.0.0/0 (This is the rule governing the input to the host, i would expect this too.) Chain FO-vnetnn (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 ! IP This is the rule governing the output via the virtual-device from the bridge. (i.e. Packets coming from the network.) I specifically asked to filter outgoing traffic. This one I don't unterstand. Perhaps somebody knows a hint? On the other hand this filter works as expected, no rule on "FO-vnetnn": <filter name='my-no-mac-spoofing' priority='-800'> <rule action='drop' direction='out'> <all match='no' srcmacaddr='$MAC'/> </rule> </filter> I used libvirt with qemu on Ubuntu 13.10. (Version 1.1.1-0ubuntu8.5) I am grateful for any helpful comments. Sincerely Matthias Babisch IT/Organisation *b+m Informatik AG* Rotenhofer Weg 20 24109 Melsdorf T +49 4340/404-1444 F +49 4340/404-111 M +49 160/8866426 matthias.babisch(a)bmiag.de Aktuelle Informationen unter www.bmiag.de <%5C%22http://www.bmiag.de%5C%22> Die b+m Informatik AG ist ein Unternehmen der Allgeier Gruppe <%5C%22http://www.allgeier-holding.de%5C%22> Vorsitzender des Aufsichtsrates: Dr. Marcus Goedsche Vorstand: Dipl-Ing. Frank Mielke Amtsgericht Kiel, HRB 5526

1 0

[libvirt-users] cgroup for VM - does it work properly?
by Martin Pavlásek 06 Mar '14

06 Mar '14

Hi I tried to restrict usage of some running VM by cpu.shares (i.e. set to 10 from original 1024) on loaded system and it seem doesn't work as I expected... all running processes has same CPU usage (by htop) :-/ Does anyone has same experience? Fedora 19, libvirt-1.0.5.9-1.fc19.x86_64 Thanks a lot Martin -- Martin Pavlásek <mpavlase(a)redhat.com> OpenStack QA Associate/Red Hat Czech/BRQ irc: mpavlase

4 5

[libvirt-users] IPv6 nwfilter
by Brian Rak 06 Mar '14

06 Mar '14

Are there any nwfilter rules out there for IPv6? I'm looking for something similar to clean-traffic, but that works with IPv6. I found some mailing list posts from 2012 ( https://www.redhat.com/archives/libvirt-users/2012-November/msg00039.html ), but they don't seem to actually go anywhere. The hard part here seems to be determining all the different ways IPv6 traffic can be bad.

1 0

[libvirt-users] fedora 19 + libvirt-1.0.5.9 routing problems
by Patrick Chemla 06 Mar '14

06 Mar '14

Hi, I am an experienced libvirt user on Fedora versions from F15 to F17. I have developped scripts to route trafic from outside on multiple interfaces/multiples IPs to multiple VMs, and back to affect each VM the required external IP address. I have servers with more than hundreds external IPs, and up to 4 VMs, each of them route trafic on different external IPs. I have servers with Fedora F17 which work very fine with this. Now libvirt-1.0.5.9 comes to Fedora 19 with many iptables default rules that refrain me to use my scripts. So I put in /etc/libvirt/hooks /qemu the right rules to get trafic to my VMs, but I can't set trafic back to external with the right external IP. The -j SNAT --to-source ot -j MASQUERADE dont work, are ignored, and I dont see any packet through these rules in iptables -tnat -L POSTROUTING. I used tcpdump to trace packet on the physical server on virbr0 interface and on eth0 interface. I see the packets on outgoing route. But, the ougoing packets are presented to the external interface with the internal address 10.0.0.x instead of the address specified in the -j SNAT rule. Am I the only one in this case? Somebody could help? Thanks Patrick

1 1

[libvirt-users] Flags in java api bindings
by Pasquale Dir 05 Mar '14

05 Mar '14

I am currently using Connect(String,ConnectAuth,int) constructor, as I decided to use tcp connection and I need the auth part. It works, but I still need the read/write flag which, in the Connect(String, boolean) is a boolean. I need to enable write permits. In the javadoc no flags are defined...so which is the flag for allow write? And where can I find a list?

