- Users - libvirt List Archives

can this network setup works?
by daggs 13 Jul '24

13 Jul '24

Greetings, I have this setup. host and two vms, a and b. vm a servers as router, it has one physical nic passed directly into it. I want to connect vm a to vm b and the host to provide internet access to both. so I've created a virtual switch like this: <network> <name>default</name> <uuid>f90b3044-81c1-4c22-98df-8bbca3153f21</uuid> <bridge name='virsw0' stp='on' delay='0'/> <mac address='52:54:00:6b:1b:92'/> </network> with this xml entry: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='virsw0'/> <model type='virtio'/> <address type='pci' domain='x' bus='x' slot='x' function='x'/> </interface> in vm a and vm b should connect the both to the virtual switch thus allowing vm b internet access. this however doesn't solves the host connection to the internet. reading docs points to the fact I can add new tun devs outside of libvirt and add it to the virtual switch. so I did this: $ ip tuntap add QemuTap0 mode tap user root $ ip link set QemuTap0 master virsw0 and brctl show virsw0 returns this: $ brctl show virsw0 bridge name bridge id STP enabled interfaces virsw0 8000.5254006b1b92 yes QemuTap0 so theoretically speaking, when vm a is started and libvirt creates a device and connects it to the virtual switch and run dhcpd, vm a will provide ip. am I correct? Thanks, Dagg

1 0

per user vm isolation with shared network
by daggs 02 Jul '24

02 Jul '24

Greetings, I have two vm which I want to isolate per user, if I'm not mistaken, I can to that with per session uri. but I want to setup a virtual bridge so they will get connected with each other. looks like that if I define the network as system, it isn't visible in the session. is there a way to do that? if I define the same network in both sessions, will it work? Thanks, Dagg

2 8

Re: dm-crypt performance regression due to workqueue changes
by Mikulas Patocka 01 Jul '24

01 Jul '24

On Sun, 30 Jun 2024, Tejun Heo wrote: > Hello, > > On Sat, Jun 29, 2024 at 08:15:56PM +0200, Mikulas Patocka wrote: > > > With 6.5, we get 3600MiB/s; with 6.6 we get 1400MiB/s. > > > > The reason is that virt-manager by default sets up a topology where we > > have 16 sockets, 1 core per socket, 1 thread per core. And that workqueue > > patch avoids moving work items across sockets, so it processes all > > encryption work only on one virtual CPU. > > > > The performance degradation may be fixed with "echo 'system' > > >/sys/module/workqueue/parameters/default_affinity_scope" - but it is > > regression anyway, as many users don't know about this option. > > > > How should we fix it? There are several options: > > 1. revert back to 'numa' affinity > > 2. revert to 'numa' affinity only if we are in a virtual machine > > 3. hack dm-crypt to set the 'numa' affinity for the affected workqueues > > 4. any other solution? > > Do you happen to know why libvirt is doing that? There are many other > implications to configuring the system that way and I don't think we want to > design kernel behaviors to suit topology information fed to VMs which can be > arbitrary. > > Thanks. I don't know why. I added users(a)lists.libvirt.org to the CC. How should libvirt properly advertise "we have 16 threads that are dynamically scheduled by the host kernel, so the latencies between them are changing and unpredictable"? Mikulas

