- Users - libvirt List Archives

Cannot access guest with bridged networking when using firewalld (nftables backend) on Debian 12 Bookworm
by Niccolò Belli 12 Jul '23

12 Jul '23

firewalld version 1.3.0-1 libvirt version 9.0.0-4 network-manager version 1.42.4-1 # firewall-cmd --get-active-zones libvirt interfaces: br28 public interfaces: dac0 dac0.100 dac0.28 ftth # firewall-cmd --list-all --zone=public public (active) target: default icmp-block-inversion: no interfaces: dac0 dac0.100 dac0.28 ftth sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: dac0 is a Direct Attach cable with several vlans. dac0.100 is the vlan where I create the ppoe connection from my FTTH provider. ftth is the ppp name. dac0.28 is the vlan for the public /28 IPv4 subnet. br28 is the bridge where dac0.28 is attached. # brctl show bridge name bridge id STP enabled interfaces br28 8000.d2605c025b1d no dac0.28 vnet1 # firewall-cmd --list-all --zone=libvirt libvirt (active) target: ACCEPT icmp-block-inversion: no interfaces: br28 sources: services: dhcp dhcpv6 dns ssh tftp ports: protocols: icmp ipv6-icmp forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule priority="32767" reject # nft list tables table inet firewalld table ip mangle # nft list table ip mangle # Warning: table ip mangle is managed by iptables-nft, do not touch! table ip mangle { chain FORWARD { type filter hook forward priority mangle; policy accept; oifname "ftth" tcp flags syn / syn,rst tcp option maxseg size 1400-65495 counter packets 0 bytes 0 tcp option maxseg size set rt mtu } } The previous rule is created by NetworkManager to clamp-mss-to-pmtu for the ftth pppoe. This is how I create the bridge and the dac0.28 vlan with NetworkManager: # nmcli con add ifname br28 type bridge con-name br28 ipv4.method manual ipv4.addresses MY_IP/28 connection.zone libvirt # nmcli connection add type vlan con-name dac0.28 ifname dac0.28 vlan.parent dac0 vlan.id 28 ipv4.method disabled ipv6.method disabled master br28 slave-type bridge I also have isc-dhcp-server, wide-dhcpv6-client and radvd running. # nmcli con NAME UUID TYPE DEVICE ftth f370639c-2712-49c2-9749-e39f17102346 pppoe ftth br28 e4d2aad3-ef2d-4ac0-bda5-58471f21655c bridge br28 lo f0327b03-bbc3-4078-8bd1-5225df0ce153 loopback lo vnet1 25ae75cd-1606-4fd7-8213-09f4ef1280c4 tun vnet1 dac0 040e747e-fd7e-41e9-b6a6-ccec9e73c022 ethernet dac0 dac0.100 147c1632-2c60-42f3-a97a-a6733ef69f4c vlan dac0.100 dac0.28 cefb4bf3-dda9-465a-95d0-512ac1294a5b vlan dac0.28 enp1s0 81a44a95-efdc-47e2-9c12-76a0a140ca5a ethernet -- The previous are all dark green expect lo and vnet1 which are light green (externally managed) and enp1s0 which is white (disconnected). The br_netfilter module is not loaded and thus net.bridge.bridge-nf-call-ip6tables, net.bridge.bridge-nf-call-iptables, net.bridge.bridge-nf-call-arptables are not even exposed to /proc/sys/net/bridge. I don't have any nwfilter enabled yet, I'd like to get the basics working first. The guest gets an IP (both v4 and v6) and can reach the internet. Unfortunately the guest cannot be reached from the outside: $ ping GUEST_IP PING GUEST_IP (GUEST_IP) 56(84) bytes of data. From FTTH_IP icmp_seq=1 Packet filtered $ ssh GUEST_IP ssh: connect to host GUEST_IP port 22: No route to host Routed networking works fine, but libvirt is in charge to create everything in that case (creating the bridge, assigning the libvirt-routed zone, enabling the libvirt-routed policies, etc) while bridged networking must be configured manually (at least on non-RedHat distros). What's wrong? It looks suspiciously similar to https://bbs.archlinux.org/viewtopic.php?id=274670 Thanks, Niccolo' Belli

1 0

Starting guest VM with default NAT network breaks host routing
by Mathias Gibbens 19 Jun '23