2 1

[libvirt-users] Live migration (kvm) not working if any I/O operation is in progress
by Pasquale Dir 05 Mar '14

05 Mar '14

Hello, I'd like to know if this is an hypervisor related problem or a libvirt one. I did this experiment: on VM I started watching a video on youtube. While video was in progress I started migration. Migration did not complete until video was not finished. I did another experiment: I installed a web server on VM. I then started an httperf stress test. As before migration did not complete until the stress test was closed. Is this normal?

2 1

[libvirt-users] libvirt-sock No such file or directory
by Ram Srivatsa Kannan 05 Mar '14

05 Mar '14

Hi, When I run the following command *~/kvm/virt-manager $ virsh -c qemu:///system list* i get the following errors. Please help me out with this issue. error: failed to connect to the hypervisor error: Failed to connect socket to '/usr/local/var/run/libvirt/libvirt-sock': No such file or directory' Thank you Ram PhD student Dept of EECS UMich

2 1

[libvirt-users] [libvirt] LXC, user namespaces and systemd
by Dariusz Michaluk 05 Mar '14

05 Mar '14

Hi! I with my colleagues from Samsung trying to run systemd in Linux container. I saw that the others are experimenting in this topic, so I would like to present the results of my work and tests, perhaps it will be helpful to others. As the prototype I used a manual written by Daniel: https://www.berrange.com/posts/2013/08/12/running-a-full-fedora-os-inside-a… After many attempts, I managed to run systemd. Let's move to specifics. 1. Host configuration, Fedora 20 - kernel 3.14 with NAMESPACES, UTS_NS, IPC_NS, USER_NS, PID_NS, NET_NS enabled in kernel config I used kernel-3.14.0-0.rc2.git0.1.fc21.i686.rpm downloaded from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide - libvirtd (libvirt) 1.2.2 I used libvirt build from git sources, it is important that the source contained commit 6fb42d7cdc57da453691d043d6b9bf23e2bae15e Patch from Richard Weinberger "Ensure systemd cgroup ownership is delegated to container with userns" 2. Container configuration - setup Fedora environment # yum -y --releasever=20 --nogpg --installroot=/var/lib/libvirt/filesystems/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal openssh-server procps-ng # echo "pts/0" >> /var/lib/libvirt/filesystems/mycontainer/etc/securetty # chroot /var/lib/libvirt/filesystems/mycontainer /bin/passwd root - In the final solution I want to map root inside container to some normal user in the host. So let's create some user (in host): # useradd foo -u 666 #id foo uid=666(foo) gid=1001(foo) grupy=1001(foo) # chown -R foo:foo /var/lib/libvirt/filesystems/mycontainer - enabling user namespace (user mapping setup), look at my full libvirt config file # cat /etc/libvirt/lxc/container.xml <domain type='lxc'> <name>mycontainer</name> <uuid>d750af59-6082-437c-b860-922e76b46410</uuid> <memory unit='KiB'>819200</memory> <currentMemory unit='KiB'>819200</currentMemory> <vcpu placement='static'>1</vcpu> <os> <type arch='i686'>exe</type> <init>/sbin/init</init> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <idmap> <uid start='0' target='666' count='1000'/> <gid start='0' target='1001' count='1000'/> </idmap> <devices> <emulator>/usr/libexec/libvirt_lxc</emulator> <filesystem type='mount' accessmode='passthrough'> <source dir='/var/lib/libvirt/filesystems/mycontainer'/> <target