4 7

Command line equivalent for cpu pinning
by Gianluca Cecchi 28 Jun '24

28 Jun '24

Hello, on my Fedora 39 with libvirt 9.7.0-3.fc39 qemu-kvm 8.1.3-5.fc39 kernel 6.8.11-200.fc39.x86_64 I'm testing cpu pinning The hw is a Nuc with 13th Gen Intel(R) Core(TM) i7-1360P If I pass from this in my guest xml: <vcpu placement='static'>4</vcpu> <cpu mode='host-passthrough' check='none' migratable='on'> <topology sockets='1' dies='1' cores='4' threads='1'/> </cpu> to this: <vcpu placement='static'>4</vcpu> <cputune> <vcpupin vcpu='0' cpuset='0'/> <vcpupin vcpu='1' cpuset='2'/> <vcpupin vcpu='2' cpuset='4'/> <vcpupin vcpu='3' cpuset='6'/> </cputune> <cpu mode='host-passthrough' check='none' migratable='on'> <topology sockets='1' dies='1' cores='4' threads='1'/> </cpu> It seems to me that the generated command line of the qemu-system-x88_64 process doesn't change. As if the cputune options were not considered What should I see as different? Actually it seems it is indeed honored, because if I run stress-ng in the VM in the second scenario and top command in the host, I see only pcpu 0,2,4,6 going up with the load. Instead the first scenario keeps several different cpus alternating in the load. The real question could be: if I want to reproduce from the command line the cputune options, how can I do it? Is it only a cpuset wrapper used for the qemu-system-x86_64 process to place it in a cpuset control group? I see for the pid of the process $ sudo cat /proc/340215/cgroup 0::/machine.slice/machine-qemu\x2d8\x2dc7anstgt.scope/libvirt/emulator and $ sudo systemd-cgls /machine.slice CGroup /machine.slice: └─machine-qemu\x2d8\x2dc7anstgt.scope … └─libvirt ├─340215 /usr/bin/qemu-system-x86_64.... ├─vcpu1 ├─vcpu2 ├─vcpu0 ├─emulator └─vcpu3 What could be an easy command to replicate from the command line what virsh does? Thanks in advance Gianluca

3 3

cpu vmx migration issue
by d tbsky 25 Jun '24

25 Jun '24

Hi: I update our RHEL9 system to RHEL 9.4, which brings libvirt 10.0. I try to calculate the cpu baseline for our two-node cluster with command "virsh domcapabilities" then "virsh hypervisor-cpu-baseline --migratable". the result has many cpu features begin with "vmx". the test cluster has cpu "intel E3-1280 V3" and "intel I3-9100F". when I try live migrate vm, it failed and told me "guest CPU doesn't match specification: missing features: vmx-apicv-register,vmx-apicv-vid,vmx-posted-intr". at another cluster with cpu " Intel i5-2520M" and "Intel i7-9750H" the migration works fine for the calculated cpu result. although there are still many "vmx" cpu features in the result. if I delete all these vmx features, then migration works fine for both cluster, like old days. I wonder what's the benefit to expose these vmx features to guest if I don't do any nested virtualization. is it ok the drop all these vmx cpu features for a guest? thanks a lot for help!

2 9

unable to start a nested vm due to iommu_group issue
by daggs 22 Jun '24

22 Jun '24

Greetings, I'm working on a new os for my server which runs 2 vms. I'm using nested vms to work on it so I won't take down the server. the new os is alpine 3.20, qemu is 9.0.1, libvirt is 10.3.0. I have a device I want to pass to one of the guests, here is the iommu group layout: IOMMU Group 18 00:1f.0 ISA bridge [0601]: Intel Corporation 82801IB (ICH9) LPC Interface Controller [8086:2918] (rev 02) IOMMU Group 18 00:1f.2 SATA controller [0106]: Intel Corporation 82801IR/IO/IH (ICH9R/DO/DH) 6 port SATA Controller [AHCI mode] [8086:2922] (rev 02) IOMMU Group 18 00:1f.3 SMBus [0c05]: Intel Corporation 82801I (ICH9 Family) SMBus Controller [8086:2930] (rev 02) IOMMU Group 18 00:1f.4 Audio device [0403]: Intel Corporation 82801I (ICH9 Family) HD Audio Controller [8086:293e] (rev 03) the device in question is 00:1f.4: utils-server:/home/igor# lspci -s 00:1f.4 -nnv 00:1f.4 Audio device [0403]: Intel Corporation 82801I (ICH9 Family) HD Audio Controller [8086:293e] (rev 03) Subsystem: Red Hat, Inc. QEMU Virtual Machine [1af4:1100] Flags: bus master, fast devsel, latency 0, IRQ 10, IOMMU group 18 Memory at e1080000 (32-bit, non-prefetchable) [size=16K] Capabilities: [60] MSI: Enable- Count=1/1 Maskable- 64bit+ Kernel driver in use: vfio-pci to achieve that, I've compiled the kernel with acs patch and defined it in the kernel cmdline: BOOT_IMAGE=/boot/vmlinuz-lts root=UUID=44299ace-27c6-4047-8cbd-bbffcc0a65f0 ro modules=sd-mod,usb-storage,ext4 quiet rootfstype=ext4 iommu=pt intel_iommu=on pcie_acs_override=id:8086:293e,8086:10c9 I see in dmesg, acs is enabled, see: # dmesg | grep "ACS overrides" [ 0.000000] Warning: PCIe ACS overrides enabled; This may allow non-IOMMU protected peer-to-peer DMA the xml file can be found at https://bpa.st/FARQ. when I try to start the vm, I get this: # virsh start streamer error: Failed to start domain 'streamer' error: internal error: QEMU unexpectedly closed the monitor (vm='streamer'): 2024-06-21T08:39:17.959476Z qemu-system-x86_64: -device {"driver":"vfio-pci","host":"0000:00:1f.4","id":"hostdev0","bus":"pcie.0","addr":"0x1f.0x5"}: vfio 0000:00:1f.4: group 18 is not viable Please ensure all devices within the iommu_group are bound to their vfio bus driver any ideas what am I missing? is it possible this cannot work within a vm? Thanks, Dagg