19 Jun '23

I'm running libvirt 9.0.0 on a Debian 12 bookworm host, setting up a Windows 11 guest using qemu-kvm and the default NAT network[1]. When I start the guest VM, it successfully acquires a DHCP lease, and I can ping other hosts on my local network subnet, but something then happens which messes up routing on the *host* machine, resulting in no access to anything beyond my LAN. If I shutdown the VM, network access returns to normal on the host system. I've been unable to figure out how to fix this, and unfortunately the terms are generic enough that Google isn't much help -- most of the results are about issues with NAT setup (which is working), not route configuration of the host. I did find one similar report[2], but there's no reported solution. I feel like this should be a very common use case, so maybe I've just setup something wrong. Since I haven't been able to solve it on my own, I'm hoping someone will have a pointer to get me going in the right direction. Further details are below, and I'm happy to provide anything else that might prove useful. Thanks, Mathias Before starting the guest VM, routes on the host are: > $ ip route > default via 172.20.1.1 dev wlan0 proto dhcp src 172.20.1.110 metric 600 > 169.254.0.0/16 dev virbr0 scope link metric 1000 linkdown > 172.20.1.0/24 dev wlan0 proto kernel scope link src 172.20.1.110 metric 600 > 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown A few seconds after the guest finishes booting, the host gets some new routes, and connectivity outside of the local LAN subnet breaks: > $ ip route > 0.0.0.0 dev vnet0 scope link > default dev vnet0 scope link > default via 172.20.1.1 dev wlan0 proto dhcp src 172.20.1.110 metric 600 > 169.254.0.0/16 dev vnet0 proto kernel scope link src 169.254.103.112 > 169.254.0.0/16 dev virbr0 scope link metric 1000 > 172.20.1.0/24 dev wlan0 proto kernel scope link src 172.20.1.110 metric 600 > 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 Within the guest, I can ping the NAT gateway (192.168.122.1), the host's IP (172.20.1.110), and another computer on the network (172.20.1.105), so NAT appears to be working correctly: > C:\Users\user>ipconfig /all > > Windows IP Configuration > > Host Name . . . . . . . . . . . . : DESKTOP-LGNEPEC > Primary Dns Suffix . . . . . . . : > Node Type . . . . . . . . . . . . : Hybrid > IP Routing Enabled. . . . . . . . : No > WINS Proxy Enabled. . . . . . . . : No > > Ethernet adapter Ethernet: > > Connection-specific DNS Suffix . : > Description . . . . . . . . . . . : Red Hat VirtIO Ethernet Adapter > Physical Address. . . . . . . . . : 52-54-00-AE-05-B2 > DHCP Enabled. . . . . . . . . . . : Yes > Autoconfiguration Enabled . . . . : Yes > Link-local IPv6 Address . . . . . : fe80::2881:98b7:34b8:fe2%11(Preferred) > IPv4 Address. . . . . . . . . . . : 192.168.122.203(Preferred) > Subnet Mask . . . . . . . . . . . : 255.255.255.0 > Lease Obtained. . . . . . . . . . : Monday, June 19, 2023 14:03:57 > Lease Expires . . . . . . . . . . : Monday, June 19, 2023 15:03:57 > Default Gateway . . . . . . . . . : 192.168.122.1 > DHCP Server . . . . . . . . . . . : 192.168.122.1 > DHCPv6 IAID . . . . . . . . . . . : 340939776 > DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2C-0E-E6-F4-52-54-00-AE-05-B2 > DNS Servers . . . . . . . . . . . : 192.168.122.1 > NetBIOS over Tcpip. . . . . . . . : Enabled > > C:\Users\user>ping 192.168.122.1 > > Pinging 192.168.122.1 with 32 bytes of data: > Reply from 192.168.122.1: bytes=32 time<1ms TTL=64 > Reply from 192.168.122.1: bytes=32 time<1ms TTL=64 > Reply from 192.168.122.1: bytes=32 time<1ms TTL=64 > Reply from 192.168.122.1: bytes=32 time<1ms TTL=64 > > Ping statistics for 192.168.122.1: > Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), > Approximate round trip times in milli-seconds: > Minimum = 0ms, Maximum = 0ms, Average = 0ms > > C:\Users\user>ping 172.20.1.110 > > Pinging 172.20.1.110 with 32 bytes of data: > Reply from 172.20.1.110: bytes=32 time<1ms TTL=64 > Reply from 172.20.1.110: bytes=32 time<1ms TTL=64 > Reply from 172.20.1.110: bytes=32 time<1ms TTL=64 > Reply from 172.20.1.110: bytes=32 time<1ms TTL=64 > > Ping statistics for 172.20.1.110: > Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), > Approximate round trip times in milli-seconds: > Minimum = 0ms, Maximum = 0ms, Average = 0ms > > C:\Users\user>ping 172.20.1.105 > > Pinging 172.20.1.105 with 32 bytes of data: > Reply from 172.20.1.105: bytes=32 time=49ms TTL=63 > Reply from 172.20.1.105: bytes=32 time=31ms TTL=63 > Reply from 172.20.1.105: bytes=32 time=26ms TTL=63 > Reply from 172.20.1.105: bytes=32 time=26ms TTL=63 > > Ping statistics for 172.20.1.105: > Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), > Approximate round trip times in milli-seconds: > Minimum = 26ms, Maximum = 49ms, Average = 33ms ----- [1] -- Here's the NAT configuration: > <network> > <name>default</name> > <uuid>ff6cd6ed-a8fe-4e50-8852-3c93a169e156</uuid> > <forward mode="nat"> > <nat> > <port start="1024" end="65535"/> > </nat> > </forward> > <bridge name="virbr0" stp="on" delay="0"/> > <mac address="52:54:00:4e:80:30"/> > <ip address="192.168.122.1" netmask="255.255.255.0"> > <dhcp> > <range start="192.168.122.2" end="192.168.122.254"/> > </dhcp> > </ip> > </network> [2] -- https://unix.stackexchange.com/questions/723091/kvm-booting-guest-breaks-ne…

