- Users - libvirt List Archives

[libvirt-users] Local and domain SIDs -- WAS: Is there any way to change the vm computer name which joined AD
by Bryan J Smith 25 Dec '12

25 Dec '12

On Mon, Dec 24, 2012 at 4:01 AM, Timon Wang <timonwst(a)gmail.com> wrote: > If a vm join AD domain, the name is registered in the AD server, when I copy > a VM, the name will conflict with the source VM. > I wanna to know if I can change the VM computer name automaticly. This is not a hostname issue. This is a pure AD/NT-SID issue** (Security Identifiers). It affects all virtualization solutions, even Hyper-V. Two (2) systems must have unique SID enumeration.** When you have standalone systems that are not part of a domain, as long as the two systems never see each other, it's typically not an issue. But when they are part of a domain, it is an issue, because there must be an unique SID enumeration for any domain member. You should never clone/create/instance/etc... a system once it's been joined to a domain, unless you use a solution that undoes its SID enumeration. Microsoft introduce sysprep years ago so when a system reboots, new local SIDs** are enumerated. This is recommended for all systems when cloned, whether they join an AD domain later or not. Some virtualization solutions don't bother to sysprep the system before joining them to a domain. This is because the SID enumeration in a domain is domain-wide, and the local SIDs are usually not utilized. This drastically reduces issues although there can still be issues between two nodes that have the same local SID enumeration.** There is no way around this issue, as it's a core NT issue. The recommended solutions are to either ... - Always run SysPrep before making a template, regardless whether an AD member or not - Join the domain as part of a local group policy before the system comes up (e.g., still has duplicate local SIDs) In oVirt/RHEV, you can join the domain as part of the SysPrep scripts. The easiest way to do this is to create an user in your AD domain that only has the delegation and no other role. The system is joined to the AD domain upon first boot of the VM instance using that user. -- bjs, MCITP/MCSE/MCSA **NT INTERNALS NOTE: The local System Accounts Manager (SAM) and other portions of the local NT systems' Registry, as well as the local NTFS file systems attributes, are where local SID are stored and utilized. The first NT system promoted to a Domain Controller (DC) has its SAM and SID enumeration because the initial, network-wide SIDs for the domain (that's an over-simplification, but similar), and it no longer has its local enumeration (all DCs are like this, there is still a local SAM/SID enumeration, but it is not referenced, which is a long and complicated story with some issues). When a local system joins a domain, and becomes a domain member, it starts using those SID references. The local SAM/SID still exist and are known (unlike a DC, which stops using them altogether), but are typically not utilized. So SIDs are usually no longer an issue, unless you have member workstations/servers directly accessing and managing other member workstations/servers (e.g., IPC like to C$ or similar). It is very, very important that anyone managing Windows systems understand these internals, especially when it comes to domains. Sadly a lot of MCSEs (especially older ones) don't seem to, among other NT and AD internals. Microsoft still doesn't offer a good AD internals course, although they do have a good NT internals course as well as set of books. -- Bryan J Smith - Professional, Technical Annoyance b.j.smith at ieee.org - http://www.linkedin.com/in/bjsmith ---------------------------------------------------------- Computers are precise, but not accurate, and make mistakes due to lack of input, as lack of awareness and observation

1 0

[libvirt-users] Difficulty with a transferred VM
by Dale Amon 21 Dec '12

21 Dec '12

I have a better faster server and moved the disk from the old one to the new one. After the move, I edited the xml file manually to give it the correct paths for the new machine, since the mount point for all the VM storage pools is now different. I get # virsh start www.foo.org error: Failed to start domain www.foo.org error: internal error cannot load AppArmor profile 'libvirt-xxx .... xxx' I tried aa-complain /usr/sbin/libvirtd I even tried editing /etc/apparmor/usr.lib.libvirt.virt-aa-helper and adding the new path to where the VM images are stored. Still no joy. Suggestions?

1 1

[libvirt-users] CFS BWC related question
by Dennis Chen 20 Dec '12

20 Dec '12

Hi, Seems this question is not related with libvirt directly, but I still want to ping this list to see if someone can be help. The OS in my desktop box is Ubuntu 12.10, the kernel is 3.5.1. I installed the cgroup utility package with:#apt-get install cgroup-bin, but after I installed these packages successfully, I can't find cpu_quota/cpu_period controller in the /sys/fs/cgroup/cpu folder. So the essential question is: What I need to do to make cgroup can support CFS BWC feature? Specifically, how to make the cpu_quota/cpu_period to be available within cgroup/cpu? BRs, Dennis

3 4

[libvirt-users] Need help regarding perl sys::virt
by Rawat, Vishwanath 20 Dec '12