1 1

librbd encryption and guest XML
by melanie witt 17 Jun '24

17 Jun '24

Hi, I have been trying to use the librbd engine to run a guest from an encrypted RBD image and am running into some problems. What I would like to do is: 1. Start from an unencrypted raw image with an OS 2. Make an encrypted clone of that image 3. Boot a guest from the encrypted clone image What I have tried so far (simplified): 1. Make a clone of the unencrypted image rbd clone images/unencrypted@snap images/encryptedclone 2. Format the clone image with encryption rbd encryption format images/encryptedclone luks1 passphrase.bin 3. Create guest XML with the encrypted clone [...] <disk type="network" device="disk"> <driver type="raw" cache="writeback"/> <source protocol="rbd" name="images/encryptedclone"> <host name="127.0.0.1" port="6789"/> <encryption format="luks" engine="librbd"> <secret type="passphrase" uuid="secretuuid"/> </encryption> </source> <auth username="cinder"> <secret type="ceph" uuid="othersecretuuid"/> </auth> <target dev="vda" bus="virtio"/> </disk> [...] and virDomainCreateWithFlags() with the XML. I don't get any errors from libvirt (no errors about loading encryption) but this configuration does not seem to work, the guest won't boot. If anyone can give me a hint what I'm doing wrong, I would appreciate it. Cheers, -melwitt

2 3

brew services start libvirt failed to start libvirt on MacOS Sonoma
by absiplant＠gmail.com 17 Jun '24

17 Jun '24

Hello, I am hoping someone can point me in the right direction regarding issues I have starting up libvirt services on MacOS Sonoma. I am running: macOS Sonoma 14.5 llibvirt: stable 10.4.0 (bottled) qemu: stable 9.0.1 (bottled) I have the following entries in libvirt.conf: listen_tls = 0 listen_tcp = 1 listen_addr = "0.0.0.0" unix_sock_group = "libvirt" unix_sock_ro_perms = "0777" unix_sock_rw_perms = "0770" unix_sock_admin_perms = "0700" unix_sock_dir = "/opt/homebrew/var/run/libvirt" auth_unix_ro = "none" auth_unix_rw = "none" auth_tls = "none" tls_no_sanity_certificate = 1 tls_no_verify_certificate = 1 log_filters="1:qemu 1:libvirt 4:object 4:json 2:event 1:util" log_outputs="1:file:/opt/homebrew/var/log/libvirt/libvirtd.log" I added ```firewalld = 0``` and ```irewall_backend = "none"```. These made no difference, I have since removed both. Snippets of the log in debug mode indicate a usable firewall backend cannot be found, is there a way to resolve this on macOS? 8617315328: debug : virSystemdNotifyStartup:648 : Skipping systemd notify, not requested 6105182208: debug : virThreadJobSet:97 : Thread 6105182208 is now running job daemon-init 6105182208: warning : virProcessGetStartTime:1205 : Process start time of pid 10814 not available on this platform 6105182208: debug : virGDBusIsServiceEnabled:386 : Service org.freedesktop.login1 is unavailable 6105182208: debug : virStateInitialize:663 : Running global init for Remote state driver 6105182208: debug : virStateInitialize:670 : State init result 1 (mandatory=0) 6105182208: debug : virStateInitialize:663 : Running global init for bridge state driver 6105182208: error : virNetworkLoadDriverConfig:147 : internal error: could not find a usable firewall backend 6105182208: debug : virStateInitialize:670 : State init result -1 (mandatory=0) 6105182208: error : virStateInitialize:674 : Initialisation of bridge state driver failed: internal error: could not find a usable firewall backend 6105182208: error : daemonRunStateInit:617 : Driver state initialisation failed 6105182208: debug : virThreadJobClear:122 : Thread 6105182208 finished job daemon-init with ret=0 Thanks.