1 0

Changing EFI boot order via API
by Lukas Zapletal 19 Jun '23

19 Jun '23

Hello, I would like to be able to change the boot order of an EFI VM via libvirt API. Specifically, I am looking into configuring a VM to boot over HTTP UEFI Boot or HTTPS UEFI Boot (also available as HTTP IPv4 in the firmware). Is this possible? I cannot find anything relevant in the documentation. Thanks. -- Later, Lukas @lzap Zapletal

2 2

Re: virsh not connecting to libvertd ?
by Jerry Buburuz 16 Jun '23

16 Jun '23

Michal PrÃvoznÃk > On 6/12/23 20:17, Jerry Buburuz wrote: >> Just found my issue. >> After I removed the cephfs mounts it worked! >> I will debug ceph. >> I assumed because I could touch files on mounted cephfs it was working. Now virsh list works! > Out of curiosity. Do you perhaps have a storage pool defined over cephfs? I can see two possible sources for the problem: > 1) autostarted storage pool that makes libvirt mount cephfs, or My storage is hard mounted in fstab. This works and it does mount on boot. # fstab on hypervisor user@.mynamefs-01=/ /data ceph noatime,_netdev 0 0 usern@.mynamefs-02=/ /data2 ceph noatime,_netdev 0 0 > 2) a storage pool defined over a path where cephfs is mounted. > The problem with 1) is obvious (in fact it's not specific to ceph, if it was NFS/iSCSI and the server wasn't responding then libvirtd would just hang). I agree with NFS/cephfs or any storage over the network if its not available libvirtd defined pools will cause problems. > The problem with 2) is that for some types of storage pools ('dir' typically) libvirt assumes they are always 'running'. And proceeds to enumerate volumes in that pool (i.e. files under the dir). And if there's a stale mount point, this might stuck libvirtd. But again, this is not limited to ceph, any network FS might do this. > Michal In my case I built this hypervisor using cephfs as my primary storage for virtualmachines over the past year. Its has worked until recently. Recently I had issue with my ceph which likely caused a stale mount. In the past if the storage went offline, after fixing the issue I had no problems and my virualmachines came back to life. In the current case I found: * cephfs working as normal. healthy. * hypervisors mounting using fstab as usual. * libvirtd starts normally no errors (even with cephfs mounted) * virsh fails to connect to libvirt when the cephfs is mounted. If I umount /cephfs, and systemctl restart libvirtd. virsh works! Example "virsh list" , "virsh version" ..etc. I am going to try and maybe delete the iso pools I have. One interesting thing I found yesterday after I restart the hypervisor and try umount /cephfs, libvirtd has one of my pools locked and opened. Its the pool with iso in it. I know someone in a previous response to me mentioned they had issues with iso being stored on cephfs and libvirtd. In order for me to umount /cephfs I have to stop all libvirtd services(livrtd, libvirtd.socket .. ro .. and admin). This makes sense libvirtd has defined pools in my cephfs. thanks jerry