dir='/'/> </filesystem> <interface type='network'> <mac address='00:16:3e:34:a2:dd'/> <source network='default'/> </interface> <console type='pty'> <target type='lxc' port='0'/> </console> </devices> </domain> 3. Start container # virsh --connect lxc:/// define /etc/libvirt/lxc/container.xml # virsh --connect lxc:/// start mycontainer --console If all login attempts are rejected, please boot host machine with audit=0 # vi /etc/default/grub GRUB_CMDLINE_LINUX=" [...] audit=0 [...]" # grub2-mkconfig -o /boot/grub2/grub.cfg # reboot 4. Problems and solutions a) "Cannot add dependency job for unit display-manager.service, ignoring: Unit display-manager.service failed to load: No such file or directory." Delete or just comment line "Wants=display-manager.service" # cat /usr/lib/systemd/system/default.target [Unit] Description=Graphical Interface Documentation=man:systemd.special(7) Requires=multi-user.target After=multi-user.target Conflicts=rescue.target #Wants=display-manager.service AllowIsolate=yes [Install] Alias=default.target b) [FAILED] Failed to mount Huge Pages File System. See 'systemctl status dev-hugepages.mount' for details. [FAILED] Failed to mount Configuration File System. See 'systemctl status sys-kernel-config.mount' for details. [FAILED] Failed to mount Debug File System. See 'systemctl status sys-kernel-debug.mount' for details. [FAILED] Failed to mount FUSE Control File System. See 'systemctl status sys-fs-fuse-connections.mount' for details. Based on knowledge, which gave Daniel: "When a syscall requires CAP_SYS_ADMIN, for example, the kernel will either use capable(CAP_SYS_ADMIN) which only succeeds in the host, or ns_capable(CAP_SYS_ADMIN) which is allowed to suceed in the container. Different filesystems have differing restrictions, but at this time the vast majority of filesystems require that capable(CAP_SYS_ADMIN) succeeed and thus you can only mount them in the host.", and discussion about "allow some kernel filesystems to be mounted in a user namespace" from: http://comments.gmane.org/gmane.linux.kernel/1525998 I decided to disable mounting this filesystems: # systemctl mask dev-hugepages.mount ln -s '/dev/null' '/etc/systemd/system/dev-hugepages.mount' # systemctl mask sys-kernel-config.mount ln -s '/dev/null' '/etc/systemd/system/sys-kernel-config.mount' # systemctl mask sys-kernel-debug.mount ln -s '/dev/null' '/etc/systemd/system/sys-kernel-debug.mount' # systemctl mask sys-fs-fuse-connections.mount ln -s '/dev/null' '/etc/systemd/system/sys-fs-fuse-connections.mount' c) [FAILED] Failed to start D-Bus System Message Bus. See 'systemctl status dbus.service' for details. Feb 26 09:26:12 localhost.localdomain systemd[1]: Starting D-Bus System Message Bus... Feb 26 09:26:12 localhost.localdomain systemd[20]: Failed at step OOM_ADJUST spawning /bin/dbus-daemon: Permission denied # echo -900 > /proc/20/oom_score_adj /proc/20/oom_score_adj: Permission denied # ls -l /proc/20/oom_score_adj -rw-r--r--. 