Csiszár Tamás | 22 May 2013 14:24
Picon
Favicon

vzctl error

Hi,

I have a strange error on one of our servers when I use vzctl. There's a running host with a few VE-s and if I type vzctl enter "CTID" then I receive enter into CT "CTID" failed and no further messages. After a lot of debugging I realized that it works if I directly connect via the server's console, but if I login via ssh it gives the error.
The system parameters:
OS: CentOS release 6.4
Kernel: Linux vm4 2.6.32-042stab078.10 #1 SMP Wed May 8 19:45:03 MSK 2013 x86_64 x86_64 x86_64 GNU/Linux 
vzctl: vzctl-core-4.2-1.el6.x86_64
         vzctl-4.2-1.el6.x86_64

I've tried to reboot the system with different kernels, but the same error. There's another strange thing: we have another machine with the same kernel but I cannot reproduce the error there.
I've also tried to run vzctl with gdb and search in the source code, and there seems to be a problem around setting up the environment:
In src/lib/hooks_vz.c there's a function:

static int vz_env_create_ioctl(vps_handler *h, envid_t veid, int flags)
{
        struct vzctl_env_create env_create;
        int errcode;
        int retry = 0;

        memset(&env_create, 0, sizeof(env_create));
        env_create.veid = veid;
        env_create.flags = flags;
        do {
                if (retry)
                        sleep(1);
                errcode = ioctl(h->vzfd, VZCTL_ENV_CREATE, &env_create);
                fprintf(stderr,"error code: %d\n",errcode);
        } while (errcode < 0 && errno == EBUSY && retry++ < ENVRETRY);
        if (errcode >= 0 && (flags & VE_ENTER)) {
                /* Clear supplementary group IDs */
                setgroups(0, NULL);
                /* Set personality PER_LINUX32 for i386 based CTs */
                set_personality32();
        }
        else{
            fprintf(stderr,"%s,%d\n",strerror(errno),errno);
        }
        return errcode;
}

The ioctl returns with an error: INVALID ARG. Also the vzct start/stop don't work.
I compared the two host's environment variables, but no difference.

Thank you for your help in advance!

Regards,
Tamas


_______________________________________________
Users mailing list
Users@...
https://lists.openvz.org/mailman/listinfo/users
Nick Knutov | 13 May 2013 22:39
Favicon

vzctl --noatime

Hello all,

couple years ago vzctl had option --noatime. But now there is no such
option:

# vzctl set ${ve} --noatime yes --save
non-option ARGV-elements: --save

# man vzctl | grep noatime
#

What happened with it? Did not find anything about it in google.

--

-- 
Best Regards,
Nick Knutov
http://knutov.com
ICQ: 272873706
Voice: +7-904-84-23-130
Nick Knutov | 11 May 2013 23:34
Favicon

AES-NI inside CT

Hello,

on the node # openssl engine -t
(aesni) Intel AES-NI engine
     [ available ]

# vzctl enter 123
inside CT # openssl engine -t
(dynamic) Dynamic engine loading support
     [ unavailable ]

Does AES-NI available inside CT? Should I add some capabilities to CT or
something else?

--

-- 
Best Regards,
Nick Knutov
http://knutov.com
ICQ: 272873706
Voice: +7-904-84-23-130
Kir Kolyshkin | 8 May 2013 03:37
Favicon

OpenVZ Maintenance Partnership

Parallels is now offering an OpenVZ Maintenance Partnership program.
The program provides bug resolution support and feature development
to the OpenVZ community. The OpenVZ Maintenance Partnership has
a small annual fee and provides two benefits to partnership members.

1. Partnership members will receive a support ID that will allow them
to submit up to10 high priority bugs per year. These bugs will be placed
at the highest priority level in the development stack.

2. Partnership members will also be able to submit a feature request(s)
which will be reviewed by the Parallels engineering team. They will work
with you to clarify the requirements and implementation options and
provide an implementation estimate and a schedule.

Learn more and join the OpenVZ Maintenance Partnership here:
http://www.parallels.com/support/virtualization-suite/openvz/
Roman Haefeli | 6 May 2013 16:11
Picon

add second ploop device to CT

Hi all

Is it possible to add a second ploop device to a CT? If so, how?

I figured how to manually create a ploop image and mount it into the
running CT. However, I didn't know how to automate that on CT start.

Any hints are welcome.

Roman
Roman Haefeli | 6 May 2013 16:09
Picon

Why does vzctl not check dirty flag of ploop device?

Hi all

We are running several CTs on a cluster of a few OpenVZ host nodes. The
nodes share an NFS export where the ploop images of the CTs are located.

I noticed that 'vzctl start CTID' will happily start a ploop-based CT
that is already running on a different node. This is also possible with
simfs-CTs (having their private directory on NFS), but running a
ploop-CT on two nodes at the same time severely corrupts the CTs
filesystem. Before deploying such a setup, I would like to much sure
that this is avoided by any chance.

I found that a ploop imagefile will set a 'dirty flag' when it is in
use. Why doesn't 'vzctl' take that into accout? If 'vzctl' would read
that flag on CT start and refuse to start the CT when it is dirty, it
would not be possible to start the same CT twice.

I would like 'vzctl start $CTID' to do something like this:

ploop-fsck -f -r /vz/private/$CTID/root.hdd/root.hdd && \
  vzctl start $CTID

What do you think?