1 0

virsh not connecting to libvertd ?
by Jerry Buburuz 16 Jun '23

16 Jun '23

I have identical two hypervisors same operating system: Ubuntu 22.04.2 LTS Recently both virsh stopped talking to the libvirtd. Both stopped within a few days of each other. Currently if I run: virsh uri virsh version virsh list # virsh list ..nothing just hangs When I ran strace on these broken machines it get stuck at same spot: strace virsh list ... access("/var/run/libvirt/virtqemud-sock", F_OK) = -1 ENOENT (No such file or directory) access("/var/run/libvirt/libvirt-sock", F_OK) = 0 socket(AF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sa_family=AF_UNIX, sun_path="/var/run/libvirt/libvirt-sock"}, 110) = 0 getsockname(5, {sa_family=AF_UNIX}, [128 => 2]) = 0 futex(0x7fa716a672f0, FUTEX_WAKE_PRIVATE, 2147483647) = 0 fcntl(5, F_GETFD) = 0 fcntl(5, F_SETFD, FD_CLOEXEC) = 0 fcntl(5, F_GETFL) = 0x2 (flags O_RDWR) fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 futex(0x7fa716a67348, FUTEX_WAKE_PRIVATE, 2147483647) = 0 eventfd2(0, EFD_CLOEXEC|EFD_NONBLOCK) = 6 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 write(4, "\1\0\0\0\0\0\0\0", 8) = 8 write(4, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x7fa70c001cb0, FUTEX_WAKE_PRIVATE, 1) = 1 futex(0x7fa716a6786c, FUTEX_WAKE_PRIVATE, 2147483647) = 0 futex(0x7fa716a67378, FUTEX_WAKE_PRIVATE, 2147483647) = 0 write(4, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x7fa70c001cb0, FUTEX_WAKE_PRIVATE, 1) = 1 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 rt_sigprocmask(SIG_BLOCK, [PIPE CHLD WINCH], [], 8) = 0 poll([{fd=5, events=POLLOUT}, {fd=6, events=POLLIN}], 2, -1) = 2 ([{fd=5, revents=POLLOUT}, {fd=6, revents=POLLIN}]) read(6, "\2\0\0\0\0\0\0\0", 16) = 8 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 futex(0x5628ce6e9710, FUTEX_WAKE_PRIVATE, 2147483647) = 0 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 write(5, "\0\0\0\34 \0\200\206\0\0\0\1\0\0\0B\0\0\0\0\0\0\0\0\0\0\0\0", 28) = 28 write(6, "\1\0\0\0\0\0\0\0", 8) = 8 rt_sigprocmask(SIG_BLOCK, [PIPE CHLD WINCH], [], 8) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}], 2, -1) = 1 ([{fd=6, revents=POLLIN}]) read(6, "\5\0\0\0\0\0\0\0", 16) = 8 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}], 2, -1 It gets stuck at this poll(). Note I tested strace on identical new install of ubtuntu 22.04 where virsh connects fine and get identical strace, except after this poll() it continues on with read/write ..etc. I turned on debugging for libvirtd and get no errors while virsh is trying to connect. I am able to get a virsh# shell. The shell only hangs when I try "connect, uri, version". Another method of debugging I tried was: LIBVIRT_DEBUG=error LIBVIRT_LOG_FILTERS="1:* " virsh uri .. .. 2023-06-06 20:51:22.312+0000: 1647: debug : doRemoteOpen:1128 : Trying authentication 2023-06-06 20:51:22.312+0000: 1647: debug : virNetMessageNew:44 : msg=0x55b996539680 tracked=0 2023-06-06 20:51:22.312+0000: 1647: debug : virNetMessageEncodePayload:383 : Encode length as 28 2023-06-06 20:51:22.312+0000: 1647: info : virNetClientSendInternal:2151 : RPC_CLIENT_MSG_TX_QUEUE: client=0x55b996538010 len=28 prog=536903814 vers=1 proc=66 type=0 status=0 serial=0 2023-06-06 20:51:22.312+0000: 1647: debug : virNetClientCallNew:2107 : New call 0x55b996535f80: msg=0x55b996539680, expectReply=1, nonBlock=0 2023-06-06 20:51:22.312+0000: 1647: debug : virNetClientIO:1920 : Outgoing message prog=536903814 version=1 serial=0 proc=66 type=0 length=28 dispatch=(nil) 2023-06-06 20:51:22.312+0000: 1647: debug : virNetClientIO:1978 : We have the buck head=0x55b996535f80 call=0x55b996535f80 2023-06-06 20:51:22.312+0000: 1647: info : virEventGLibHandleUpdate:195 : EVENT_GLIB_UPDATE_HANDLE: watch=1 events=0 2023-06-06 20:51:22.312+0000: 1647: debug : virEventGLibHandleUpdate:206 : Update handle data=0x55b996534d30 watch=1 fd=5 events=0 2023-06-06 20:51:22.312+0000: 1647: debug : virEventGLibHandleUpdate:229 : Removed old handle source=0x55b996534de0 2023-06-06 20:51:22.312+0000: 1648: debug : virEventRunDefaultImpl:341 : running default event implementation Any help would be appreciated. thanks jerry