1 65534 65534 0 Feb 26 10:28 /proc/20/oom_score_adj Regarding to kernel documentation in user namespace local root user (on guest) cannot set the OOM on any value. Set OOM on any value required except CAP_SYS_RESOURCE also full root privileges. To disable OOM support delete or just comment line "OOMScoreAdjust=-900" # cat /usr/lib/systemd/system/dbus.service [Unit] Description=D-Bus System Message Bus Requires=dbus.socket After=syslog.target [Service] ExecStart=/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation ExecReload=/bin/dbus-send --print-reply --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig #OOMScoreAdjust=-900 5. Final systemd start # virsh --connect lxc:/// start mycontainer --console systemd 208 running in system mode. (+PAM +LIBWRAP +AUDIT +SELINUX +IMA +SYSVINIT +LIBCRYPTSETUP +GCRYPT +ACL +XZ) Detected virtualization 'lxc-libvirt'. Welcome to Fedora 20 (Heisenbug)! Failed to install release agent, ignoring: No such file or directory [ OK ] Reached target Remote File Systems. [ OK ] Created slice Root Slice. [ OK ] Created slice User and Session Slice. [ OK ] Created slice System Slice. [ OK ] Created slice system-getty.slice. [ OK ] Reached target Slices. [ OK ] Listening on Delayed Shutdown Socket. [ OK ] Listening on /dev/initctl Compatibility Named Pipe. [ OK ] Reached target Paths. [ OK ] Reached target Encrypted Volumes. [ OK ] Listening on Journal Socket. Mounting POSIX Message Queue File System... Starting Journal Service... [ OK ] Started Journal Service. Starting Create static device nodes in /dev... [ OK ] Reached target Swap. Mounting Temporary Directory... Starting Load/Save Random Seed... [ OK ] Mounted POSIX Message Queue File System. [ OK ] Started Create static device nodes in /dev. [ OK ] Reached target Local File Systems (Pre). [ OK ] Started Load/Save Random Seed. [ OK ] Mounted Temporary Directory. [ OK ] Reached target Local File Systems. Starting Trigger Flushing of Journal to Persistent Storage... Starting Recreate Volatile Files and Directories... [ OK ] Started Trigger Flushing of Journal to Persistent Storage. [ OK ] Started Recreate Volatile Files and Directories. Starting Update UTMP about System Reboot/Shutdown... [ OK ] Started Update UTMP about System Reboot/Shutdown. [ OK ] Reached target System Initialization. [ OK ] Reached target Timers. [ OK ] Listening on D-Bus System Message Bus Socket. [ OK ] Reached target Sockets. [ OK ] Reached target Basic System. Starting OpenSSH server daemon... Starting Permit User Sessions... Starting D-Bus System Message Bus... [ OK ] Started D-Bus System Message Bus. Starting Login Service... [ OK ] Started OpenSSH server daemon. [ OK ] Started Permit User Sessions. Starting Console Getty... [ OK ] Started Console Getty. [ OK ] Reached target Login Prompts. Starting Cleanup of Temporary Directories... [ OK ] Started Cleanup of Temporary Directories. [ OK ] Started Login Service. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Fedora release 20 (Heisenbug) Kernel 3.14.0-0.rc2.git0.1.fc21.i686 on an i686 (console) localhost login: root Password: Last login: Wed Feb 26 09:26:21 on pts/0 -bash-4.2# - verification which namespace is used inside container # ls -l /proc/self/ns/ ipc -> ipc:[4026532341] mnt -> mnt:[4026532338] net -> net:[4026532344] pid -> pid:[4026532342] user -> user:[4026532337] uts -> uts:[4026532339] outside container $ ls -l /proc/self/ns/ ipc -> ipc:[4026531839] mnt -> mnt:[4026531840] net -> net:[4026531956] pid -> pid:[4026531836] user -> user:[4026531837] uts -> uts:[4026531838] I know that no one likes to read long emails , but most is config and logs. I will be grateful for comments and suggestions. Regards. -- Dariusz Michaluk Samsung R&D Institute Poland Samsung Electronics d.michaluk(a)samsung.com