3 2

vfio usage in a vm
by daggs 14 Jun '24

14 Jun '24

Greetings, I wanted to know if it is possible to attach a virtual nic (shows up as 02:01.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8100/8101L/8139 PCI Fast Ethernet Adapter (rev 20)) to the vfio module, when I modprobe it I get this error: [ 854.624668] vfio-pci: probe of 0000:02:01.0 failed with error -22 Thanks, Dagg

2 4

Statically Defining a Network
by richard.schmitt＠starlab.io 13 Jun '24

13 Jun '24

We install libvirt in a AlmaLinux 9 Kickstart file. The version of libvirt we are using is 10.0.0. What we'd like to do is to statically define a network in the kickstart file without having to run `virsh net-define`. In other words, we had hoped that by installing a <network>.xml file in /usr/share/libvirt/networks, that that network would be recognized by libvirt the first time the system is booted. This does not appear to be the case. Is there a way to statically define libvirt networks without needing to run 'virsh net-define'? Thanks

3 3

Re: Guests: Unable to get IP address
by Michal Prívozník 11 Jun '24

11 Jun '24

Please keep the list on CC so that others can benefit from the conversation too. On 5/21/24 14:34, Arun Mani J wrote: > Thanks for the reply! > > I recreated the NAT network using the guide from https://wiki.libvirt.org/Networking.html. > > The configuration now reads as: > <network> > <name>default</name> > <uuid>33376669-6292-44c9-b26b-9d2ee69826a7</uuid> > <forward mode="nat"> > <nat> > <port start="1024" end="65535"/> > </nat> > </forward> > <bridge name="virbr0" stp="on" delay="0"/> > <mac address="52:54:00:78:76:0f"/> > <ip address="192.168.122.1" netmask="255.255.255.0"> > <dhcp> > <range start="192.168.122.2" end="192.168.122.254"/> > </dhcp> > </ip> > </network> > > There is a dhcp section but still I'm not able to get my guest working. > > I have dnsmasq-base package installed in my host. However I'm not sure how to see if that is running. Like I opened Systems Monitor and can't find any process with that name. > > So may be that's the problem? Well, have you restarted the network? You need the 'virsh net-destroy default && virsh net-start default' combo to restart it. After that you should see dnsmasq process, e.g. via 'ps axf | grep dnsmasq'. Michal

2 8

TLS live migrations and cgroups (cpuset)
by Giovanni Tirloni 30 May '24

30 May '24

Hello, I have got a situation where a live migration (TLS) is failing because the virtual machine has the following configuration: <vcpu placement='static' cpuset='0-1,3,5,7-47,49,51,53,55-95'>2</vcpu> This is in place because the host is shared with some other application with strict requirements and so the `machine.slice` was limited to these CPUs. During a live migration, libvirtd (running as root) seems to spawn a new rpc-libvirtd process with the same uid/gid defined in qemu.conf (non-root). It then fails to write to `cpuset.cpus`: virNetClientProgramDispatchError:172 : Unable to write to '/sys/fs/cgroup/cpuset/machine.slice/machine-qemu\x2d80\x2dinstance\x2d0000007c.scope/libvirt/emulator/cpuset.cpus': Permission denied Here are the running processes during the live migration: UID PID GID PPID CMD root 2639801 0 2639361 /usr/sbin/libvirtd --listen 12345 3033179 109 2638878 /usr/sbin/libvirtd --listen 12345 3033179 109 2638878 [rpc-libvirtd] (processes with uid=12345 are spawned during the migration. gid=109 is `kvm`) Changing group membership and file permissions has no effect because the file/directory permissions in machine.slice are not inherited inside the machine scope (a workaround was setting regular files as 664 and making the non-root UID of rpc-libvirtd be a member of the root group). I did not try to change the user/group in qemu.conf for fear of breaking other parts of the system or sabotaging security (e.g. by setting it to root/root for qemu-system-x86_64). The systemd scope for the machine has "Delegate=yes" so systemd expects the manager process to fully own the cgroups configuration. So looking at libvirtd, I cannot find a configuration setting that would either change the UID/GID of that rpc-libvirtd process or how to tweak the cgroups file permissions. Any insights? Environment: * Ubuntu 22.04 x86_64 * systemd 249.11 * libvirt 8.0.0