5 7

site certificate
by Daan Hoogland 13 Jun '23

13 Jun '23

LS, I am sure you have already noticed but I want to report it anyway; When compiling a dependend on "https://libvirt.org/maven2/net/juniper/tungsten/juniper-tungsten-api/2.0/ju…", I get a certificate error. I get the a similar error when accessing https://libvirt.org btw hope you can do something with this information, -- Daan

2 1

Criteria used to allow or not live migration
by Gianluca Cecchi 02 Jun '23

02 Jun '23

Hello, I would like to know what are the criteria that allow or not live migration when source and dest hosts have same CPU type (eg Intel) but different models (eg cascade lake vs ice lake). I imagine it is libvirtd to drive this decision, correct? Does libvirt has a sort of table or list of cpu flags that are mandatory / optional? Or how is it established to prevent or not live migration across different couodels systems? Thanks, Gianluca

1 0

issue about libvirtd: daemon can not start
by 王东亚 30 May '23

30 May '23

hi, I installed kmv on ubuntu-22.04-desktop-amd64, after installing some necessary package (qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virtinst), the libvirtd can not get start, actually, when I running systemctl start libvirtd.service, it'll run a little while (about 3 sec) and then it stops, or should I say it never start. I checked the status, it says ExecStart=/user/sbin/libvirtd $LIBVIRTD_ARGS (code=dumped, signal=TRAP) I processed journalctl -p err, it says ../../../glib/gmem.c:167 failed to allocate xxxxxxx bytes my laptop has 8G phycial memory any suggestion will be appricate. Best Regards.

2 1

Question regaring correct usage of CPU shares
by mailing-libvirt＠posteo.de 26 May '23

26 May '23

Hi there, I have a question regarding the shares option of the cputune section. I want to illustrate my question with the following example. Let's assume I have two virtual machines like the following on four dedicated core with two threads each: VM1: <cputune> <shares>512</shares> <vcpupin vcpu="0" cpuset="0"/> <vcpupin vcpu="1" cpuset="4"/> </cputune> VM2: cputune> <shares>512</shares> <vcpupin vcpu="0" cpuset="1"/> <vcpupin vcpu="1" cpuset="5"/> <vcpupin vcpu="2" cpuset="2"/> <vcpupin vcpu="3" cpuset="6"/> <vcpupin vcpu="4" cpuset="3"/> <vcpupin vcpu="5" cpuset="7"/> </cputune> Those two virtual machines I just mentioned won't interfere with one another since they are pinned to different cores. However I introduce another, third virtual machine, like this: VM3: <cputune> <shares>512</shares> <vcpupin vcpu="0" cpuset="0"/> <vcpupin vcpu="1" cpuset="4"/> <vcpupin vcpu="2" cpuset="1"/> <vcpupin vcpu="3" cpuset="5"/> <vcpupin vcpu="4" cpuset="2"/> <vcpupin vcpu="5" cpuset="6"/> <vcpupin vcpu="6" cpuset="3"/> <vcpupin vcpu="7" cpuset="7"/> </cputune> What I want is that VM1, VM2 and VM3 all receive half of the cores CPU time if congestion appears. My question is how the shares are calculated. Are they calculated on a per core basis? Meaning VM1 and VM3 use the first core so each will get half of the cores capacity when congestion appears, or are the shares calculated over all cores a virtual machine uses and I need to scale the amount of shares with increasing number of cores. What is the correct setting here so that all virtual machines in this example are guaranteed half of the capacity of each of their respective cores if congestion appears? Thank you.

2 1

Cron jobs not working with virsh commands
by Jeff Brown 26 May '23

26 May '23

Recently, while testing backup scripts, I happened to notice that 'virsh snaphot-create-as . . .' has been failing with 'error: failed to get domain '$DOMAIN'' when run through crontab. So I've been unwittingly backing up the live, running, QCOW2 images for quite some time because scripts which run fine when testing from CLI, fail to work as expected when run as a cron job. After much searching, I stumbled upon a related issue with the (obvious?) simple solution almost hidden in the answers. You have to explicitly connect to the local server with, e.g.: virsh -c qemu:///system snapshot-create-as . . . Humble apologies if I missed something I should have been aware of, but I just thought it worthwhile mentioning here for anyone else searching for an answer in the archives. Best regards, Jeff