4 10

[libvirt-users] 'virsh capabilities' on Debian Wheezy-amd64 reports different cpu to Wheezy-i386 (on same hardware)
by Struan Bartlett 04 Mar '14

04 Mar '14

Hi On a range of Dell servers containing Intel 64bit processors, 'virsh capabilities' reports the cpu differently on Debian Wheezy-amd64 and Wheezy-i386. The results given by the Wheezy-i386 version seem very wrong (since n270 is an Atom processor). Apart from architecture, the package versions of libvirt-bin are identical: 1.2.1-1~bpo70+1. /usr/share/libvirt/cpu_map.xml files are identical. Is this a known issue? Details for one server are: # cat /proc/cpuinfo| head -n 26 processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 45 model name : Intel(R) Xeon(R) CPU E5-2650L 0 @ 1.80GHz stepping : 7 microcode : 0x70d cpu MHz : 1800.054 cache size : 20480 KB physical id : 0 siblings : 16 core id : 0 cpu cores : 8 apicid : 0 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 13 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm ida arat xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid bogomips : 3600.10 clflush size : 64 cache_alignment : 64 address sizes : 46 bits physical, 48 bits virtual power management: ... </proc/cpuinfo for processors 1..31 snipped here for brevity> # Running Wheezy-amd64 libvirt-bin1.2.1-1~bpo70+1 # virsh capabilities <cpu> <arch>x86_64</arch> <model>SandyBridge</model> <vendor>Intel</vendor> <topology sockets='2' cores='8' threads='2'/> <feature name='pdpe1gb'/> <feature name='osxsave'/> <feature name='dca'/> <feature name='pcid'/> <feature name='pdcm'/> <feature name='xtpr'/> <feature name='tm2'/> <feature name='est'/> <feature name='smx'/> <feature name='vmx'/> <feature name='ds_cpl'/> <feature name='monitor'/> <feature name='dtes64'/> <feature name='pbe'/> <feature name='tm'/> <feature name='ht'/> <feature name='ss'/> <feature name='acpi'/> <feature name='ds'/> <feature name='vme'/> </cpu> # Running Wheezy-i386 libvirt-bin1.2.1-1~bpo70+1 # virsh capabilities <cpu> <arch>x86_64</arch> <model>n270</model> <vendor>Intel</vendor> <topology sockets='2' cores='8' threads='2'/> <feature name='lahf_lm'/> <feature name='lm'/> <feature name='rdtscp'/> <feature name='pdpe1gb'/> <feature name='avx'/> <feature name='osxsave'/> <feature name='xsave'/> <feature name='aes'/> <feature name='tsc-deadline'/> <feature name='popcnt'/> <feature name='x2apic'/> <feature name='sse4.2'/> <feature name='sse4.1'/> <feature name='dca'/> <feature name='pcid'/> <feature name='pdcm'/> <feature name='xtpr'/> <feature name='cx16'/> <feature name='tm2'/> <feature name='est'/> <feature name='smx'/> <feature name='vmx'/> <feature name='ds_cpl'/> <feature name='dtes64'/> <feature name='pclmuldq'/> <feature name='pbe'/> <feature name='tm'/> <feature name='ht'/> <feature name='ss'/> <feature name='acpi'/> <feature name='ds'/> <feature name='pse36'/> </cpu> Kind regards Struan Bartlett -- Struan Bartlett NewsNow Publishing Limited Tel: +44 (0)845 838 8890 Fax: +44 (0)845 838 8898 The UK's #1 News Portal: > www.NewsNow.co.uk <http://www.NewsNow.co.uk> (est. 1998) Also tailored for Mobile: > mobile.NewsNow.co.uk <http://mobile.NewsNow.co.uk/> Now with FREE Personalisation: > Register <http://www.NewsNow.co.uk/register/> Bespoke B2B Internet News Monitoring: > Internet News Monitoring <http://www.newsnow.co.uk/services/newsmonitoring/> Bespoke B2B Headlines for Websites: > Editorial-In-A-Box <http://www.newsnow.co.uk/services/websites/> NewsNow Publishing Limited, trading also as NewsNow.co.uk, is a company registered in England and Wales under company no. 3435857 with registered office The Euston Office, 1 Euston Square, 40 Melton Street, London NW1 2FD

2 10

[libvirt-users] Set a domain name instead of an ip address into tls certificate
by Pasquale Dir 03 Mar '14

03 Mar '14

I tried to set cn=myMachine instead of cn=192.168.1.x and...everything frezees! virsh -c qemu://.../system tries to connect forever. You really need static ip addresses in the cn field?? I think this is an HUGE bug: you are saying to me that each time I change network or ip (because, dear sirs, dhcp exists) I have to generate a whole new couple of certificates?? I hope it is not the case.... regards Pasquale

2 1