1 0

How can I create a VM in virt-manager that can access the internet through the host but can't even see the host or other devices on the LAN?
by imthenachoman＠gmail.com 22 May '24

22 May '24

I want to be able to create multiple VMs for testing purposes -- questionable websites, files that could be infected with a virus, etc. I want to make sure these VMs should be able to access the internet (through the host) but they should not be able to access the host or any other device on the LAN. I tried `NAT` mode but that let's me access the host and other devices on the LAN. I tried `Isolated` mode but that doesn't give me internet access. I don't want to run a second VM and route traffic through it. I want to avoid creating FW rules on the host or VMs because I'll be creating and destroying VMs all the time. And I think I need to use some kind of NAT because I don't want my router to know/see the VMs as clients. What do I need to do?

7 10

How to live migrate with copy-storage-inc and zfs snapshot replication?
by Dan Vatca 21 May '24

21 May '24

Hello everybody, I am trying to understand how I can create a setup with two libvirt + kvm + zfs systems, in which I can: 1. Create a domain on sys-a, with storage space on a zfs filesystem. This filesystem stores the qcow2 image, any qcow2 disk snapshots, memory dumps and domain XML definition. 2. Take consistent ZFS snapshots every 15 minutes, and sync them to sys-b. The snapshots will be replicated using syncoid. These will be using scripts to quiesce the VM. 3. Given that most of the disk is synced (at most 15 minutes ago), what are the things I need to ensure (libvirt snapshots, memory snapshot, etc), so that I can do a live migration while copying just the incremental changes since the last snapshot I already transferred? I was trying to use virsh migrate —copy-storage-inc, however I could not find any working example that would copy just the incremental changes. I could find the theory of the snapshot backing chain, however —copy-storage-inc complains that it cannot replicate while there are snapshots present. (error: Requested operation is not valid: cannot migrate domain with 1 snapshots). I this scenario possible? Dan Vatca

2 1

Guests: Unable to get IP address
by Arun Mani J 21 May '24

21 May '24

Hey all. I'm exploring virt-manager, libvirt etc. I downloaded Debian 12 KDE ISO and when launched using virt-manager, it does not seem to connect to network. nmcli says it has failed to get an IP address. However, if I run the same ISO inside GNOME Boxes, then it is able to connect to network. I checked the XML configuration of both and found this: ```xml <interface type="user"> <mac address="52:54:00:ea:f9:69"/> <model type="virtio"/> <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </interface> ``` However, the one created via virt-manager has this: ```xml <interface type="network"> <mac address="52:54:00:5d:c7:9e"/> <source network="default"/> <model type="virtio"/> <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/> </interface> ``` What I'm not able to understand is, why does the user mode networking work fine but not network mode? My ultimate goal is to set up routed configuration, so one can directly SSH into the guests. Packages: - virt-manager - 4.1.0 (Debian) - libvirt0 - 10.3.0-3 (Debian) - GNOME Boxes - 46.0 (Flatpak) Please let me know if you need any other information. It is a pretty much clean installation with no extra configuration, so I don't think I messed up anything. Thank you! Arun Mani J

2 1

stats : active memory / disk latency
by Peter Quiring 21 May '24

21 May '24

Two stats that VMWare offers that I can't seem to find in libvirt is "active" memory and disk latency. Any idea how I could extract these stats? libvirt offers memory stats such as maximum, current, unused, usable, etc. but these are all 100% or 0% of what the VM has available. Looking for an "active" value. /proc/memstat has similar stats within a Linux VM but need to get from libvirt. Disk latency is also sometimes critical information. Thanks, -- Peter Quiring