2 1

fails to start @boot - service-start-limit-hit
by lejeczek 24 May '23

24 May '23

Hi guys. When I login to the system I find: UNIT LOAD ACTIVE SUB DESCRIPTION ● virtproxyd.service loaded failed failed Virtualization daemon ● virtproxyd-admin.socket loaded failed failed Libvirt proxy admin socket ● virtproxyd-ro.socket loaded failed failed Libvirt proxy local read-only socket ● virtproxyd-tls.socket loaded failed failed Libvirt proxy TLS IP socket ● virtproxyd.socket loaded failed failed Libvirt proxy local socket only 'virtproxyd-tls.socket' is enabled -> $ journalctl -l -o cat -u virtproxyd-tls.socket virtproxyd-tls.socket: Failed with result 'service-start-limit-hit'. Closed Libvirt proxy TLS IP socket. But any use of 'virtproxyd-tls.socket' from that point on, is successful - VM migrates to/from okey. I think pcs/pacemaker cluster plays a role in it for it must be - I'm guessing - trying to migrate a single VM back to booting-up node, though.. 'resource-agents-deps.target' is told to 'After=virtproxyd-tls.socket', among other 'after' bits. To confirm this suspicion - I put the node into 'standby' then I reboot and I get none of those failures mentioned above. & to make it an utterly curious test case - all these 'failures' only started after the node was remove from IPA domain ! If I make the node again a client/member of IPA (same as before) domain then - standby or not - all those services above fail @boot no more! I'd be very glad to read suggestions/thoughts you can share. many thanks, L.

1 0

Adding custom xml:ns to definitions for additional application
by Darragh Bailey 19 May '23

19 May '23

Hi, I'm looking at adding support to vagrant-libvirt to add some additional XML to the network definitions it creates following https://libvirt.org/formatnetwork.html#general-metadata assuming the metadata element is to be treated the same as what is listed for domains https://libvirt.org/formatdomain.html#general-metadata (app metadata isn't explained What I was wondering is if there are any expectations around the URI used? Or recommendations? I was hoping to use http://vagrant-libvirt.github.io/v1/network as it's at least under control of the maintainers. However I wasn't planning to publish anything there unless that is needed? Reason behind this is that I want to annotate networks created and managed by vagrant-libvirt so that teardown can be safely done without accidentally destroying networks that have been manually created. As well as allowing CI systems that might have multiple agents running on the same host to be able to safely create and destroy machines with network definitions in parallel with any attempts to remove a network that has just been created being prevented without networks ending up persisting forever. https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1738 summaries what I'm hoping to do. -- Darragh Bailey "Nothing is foolproof to a sufficiently talented fool"

1 0

Invalid value '-1' for 'cpu.max': Invalid argument - a result of?
by lejeczek 17 May '23

17 May '23

Hi guys. In hope that an expert read this - what is, can be, the below a result of? 12284 still running (86040) Invalid value '-1' for 'cpu.max': Invalid argument 12284 still running (86035) 12284 still running (86030) this is a snippet from libvirtd logs which is a consequence of what ovirt's engine setup is doing. To troubleshoot ansible playbooks which is what engine setup does, as I understand it, would be an impossible task for me so I reckoned I should try this end. many thanks, L.

2 5

<qemu:commandline> ignored ?
by lejeczek 16 May '23

16 May '23

Hi guys. I have a domain definition with this: ... <qemu:commandline> <qemu:arg value='-fw_cfg'/> <qemu:arg value='name=opt/com.coreos/config,file=/00-VMs/oshift1node.ign'/> </qemu:commandline> </domain> at the bottom of xml. 'virsh' creates domain a okey but in VM I do not see ignition happened - it's fedora coreos - and when I dumpxml running domain, then indeed those bits, show above, are not there. I'd grateful for any/all thoughts shared on - what is not/happening there. Is there something else which is a prerequisite to 'qemu:commandline' but if yes and I'm missing those, why would not then 'virsh' and/or 'virtqemud' say something? many thanks, L.

5 7

Re: PHP API
by Michal Prívozník 15 May '23

15 May '23

On 5/11/23 20:19, Simon Fairweather wrote: > Hi Michal, > > Would you be able to add, if there is a process you follow I can look at > creating merge requests. > > Regards > Simon > > int virDomainBlockPull (virDomainPtr > <https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainPtr> dom, > const char * disk, > unsigned long bandwidth, > unsigned int flags) > > > int virDomainBlockCopy (virDomainPtr > <https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainPtr> dom, > const char * disk, > const char * destxml, > virTypedParameterPtr > <https://libvirt.org/html/libvirt-libvirt-common.html#virTypedParameterPtr> params, > int nparams, > unsigned int flags)intvirDomainBlockPull (virDomainPtr > <https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainPtr>dom, > > > On Wed, May 3, 2023 at 12:42 PM Michal Prívozník <mprivozn(a)redhat.com > <mailto:mprivozn@redhat.com>> wrote: > > On 4/30/23 20:29, Simon Fairweather wrote: > > Hi Michal > > > > Are there plans to implement snapshot create_as version of the > > following function where XML could be passed? > > Honestly, there are no plans for libvirt-php. I maintain it in my spare > time and implement features as somebody requests them. Let me implement > it. And also fix the issue you've filled earlier this week. > > Michal > Posted as: https://gitlab.com/libvirt/libvirt-php/-/merge_requests/39 Michal