20 Dec '12

Hi, I wanted to use perl Sys::Virt (which uses libvirt) to remotely connect KVM hypervisor. As a start I tried following simple script(KVM.pl) but I am getting following error. First it will ask for authentication which I am providing to it manually then it fails. Do I need to do some configuration on KVM hypervisor before executing this script? Any help is appreciated. bash-3.2$ perl KVM.pl root(a)10.238.132.125's password: Unable to open connection to qemu+ssh://root@10.238.132.125/system?no_verify=1: End of file while reading data: Warning: Perm: Input/output error8.132.125' (RSA) to the list of known hosts. Can't call method "list_domains" on an undefined value at KVM.pl line 21. bash-3.2$ bash-3.2$ cat KVM.pl use strict; use warnings; use Sys::Virt; use Data::Dump qw(dump); my $user = "root"; my $host = <some_host>; my $uri = "qemu+ssh://root\@$host/system?no_verify=1"; my $vmm; eval { $vmm = Sys::Virt->new(uri => $uri, readonly => 1); }; if ($@) { print "Unable to open connection to $uri: " . $@->message . "\n"; } for my $dom ($vmm->list_domains, $vmm->list_defined_domains) { ## see perldoc Sys::Virt::Domain print "name: ", $dom->get_name, "\n"; print "uuid: ", $dom->get_uuid_string(), "\n"; ## $dom->get_info returns a hash reference dump $dom->get_info; print "\n"; } Regards, Rawat

3 4

[libvirt-users] Ordering multiple network interfaces on vms
by john fisher 19 Dec '12

19 Dec '12

On a hypervisor with multiple interfaces, we'd like to make those interfaces available to each of multiple VMs. We have both bridged interfaces and SRIOV interfaces, no NAT interfaces. When we create a vm in virsh using an xml file with no network elements, but having interface elements, we get the interfaces in the vm, but the ordering of eth devices does not match the ordering on the hypervisor and we aren't sure the ordering is repeatable either. In other words, eth0 in the HV is thingA and eth1 is thingB, but on the VM eth0 is thingC eth1 is thingD and eth4 is thingA so forth. we have 12 interfaces so ordering or naming is important and confusing. We've tried to use the PCI bus numbers as seen in lspci on the HV, but no luck. Do we need to start using network elements in the vm's xml file or separately to control the ordering? Whats the usual practice here? Sample xml: <interface type='hostdev'> <source dev='eth3' mode='vepa'> <address type='pci' domain='0x0000' bus='0x16' slot='0x10' function='0x1'/> </source> <target dev='macvtap0'/> </interface> <interface type='bridge'> <source bridge='br4'/> <target dev='vnet0'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> Thanks! -- John Fisher

2 3

[libvirt-users] ANNOUNCE: New libosinfo project mailing list
by Daniel P. Berrange 17 Dec '12

17 Dec '12

Historically the libosinfo project has used virt-tools-list(a)redhat.com for all its discussions. Since the project has grown and matured, it is time for a dedicated mailing list. If you are interested/involved with libosinfo, please subscribe to the new list: https://www.redhat.com/mailman/listinfo/libosinfo The list only accepts postings from members. Once subscribed you can post to libosinfo(a)redhat.com Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt-users] Virtualbox Driver
by Arslan Waqar 17 Dec '12

17 Dec '12

Hi all, I am new to the group and hence there might be a chance I might be asking a simple question... The thing is I compiled and installed libvirt from git. Then in my terminal window I started virsh. It started. Then since I had Virtual Box installed on my machine I ran "connect vbox:///session". Once I did this I got two errors which said: error: Failed to connect to the hypervisor error: internal error unable to initialize VirtualBox driver API I am unable to resolve this issue...Any input is welcome! Thanks! -- Regards, Arslan Waqar.

1 0

[libvirt-users] alternate location of client pki artifacts
by Alon Bar-Lev 16 Dec '12

16 Dec '12

Hello, At libvirtd.conf there are configurations to override the defaults of the ca, cert, key of libvirt. Can the client configuration be also overridden? Thanks! Alon

1 1

[libvirt-users] Newer Builds Available for Ubuntu 12.04 LTS?
by Andrew Martin 15 Dec '12

15 Dec '12

Hello, I am running Libvirt 0.9.8 and QEMU 1.0 on Ubuntu 12.04 LTS on several virtual machine servers and would like to take advantage of some of the snapshotting functionality available in newer versions of QEMU and Libvirt: https://www.redhat.com/archives/libvirt-users/2012-August/msg00086.html Is anyone maintaining newer binary builds for Ubuntu? I was not able to find a PPA with updated packages, and building from source is proving rather tricky because my custom-built packages have some differences from the official packages (e.g. no upstart integration). I would really like to use the newer versions of Libvirt and QEMU on this LTS release. Thanks, Andrew

2 2

Re: [libvirt-users] NetworkManager and VM Bridged Networking
by Eric Blake 14 Dec '12

14 Dec '12

[adding libvirt-users] On 12/14/2012 01:26 AM, Chuck Forsberg WA7KGX N2469R wrote: > I tried using the procedure in > http://fedorasolved.org/Members/kc8hfi/qemu-kvm-bridged-networking. > > The first thing this article mentions is that NetworkManager cannot work > with bridged networking. This is \unfortunate\ as Lunix stopped being a > useful server when I tried ro revert to the old "network" as suggested > by the article. > > I have no trouble running the VM on a satellite machine and have its > guest operating system (SCO Unix) mount the server's NFS shares. > I would like to have an SCO image running in a VM on the server and > still be able to mount NFS shares from the server. > > Since NetworkManager is more and more an indespensible part of Fedora, > how can I do the needed bridged networking in the new environment? Does this page of examples help? http://libvirt.org/formatnetwork.html#examples If not, what setup are you trying to achieve? It may be that the libvirt folks can better answer your question on how to set it up, while still using NetworkManager. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

1 0