2 1

qemu guest agent with openbsd
by Christian Haumesser 13 May '24

13 May '24

Hello, I have an OpenBSD 7.5 guest running on Debian bookworm with libvirt (9.0) and qemu (7.2). I'd like to use the qemu guest agent in this guest, but I can't seem to figure out how to craft the libvirt xml to expose the serial port in a way that OpenBSD and libvirt can use it together (or if it’s even possible). Per the libvirt docs <https://wiki.libvirt.org/Qemu_guest_agent.html>, I’m currently using: > <channel type='unix'> > <source mode='bind'/> > <target type='virtio' name='org.qemu.guest_agent.0'/> > </channel> But OpenBSD doesn’t directly support the virtio console driver. Consistent with this 2020 thread <https://undeadly.org/cgi?action=article;sid=20200514073852> from the OpenBSD ports making list, I see the following message in my guest’s dmesg output: > virtio5 at pci0 dev 10 function 0 "Qumranet Virtio Console" rev 0x00 > virtio5: no matching child driver; not configured Thanks to this libvir-list thread <https://listman.redhat.com/archives/libvir-list/2015-October/120250.html> from 2015, I’ve realized that I can manually expose an ISA serial console that will allow me to connect to the guest agent using native qemu tooling; but there doesn’t seem to be a way to create a channel that libvirt can communicate over without virtio console support in the guest. The thread discusses a couple of approaches to resolving this issue with code changes, but it seems like the discussion stalled out before anything happened. Am I missing something or is it still impossible? Thanks!

2 2

jfKVM - new app using libvirt
by Peter Quiring 06 May '24

06 May '24

jfKVM is a new web-based VM management system based on libvirt. jfkvm.sf.net https://pquiring.github.io/javaforce/projects/jfkvm/docs/help.html Thanks, -- Peter Quiring

1 1

What's wrong with internal VM snapshots?
by Marius Vollmer 06 May '24

06 May '24

Hi! I am trying to improve the support for VM snapshots in the Cockpit web console, and I am afraid I have questions... We have been asked to prefer the "external" over the "internal" snapshot format, at least on RHEL. I haven't yet figured out why, and consequently I am struggling with deciding how hard the Cockpit UI should push people towards external snapshots. So, what's wrong with internal snapshots? I heard they are "unreliable", but how so in detail? Does the data structure inside the qcow2 files get corrupted easily? Do they behave poorly when the snapshot process runs out of disk in the middle? That sort of thing would help me a lot to figure out what Cockpit should be doing on platforms other than RHEL. And how well (or how soon) can external snapshots be expected to work? I have severely messed up my libvirt state a couple of times while playing around with them, and my confidence in them right now isn't great. :-) Are you surprised by this? Or are external snapshots not yet considered ready? (Most recent example from my experiments: Deleting a full system snapshot of a paused machine fails with "internal error: unable to execute QEMU command 'block-commit': Block node is read-only". Reverting to it works and after that it can also be deleted, all while the VM is paused.) Thanks!

2 5

Error Cannot acquire state change lock from remoteDispatchDomainMigratePrepare3Params during live migration of domains
by Christian Rohmann 25 Apr '24

25 Apr '24

Hallo libvirt-users! we observe lock-ups / timeouts with in prometheus-libvirt-exporter (https://github.com/inovex/prometheus-libvirt-exporter) when libvirt is live-migrating domains: > Timed out during operation: cannot acquire state change lock (held by > monitor=remoteDispatchDomainMigratePrepare3Params) All of the source code can be found at: https://github.com/inovex/prometheus-libvirt-exporter/blob/master/pkg/expor…. Basically the error happens when DomainMemoryStats or other operational domain info is queried via the libvirt socket. 1) We are actually using the read-only socket at '/var/run/libvirt/libvirt-sock-ro', so there should not be any locking required. Is there any way to not run into lock contention, like running a request with some "nolock" indication? 2) This being reported as timeout waiting for the lock, what is the timeout and would waiting a bit longer help? Or is the lock active during the whole time a domain live migration is running? 3) Is this in any way related to the type of migration? Tunneled vs. native (https://libvirt.org/migration.html)? 4) Is there any indication that we could use to skip those domains (or certain queries)? The same issue was actually previously reported for another implementation of a Prometheus exporter (https://github.com/kumina/libvirt_exporter/issues/33) Currently the exporter locks up or throws the mentioned timeout errors during the the migration of 200 domains, 5 at a time. It would be awesome to find a way to make this work as smooth as possible, even during live migrations! I am thankful for any insights into how the libvirt socket, the various calls, the locking mechanisms or live migration modes work! Regards Christian