1 0

Windows Guest on KVM running "single core" after windows update
by Benjammin2068 11 May '23

11 May '23

Hey all, I have a Windows 10 pro (64bit) long time running as a libvirt/KVM guest that I think Windows Update finally narfed. The hardware is a supermicro motherboard with dual Intel E5-2640 CPUs for a total of 40 threads and 64GB The guest is allocated 2sockets, 5cores, 2 threads and 32GB of RAM. (I've also tried 1 socket, 20 cores, 1 thread and 1s10c2t -- no help) In an SSH session to the linux host (CentOS7 - up to date), htop shows 1 core pegged and abnormal distribution of load (like it used to) even with fun little tools in Windows like the PowerToy -> CPUStress64.exe (i.e. the head CPU will show 90-99% and next thread in HTOP will show like 10% which then trails off to like 5%) Even if I tell CPUStress64.exe to load up 10 or 15 threads worth of 100%. Has anyone else seen this? Thanks, -Ben

3 5

how to get domain name into the logs - ?
by lejeczek 09 May '23

09 May '23

Hi guys. I have libvirt/qemu setup with pretty vanilla settings and my logs, a snippet, look like this: ... migration successfully aborted internal error: qemu unexpectedly closed the monitor: 2023-05-08T07:56:37.785886Z qemu-kvm: Failed to load virtio_pci/modern_queue_state:desc 2023-05-08T07:56:37.786024Z qemu-kvm: Failed to load virtio_pci/modern_state:vqs 2023-05-08T07:56:37.786029Z qemu-kvm: Failed to load virtio/extra_state:extra_state 2023-05-08T07:56:37.786033Z qemu-kvm: Failed to load virtio-rng:virtio 2023-05-08T07:56:37.786036Z qemu-kvm: error while loading state for instance 0x0 of device '0000:00:02.5:00.0/virtio-rng' 2023-05-08T07:56:37.786279Z qemu-kvm: load of migration failed: Input/output error Would you know how to make libvirt/qemu to get domains/guests names into the logs? (ideally without going into debug/similar level) many thanks, L.

3 3

Using pki/ssl/tls connection.
by Kamil Jońca 04 May '23

04 May '23

I am thinking of using tls connection between my client and server instead of current ssh. I found https://libvirt.org/kbase/tlscerts.html and I want to know if it is possible to customise some setting (e.g. use my own cert names, or locations) but I was not able to. Moreover https://github.com/libvirt/libvirt/blob/44520f6e01580d6bada88b47e5b77e6bee0… suggests that these values are hardcoded. So my questions are: is it possible to customise these values? If so, how? How can I configure virt-manager with two connections, each with different CA? KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html

2 1

PHP API
by Simon Fairweather 03 May '23

03 May '23

Hi Michal Are there plans to implement snapshot create_as version of the following function where XML could be passed? https://github.com/libvirt/libvirt-php/blob/afe404b2cf4bb46cdd39c6ea4df1c7c… Regards Simon.

2 1

UEFI and External Snapshots
by Simon Fairweather 27 Apr '23

27 Apr '23

Is there a plan to support UEFI and Ext Snaps? Or is there a location for documentation as the info I can find is quite old.

2 2

seclabel & fuse
by lejeczek 24 Apr '23

24 Apr '23

Hi guys. Wtih images stored on fuse-mounded storage - does it make sense to try 'seclabel', does it even work? Are there any other techniques which would help to add that/similar layer of security when fuse is used? many thanks, L.

1 0

ecrypting image file breaks efi/boot of the guest/Ubuntu - ?
by lejeczek 20 Apr '23

20 Apr '23

Hi guys. I've have a guest and that guest differs from all other guest by: <os> <type arch='x86_64' machine='pc-q35-rhel9.0.0'>hvm</type> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram>/var/lib/libvirt/qemu/nvram/ubusrv1_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> whereas everything else has: <os> <type arch='x86_64' machine='pc-q35-rhel9.0.0'>hvm</type> <boot dev='hd'/> <boot dev='cdrom'/> <bootmenu enable='yes'/> </os> Now, that different guest fails - as the only one - to start, to boot after its qcow2 image was luks-encrypted. Guest starts but says that: BdsDxe: failed to load Boot0001 "Uefi Misc Device" from PciRoot (0x0)/Pci(0x2,0x3)/Pci(0x0,0x0): Not found revert back to original, non-encrypted qcow2 image and all works a ok. All and any thoughts shared are much appreciated. many thanks, L.