Roman
Benjamin Henrion | 6 May 2013 11:55

Openvz template for Debian Wheezy

Hi,

I just updated my debian wheezy template with the debian release of
this weekend:

http://filez.zoobab.com/openvz/templates/debian-7.0-x86_64.tar.gz

I created it with:

https://github.com/zoobab/openvz-scripts/blob/master/create-template-debian-amd64.sh

--
Benjamin Henrion <bhenrion at ffii.org>
FFII Brussels - +32-484-566109 - +32-2-3500762
"In July 2005, after several failed attempts to legalise software
patents in Europe, the patent establishment changed its strategy.
Instead of explicitly seeking to sanction the patentability of
software, they are now seeking to create a central European patent
court, which would establish and enforce patentability rules in their
favor, without any possibility of correction by competing courts or
democratically elected legislators."
Bhargav Bhikkaji | 3 May 2013 17:38
Picon

"-R" TASK_ALIVE option

I am completely new to CRIU and trying to checkpoint a process from VM-1 to VM-2, during this process would like to continue running the process on VM-1. Version 0.5 has this support with "-R" option during dumping of the process. 

My question is

1) During this dump (or checkpoint), does the process get's stalled for copy ?. 
2) If the process get's stalled, is a there a way to measure the time it got stalled for my process

Thanks
Bhargav

_______________________________________________
Users mailing list
Users@...
https://lists.openvz.org/mailman/listinfo/users
CoolCold | 1 May 2013 02:21
Picon
Gravatar

vzstats 0.2.1 debianization

Hello!
I've read your LJ blog post about vzstats (0.2.1) tool, but looks like
it somehow misses Debian packages and debianization (I've found rpm
spec only), so I've created initial debianization for it.

Debianization is squashed into one commit -
https://github.com/CoolCold/vzstats/commit/f2425b5ce97215c3ba4030e3c314a501920658a0
, feel free to try it.
From my POV it should work in general, there are no any errors found
by lintian, warnings only, but it is not perfect at all - using sed
instead of dpatch/quilt and so on.
Package building can be done via: git clone ... && cd vzstats &&
dpkg-buildpackage -us -uc -sa -si -rfakeroot

Also, I've found several issues:
1) osrelease script tryes to find /etc/*-release which is not used in
Debian. As solution I think it is possible to use lsb_release as
distro-independent way to detect release.
2) vzlist script relyes on some newer vzctl version, for example, my
system has backported vzctl 3.0.30.2 , and it doesn't contain output
fields like 'layout' and 'vswap' , so it just exits.

While saying "Debian" here I meant "Squeeze" release.

If anyone interested in, I can put debian package somewhere.

--
Best regards,
[COOLCOLD-RIPN]
Frank Myhr | 18 Apr 2013 18:11
Favicon

syslog-ng unable to read /proc/kmsg on 2.6.32-042stab076.5

Hi,

I have an AMD64 node that runs Ubuntu 12.04 LTS and syslog-ng. After updating the kernel from
2.6.32-042stab072.10 to 2.6.32-042stab076.5 
syslog-ng is unable to read /proc/kmsg:

# /etc/init.d/syslog-ng start
  * Starting system logging syslog-ng
Error opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)'
Error initializing source driver; source='kernel', id='kernel#0'
Error initializing message pipeline;

File permission remains 0400, which works with other kernels:

# ls -l /proc/kmsg
-r-------- 1 root root 0 Apr 18 11:28 /proc/kmsg

I temporarily commented out the syslog-ng configuration that attempts to read /proc/kmsg:
#source "kernel" { file("/proc/kmsg" program_override("kernel")); };

syslog-ng then starts up fine. Looking at its capabilities:

# cat /proc/14768/status
...
CapInh: 0000000000000000
CapPrm: fffffffbffffffff
CapEff: fffffffbffffffff
CapBnd: fffffffbffffffff
...

I notice that bit 34 is zero. This is also true of the init (upstart) process:

# cat /proc/1/status
...
CapInh: 0000000000000000
CapPrm: fffffffbffffffff
CapEff: fffffffbfffffeff
CapBnd: fffffffbffffffff
...

Looking in patch-042stab076 from the kernel source, I see:
+#define CAP_FS_FREEZE        34

But since mainline kernel 2.6.38 or so we have CAP_SYSLOG which is also bit 34. I don't fully understand
which of the kernel, init, libcap, 
and syslog-ng request and grant/deny access to /proc/kmsg. But I suspect that a collision between
CAP_FS_FREEZE and CAP_SYSLOG is preventing 
syslog-ng from reading /proc/kmsg on 2.6.32-042stab076.5. I see that CAP_FS_FREEZE is new since
2.6.32-042stab072.10, on which syslog-ng 
works fine:

$ grep -i "cap_fs_freeze" patch-042stab072
$

Would appreciate any help or insight:
* Do you think this is a kernel bug or something else?
* Any work-around to get syslog-ng to log kernel messages?

Thanks,
Frank
Benjamin Henrion | 18 Apr 2013 15:24

Macvlan with openvz?

Hi,

I just played with LXC, they support macvlan, which does not force you
to use a bridge on the HN side, and it is quite straightforward to
setup.

lxc.network.type=macvlan
lxc.network.macvlan.mode=bridge
lxc.network.link=eth0
lxc.network.flags=up
lxc.network.hwaddr = 00:16:AA:BB:CC:DD

On the HN side, brctl show reports nothing, so it works without a bridge.

Any idea if this is supported under openvz?

--
Benjamin Henrion <bhenrion at ffii.org>
FFII Brussels - +32-484-566109 - +32-2-3500762
"In July 2005, after several failed attempts to legalise software
patents in Europe, the patent establishment changed its strategy.
Instead of explicitly seeking to sanction the patentability of
software, they are now seeking to create a central European patent
court, which would establish and enforce patentability rules in their
favor, without any possibility of correction by competing courts or
democratically elected legislators."

Gmane