5 10

How to configure the default connection for virsh
by Nir Soffer 18 Apr '24

18 Apr '24

We are using minikube vms, which require adding the user to to libvirt group[1]. We use `virsh -c qemu:///system` for debugging these vms or related libvirt networks. Using virsh without specifying the '-c' argument is a common mistake that leads to trouble, for example creating the libvirt default network incorrectly. I wonder if it is possible to configure virsh so it uses -c qemu:///system by default? We know that this is not great, but we don't know a better way to use minikube with the kvm2 driver. The minikube vms are started for creating a development environment and during CI, and they cannot require a password or any complicated setup. [1] https://github.com/kubernetes/minikube/issues/3467 Nir

2 2

Linking virtual sound cards in two virtual machines?
by Lars Kellogg-Stedman 15 Apr '24

15 Apr '24

I would like to create a virtual audio cable between two libvirt guests such that sound output from guest A goes to sound input on guest B, and vice versa. I figure the solution to this is using something like the pulseaudio's "virtual sink", but I'm not entirely sure what the syntax would look like (fwiw, I'm on Fedora 39, which means libvirt 9.7.0, which means this has to be through libvirt's pulseaudio driver rather than the pipewire driver, since the latter isn't available in 9.7.0). I started by creating a virtual sink (and yes, I realize that's only half the process): pactl load-module module-null-sink sink_name=vaudio0 And adding the following snippet to the domain xml for guest "node1.virt": <audio id='1' type='pulseaudio'> <input name='vaudio0' streamName='node1-in' latency='100'/> <output name='vaudio0' streamName='node1-out' latency='100'/> </audio> But trying to start this guest results in: error: Failed to start domain 'node1.virt' error: internal error: process exited while connecting to monitor: audio: Could not init `pa' audio driver There doesn't appear to be any additional information in /var/log/libvirt/qemu/node1.virt.log. I'm wondering if someone has an example of what this might look like? Thanks, -- Lars Kellogg-Stedman <lars(a)redhat.com>

1 0

'nconnect' nfs mount option support
by Abhisar Sinha 15 Apr '24

15 Apr '24

Hi, Is there a way to specify the 'nconnect' nfs mount opt value in the XML file used by 'virsh create-pool' command? If not, how hard would it be to implement this functionality? Please advise. Thanks, Abhisar

2 1

TLS Configuration with libvirt and Perfect Forward Secrecy
by Tommy.J.Mairo 09 Apr '24

09 Apr '24

Dear libvirt Users, I'm seeking guidance on configuring TLS with libvirt to achieve perfect forward secrecy (PFS). While I followed the tutorial on setting up TLS with libvirt from the project wiki [1], I encountered an error when bringing up the legacy monolithic libvirt daemon. The error message, "Certificate /etc/pki/libvirt/servercert.pem usage does not permit key encipherment," appeared even though I declared the "encryption_key" field in the certtool template file when generating the server certificate. Moreover, when I inspected the generated certificate with certtool, I discovered that it only had a "Digital signature" entry under X509v3 key usage. The deficiency in "Key Encipherment" usage could result from the key type specifications when generating the private key with the command "certtool --generate-privkey --key-type=ed25519 --curve=Ed25519 --sec-param=ultra > /etc/pki/libvirt/private/serverkey.pem". I prefer using elliptic-curve cryptography, specifically curve25519, over RSA, which the tutorial employs. Although a digital signature-only certificate can still perform Diffie–Hellman exchanges with ECDSA, it cannot encrypt client-generated pre-master secrets. Nonetheless, a TLS session can still be established without pre-master secrets, avoiding session key leakage even if the decryption key is compromised in the future. This fulfills the PFS requirement, and I believe that a certificate without "Key Encipherment" usage contributes to the system's overall security. Based on my understanding, I am seeking any insights or suggestions on whether there is a way to suppress the "certificate usage does not permit key encipherment" error and allow the legacy monolithic libvirt daemon to proceed. Thanks, Tommy.J.Mairo [1] https://wiki.libvirt.org/TLSSetup.html

1 0

all domains paused, maybe logging might be helpfull
by Lennart Fricke 21 Mar '24

21 Mar '24

Hello, I just hit the situation that all domains on a host where paused due to missing space. It took me some time to figure out that there was no space left for the images on the host. I learned that 'virsh domstate --reason $GUEST' and 'domblkerror $GUEST' could have helped me. But the logs are silent about the problem. Would it be possible to show these problems in logs or is there other documentation than the reference to find out how to troubleshoot those issues? Thank you Lennart

2 3