2 7

which daemon/service for live migration - ?
by lejeczek 19 Apr '23

19 Apr '23

Hi guys. With this relatively new modular approach in libvirt - which service is needed in order to migrate guests via tcp? many thanks, L.

3 11

storage backup with encryption on-the-fly ?
by lejeczek 11 Apr '23

11 Apr '23

Hi guys. Is there a solution, perhaps a function of libvirt, to backup guest's storage and encrypt the resulting image file? On-the-fly ideally. If not ready/built-in solution then perhaps a best technique you recommend/use? I currently use 'backup-begin' on qcow2s, which are LUKS encrypted. many thanks, L.

2 4

Virtiofsd
by Simon Fairweather 06 Apr '23

06 Apr '23

Hi In QEMU 8 virtiofsd has been removed in favor of the rust version. Which includes options that are not longer supported, Do you have a view on what should be used going forwards to support virtiofsd in libvirt with qemu 8? The options are showing as depreciated, -o <compat-options>... Options in a format compatible with the legacy implementation [deprecated] Rust version options virtiofsd backend 1.5.1 Launch a virtiofsd backend. USAGE: virtiofsd [FLAGS] [OPTIONS] --fd <fd> --socket <socket> --socket-path <socket-path> FLAGS: --allow-direct-io Honor the O_DIRECT flag passed down by guest applications --announce-submounts Tell the guest which directories are mount points -d Set log level to "debug" [deprecated] -f Compatibility option that has no effect [deprecated] -h, --help Prints help information --killpriv-v2 Enable KILLPRIV V2 support --no-killpriv-v2 Disable KILLPRIV V2 support [default] --no-readdirplus Disable support for READDIRPLUS operations --posix-acl Enable support for posix ACLs (implies --xattr) --print-capabilities Print vhost-user.json backend program capabilities and exit --security-label Enable security label support. Expects SELinux xattr on file creation from client and stores it in the newly created file --syslog Log to syslog [default: stderr] -V, --version Prints version information --writeback Enable writeback cache --xattr Enable support for extended attributes OPTIONS: --cache <cache> The caching policy the file system should use (auto, always, never) [default: auto] -o <compat-options>... Options in a format compatible with the legacy implementation [deprecated] --fd <fd> File descriptor for the listening socket --inode-file-handles=<inode-file-handles> When to use file handles to reference inodes instead of O_PATH file descriptors (never, prefer, mandatory) - never: Never use file handles, always use O_PATH file descriptors. - prefer: Attempt to generate file handles, but fall back to O_PATH file descriptors where the underlying filesystem does not support file handles. Useful when there are various different filesystems under the shared directory and some of them do not support file handles. ("fallback" is a deprecated alias for "prefer".) - mandatory: Always use file handles, never fall back to O_PATH file descriptors. Using file handles reduces the number of file descriptors virtiofsd keeps open, which is not only helpful with resources, but may also be important in cases where virtiofsd should only have file descriptors open for files that are open in the guest, e.g. to get around bad interactions with NFS's silly renaming. [default: never] --log-level <log-level> Log level (error, warn, info, debug, trace, off) [default: info] --modcaps <modcaps> Modify the list of capabilities, e.g., --modcaps=+sys_admin:-chown --rlimit-nofile <rlimit-nofile> Set maximum number of file descriptors (0 leaves rlimit unchanged) [default: min(1000000, '/proc/sys/fs/nr_open')] --sandbox <sandbox> Sandbox mechanism to isolate the daemon process (namespace, chroot, none) [default: namespace] --seccomp <seccomp> Action to take when seccomp finds a not allowed syscall (none, kill, log, trap) [default: kill] --shared-dir <shared-dir> Shared directory path --socket <socket> vhost-user socket path [deprecated] --socket-group <socket-group> Name of group for the vhost-user socket --socket-path <socket-path> vhost-user socket path --thread-pool-size <thread-pool-size> Maximum thread pool size. A value of "0" disables the pool [default: 0] --xattrmap <xattrmap> Add custom rules for translating extended attributes between host and guest (e.g. :map::user.virtiofs.:) Regards Simon.

2 4